Big data platform asset intelligent sensing method based on LLM and customizable MCP

Abstract

The invention discloses a big data platform asset intelligent sensing method based on LLM and a customizable MCP, and the method comprises the steps: defining a standard resource library of a model context protocol, constructing a model context protocol server, integrating a plurality of scanning tools, and carrying out the automatic adaption; receiving a natural language demand input by a user, and calling a pre-trained LLM model; the scene analysis module converts a natural language demand into a standardized scene description object; the intelligent scanning module is used for describing an object according to a standardized scene, generating an optimal tool execution chain, executing a complete scanning task, obtaining a task scanning result and unifying formats of heterogeneous data in the task scanning result, and the conflict resolution module is used for removing conflicts; the multi-source data association module fuses network topology resources and flow data captured by a probe to construct a dynamic asset atlas including asset attributes, service dependence and vulnerability information, and the report generation module generates a structured report. The method can provide a global risk perspective and decision support.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of artificial intelligence, and particularly relates to a big data platform asset intelligent sensing method based on LLM and customizable MCP. BACKGROUND

[0002] With the deep coupling of digital economy and enterprise digital transformation, big data platforms have been upgraded from auxiliary data storage tools to strategic infrastructure supporting core business operations. Whether it is transaction data processing in the financial industry, livelihood information management in the government field, or electronic medical record storage in the medical field, the business continuity and data security are highly dependent on the stable operation of big data platforms. The premise of big data platform security lies in the accurate perception of "global assets" and the dynamic assessment of "potential risks". Asset perception is the basis for identifying all types of carriers in the platform, such as physical servers, virtual hosts, container clusters, micro-service APIs, and sensitive data assets. Risk assessment is a key step to locate vulnerabilities, weak passwords, and configuration abnormalities based on perception results, and to formulate repair strategies by associating business impacts. Both of them constitute the "first line of defense" of the big data platform security protection system.

[0003] Although the current industry has formed an asset perception and risk assessment scheme combining active scanning and passive monitoring (such as detecting port assets through Nmap, detecting vulnerabilities through Nessus, and analyzing traffic through Wireshark), with the continuous expansion of big data platforms, asset forms gradually present heterogeneity, dynamics, and complexity. For example, physical devices coexist with cloud-native containers, static servers interweave with elastic microservices, and structured data and unstructured data flow across nodes. Due to the inherent limitations of the technical architecture, traditional solutions are difficult to adapt to the above complex scenarios, resulting in incomplete asset perception, inaccurate risk assessment, low management efficiency, and other problems. They cannot meet the core needs of asset security for enterprises, and the specific technical problems are as follows: First, the current asset awareness of the big data platform highly depends on various professional awareness tools (such as port detection, vulnerability scanning, weak password detection tools, etc.), and the coverage, function integrity and scheduling efficiency of the tools directly determine the comprehensiveness of asset awareness and the timeliness of risk assessment. However, the existing technology has significant defects in the tool application link: on the one hand, most of the current awareness tools are single-functioned and can only support single-dimensional asset detection, which cannot achieve full-stack asset coverage; and the tool updating mechanism is lagging behind, lacking the technical ability to dynamically integrate the latest open source tools, and the newly added tools need to manually develop adaptive interfaces and analysis logic, which is long in cycle and high in cost; in the face of emerging network threats, the feature library and detection logic of the existing tools cannot be quickly iterated, leading to a disconnection between awareness capability and actual security needs, and making it difficult to cope with the rapidly changing network environment. On the other hand, the current awareness tool calling mainly relies on API interface and command line interface, but there is no unified integration standard, and execution and integration are difficult. In the API interface calling scene, the protocols, parameters and response formats of different tools are significantly different, and adaptive modules need to be developed for each type of tool, which is high in development cost and poor in scalability. In the command line interface calling scene, tool execution is seriously dependent on the environment, and the environment variables returned under different environments are inconsistent, which easily leads to tool execution failure or result distortion; in addition, the output formats of the above two types of calling methods are heterogeneous, even if the same meaning field also has different expressions, and the system needs to develop exclusive analysis scripts for each type of tool, which is low in result integration efficiency and cannot quickly form a unified risk view covering full-stack assets.

[0004] Secondly, in the asset awareness process of a big data platform, the scanning strategy is the core bridge connecting business security needs and technical detection actions. It requires a precise understanding of business demands such as in-depth detection of financial database security and investigation of vulnerabilities in core business systems. This understanding must then be transformed into a structured execution plan that includes the target asset type (e.g., financial MySQL database), risk detection category (e.g., SQL injection vulnerabilities, weak passwords), and scan intensity (e.g., full port detection / prioritizing high-risk vulnerabilities). Simultaneously, the path must be optimized in real-time based on network dynamics during the scanning process (e.g., port status changes, topology adjustments) to ensure accurate and efficient scanning actions and avoid resource waste and missed risks. However, existing solutions lack intelligence in the strategy formulation and execution stages, failing to match business needs and dynamic network environments. On one hand, strategy formulation lacks natural language understanding capabilities, creating a disconnect between business needs and technical execution. Existing solutions cannot parse ambiguous business needs, failing to automatically associate needs with asset type ontology, match risk categories, or quantify natural language descriptions into specific technical parameters. Security experts must manually define core elements such as scan scope, tool selection, and parameter configuration, which is not only time-consuming and labor-intensive but also prone to errors due to differences in expert experience. On the other hand, the scanning process uses a predefined static script flow. When encountering dynamic scenarios such as port closure or network topology changes, the scanning path cannot be adjusted in real time, and invalid scans are still performed. Manual intervention is required, which affects scanning efficiency.

