Network security automatic decision-making method and system based on multi-agent collaboration

Abstract

The invention belongs to the technical field of network security, and discloses a network security automatic decision-making method and system based on multi-agent collaboration, and the method comprises the steps: constructing a multi-agent system; establishing a script-based standardized safety response flow library, and completing flow representation and execution arrangement of the script in the SOAR system; constructing a structured cue word for each agent, and constraining a role boundary and an output specification through the cue word; security event input is received, and event analysis, task decomposition, script selection and response execution are completed through cooperation of multiple agents; and verifying the validity of the system in the security event response based on a preset index, and iteratively optimizing the cue word and the script-based standardized security response process library according to feedback data. According to the invention, accurate, efficient and automatic response to the security event is realized by constructing a role-based, cooperative and evolvable intelligent decision-making system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a network security automatic decision-making method and system based on multi-agent cooperation. BACKGROUND

[0002] With the deepening of digital transformation, the form of network attacks is showing a trend of increasing complexity, systematization and high frequency. Advanced persistent threats (APT), ransomware, zero-day exploit and other new attack methods are constantly evolving, with long attack chains, strong concealment and outstanding cross-platform penetration capabilities, posing a continuous and severe security pressure on government agencies, enterprises and critical information infrastructure. Under this background, the traditional response mode relying on security experts for manual analysis, judgment and disposal has been difficult to meet the rhythm and scale of modern attack and defense confrontation. Artificial processing usually has the following inherent limitations: first, there is a significant efficiency bottleneck. When the security team faces a large number of high-noise alarms, the mean time to detect (MTTD) and the mean time to respond (MTTR) are often long, which further enlarges the operational window of the attacker; second, the inconsistency of disposal caused by relying on expert experience. The quality of incident response depends largely on the experience level and immediate state of the analyst, and different analysts may form different judgments and response strategies for the same incident, making it difficult to standardize and scale the response process; third, the shortage of human resources and long-term high-load pressure make security personnel prone to fatigue, misjudgment, and missed reports, and the global security talent gap further exacerbates this contradiction.

[0003] To alleviate the above problems, automated security response technology has begun to attract industry attention. Early automated technologies are mainly integrated into security information and event management (SIEM) systems, triggering corresponding actions through pre-defined, static "if-then" rules. Although such systems can improve efficiency to some extent in dealing with known threats and simple scenarios, they lack the ability to understand attack semantics and attack chain context, making it difficult to deal with unknown threats and complex, variable and cross-stage attack scenarios, and the rigidity and intelligence of their system architecture have gradually become a problem.

[0004] In recent years, security orchestration, automation, and response (SOAR) technology has developed rapidly. SOAR systems introduce the concept of "playbook" to solidify the experience of security experts in the form of structured, executable, and reusable processes, achieving unified orchestration across tools and platforms. However, existing SOAR systems based on playbook still have significant limitations: first, the playbook selection mechanism still mainly relies on manual judgment or simple rule matching, making it difficult to automatically select the optimal playbook combination for security events with multi-dimensional attributes and complex context; second, the lack of dynamic decision-making capabilities, existing systems cannot adjust the execution path based on real-time feedback during playbook execution, and the decision chain is preset and linear, making it difficult to handle unexpected, abnormal, or undefined situations; third, the overall intelligence level of the system is limited. Although existing research has attempted to introduce graph neural networks and reinforcement learning methods for playbook recommendation, these techniques often rely on a large number of high-quality labeled samples for training, feature engineering is complex, and model interpretability is insufficient, making it difficult for security experts to widely adopt them in actual production environments.

[0005] On the other hand, multi-agent systems (MAS) as an important distributed artificial intelligence framework, through the collaborative reasoning between multiple autonomous or semi-autonomous agents to handle complex tasks, have shown strong collaboration and adaptability in intelligent manufacturing, autonomous driving, and other fields. However, the application of MAS to security event response is still in the early stages of exploration. Existing related research mostly stays at the conceptual or theoretical level, and there is still a lack of mature engineering solutions for core issues such as how to design a collaborative agent role system, how to deeply integrate the strong semantic understanding ability of large language models with network security professional knowledge, and how to build a closed-loop optimized response system.

