An agent-based complex threat intelligence analysis and logical reasoning method

Abstract

The application discloses a complex threat intelligence analysis and logical reasoning method based on an agent, and belongs to the technical field of agent intelligence processing. In order to solve the problem of accurate and interpretable analysis of complex threat intelligence, the application comprises the following steps: decomposing a problem based on a multi-strategy decomposition mechanism to obtain a decomposed sub-problem according to a user input problem; obtaining a preliminarily screened candidate document by using adaptive hybrid retrieval and information refining; constructing a hybrid reordering model based on a spectral graph theory and a determinant point process, including constructing a hybrid semantic weighted graph, adaptive spectral embedding and noise reduction, and greedy k-DPP selection based on a spectral space, reordering the preliminarily screened candidate document to obtain topological data of the reordered hybrid semantic weighted graph; and reasoning and generating a final answer based on the constructed global evidence graph. The application realizes output of a logically coherent, accurately cited and globally perspective final answer of complex threat intelligence.

Description

Technical Field

[0001] This invention belongs to the field of intelligent agent intelligence processing technology, specifically relating to a method for complex threat intelligence analysis and logical reasoning based on intelligent agents. Background Technology

[0002] Advanced Persistent Threats (APTs) pose a significant challenge to the cybersecurity field. With the evolution of APT technologies, cyberattacks are characterized by long attack chains, high stealth capabilities, and diverse tactics. Security operations personnel often need to process massive amounts of heterogeneous data and perform complex logical reasoning across entities and time periods when conducting threat assessments.

[0003] Currently, using Retrieval-Augmented Generation (RAG) to assist security analysis has become a trend. However, existing threat intelligence analysis techniques have significant limitations when dealing with such complex scenarios: on the one hand, traditional RAG systems mostly adopt a linear "retrieval-generation" process, lacking dynamic decomposition and routing mechanisms for complex multi-hop problems, making it difficult to accurately cover multi-dimensional query intents; on the other hand, retrieval ranking algorithms based on a single similarity index ignore the topological structure and complementarity between data fragments, easily producing homogeneous redundancy and noise interference in the retrieval results, and the system cannot construct an explicit logical chain of evidence from local clues to global conclusions, resulting in insufficient accuracy and interpretability of the analysis results.

[0004] Although retrieval enhancement generation technology has been gradually applied to the field of threat intelligence analysis, existing methods still lack systematic and in-depth analytical capabilities when dealing with complex and covert advanced persistent threats (APTs). On the one hand, traditional linear retrieval processes often presuppose a single and direct query intent, lacking a dynamic decomposition mechanism for complex attack scenarios involving multi-hop reasoning or multifaceted comparisons, making it difficult to accurately capture the deep logical connections in long-chain attacks. On the other hand, existing retrieval ranking mechanisms mostly rely on a single semantic similarity index, ignoring the potential topological structure and complementarity between intelligence data fragments, easily leading to homogeneous and redundant retrieval results, and failing to construct explicit logical support from local fragmented clues to global analytical conclusions. Therefore, in the context of massive heterogeneous threat intelligence, how to design an intelligent analysis scheme that integrates dynamic task planning and topological diversity reordering, effectively removing noise interference while achieving a leap from implicit semantic matching to explicit evidence chain reasoning, is a pressing technical challenge to be addressed in improving the accuracy and interpretability of APT analysis.

[0005] Therefore, there is an urgent need for a threat intelligence analysis method that can dynamically plan tasks for complex problems and optimize the diversity and signal-to-noise ratio of search results in order to improve the accuracy and efficiency of APT analysis. Summary of the Invention

[0006] The problem this invention aims to solve is to achieve accurate and interpretable analysis of complex threat intelligence, and proposes a method for complex threat intelligence analysis and logical reasoning based on intelligent agents.

[0007] To achieve the above objectives, the present invention provides the following technical solution:

[0008] A complex threat intelligence analysis and logical reasoning method based on intelligent agents includes the following steps:

[0009] S1. For the user-input question, decompose the question based on a multi-strategy decomposition mechanism to obtain the decomposed sub-questions;

[0010] S2. For the sub-problems obtained from step S1, an adaptive hybrid retrieval and information refinement method is used to obtain preliminary candidate documents;

[0011] S3. Construct a hybrid reordering model based on spectral graph theory and determinant point process, including constructing a hybrid semantic weighted graph, adaptive spectral embedding and denoising, and greedy k-DPP selection based on spectral space. Reorder the candidate documents initially screened in step S2 to obtain the topological data of the reordered hybrid semantic weighted graph.