[0005] Third, in big data platform security management, the core value of risk assessment lies in clarifying the actual impact of risks on core businesses through the correlation analysis of "vulnerabilities-assets-businesses," and formulating precise remediation priorities based on asset criticality, providing targeted support for operational decisions. However, existing risk assessment solutions suffer from missing correlations and misaligned priorities. On the one hand, the risk assessment process merely lists results, lacking contextual relevance. For example, CVE vulnerabilities detected by vulnerability scanners cannot be mapped to specific business operations. This isolated risk presentation makes it impossible for operations personnel to determine the actual threat level of vulnerabilities to the business. On the other hand, existing solutions only rank vulnerabilities according to their CVSS scores, ignoring the coreity of assets in the business chain and service dependencies. They fail to identify scenarios where "low-scoring vulnerabilities trigger cascading risks." This one-dimensional prioritization may lead operations personnel to invest significant resources in remediating non-critical vulnerabilities while neglecting risks with high impact on core businesses, resulting in wasted resources and the creation of business security vulnerabilities. Meanwhile, the ability to present risk results is weak, with isolated "asset-vulnerability" correspondences mostly displayed in the form of tables and text reports. This cannot intuitively show the distribution of vulnerabilities in the network topology and their dependence on other assets, nor can it reflect the impact of high-risk vulnerabilities on related businesses. It is also difficult to distinguish the risk differences between different business lines and assets of different importance levels. Operation and maintenance personnel need to manually integrate multiple reports to form a global understanding, which makes it difficult to quickly grasp the core risk points and is not conducive to real-time monitoring of the security situation and emergency decision-making.

[0006] Therefore, there is an urgent need to provide a task execution method and system to improve the shortcomings of the existing technology. Summary of the Invention

[0007] To address the aforementioned problems in existing technologies, this invention provides a method for intelligent asset perception on a big data platform based on LLM and customizable MCP. The technical problem to be solved by this invention is achieved through the following technical solution: In a first aspect, the present invention provides a method for intelligent asset perception on a big data platform based on LLM and customizable MCP, comprising: A standard resource library for the model context protocol is defined, a model context protocol server is built, multiple scanning tools are integrated, and automatic adaptation is performed. The model context protocol server includes a scene parsing module, an intelligent scanning module, a multi-source data association module, a conflict resolution module, a report generation module, and a zero-shot integration module. The zero-shot integration module automatically adapts to each of the aforementioned scanning tools. The Model Context Protocol (MTP) server receives natural language input from the user and invokes a pre-trained LLM model. The scene parsing module transforms the natural language input into a standardized scene description object. The intelligent scanning module generates the optimal tool execution chain based on the standardized scene description object, executes the complete scanning task, obtains the task scanning results, and unifies the format of heterogeneous data in the task scanning results. The conflict resolution module resolves conflicts in the formatted task scanning results to obtain updated task scanning results. Based on the updated task scanning results, the multi-source data association module integrates network topology resources and traffic data captured by probes to construct a dynamic asset map including asset attributes, service dependencies, and vulnerability information. The report generation module generates a structured report based on the dynamic asset map.

[0008] The beneficial effects of this invention are: This invention provides a big data platform asset intelligent perception method based on LLM and customizable MCP. To address the deficiencies in asset perception and risk identification on big data platforms, it constructs a collaborative system of six core modules. Through deep linkage of a scene analysis engine, intelligent scanning engine, multi-source data association engine, conflict resolution engine, zero-shot integration engine, and report generation engine, it collaboratively achieves automated construction and dynamic perception of a full-domain asset risk map. By constructing a deeply integrated system of multi-modal analysis engines driven by the LLM model, it completely replaces the traditional rigid execution mode relying on fixed scripts. This invention can intelligently identify network topology features, construct a full-domain asset risk map, and, in conjunction with the zero-shot integration engine, support automated access to emerging scanning technologies. The intelligent scanning engine generates context-aware strategies, achieving full-platform perception. Functions such as multi-source data association and conflict resolution engines enable unified attribution and visualization of risk data.

[0009] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0010] Figure 1 This is a flowchart of an intelligent asset perception method for a big data platform based on LLM and customizable MCP provided in an embodiment of the present invention. Figure 2 This is a schematic diagram of a model context protocol server system provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of intelligent sensing provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of risk identification provided in an embodiment of the present invention; Figure 5 This is a schematic diagram illustrating the unification of heterogeneous data formats provided in an embodiment of the present invention; Figure 6This is a schematic diagram of multi-source data fusion provided in an embodiment of the present invention; Figure 7 This is a schematic diagram illustrating the generation of a risk assessment report provided in an embodiment of the present invention; Figure 8 This is a schematic diagram of a zero-sample capability extension provided in an embodiment of the present invention. Detailed Implementation

[0011] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0012] The existing technology has the following problems: (1) The entire process relies excessively on expert experience and manual decision-making, making it difficult to form an automated closed loop. From scanning strategy formulation and natural language command parsing to scanning task execution, existing technologies almost entirely rely on the personal knowledge of security experts for manual intervention. Although the Nessus tool developed by Tenable Network Security supports automated vulnerability scanning, its scanning strategies (such as port range and vulnerability detection depth) need to be manually preset by experts. If it is necessary to switch from "fast scan to deep scan", the scanning template parameters need to be manually modified. When the asset perception and analysis solution of the big data platform handles the conflict of results from multiple tools, the allocation of tool weights depends on the experts' settings based on historical experience and cannot be dynamically updated according to the adaptability of the tools in the current scenario.

[0013] (2) The scanning execution and risk assessment lack context awareness and lack dynamic adaptation and business relevance capabilities. The scanning process of the Nmap tool proposed by Gordon Lyon is based on predefined scripts. If the target network topology changes or service ports are migrated during the scanning process, the system will still execute the scan according to the original script, resulting in a large number of dynamic assets being missed or invalid scans. In terms of risk assessment, the vulnerability scanning scheme based on static rules can only identify basic attributes such as vulnerability type, CVE ID, and risk level, without associating them with the criticality of assets. This leads to operations and maintenance personnel prioritizing low-risk test environment vulnerabilities and overlooking high-impact core business vulnerabilities.

[0014] (3) The integration efficiency of third-party tools and results is low. When introducing new tools into the asset perception and analysis solution of the big data platform, developers need to manually write interface adaptation code. If the tool is command line type, regular expressions need to be manually written to parse the text output results, resulting in a long integration cycle. Moreover, when the solution handles result conflicts, it only adopts the strategy of directly adopting the results of high-weight tools when there are conflicts or merging all data when there are no major conflicts. It cannot identify semantic differences, such as the equivalence of "open" in the Nmap report and "listening" in the Nessus report in the description of "service availability", which leads to ambiguity or redundancy in the integrated data.

[0015] (4) Insufficient adaptability to complex network environments and lack of perception of full-stack assets and implicit relationships; In the asset positioning stage of the asset perception and analysis solution of the big data platform, the probe deployment location and scanning range need to be manually planned based on the preset network topology. It cannot automatically identify the division of sensitive areas such as production environment and test environment, and cannot infer implicit relationships such as microservice call chain and inter-Pod communication in container orchestration layer through asset data. It is difficult to adapt to the complex architecture of cloud-native big data platform.