[0006] In summary, there is an urgent need in the field for a network security automated response method that can deeply integrate advanced artificial intelligence technologies and have high adaptability and collaborative decision-making capabilities, to make up for the lack of intelligence in traditional rule-driven systems and existing SOAR platforms, and to achieve precise, efficient, interpretable, and sustainable optimization of automated handling of security events. SUMMARY

[0007] To solve the above problems, the present application proposes a network security automated decision-making method and system based on multi-agent collaboration, which builds a role-based, collaborative, and evolving intelligent decision-making system to achieve precise, efficient, and automated response to security events.

[0008] To achieve the above purpose, the present application adopts the following technical solutions: In a first aspect, the present application provides a network security automated decision-making method based on multi-agent collaboration, comprising the following steps: Construct a multi-agent system; Establish a standardized security response process library based on scripts, and complete the process representation and execution arrangement of scripts in the SOAR system; Construct structured prompts for each agent, and constrain the role boundary and output specification through the prompts; Receive security event input, and complete event analysis, task decomposition, script selection and response execution through multi-agent collaboration; Verify the effectiveness of the system in security event response based on preset indicators, and iteratively optimize the prompts and the standardized security response process library based on scripts according to feedback data.

[0009] As an optional implementation, the multi-agent system includes a commander agent, an administrator agent, an operator agent, a security expert agent and an executor, wherein the commander agent is responsible for global situation analysis and task planning, the administrator agent is responsible for task refinement and action planning, the operator agent is responsible for generating executable commands, the security expert agent is responsible for professional review and strategy suggestion, and the executor is responsible for calling the SOAR system to execute scripts or trigger manual intervention.

[0010] As an optional implementation, each script in the standardized security response process library based on scripts has a unique identifier, a name, a description, an execution logic and a set of configurable parameters, and is stored in YAML format.

[0011] As an optional implementation, the structured prompts include role positioning, responsibility range, decision rule, action specification and output format requirement.

[0012] As an optional implementation, the multi-agent collaboration process includes: Provide event description, context information and severity through the event input module; Implement collaborative reasoning through the decision, execution and feedback loop; Support multi-round response process based on real-time feedback.

[0013] As an optional implementation, the preset indicators include accuracy, recall rate and F1-Score.

[0014] In a second aspect, the present application provides a network security automated decision system based on multi-agent collaboration, comprising: A system construction module configured to construct a multi-agent system; A script management module configured to establish a standardized security response process library based on scripts, and complete the process representation and execution arrangement of scripts in the SOAR system; The prompt word management module is configured to construct structured prompt words for each agent, and to constrain role boundaries and output specifications through the prompt words. The multi-agent collaboration module is configured to receive a security event input, and to complete event analysis, task decomposition, scenario selection, and response execution through multi-agent collaboration. The evaluation and optimization module is configured to verify the effectiveness of the system in security event response based on preset indicators, and to iteratively optimize prompt words and standardized security response process libraries based on scenarios according to feedback data.

[0015] In a third aspect, the present application provides an electronic device, comprising a memory and a processor, and computer instructions stored in the memory and running on the processor, when the computer instructions are run by the processor, the method of the first aspect is completed.

[0016] In a fourth aspect, the present application provides a computer readable storage medium for storing computer instructions, when the computer instructions are executed by the processor, the method of the first aspect is completed.

[0017] In a fifth aspect, the present application provides a computer program product comprising a computer program, when the computer program is executed by the processor, the method of the first aspect is completed.