[0012] S4. Based on the constructed global evidence graph, reason and generate the final answer using the topological data of the reordered hybrid semantic weighted graph obtained in step S3.

[0013] Furthermore, the specific implementation method of step S1 includes the following steps:

[0014] S1.1. Construct the global proxy state This includes user queries Decomposition markers Topological types of problems and the generated sequence of subproblems ;

[0015] S1.2. Perform semantic complexity evaluation and intent mapping, and receive user queries. Then, the task decomposition module is called to define the decomposition function. The system extracts and classifies the structural features of queries using a large language model, and outputs decomposed decision tuples. ,in A decomposition flag indicating whether decomposition is required. Yes, Indicates no. ,in For serial decomposition, For parallel decomposition, No decomposition. For the generated sequence of subproblems, This is the nth subproblem;

[0016] S1.3. Based on state conditions, branch control is applied to the obtained decomposed function. A conditional edge mechanism is used to construct the dynamic control flow, and the control function is defined. If the topology type of the problem is determined to be You can directly enter the tool selection and search node and execute a single search generation process;

[0017] If the topology type of the problem is determined to be Perform serial dependency chain decomposition, and based on the existence of causal or temporal dependencies between subproblems, construct a recursive execution environment, where the i-th subproblem... The input depends on all preceding subproblems output set , The output corresponding to the (i-1)th subproblem; define the placeholder replacement operation. For each subproblem in the sequence The actual query executed The calculation is as follows:

[0018]

[0019] in, To refer to the preceding number The actual reasoning result of the sub-problem The variable symbols, i.e., the placeholders in the system's dynamic parsing subproblem template, are replaced with the actual reasoning results from the preceding steps. ;

[0020] If the topology type of the problem is determined to be If the elements in the subproblem set are independent of each other and do not constitute context constraints, the system maps the subproblem set to a set of orthogonal execution tasks, triggering execution units in parallel or iteratively.

[0021] Furthermore, the specific implementation method of step S2 includes the following steps:

[0022] S2.1. For the sub-problems obtained in step S1, the Agent calls the LLM to perform intent feature analysis for each specific sub-problem and dynamically selects the retrieval tool, which consists of different vector knowledge base retrieval methods;

[0023] S2.2. Perform intent-based differentiated retrieval: For descriptive sub-questions with ambiguous semantics and broad concepts, invoke semantic retrieval based on a vector database and recall relevant documents by calculating vector cosine similarity;

[0024] For sub-questions containing proper nouns, specific code snippets, or specific model numbers, keyword retrieval based on inverted indexes is invoked to anchor key information through exact matching;

[0025] S2.3. Perform relevance cleaning on the original document blocks obtained by retrieval. Based on the preset relevance judgment prompt, drive the Agent to automatically remove noise segments that are irrelevant to the current sub-problem, and further extract the core semantic units in the document blocks, retaining only the text segments containing high-value information to obtain the preliminary candidate documents.

[0026] Furthermore, the specific implementation method of step S3 includes the following steps:

[0027] S3.1. Construct a hybrid semantic weighted graph:

[0028] First, the preliminary selection of candidate document blocks is... Consider the nodes of a graph, and compute any two nodes and Edge weights between The calculation formula is as follows:

[0029]

[0030] in, , Representing nodes respectively and The dense semantic vectors are extracted by a pre-trained Embedding model to capture deep semantics and implicit associations; , Representing nodes respectively and Sparse entity vectors are used to capture precise matches between keywords and entities; For balance coefficient, , used to adjust the weight ratio of semantic similarity and literal matching, where T is the transpose;

[0031] To remove weak noise correlations and reduce subsequent computational complexity, a minimum edge weight threshold is set. When calculated season This achieves graph sparsification.