[0016] In view of this, the present invention provides a big data platform asset intelligent perception method and system based on LLM and customizable MCP. By introducing an LLM inference engine and standardized resource protocol, an intelligent scene parsing engine is constructed, realizing full-process automation from user intent understanding to result decision-making, changing the traditional security operation and maintenance model that highly relies on expert experience.

[0017] Please see Figure 1 , Figure 1 This is a flowchart of a big data platform asset intelligent perception method based on LLM and customizable MCP provided in an embodiment of the present invention. The big data platform asset intelligent perception method based on LLM and customizable MCP provided by the present invention includes: S101. Define a standard resource library for the model context protocol, build a model context protocol server, integrate multiple scanning tools, and perform automated adaptation; the model context protocol server includes a scene parsing module, an intelligent scanning module, a multi-source data association module, a conflict resolution module, a report generation module, and a zero-shot integration module, and the zero-shot integration module automatically adapts to each of the aforementioned scanning tools.

[0018] Specifically, in this embodiment, firstly, please refer to Figure 2 , Figure 2 This is a schematic diagram of a Model Context Protocol Server system provided in an embodiment of the present invention. The Model Context Protocol Server system mainly includes an inference module and a Model Context Protocol Server (MCP Server) module; wherein, The inference module uses an LLM model. In this embodiment, a pre-trained Claude model is used. This model can deeply process multi-source unstructured network documents, automatically identify key features in multi-layer network architectures, and intelligently generate a complete scanning plan according to user needs. During the scanning process, the scanning strategy is adjusted in real time based on real-time feedback.

[0019] The MCP Server module includes a scene analysis module, an intelligent scanning module, a multi-source data association module, a conflict resolution module, a report generation module, and a zero-sample integration module.

[0020] The scene parsing module is responsible for converting the user's natural language into a structured scanning scene; The intelligent scanning module is responsible for generating the optimal tool execution chain based on the standardized scene description object and executing the complete scanning task chain safely and efficiently. The multi-source data association module is responsible for unifying the data format and performing fusion analysis on the scan results; The conflict resolution module is responsible for resolving conflicts in multi-source scan results and fusing the result data; The report generation module is responsible for outputting visualized risk reports; The zero-sample tool integration module is responsible for integrating new scanning tools and generating adapters for different tools.

[0021] Furthermore, resources are the core units of the Model Context Protocol (MCP). Each resource is identified by a unique URI (Uniform Resource Identifier) ​​and can contain text or binary data. Resources are identified using URIs in the following format: [protocol]: / / [host] / [path]. In this embodiment, the system defines five standard MCP resources, including network topology resources, tool resource documentation, basic scanning policy library, scanning context resources, and tool capability resources; among them, The network topology resource (asset:network-topology) supports multiple formats, including Visio diagram files, topology description text, and network configuration scripts, to help the scene analysis module and the intelligent scanning module understand the target scanning environment. The tool resource documentation (tool:documentation) is provided to enable the zero-sample integration module to automatically learn the usage of each scanning tool; The basic scanning policy library (config:scan-policy-base) includes predefined policy templates, such as port scanning strength and vulnerability scanning depth levels, which serve as the basic templates for the intelligent scanning module to generate specific scanning instructions; The scan context resource (runtime:scan-context) includes a list of target assets, selected strategy fragments, user preferences, and current status, which are shared and updated by various modules during the execution of the scan task. The tool:capability resource identifies the scanning capabilities of the integrated scanning tool, such as labeling Nmap as port_scanner, Hydra as password_cracker, and OpenVAS / Nessus as vulnerability_scanner.

[0022] Furthermore, the system initializes and integrates five scanning tools, including probes, Nmap, Hydra, openVAS, and Nassus. It should be noted that the zero-sample integration module automatically adapts to these five types of scanning tools.

[0023] S102. The Model Context Protocol (MTP) server receives the user's natural language input request and calls the pre-trained LLM model. The scene parsing module transforms the natural language request into a standardized scene description object. The intelligent scanning module generates the optimal tool execution chain based on the standardized scene description object, executes the complete scanning task, obtains the task scanning results, and unifies the format of heterogeneous data in the task scanning results. The conflict resolution module resolves conflicts in the formatted task scanning results to obtain updated task scanning results. Based on the updated task scanning results, the multi-source data association module integrates network topology resources and traffic data captured by probes to construct a dynamic asset map including asset attributes, service dependencies, and vulnerability information. The report generation module generates a structured report based on the dynamic asset map.

[0024] Specifically, in this embodiment, please refer to Figure 3 , Figure 3 This is a schematic diagram of intelligent sensing provided in an embodiment of the present invention, which mainly consists of two processes: intelligent sensing and risk identification; wherein, In intelligent perception, an LLM inference module (Claude model) is integrated as the intelligent decision-making hub. The scene parsing engine realizes the accurate conversion from natural language to structured scanning strategies. By using a Few-shot learning and dynamic constraint injection mechanism, fuzzy requirements are automatically transformed into standard scene description objects containing asset type matrices, risk category sets, and quantitative technical parameters. The intelligent scanning engine integrates a parallel scheduling framework and implements intelligent task distribution based on the tool dependency graph (DAG), dynamically adjusting the scanning strategy and solving the dependence on human intervention in the scanning strategy formulation and execution stages.

[0025] After the user inputs their natural language requirements, the pre-trained LLM model and scene parsing module are invoked. Combining a pre-defined asset type ontology library and risk classification tree, the fuzzy requirements are transformed into structured parameters. Simultaneously, security constraints in network topology resources (such as avoiding production environment network segments) are considered. Finally, a standardized scene description object containing the target network segment, asset type set, risk detection category, and scan intensity level is generated as the basis for subsequent scan execution. Upon receiving a clear scan instruction, the intelligent scan module builds an independent security sandbox for each tool, schedules tasks based on tool dependencies, and creates a containerized execution engine. A customized Docker environment is built for each tool, and security boundaries are ensured through namespace isolation and resource quota limits. During the scan, the engine reads intermediate scan results in real time, intelligently adjusts the scan path, and the scan results are processed by subsequent components.