[0018] Compared with the prior art, the present application has the following beneficial effects: The present application proposes a network security automated decision-making method based on multi-agent collaboration, through collaborative reasoning and task decomposition between agents, the average detection and response time is significantly shortened, and the response efficiency is improved; the structured prompt words constrain the behavior of the agent, avoid inconsistent handling due to differences in human experience, and enhance the consistency of decision-making; the system supports dynamic adjustment, which can adjust the execution path according to real-time feedback, and adapt to complex and variable attack scenarios; the decision-making process of each agent is transparent and traceable, and has explainability, which is convenient for security experts to review and optimize; based on experimental feedback and expert suggestions, the system can iteratively improve the quality of the scenario library and the prompt words, form a closed-loop evolution mechanism, and realize continuous optimization.

[0019] The experimental results show that the present application achieves an average F1-Score of 61.06% on a typical security event data set, and performs excellently in terms of accuracy and recall rate, verifying its effectiveness and practicality in real scenarios.

[0020] The advantages of the additional aspects of the present application will be partially given in the following description, partially will become obvious from the following description, or will be known by the practice of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0021] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0022] Figure 1 This is a schematic diagram of the structure of the multi-agent system of the present invention; Figure 2 This is a diagram illustrating the operational guidance of the commander's intelligent agent in this invention. Figure 3 This is a diagram illustrating the operational guidelines for the administrator intelligent agent of the present invention. Figure 4 This is a diagram illustrating the operation guidance of the operator intelligent agent of the present invention; Figure 5 This is a diagram illustrating the operational guidelines for the security expert intelligent agent of this invention. Figure 6 This is a script layout diagram of the SOAR system of the present invention; Figure 7 This refers to the accuracy of the security incident handling in this invention. Figure 8 The recall rate for the security incident handling of this invention; Figure 9 The F1-Score for the security incident handling of this invention. Detailed Implementation

[0023] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0024] It should be noted that the following detailed description is exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0025] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments of the invention. As used herein, unless the context clearly indicates otherwise, the singular form is intended to include the plural form as well. Furthermore, it should be understood that the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but includes other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0027] Example 1 This embodiment provides a network security automated decision-making method based on multi-agent collaboration, including the following steps: like Figure 1 As shown, a multi-agent system is constructed. This system includes a commander agent, an administrator agent, an operator agent, a security expert agent, and an executor. Each agent has a clearly defined role, working together through collaborative reasoning to understand events, plan tasks, and schedule execution. Specifically, the commander agent is responsible for overall situational analysis and task planning; the administrator agent is responsible for task refinement and action planning; the operator agent is responsible for generating executable commands; the security expert agent is responsible for professional review and strategy recommendations; and the executor is responsible for invoking the SOAR system to execute scripts or triggering human intervention.

[0028] A standardized security response process library based on scripts was established, and the scripts were represented and executed in a structured manner within the SOAR system. Structured descriptions ensured the scripts' executability, reusability, and manageability across different scenarios. Each script in the standardized security response process library has a unique identifier, name, description, execution logic, and a set of configurable parameters, and is stored in YAML format.

[0029] Structured cue words are constructed for each agent to constrain role boundaries and output specifications. Cue word templates with role constraints, output specifications, and contextual conventions are built for each type of agent to ensure stable behavioral patterns during decision-making, thereby improving the accuracy and consistency of output. Structured cue words include role positioning, scope of responsibility, decision-making rules, action specifications, and output format requirements.

[0030] It receives security event inputs and completes event analysis, task decomposition, script selection, and response execution through multi-agent collaboration.

[0031] An experimental verification system was established to verify the effectiveness of the system in security incident response based on preset indicators. An iterative optimization mechanism was constructed to iteratively optimize the prompt words and the script-based standardized security response process library based on feedback data. The preset indicators include accuracy, recall, and F1-Score.

[0032] The multi-agent cooperative process includes: The event input module provides an event description, contextual information, and severity. Collaborative reasoning is achieved through a closed loop of decision-making, execution, and feedback. Supports multi-round response processes based on real-time feedback.