[0032] S3.2. Perform adaptive spectral embedding and noise reduction:

[0033] After constructing the weighted adjacency matrix Then, the graph data is mapped to a low-dimensional spectral space to utilize the graph's topological structure for noise reduction;

[0034] S3.2.1. Constructing the Laplace matrix :calculate ,in For a degree matrix, its diagonal elements ;

[0035] S3.2.2. Perform eigenvalue decomposition: Decompose the Laplace matrix Perform eigenvalue decomposition , For eigenvalue scalars, Using eigenvectors, we obtain the sequence of eigenvalues. and its corresponding eigenvectors;

[0036] S3.2.3. Perform dynamic dimension selection: Determine the optimal embedding dimension using the Eigengap heuristic. Calculate the difference between adjacent feature values, and select the point with the largest difference as the cutoff point. ;

[0037] S3.2.4. Perform spectral mapping, selecting the first... Each document block has a feature vector. Mapped to Vectors in spectral space At this point, the semantic differences between documents are transformed into orthogonality in geometric space, resulting in the feature vector representation of the determinant point process;

[0038] S3.3. Greedy k-DPP selection based on spectral space: Select a subset of documents from the eigenvector representation of the determinant point process obtained in step S3.2. ,in Let k be the number of target documents to be reordered, such that the kernel matrix corresponding to this subset is... Maximizing the determinant is expressed as:

[0039]

[0040] in, Representative of a subset of documents The volume of the polyhedron spanned by the median vector. The optimal subset of documents that maximizes the determinant. The complete set of candidate document vectors after spectral mapping. To find the variable operation that maximizes the objective function, a greedy algorithm is used to approximate the maximum a posteriori probability, resulting in a reordered subset of documents that retains the graph topology.

[0041] Furthermore, the specific implementation method of step S4 includes the following steps:

[0042] S4.1. Topology Reuse and Edge Extraction: Based on the reordered document subset that retains the graph topology obtained in step S3, extract the corresponding submatrices from the weighted adjacency matrix. ;

[0043] For any two nodes in the subset and The formula for determining the existence of an edge is:

[0044]

[0045] in, To represent nodes With nodes A binary indicator variable indicating whether there is a connecting edge between them; The two document blocks are strongly connected in both the vector space and entity association.

[0046] S4.2. Semantic relation generation: For all satisfying node pairs The data is input into an LLM for in-depth content analysis. Through a predefined set of relationship types, the model is constrained to identify within the following logical categories: support / validation, supplementation / extension, contrast / conflict, and causality / derivation.

[0047] S4.3. Generate a structured graph to obtain the output evidence graph. , where the set of nodes It consists of the reordered Top-K document fragments, and the edge set. Includes directed or undirected connections between nodes and their semantic attributes;

[0048] S4.4. The Agent infers and generates the final answer based on the output evidence graph.

[0049] The beneficial effects of this invention are:

[0050] This invention discloses a complex threat intelligence analysis and logical reasoning method based on intelligent agents. In the question reception and planning phase, the agent analyzes the input. For complex queries involving multi-hop reasoning or multi-dimensional comparison, the agent initiates a multi-strategy decomposition mechanism. For highly dependent questions, serial decomposition is used, treating previous answers as subsequent context; for highly independent questions, parallel decomposition is used for simultaneous processing. The agent intelligently routes and selects the most suitable retrieval tool based on the characteristics of sub-questions, utilizing semantic retrieval to handle fuzzy concepts and keyword retrieval to anchor precise codes or entities, achieving a dual-path complementary approach.

[0051] The present invention discloses a complex threat intelligence analysis and logical reasoning method based on intelligent agents. In the information retrieval and preprocessing stage, the agent performs deep cleaning on the retrieved original document blocks. Through relevance extraction and noise filtering modules, redundant information irrelevant to sub-problems is removed, retaining only the smallest semantic units with high signal-to-noise ratios, thereby reducing interference and computational overhead for subsequent graph computation.

[0052] This invention presents a complex threat intelligence analysis and logical reasoning method based on intelligent agents. In the graph diversity reordering stage, to address the document homogenization problem easily caused by traditional reordering, this scheme constructs a topological graph on the retrieved document block set. The adjacency matrix weights of this graph are weighted by a fusion of dense semantic similarity and sparse entity symbol association, with a threshold set for sparsity denoising. Subsequently, the Laplacian matrix is ​​calculated and eigenvalue decomposition is performed. The optimal dimension is determined using the Eigengap heuristic, mapping the document blocks to a low-dimensional spectral space. In this orthogonalized geometric space, the agent employs a determinant-based point selection strategy based on a greedy algorithm, aiming to maximize the polyhedral volume, selecting a subset of documents that is both highly semantically representative and as orthogonal as possible in the vector space, thereby maximizing information coverage.