[0026] Furthermore, the scene parsing module transforms natural language requirements into standardized scene description objects, including: Based on a standardized strategy generated using Prompt, a pre-trained LLM model is invoked. A structured knowledge base is constructed using a pre-defined asset type ontology (containing various entity labels such as servers, databases, and IoT devices) and a risk classification tree (a three-level system of CVE vulnerabilities, weak passwords, and configuration errors). Combined with Few-shot learning capabilities, a pre-defined prompt engineering template is used, including the system role definition "as a network asset scanning semantic parser" and example conversion pairs. {"query":"Deep check financial database security","output":{"asset_types":["database"]","risk_types":["vulnerability","misconfiguration"]","scan_intensity":"deep"}}; This enables the mapping from natural language to machine instructions; at the same time, a dynamic constraint injection mechanism is introduced to associate security policies in network topology resources in real time (such as automatically blocking illegal instructions when scanning the production environment). The natural language requirements are converted into technical parameters (time window < 10 min, probe packet rate 100 pps, CVE detection depth = known high risk) through a preset intensity quantification model. For example, "fast scan" and "deep scan" are converted into standardized scenario description objects. The structured fields of the standardized scenario description objects include target network segments, asset type sets, risk type matrix, scan intensity level, and automatic constraints from the strategy base. Among them, the technical parameters include the preset basic probe packet rate. Intensity weight Actual detection packet rate .

[0027] The generated standardized scene description object is represented as follows: { "target": {"type": "ip_range", "value": "192.168.1.0 / 24"}, "asset_types":["web_server","database"], "risk_types": ["cve", "weak_credentials"], "scan_intensity": "deep", "tool_constraints":["no_bruteforce"] } Furthermore, in this embodiment, the intelligent scanning module generates an optimal tool execution chain based on a standardized scene description object, executes the complete scanning task, and obtains the task scanning results, including: A toolchain generator is built based on graph neural networks; The standardized scenario description object is input into the toolchain generator. Combining the asset type and risk type of the standardized scenario description object, the required capabilities corresponding to the asset type and risk type are extracted and encoded into a requirement feature vector (scene_vector).

[0028] Specifically, , Representing the context of capabilities Demand level (1 = necessary, 0 = unnecessary, 0.6 = priority).

[0029] Real-time query tool capability resources, generate scanning tool feature vectors, such as Nessus-[vulnerability_scanner, cve_detection_level=high], and encode the scanning tool feature vectors into capability feature vectors (tool_vector).

[0030] Specifically, the system is designed to support... Core-level scanning capabilities (such as capability 1 = port detection, capability 2 = CVE vulnerability detection, and capability 3 = weak password brute-force) against any scanning tool Its capability feature vector is: , Indicates scanning tool Regarding ability Support level (1 = fully supported, 0 = not supported, 0.5 = partially supported).

[0031] The cosine similarity algorithm is used to calculate the cosine similarity between the capability feature vector and the requirement feature vector, and the optimal tool execution chain is dynamically generated based on the cosine similarity; where the similarity is represented as: ; Each scanning tool is built with an independent security sandbox. Tasks are scheduled based on the scanning tool's dependencies, and a containerized execution module is built to provide a customized Docker environment for each scanning tool. Security boundaries are ensured through namespace isolation and resource quota limits.

[0032] During the task scanning process, intermediate scan results are read in real time, the task scanning path is adjusted, and the task scanning results are obtained.

[0033] Furthermore, in this embodiment, during the task scanning process, intermediate scanning results are read in real time, the task scanning path is adjusted, and the task scanning results are obtained, including: A parallel scheduling framework is built based on the Dependency Graph (DAG). For scanning tools with no logical relationship, such as port scanning and weak password detection, an asynchronous parallel execution task scanning queue is started. For scanning tools with upstream and downstream dependencies, such as port discovery followed by vulnerability scanning, a pipelined execution task scanning is started after all upstream dependent scanning tools have completed execution. This includes: The tool dependency graph is represented using a directed acyclic graph, where the vertex set... This represents an instance of the scanning tool in a scanning task. ,For example This indicates an Nmap port scan. This indicates a Nessus vulnerability detection. This indicates weak password detection in Hydra; edge set This represents the dependencies between vertices; if the scanning tool It is a scanning tool If there is a pre-dependency, then there exists a directed edge. Weight (Indicates a necessary dependency). If there is no dependency, there is no corresponding edge. Weight .

[0034] Based on dependency relationships, the dimension is built as follows: Order dependency matrix , The number of scanning tool instances is represented by the elements in the dependency matrix. Defined as: if an edge exists , If there is no edge , .

[0035] The in-degree topological sort is used to determine the execution order of the scanning tools. in-degree Indicates all pointing to scanning tools The number of edges (i.e., the number of preceding dependent tools) is represented as: ; If scanning tool in-degree If no prerequisites are specified, then the asynchronous parallel execution task scanning queue is started; if the scanning tool... in-degree Then, after all the preceding dependent scanning tools have completed their tasks, the pipeline will start to perform the task scanning.

[0036] Furthermore, this embodiment also includes: when the currently associated scanning tool does not meet the dependency conditions, removing the subsequent associated scanning tools; if no web service is found (ports 80 / 443 are closed), skipping Nessus's web vulnerability detection module to update the task scanning queue; including: Obtain the pre-scanning tool For subsequent scanning tools The result satisfaction was The value range is [0, 1], and it is represented as: ; in, Indicates the front scanning tool Core output metrics (such as) =Nmap's metric is "number of open ports 80 / 443"). Indicates subsequent scanning tools The minimum threshold of the core output metrics required for normal task execution (preset by business rules, such as...) Nessus Web vulnerability detection requires If the output is "Number of open ports 80 / 443 ≥ 1", then... ).

[0037] if Then take The highest satisfaction level is 1, meaning the requirement is fully met.

[0038] For any pre-scanning tool exist , Represents the pruning threshold (often taken as...) This indicates that when the satisfaction rate is below 20%, subsequent tools are meaningless to execute, and the subsequent scanning tools are removed. pruning decision function (Pruning decision function) Used to determine whether to remove subsequent dependency scanning tools. ), from vertex set Remove subsequent scanning tools From the dependency matrix Delete the first OK( (dependence on other scanning tools) and the Columns (other tools) (dependencies) to update vertex sets Dependency Matrix The updated vertex set is obtained. Dependency Matrix Updated dependency matrix The dimension is Recalculate the in-degree of the remaining scanning tools and update the task scanning queue.