[0033] The specific solution of the present invention is as follows: By constructing an intelligent collaborative decision-making system composed of multi-role intelligent agents, efficient, accurate, and standardized responses to cybersecurity incidents can be achieved. To address the problems of low efficiency in manual analysis, inconsistent response chains, and lack of intelligent decision-making capabilities in existing security operation systems, this invention proposes an automated cybersecurity decision-making method based on Playbook management and multi-agent collaborative reasoning. The overall implementation process of this method can be summarized into the following key technical solutions: Constructing a multi-agent system: By establishing a collaborative framework consisting of commander, administrator, operator, security expert agents, and executors, a layered, role-based, and intelligent handling of security incidents is achieved. The commander agent, acting as the entry node, receives security incident information from the incident input module and aggregates the incident description, context information, and historical handling records into a unified structured context object. This context object, along with the assessed incident severity, is passed as input to the administrator agent. Based on a comprehensive understanding of the organization's security policies and the capabilities of the Playbook library, the administrator agent generates a task list containing several sub-tasks based on the context object output by the commander, specifying the action type, preconditions, and key parameter constraints for each sub-task. This task list is then passed as input to the operator agent. The operator agent, based on the action type and parameter constraints provided by the administrator agent, selects the most relevant script from the Playbook library, generates the execution command and required parameters bound to the specific script, and sends the execution command to the executor. The executor invokes the SOAR system to execute the corresponding script process based on commands output by the operator agent. Upon completion or in case of an exception, it returns the execution result, error information, and key intermediate states in the form of a standardized feedback object. This feedback object is simultaneously sent back to both the operator and administrator agents to update the context state of the current event. Based on the latest context object and execution feedback, the security expert agent conducts expert-level review and effectiveness evaluation of the entire execution chain, revising the commander agent's strategy assumptions or suggesting manual intervention if necessary. Feedback information confirmed by the security expert is then input back to the commander agent, forming a multi-round collaborative closed loop of "decision-execution-feedback-re-decision" to support iterative optimization of the handling process in complex scenarios. The event information flow and decision-making process among multiple agents are as follows: Figure 2 –5 is shown.

[0034] Establish a Playbook management system: Playbooks are standardized and orchestrated within the SOAR platform, possessing complete structured metadata, including playbook identifiers, names, functional descriptions, execution logic, input parameter sets, and constraints. Playbook lists are stored in structured YAML format, ensuring scripts have unified and standardized field descriptions, guaranteeing accurate parsing and invocation by different agents. Based on this, each agent dynamically evaluates multiple candidate Playbooks according to parameters such as task context, event type, risk level, and executable action constraints. The final execution Playbook is determined through an "optimal selection algorithm" that comprehensively calculates rule weights, semantic matching scores, historical success rates, and task matching degrees. This selection mechanism ensures that agents can invoke the most suitable playbook in different event scenarios, achieving stable, interpretable, and verifiable automated decision-making. The playbook identifier is consistent with the internal identifier of the SOAR system to ensure a unique and verifiable invocation path; the parameter set further constrains the information required for execution logic, ensuring controllable and predictable execution results. Figure 6 As shown.

[0035] Designing agent prompts: By constructing structured prompt templates for each type of agent, we guide them to complete event analysis, task generation, and response output within the preset role scope. The prompt content includes, but is not limited to, role positioning, scope of responsibilities, input / output format conventions, reusable historical experience constraints, and output format requirements. This ensures that the behavioral boundaries, decision-making logic, and expression methods of various agents remain consistent during task processing, thereby enhancing the overall consistency, interpretability, and stability of the system. For example, the prompts for the Commander agent include guiding statements such as "You are a commander-in-chief responsible for coordinating security operations; you should provide risk classification and handling direction based on the original alarm description and contextual information," constraining its output of task classification judgments and high-level decision-making objectives. The prompts for the Operator agent include phrases such as "You only accept action requests issued by _manager and select the most matched script from the Playbook list to generate executable commands," emphasizing that it is only responsible for script selection and command arrangement. The prompt word template establishes clear role boundaries and behavioral constraints among various intelligent agents, ensuring that each agent follows unified structured rules when performing event analysis, task generation, and command output, thereby guaranteeing the clarity of the internal instruction chain and the standardization of the collaboration process.