[0053] This invention discloses a complex threat intelligence analysis and logical reasoning method based on intelligent agents. In the reasoning and generation phases, the agent reuses the topology structure from the reordering phase, transforming a selected subset of documents into an explicit evidence graph. The system calls the agent to analyze the connections between nodes, generating a logical evidence chain described in natural language, thus white-boxing the reasoning process. The final generation model no longer processes text fragments in isolation, but rather uses graph-guided generation based on a globally assembled evidence graph. It traces back along the evidence chain and synthesizes clues from multiple sub-problems, outputting a logically coherent, accurately cited, and globally-oriented final answer. Attached Figure Description

[0054] Figure 1 This is a flowchart of a complex threat intelligence analysis and logical reasoning method based on intelligent agents as described in this invention;

[0055] Figure 2 This is a structural block diagram of a complex threat intelligence analysis and logical reasoning method based on intelligent agents as described in this invention. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only for explaining the invention and are not intended to limit the invention; that is, the described specific embodiments are merely a part of the embodiments of the invention, and not all of them. The components of the specific embodiments of the invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations, and the invention may also have other embodiments.

[0057] Therefore, the following detailed description of specific embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected specific embodiments of the invention. All other specific embodiments obtained by those skilled in the art based on these specific embodiments without inventive effort are within the scope of protection of this invention.

[0058] To further understand the invention's content, features, and effects, the following specific embodiments are provided, along with accompanying drawings. Figure 1 -Appendix Figure 2 Detailed explanation is as follows:

[0059] Example 1:

[0060] A complex threat intelligence analysis and logical reasoning method based on intelligent agents includes the following steps:

[0061] S1. For the user-input question, decompose the question based on a multi-strategy decomposition mechanism to obtain the decomposed sub-questions;

[0062] Furthermore, the specific implementation method of step S1 includes the following steps:

[0063] S1.1. Construct the global proxy state This includes user queries Decomposition markers Topological types of problems and the generated sequence of subproblems ;

[0064] S1.2. Perform semantic complexity evaluation and intent mapping, and receive user queries. Then, the task decomposition module is called to define the decomposition function. The system extracts and classifies the structural features of queries using a large language model, and outputs decomposed decision tuples. ,in A decomposition flag indicating whether decomposition is required. Yes, Indicates no. ,in For serial decomposition, For parallel decomposition, No decomposition. For the generated sequence of subproblems, This is the nth subproblem;

[0065] S1.3. Based on state conditions, branch control is applied to the obtained decomposed function. A conditional edge mechanism is used to construct the dynamic control flow, and the control function is defined. If the topology type of the problem is determined to be You can directly enter the tool selection and search node and execute a single search generation process;

[0066] If the topology type of the problem is determined to be Perform serial dependency chain decomposition, and based on the existence of causal or temporal dependencies between subproblems, construct a recursive execution environment, where the i-th subproblem... The input depends on all preceding subproblems output set , The output corresponding to the (i-1)th subproblem; define the placeholder replacement operation. For each subproblem in the sequence The actual query executed The calculation is as follows:

[0067]

[0068] in, To refer to the preceding number The actual reasoning result of the sub-problem The variable symbols, i.e., the placeholders in the system's dynamic parsing subproblem template, are replaced with the actual reasoning results from the preceding steps. ;

[0069] If the topology type of the problem is determined to be If the elements in the subproblem set are independent of each other and do not constitute context constraints, the system maps the subproblem set to a set of orthogonal execution tasks, triggering execution units in parallel or iteratively.

[0070] Furthermore, this module proposes a dynamic task orchestration and adaptive decomposition mechanism based on semantic intent. This mechanism maps natural language queries into executable directed acyclic graphs or independent task sets by introducing a task decomposer into the agent's state space, thus achieving structured solutions to complex problems.

[0071] S2. For the sub-problems obtained from step S1, an adaptive hybrid retrieval and information refinement method is used to obtain preliminary candidate documents;

[0072] Furthermore, the specific implementation method of step S2 includes the following steps:

[0073] S2.1. For the sub-problems obtained in step S1, the Agent calls the LLM to perform intent feature analysis for each specific sub-problem and dynamically selects the retrieval tool, which consists of different vector knowledge base retrieval methods;

[0074] S2.2. Perform intent-based differentiated retrieval: For descriptive sub-questions with ambiguous semantics and broad concepts, invoke semantic retrieval based on a vector database and recall relevant documents by calculating vector cosine similarity;

[0075] For sub-questions containing proper nouns, specific code snippets, or specific model numbers, keyword retrieval based on inverted indexes is invoked to anchor key information through exact matching;

[0076] S2.3. Perform relevance cleaning on the original document blocks obtained by retrieval. Based on the preset relevance judgment prompt, drive the Agent to automatically remove noise segments that are irrelevant to the current sub-problem, and further extract the core semantic units in the document blocks, retaining only the text segments containing high-value information to obtain the preliminary candidate documents.