[0039] It should be noted that this embodiment designs a toolchain dynamic generation algorithm, which constructs tool feature vectors and scenario requirement vectors based on graph neural networks, and matches the optimal tool combination in real time through cosine similarity calculation. A dynamic pruning algorithm is introduced to optimize the scanning process, and a containerized security sandbox ensures execution security. This technology achieves fully automated integration and scheduling of new tools. At the same time, a new function automatic registration engine is designed: when LLM identifies the functional characteristics of a tool, it automatically generates standardized capability tags and updates the system policy library, dynamically triggering context-aware scanning.

[0040] In risk identification, the intelligent scanning module converts the task scanning results into a unified JSON format and performs deduplication; simultaneously, the multi-source data association module integrates network topology resources and traffic data captured by probes to construct a dynamic asset map containing asset attributes, service dependencies, and vulnerability information. The results, processed by the conflict resolution engine, are injected into the dynamic risk map resource library and a structured PDF report is generated.

[0041] Further, please see Figures 4-5 , Figure 4 This is a schematic diagram of risk identification provided in an embodiment of the present invention. Figure 5 This is a schematic diagram illustrating the unification of heterogeneous data formats provided in an embodiment of the present invention. In this embodiment, the format unification of heterogeneous data in the task scanning results includes: When processing scan results from tools such as OpenVAS, Nessus, and Hydra, the intelligent scanning module standardizes the scan results from different tools into a unified data format. The result standardization tool (Adapter) in the intelligent scanning module performs intelligent data transformation.

[0042] The task scanning results are unified into a structured JSON format by using a preset XPath parser (Nessus XML report), regular expression module (Nmap text output) and dedicated library (pyTenable) to ensure the initial alignment of port status, vulnerability ID and key fields; the parsing steps map data of different formats to a unified data model, and the detailed parsing rules are shown in Table 1.

[0043] Data consistency is ensured by using structured JSON Schema to constrain field types and value ranges.

[0044] During the process of standardizing data formats, if different scanning tools detect the same asset or vulnerability information, they will match based on IP address, port number, and vulnerability ID unique identifier, and delete duplicates to achieve deduplication.

[0045] For each piece of standardized data, a unique asset identifier, `asset_id`, is generated according to the formula: `asset_id = ip_address + ":" + str(port)`. For vulnerability information (`vuln_id`, `risk_level`), an MD5 hash value is calculated: `hash_value = MD5(vuln_id + "_" + str(risk_level))`. MD5 can compress inputs of arbitrary length into a fixed-length hash value (32-bit hexadecimal string). This feature significantly reduces the storage pressure on the deduplication cache table. A deduplication cache table, `DedupCache = {asset_id: [hash_value1, hash_value2, ...]}`, is constructed. When new data arrives, it is determined whether the data is duplicated based on the `asset_id` and the hash value.

[0046] Table 1. Multi-source data parsing rules

[0047] Furthermore, in this embodiment, the conflict resolution module performs conflict removal on the uniformly formatted task scan results to obtain updated task scan results, including: When discrepancies occur in the uniformly formatted task scan results, the conflict resolution module automatically detects the conflict. Conflict detection includes a comparison of differences in asset information and vulnerability information, such as IP address, port status, and running services.

[0048] If multi-source scan results show attribute differences (such as contradictory port open states) or logical conflicts (such as disagreements about vulnerability existence), the conflict resolution module employs a three-level semantic resolution architecture to achieve intelligent decision-making and resolve conflicts, including: In the terminology semantic alignment layer, when a conflict is detected in the formatted task scanning results, a terminology alignment mechanism based on a pre-trained semantic understanding model is employed. The terms to be aligned (e.g., "open" in Nmap, "listening" in Nessus) are input into the text embedding layer of the pre-trained Claude model to generate... =768-dimensional semantic vector ( The terms are input into the text embedding layer of a pre-trained LLM model to generate semantic vectors; the cosine similarity algorithm is used to calculate the similarity between any two terms, expressed as: ; Set similarity threshold If the similarity between two terms is greater than a threshold, i.e. If the two terms are deemed equivalent, they are included in the dynamic mapping rule base.

[0049] At the dynamic credibility decision layer, a multi-factor weighted evaluation model is adopted to achieve scenario-adaptive decision-making. This model integrates historical accuracy factors (dynamically calculating the true positive rate based on tool alert verification results in audit logs), CVE matching factors (quantifying the degree of conformity compared to the NVD official vulnerability feature library), and environmental adaptability factors (evaluating the fit weight between the tool and the target asset type using a graph neural network). A dynamic weighted algorithm is then used to generate a standardized confidence score for the task scan results, expressed as: ; Among them, historical accuracy factor The true positive rate (TPR) of vulnerability detection tools, based on audit logs from the past 90 days, is calculated using the following formula: ; CVE matching factor To compare the degree of match between the vulnerability features detected by the tool and the official feature database of NVD (National Vulnerability Database), the formula is as follows: ; Environmental adaptability factor This is a graph neural network assessment score that evaluates the suitability of the tool to the target asset type. The environmental suitability factor automatically increases the weight of specialized tools in specific scenarios such as industrial control systems, achieving a scientifically reliable scenario-based assessment.

[0050] In the intelligent decision-making execution layer, when the confidence level is greater than the first threshold (0.9), the conflict is eliminated and the data is directly injected into the dynamic risk map resource library. When the confidence level is between the first and second thresholds (0.7), a verification label is added, and a secondary scanning verification process is automatically performed. When the confidence level is less than the second threshold, a structured review questionnaire is generated and associated with the original scan data snapshot. This questionnaire is then automatically distributed to the administrator terminal via the model context protocol, and updates to the relevant dynamic risk map resource library are paused until manual confirmation.

[0051] It should be noted that the multi-source data fusion and three-level semantic resolution mechanism proposed in this embodiment addresses the deep integration bottlenecks of multi-source scanning tools, such as heterogeneous data formats, semantic conflicts in fields, and logical contradictions. It breaks through the limitations of traditional rule integration by first performing deep integration of the scanning results through a multi-source data association engine, and then designing a three-level conflict resolution architecture: The terminology alignment layer utilizes an LLM attention mechanism to calculate terminology similarity between tools. The credibility decision layer employs a dynamic weighted algorithm to assess the reliability of results, comprehensively considering historical accuracy factors (calculated based on the true positive rate of audit logs), CVE matching factors (comparing the feature conformity with the NVD vulnerability database), and environmental adaptability factors (assessing the fit between the graph neural network assessment tool and the asset type) to generate a confidence score. The intelligent execution layer implements a tiered strategy: results with a confidence score >90% are directly adopted as benchmark data, results with medium confidence scores undergo secondary verification, and results with low confidence scores are manually reviewed. This engine collaborates with a multi-source data association engine, fusing scan results and network traffic data through GNN technology to construct a dynamic asset graph that includes asset topology, vulnerability associations, and business context. This upgrades result integration from simple format conversion to semantic cognitive unification, addressing the systemic shortcomings of traditional solutions in areas such as field ambiguity resolution and cross-tool logic verification.