[0036] Achieve visual interaction: Develop a web user interface based on the Flask framework, responsible for event management, execution process display, and human intervention. The interface supports creating security events, viewing event context, monitoring multi-agent collaboration processes, and displaying information exchange and decision-making processes between agents in real time in the form of a chat flow. Event and execution logs are stored in an SQLite database for easy event tracking, review, and auditing.

[0037] Experimental Validation: The effectiveness of the proposed method was validated using a dataset containing 30 real-world security events. Accuracy, recall, and F1-Score were used as key evaluation metrics, and multiple rounds of experiments were conducted for each event to obtain more stable statistical results. The results show that the proposed method performs well in playbook selection and response path planning, indicating that the multi-agent collaborative mechanism can effectively improve the quality of response decisions.

[0038] Method Optimization: Based on experimental results and feedback from security experts, the agent prompts, Playbook library content, and collaboration strategies are continuously optimized to form a dynamically updatable closed-loop system. Through continuous iterative improvement of each component, the system maintains high response accuracy and processing efficiency under different event types, contexts, and business scenarios. This invention achieves system self-evolution and enhanced robustness through a continuous optimization mechanism.

[0039] In its implementation, the multi-agent system is built on the DeepSeek platform, with each agent communicating and collaborating through API interfaces. The playbook undergoes orchestration, semantic verification, and test execution within the OctoMation SOAR system to ensure accurate script invocation and stable operation. The visual interface utilizes Flask and SQLite to form a lightweight yet reliable human-computer interaction and data management system.

[0040] Experimental results show that the method of this invention achieved an average F1 score of 61.06% on the test dataset, demonstrating good performance in both accuracy and recall, effectively improving the efficiency and accuracy of security incident response. Figures 7-9 As shown, this provides reliable technical support for network security operations.

[0041] Example 2 This embodiment provides a network security automated decision-making system based on multi-agent collaboration, including: The system construction module is configured to: build a multi-agent system; The script management module is configured to: establish a standardized security response process library based on scripts, and complete the process representation and execution arrangement of scripts in the SOAR system; The prompt word management module is configured to: construct structured prompt words for each agent, and constrain role boundaries and output specifications through prompt words; The multi-agent collaboration module is configured to: receive security event inputs and complete event parsing, task decomposition, script selection, and response execution through multi-agent collaboration; The evaluation and optimization module is configured to: verify the effectiveness of the system in security incident response based on preset indicators, and iteratively optimize the prompt words and script-based standardized security response process library based on feedback data.

[0042] It should be noted that the above modules correspond to the steps in Embodiment 1, and the examples and application scenarios implemented by the above modules and their corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should also be noted that the above modules can be executed in a computer system as part of the system.

[0043] In further embodiments, the following is also provided: An electronic device includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, which, when executed by the processor, perform the method described in Embodiment 1. For brevity, further details are omitted here.

[0044] It should be understood that in this embodiment, the processor can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0045] A computer-readable storage medium for storing computer instructions that, when executed by a processor, perform the method of Embodiment 1.

[0046] The method in Example 1 can be directly executed by a hardware processor, or it can be executed by a combination of hardware and software modules within the processor. The software modules can reside in readily available storage media in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, a detailed description is not provided here.

[0047] A computer program product includes a computer program that, when executed by a processor, implements the method in Embodiment 1.