[0077] S3. Construct a hybrid reordering model based on spectral graph theory and determinant point process, including constructing a hybrid semantic weighted graph, adaptive spectral embedding and denoising, and greedy k-DPP selection based on spectral space. Reorder the candidate documents initially screened in step S2 to obtain the topological data of the reordered hybrid semantic weighted graph.

[0078] Furthermore, the specific implementation method of step S3 includes the following steps:

[0079] S3.1. Construct a hybrid semantic weighted graph:

[0080] First, the preliminary selection of candidate document blocks is... Consider the nodes of a graph, and compute any two nodes and Edge weights between The calculation formula is as follows:

[0081]

[0082] in, , Representing nodes respectively and The dense semantic vectors are extracted by a pre-trained Embedding model to capture deep semantics and implicit associations; , Representing nodes respectively and Sparse entity vectors are used to capture precise matches between keywords and entities; For balance coefficient, , used to adjust the weight ratio of semantic similarity and literal matching, where T is the transpose;

[0083] To remove weak noise correlations and reduce subsequent computational complexity, a minimum edge weight threshold is set. When calculated season This achieves graph sparsification; the weights integrate dense semantic similarity and sparse symbolic correlation.

[0084] S3.2. Perform adaptive spectral embedding and noise reduction:

[0085] After constructing the weighted adjacency matrix Then, the graph data is mapped to a low-dimensional spectral space to utilize the graph's topological structure for noise reduction;

[0086] S3.2.1. Constructing the Laplace matrix :calculate ,in For a degree matrix, its diagonal elements ;

[0087] S3.2.2. Perform eigenvalue decomposition: Decompose the Laplace matrix Perform eigenvalue decomposition , For eigenvalue scalars, Using eigenvectors, we obtain the sequence of eigenvalues. and its corresponding eigenvectors;

[0088] S3.2.3. Perform dynamic dimension selection: Determine the optimal embedding dimension using the Eigengap heuristic. Calculate the difference between adjacent feature values, and select the point with the largest difference as the cutoff point. This step can automatically identify the number of major semantic clusters in the graph and ignore high-frequency noise.

[0089] S3.2.4. Perform spectral mapping, selecting the first... Each document block has a feature vector. Mapped to Vectors in spectral space At this point, the semantic differences between documents are transformed into orthogonality in geometric space, resulting in the feature vector representation of the determinant point process;

[0090] S3.3. Greedy k-DPP selection based on spectral space: Select a subset of documents from the eigenvector representation of the determinant point process obtained in step S3.2. ,in Let k be the number of target documents to be reordered, such that the kernel matrix corresponding to this subset is... Maximizing the determinant is expressed as:

[0091]

[0092] in, Representative of a subset of documents The volume of the polyhedron spanned by the median vector. The optimal subset of documents that maximizes the determinant. The complete set of candidate document vectors after spectral mapping. To find the variable operation that maximizes the objective function, a greedy algorithm is used to approximate the maximum a posteriori probability, resulting in a reordered subset of documents that retains the graph topology.

[0093] Furthermore, the greedy algorithm first initializes the selected set. Then iterate at each step. In the middle, calculate the remaining document blocks. Add to collection The resulting determinant gain is used to select the document block with the largest gain for inclusion. Repeat the above steps until... The final output document subset and adjacency matrix As a subset of reordered documents that retains the graph topology.

[0094] S4. Based on the constructed global evidence graph, reason and generate the final answer using the topological data of the reordered hybrid semantic weighted graph obtained in step S3.

[0095] After completing the diversity reordering, in order to achieve white-box and interpretability of the reasoning process, this solution is equipped with an explicit evidence graph construction module, which is used to transform the implicit mathematical structure of the reordering stage into an explicit logical evidence graph.

[0096] Furthermore, the specific implementation method of step S4 includes the following steps:

[0097] S4.1. Topology Reuse and Edge Extraction: Based on the reordered document subset that retains the graph topology obtained in step S3, extract the corresponding submatrices from the weighted adjacency matrix. ;

[0098] For any two nodes in the subset and The formula for determining the existence of an edge is:

[0099]

[0100] in, To represent nodes With nodes A binary indicator variable indicating whether there is a connecting edge between them; The two document blocks are strongly connected in both the vector space and entity association.