[0052] Further, please see Figure 6 and Figure 7 , Figure 6 This is a schematic diagram of multi-source data fusion provided in an embodiment of the present invention. Figure 7 This is a schematic diagram of a risk assessment report generation provided in this embodiment of the invention. In this embodiment, based on the updated task scan results, the multi-source data association module integrates network topology resources and traffic data captured by probes to construct a dynamic asset map including asset attributes, service dependencies, and vulnerability information; the report generation module generates a structured report based on the dynamic asset map, including: The probe traffic topology analysis module interprets network flow data and combines it with the NetFlow parser to capture service dependencies (such as establishing API_CALL associations for HTTP traffic and marking DB_ACCESS connections for port 3306 traffic) to build a basic service dependency model and obtain the probe traffic dependency chain. At the same time, the scanning tool result association module starts collaborative annotation, mapping service attributes to graph nodes for Nmap port scan results, binding CVEs to asset IP nodes for Nessus vulnerability data, associating credentials with service nodes for Hydra weak password detection, and configuring audit link settings to asset nodes for OpenVAS to obtain the scanning tool annotation results.

[0053] The dynamic asset graph construction tool integrates initial network topology resources, probe traffic dependency chains, and scanning tool annotation results. It uses a pre-trained graph neural network (GNN) to infer the communication chains between Pods in the container orchestration layer and the implicit relationships of the call tree in the microservice layer, generating a dynamic asset graph with multiple attributes.

[0054] The conflict resolution results are injected into a dynamic risk graph resource library, which includes asset topology relationships (such as server-database call chains), vulnerability risk matrix (CVE number + CVSS score), and business criticality labels.

[0055] The numerical conversion tool in the report generation module converts the dynamic asset map into WebGL renderable vertex buffer objects; the 3D rendering tool, based on color mapping rules in the strategy parameter library (such as enabling pulsation for CVSS≥9.0) and business weight configuration (200% enhancement for core business nodes), generates a heatmap frame cache containing spatial coordinates and risk gradients through Babylon.js space construction and Three.js gradient shading fusion technology; the document assembler synchronously integrates the heatmap frame cache and the asset relationship table exported by Neo4j, and generates a structured PDF report including a 3D visualization map, a vulnerability priority list, and a remediation suggestion matrix through a LaTeX template engine; finally, the distribution interface, according to the MCP protocol specification, uses the MQTT overTLS 1.3 protocol to adaptively push the format-optimized report to the administrator terminal.

[0056] Further, please see Figure 8 , Figure 8 This is a schematic diagram of a zero-shot capability extension provided by an embodiment of the present invention. In this embodiment, it also includes: a zero-shot integration module that automatically adapts to new scanning tools for user input.

[0057] The zero-shot tool integration module adopts a protocol-independent parsing framework. When a user submits a new tool documentation resource (tool:documentation), the zero-shot integration module analyzes the semantic structure of the document in real time through a pre-trained LLM model. For API-driven tools (such as Wazuh), it automatically extracts endpoint paths, request specifications, and response structures to generate adapter interfaces that conform to the OpenAPI 3.0 standard. For command-line tools (such as Sqlmap), it parses parameter syntax and execution constraints to build a containerized Dockerfile encapsulation solution.

[0058] A dynamic capability registration mechanism is initiated to generate standardized capability tags and update the policy library to establish trigger rules, such as automatically calling weak password scanning when detecting database services. A four-fold security sandbox (OverlayFS file isolation, iptables network isolation, cgroups resource management, and non-root permission control) is deployed to ensure that the tool runs securely in a restricted environment. At the same time, a self-healing framework is built to achieve fully automated tool integration.

[0059] It should be noted that, in response to the problems of fixed functions and slow iteration of existing asset awareness tools, a zero-sample integration engine was designed. This engine automatically parses tool documentation using an LLM model to intelligently generate standard OpenAPI 3.0 adapters or containerized execution environments.

[0060] In summary, the intelligent asset perception method for big data platforms based on LLM and customizable MCP provided by this invention has the following beneficial effects, specifically: First, this invention integrates an LLM inference module to construct an intelligent scene parsing module, achieving end-to-end automation from understanding user intent to decision-making, thus changing the traditional security operations and maintenance model that heavily relies on expert experience. At the policy generation end, the scene parsing engine does not rely on simple keyword matching, but instead utilizes the Few-shot learning capability of the Claude model, combined with a pre-set, semantically rich asset type ontology and risk classification tree, to perform contextual learning through prompt templates. This enables the system to accurately understand the deep semantics of natural language instructions and transform them into structured, machine-executable, standardized scene description objects.

[0061] Secondly, this invention adaptively adjusts the scanning path during the scanning process based on real-time intermediate results and through a dynamic pruning algorithm. The system uses semantic matching technology to quantify the capabilities of the scanning tools and user needs into feature vectors, and dynamically recommends the optimal tool combination and generates an initial execution plan using an intelligent algorithm. Furthermore, a dynamic pruning mechanism is introduced to analyze intermediate results in real time during execution and automatically skip unnecessary subsequent scanning modules. This adaptive adjustment capability improves scanning efficiency and avoids a large number of ineffective operations in traditional fixed processes.

[0062] Third, this invention achieves a profound upgrade in comprehensive asset risk awareness through a multi-source data association engine during the results integration phase. The multi-source data association engine first integrates scan results from five types of tools: probes, Nmap, Nessus, Hydra, and OpenVAS, and simultaneously accesses initial network topology resources and real-time network flow data. The engine does not simply merge data; instead, it performs deep association reasoning through graph neural networks (GNNs)—mapping port services discovered by Nmap to node attributes in the graph, binding CVE vulnerabilities detected by Nessus to specific asset IP nodes, associating weak passwords identified by Hydra with corresponding service credentials, and using a NetFlow parser to extract service dependencies (such as API call chains and database access connections) from network traffic. Ultimately, all this information is fused to construct a multi-dimensional dynamic asset graph containing asset attributes, service dependencies, vulnerability information, configuration status, and business context, thus completely changing the flat perspective of isolated data lists in traditional reports.