[0048] The present invention also provides at least one computer program product tangibly stored on a non-transitory computer-readable storage medium. The computer program product includes computer-executable instructions, such as instructions included in program modules, which execute in a device on a target real or virtual processor to perform the processes / methods described above. Typically, program modules include routines, programs, libraries, objects, classes, components, data structures, etc., that perform specific tasks or implement specific abstract data types. In various embodiments, the functionality of program modules can be combined or divided among program modules as needed. The machine-executable instructions for the program modules can execute within a local or distributed device. In a distributed device, the program modules can reside in both local and remote storage media.

[0049] The computer program code used to implement the methods of the present invention may be written in one or more programming languages. This computer program code may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the computer or other programmable data processing device, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a computer, partially on a computer, as a stand-alone software package, partially on a computer and partially on a remote computer, or entirely on a remote computer or server.

[0050] In the context of this invention, computer program code or related data may be carried by any suitable carrier to enable a device, apparatus, or processor to perform the various processes and operations described above. Examples of carriers include signals, computer-readable media, and the like. Examples of signals may include electrical, optical, radio, sound, or other forms of propagation signals, such as carrier waves, infrared signals, etc.

[0051] Those skilled in the art will recognize that the units and algorithm steps described in conjunction with the embodiments herein can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0052] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A network security automated decision-making method based on multi-agent collaboration, characterized in that, Includes the following steps: Constructing multi-agent systems; Establish a standardized security response process library based on scripts, and complete the process representation and execution orchestration of scripts in the SOAR system; Structured prompts are constructed for each agent, and these prompts constrain role boundaries and output specifications. It receives security event inputs and completes event parsing, task decomposition, script selection, and response execution through multi-agent collaboration. The effectiveness of the system in responding to security incidents is verified based on preset indicators, and the prompt words and script-based standardized security response process library are iteratively optimized based on feedback data.

2. The automated network security decision-making method based on multi-agent collaboration as described in claim 1, characterized in that, The multi-agent system includes a commander agent, an administrator agent, an operator agent, a security expert agent, and an executor. The commander agent is responsible for global situation analysis and task planning, the administrator agent is responsible for task refinement and action planning, the operator agent is responsible for generating executable commands, the security expert agent is responsible for professional review and strategy recommendations, and the executor is responsible for calling the SOAR system to execute scripts or triggering manual intervention.

3. The automated network security decision-making method based on multi-agent collaboration as described in claim 1, characterized in that, Each script in the script-based standardized security response process library has a unique identifier, name, description, execution logic, and configurable parameter set, and is stored in YAML format.

4. The automated network security decision-making method based on multi-agent collaboration as described in claim 1, characterized in that, The structured prompts include role positioning, scope of responsibilities, decision-making rules, action specifications, and output format requirements.

5. The automated network security decision-making method based on multi-agent collaboration as described in claim 1, characterized in that, The multi-agent cooperative process includes: The event input module provides an event description, contextual information, and severity. Collaborative reasoning is achieved through a closed loop of decision-making, execution, and feedback. Supports multi-round response processes based on real-time feedback.

6. The automated network security decision-making method based on multi-agent collaboration as described in claim 1, characterized in that, The preset metrics include accuracy, recall, and F1-Score.

7. A network security automated decision-making system based on multi-agent collaboration, characterized in that, include: The system construction module is configured to: build a multi-agent system; The script management module is configured to: establish a standardized security response process library based on scripts, and complete the process representation and execution arrangement of scripts in the SOAR system; The prompt word management module is configured to: construct structured prompt words for each agent, and constrain role boundaries and output specifications through prompt words; The multi-agent collaboration module is configured to: receive security event inputs and complete event parsing, task decomposition, script selection, and response execution through multi-agent collaboration; The evaluation and optimization module is configured to: verify the effectiveness of the system in security incident response based on preset indicators, and iteratively optimize the prompt words and script-based standardized security response process library based on feedback data.

8. An electronic device, characterized in that, It includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, which, when executed by the processor, perform the method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, Used to store computer instructions, which, when executed by a processor, perform the method described in any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program, which, when executed by a processor, implements the method described in any one of claims 1-6.

Images