[0063] Fourth, in the result processing stage, this invention uses a conflict resolution engine to handle conflicting results from different scanning tools. For differences in results from multiple scanning tools, the conflict resolution engine employs a three-level semantic architecture to achieve intelligent decision-making: the terminology semantic alignment layer first uses the attention mechanism of the Claude model to deeply analyze the context of conflicting fields, eliminating misjudgments caused by differences in terminology systems; the dynamic credibility decision layer integrates three factors—historical accuracy, CVE matching degree, and environmental adaptability—and uses a weighted algorithm to quantitatively evaluate the reliability of the results from each tool, achieving a scientific and credible scenario-based evaluation; the intelligent decision execution layer finally automatically triggers processing strategies based on the confidence score, forming a closed-loop control system of "machine decision-making - automatic verification - human intervention".

[0064] Fifth, this invention breaks through the limitations of traditional perception system tools being singular. By extending the engine with zero-sample capability, it enhances the system's configuration capabilities and flexibility. Users can flexibly select the latest open-source tools according to their security needs. The core LLM engine automatically reads tool documentation resources and parses tool technical documents—generating OpenAPI 3.0 standard adapters in real time for API-type tools, intelligently building containerized execution environments for CLI tools, and automatically integrating and scheduling third-party tools.

[0065] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that an article or device comprising a list of elements includes not only those elements but also other elements not expressly listed. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or device comprising said element. Terms such as "connected" or "linked" are not limited to physical or mechanical connections but can include electrical connections, whether direct or indirect. The orientations or positional relationships indicated by terms such as "upper," "lower," "left," and "right" are based on the orientations or positional relationships shown in the accompanying drawings and are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as limiting the invention.

[0066] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0067] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for intelligent asset perception on a big data platform based on LLM and customizable MCP, characterized in that, include: A standard resource library for the Model Context Protocol (MGP) is defined, a MGP server is constructed, multiple scanning tools are integrated, and automatic adaptation is performed. The MGP server includes a scene parsing module, an intelligent scanning module, a multi-source data association module, a conflict resolution module, a report generation module, and a zero-shot integration module. The zero-shot integration module automatically adapts to each of the scanning tools. The Model Context Protocol (MTP) server receives natural language input from the user and invokes a pre-trained LLM model. The scene parsing module transforms the natural language requirement into a standardized scene description object. The intelligent scanning module generates an optimal tool execution chain based on the standardized scene description object, executes a complete scanning task, obtains the task scanning results, and unifies the format of heterogeneous data in the task scanning results. The conflict resolution module resolves conflicts in the format-unified task scanning results to obtain updated task scanning results. Based on the updated task scanning results, the multi-source data association module integrates network topology resources and traffic data captured by probes to construct a dynamic asset graph including asset attributes, service dependencies, and vulnerability information. The report generation module generates a structured report based on the dynamic asset graph.

2. The intelligent asset perception method for big data platforms based on LLM and customizable MCP as described in claim 1, characterized in that, The standard resource library for the model context protocol includes network topology resources, tool resource documentation, a basic scanning strategy library, scanning context resources, and tool capability resources; among which... The network topology resources support multiple formats, including Visio diagram files, topology description text, and network configuration scripts, so that the scene parsing module and the intelligent scanning module can understand the target scanning environment. The tool resource documentation is provided for the zero-sample integration module to automatically learn the usage of each of the scanning tools; The basic scanning strategy library includes predefined strategy templates, which serve as the basic templates for the intelligent scanning module to generate specific scanning instructions. The scanning context resources include a list of target assets, selected strategy fragments, user preferences, and current status, which are shared by various modules and used to update the task status during the execution of the scanning task. The tool capability resource identifier indicates the scanning capabilities of the integrated scanning tool.

3. The intelligent asset perception method for big data platforms based on LLM and customizable MCP as described in claim 1, characterized in that, The scene parsing module transforms the natural language requirements into standardized scene description objects, including: The pre-trained LLM model is invoked, and a structured knowledge base is constructed through a pre-defined asset type ontology and risk classification tree. Combined with Few-shot learning capabilities, a pre-defined prompt engineering template is used to achieve the mapping from natural language to machine instructions. At the same time, a dynamic constraint injection mechanism is introduced to associate security policies in network topology resources in real time. The natural language requirements are converted into technical parameters through a preset intensity quantification model to generate the standardized scenario description object. The structured fields of the standardized scenario description object include target network segment, asset type set, risk type matrix, scan intensity level, and automatic constraint terms of the strategy library. The technical parameters include preset basic probe packet rate, intensity weight, and actual probe packet rate.

4. The intelligent asset perception method for big data platforms based on LLM and customizable MCP as described in claim 1, characterized in that, The intelligent scanning module generates an optimal tool execution chain based on the standardized scene description object, executes the complete scanning task, and obtains the task scanning results, including: A toolchain generator is built based on graph neural networks; The standardized scenario description object is input into the toolchain generator. Combining the asset type and risk type of the standardized scenario description object, the required capabilities corresponding to the asset type and risk type are extracted and encoded into a requirement feature vector. Real-time query tool capability resources, generate scanning tool feature vector, and encode the scanning tool feature vector into capability feature vector; The cosine similarity algorithm is used to calculate the cosine similarity between the capability feature vector and the requirement feature vector, and the optimal tool execution chain is dynamically generated based on the cosine similarity. An independent security sandbox is built for each scanning tool, tasks are scheduled according to the dependencies of the scanning tools, and a containerized execution module is built to provide a customized Docker environment for each scanning tool. Security boundaries are ensured through namespace isolation and resource quota limits. During the task scanning process, intermediate scan results are read in real time, the task scanning path is adjusted, and the task scanning results are obtained.

5. The intelligent asset perception method for big data platforms based on LLM and customizable MCP as described in claim 4, characterized in that, During the task scanning process, intermediate scan results are read in real time, the task scanning path is adjusted, and the task scanning results are obtained, including: A parallel scheduling framework is built based on a tool dependency graph. For scanning tools with no logical connections, an asynchronous parallel execution task scanning queue is initiated. For scanning tools with upstream and downstream dependencies, a pipelined execution task scanning is started after all upstream dependent scanning tools have completed execution. This includes: The tool dependency graph is represented using a directed acyclic graph, where the vertex set... This represents an instance of the scanning tool in a scanning task. Edge set This represents the dependencies between vertices; if the scanning tool It is a scanning tool If there is a pre-dependency, then there exists a directed edge. Weight If there is no dependency, there is no corresponding edge, and the weight is... ; Based on the dependency relationship, the dimension is built as follows: Order dependency matrix Elements in the dependency matrix Defined as: if an edge exists , If there is no edge , ; The in-degree topological sort is used to determine the execution order of the scanning tools. in-degree Indicates all pointing to scanning tools The number of edges is represented as: ； If scanning tool in-degree If no prerequisites are specified, then the asynchronous parallel execution task scanning queue is started; if the scanning tool... in-degree Then, after all the preceding dependent scanning tools have completed their tasks, the pipeline will start to perform the task scanning.

6. The intelligent asset perception method for big data platforms based on LLM and customizable MCP as described in claim 5, characterized in that, Also includes: When the scanning tool associated with the preceding dependency does not meet the dependency conditions, the scanning tool associated with the subsequent dependency is removed to update the task scanning queue; including: Obtain the pre-scanning tool For subsequent scanning tools The result satisfaction was , represented as: ； in, Indicates the front scanning tool The core output metrics, Indicates subsequent scanning tools The minimum threshold for the core output metrics required for normal task execution; For any pre-scanning tool exist , This indicates the pruning threshold, which removes subsequent scanning tools. pruning decision function From the vertex set Remove subsequent scanning tools From the dependency matrix Delete the first row and number Columns to update vertex set Dependency Matrix The updated vertex set is obtained. Dependency Matrix Updated dependency matrix The dimension is Recalculate the in-degree of the remaining scanning tools and update the task scanning queue.

7. The intelligent asset perception method for big data platforms based on LLM and customizable MCP as described in claim 1, characterized in that, The heterogeneous data in the task scan results are formatted uniformly, including: The task scanning results are unified into a structured JSON format by using a preset XPath parser, regular expression module and dedicated library to ensure the initial alignment of port status, vulnerability ID and key fields; Data consistency is ensured by constraining field types and value ranges using structured JSON Schema; During the process of standardizing data formats, if different scanning tools detect the same asset or vulnerability information, they will match based on IP address, port number, and vulnerability ID unique identifier, and delete duplicates to achieve deduplication.

8. The intelligent asset perception method for big data platforms based on LLM and customizable MCP as described in claim 1, characterized in that, The conflict resolution module removes conflicts from the uniformly formatted task scan results to obtain updated task scan results, including: When discrepancies occur in the uniformly formatted task scan results, the conflict resolution module automatically detects conflicts, including a comparison of differences in asset information and vulnerability information. The conflict resolution module employs a three-level semantic resolution architecture to achieve intelligent decision-making and resolve conflicts, including: In the terminology semantic alignment layer, when a conflict is detected in the uniform task scanning results, a terminology alignment mechanism based on a pre-trained semantic understanding model is adopted. The terms to be aligned are input into the text embedding layer of the pre-trained LLM model to generate semantic vectors. The cosine similarity algorithm is used to calculate the similarity between any two terms. If the similarity between the two terms is greater than the threshold, the two terms are determined to be equivalent and included in the dynamic mapping rule base. In the dynamic confidence decision layer, a multi-factor weight evaluation model is adopted to achieve scenario adaptive decision-making. It integrates historical accuracy factor, CVE matching factor and environmental adaptability factor, and uses a dynamic weighting algorithm to generate confidence scores of task scanning results with a unified format. In the intelligent decision execution layer, when the confidence level is greater than the first threshold, the conflict is eliminated and the data is directly injected into the dynamic risk map resource library; when the confidence level is between the first and second thresholds, a verification label is added and a secondary scanning verification process is automatically performed; when the confidence level is less than the second threshold, a structured review questionnaire is generated and associated with the original scan data snapshot, which is automatically distributed to the administrator terminal through the model context protocol, while the update of the relevant dynamic risk map resource library is suspended until manual confirmation.

9. The intelligent asset perception method for big data platforms based on LLM and customizable MCP according to claim 1, characterized in that, Based on the updated task scan results, the multi-source data association module integrates network topology resources and traffic data captured by probes to construct a dynamic asset map that includes asset attributes, service dependencies, and vulnerability information. The report generation module generates a structured report based on the dynamic asset map, including: The probe traffic topology analysis module interprets network flow data, and the NetFlow parser captures service dependencies to build a basic service dependency model and obtain the probe traffic dependency chain. At the same time, the scanning tool result association module starts collaborative annotation to obtain the scanning tool annotation results. The dynamic asset graph construction tool integrates initial network topology resources, probe traffic dependency chains, and scanning tool annotation results. It uses a pre-trained graph neural network to infer the communication chains between Pods in the container orchestration layer and the implicit relationships of the call tree in the microservice layer, generating a dynamic asset graph with multiple attributes. The numerical conversion tool in the report generation module converts the dynamic asset map into a WebGL renderable vertex buffer object; the 3D rendering tool generates a heatmap frame cache containing spatial coordinates and risk gradients based on the color mapping rules and business weight configuration in the strategy parameter library, using Babylon.js space construction and Three.js gradient shading fusion technology; the document assembler synchronously integrates the heatmap frame cache and the asset relationship table exported by Neo4j, and generates a structured PDF report including a 3D visualization map, a vulnerability priority list, and a remediation suggestion matrix through the LaTeX template engine.

10. The intelligent asset perception method for big data platforms based on LLM and customizable MCP according to claim 1, characterized in that, Also includes: The zero-sample integration module automatically adapts to new scanning tools input by the user; When a user submits new tool documentation resources, the zero-shot integration module analyzes the semantic structure of the document in real time through a pre-trained LLM model. For API-driven tools, it automatically extracts endpoint paths, request specifications, and response structures to generate adapter interfaces that conform to the OpenAPI 3.0 standard. For command-line tools, it parses parameter syntax and execution constraints to build a containerized Dockerfile encapsulation solution. A dynamic capability registration mechanism is initiated to generate standardized capability tags, and the policy library is updated in conjunction with it to establish trigger rules. A four-layer security sandbox is deployed to ensure that the tool can be executed safely in a restricted environment. At the same time, a self-healing framework is built to achieve fully automated tool integration.

Images