[0101] S4.2. Semantic relation generation: For all satisfying node pairs The data is input into an LLM for in-depth content analysis. Through a predefined set of relationship types, the model is constrained to identify within the following logical categories: support / validation, supplementation / extension, contrast / conflict, and causality / derivation.

[0102] S4.3. Generate a structured graph to obtain the output evidence graph. , where the set of nodes It consists of the reordered Top-K document fragments, and the edge set. Includes directed or undirected connections between nodes and their semantic attributes;

[0103] S4.4. The Agent infers and generates the final answer based on the output evidence graph.

[0104] This evidence graph not only serves as contextual input for generating the final answer, but also provides users with a complete logical backtracking path from the original document to the final answer, thus effectively solving the problem of the invisible reasoning process in traditional RAG systems.

[0105] Furthermore, the global graph-guided generation includes the agent reasoning and generating the final answer based on the constructed global evidence graph. If the original question has been broken down into multiple levels, the system first logically merges the local evidence graphs generated by each sub-question, assembling them into a global evidence graph that covers the entire question domain. The nodes of the global evidence graph are tuples (sub-question, answer to the sub-question), and the edges represent the relationships between the sub-questions. When processing the final answer, the generation model no longer reads a bunch of scattered text fragments in isolation, but uses this global evidence graph as the core context. The model can backtrack and reason along the explicit evidence chain in the graph, integrating clues and relationship descriptions from multiple nodes, eliminating illusions through graph guidance, and finally outputting a logically coherent, accurately cited, and globally-oriented answer, completing a complete closed loop from fragmented information retrieval to systematic knowledge output.

[0106] It should be noted that relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0107] Although this application has been described above with reference to specific embodiments, various modifications can be made and components can be replaced with equivalents without departing from the scope of this application. In particular, as long as there is no structural conflict, the features in the specific embodiments disclosed in this application can be combined with each other in any way. The lack of an exhaustive description of these combinations in this specification is merely for the sake of brevity and resource conservation. Therefore, this application is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. A method for complex threat intelligence analysis and logical reasoning based on intelligent agents, characterized in that, Includes the following steps: S1. For the user-input question, decompose the question based on a multi-strategy decomposition mechanism to obtain the decomposed sub-questions; S2. For the sub-problems obtained from step S1, an adaptive hybrid retrieval and information refinement method is used to obtain preliminary candidate documents; S3. Construct a hybrid reordering model based on spectral graph theory and determinant point process, including constructing a hybrid semantic weighted graph, adaptive spectral embedding and denoising, and greedy k-DPP selection based on spectral space. Reorder the candidate documents initially screened in step S2 to obtain the topological data of the reordered hybrid semantic weighted graph. S4. Based on the constructed global evidence graph, reason and generate the final answer using the topological data of the reordered hybrid semantic weighted graph obtained in step S3. The specific implementation method of step S3 includes the following steps: S3.

1. Construct a hybrid semantic weighted graph: First, the preliminary selection of candidate document blocks is... Consider the nodes of a graph, and compute any two nodes and Edge weights between The calculation formula is as follows: in, , Representing nodes respectively and The dense semantic vectors are extracted by a pre-trained Embedding model to capture deep semantics and implicit associations; , Representing nodes respectively and Sparse entity vectors are used to capture precise matches between keywords and entities; For balance coefficient, , used to adjust the weight ratio of semantic similarity and literal matching, where T is the transpose; To remove weak noise correlations and reduce subsequent computational complexity, a minimum edge weight threshold is set. When calculated season This achieves graph sparsification. S3.

2. Perform adaptive spectral embedding and noise reduction: After constructing the weighted adjacency matrix Then, the graph data is mapped to a low-dimensional spectral space to utilize the graph's topological structure for noise reduction; S3.2.

1. Constructing the Laplace matrix :calculate ,in For a degree matrix, its diagonal elements ; S3.2.

2. Perform eigenvalue decomposition: Decompose the Laplace matrix Perform eigenvalue decomposition , For eigenvalue scalars, Using eigenvectors, we obtain the sequence of eigenvalues. and its corresponding eigenvectors; S3.2.

3. Perform dynamic dimension selection: Determine the optimal embedding dimension using the Eigengap heuristic. Calculate the difference between adjacent feature values, and select the point with the largest difference as the cutoff point. ; S3.2.

4. Perform spectral mapping, selecting the first... Each document block has a feature vector. Mapped to Vectors in spectral space At this point, the semantic differences between documents are transformed into orthogonality in geometric space, resulting in the feature vector representation of the determinant point process; S3.

3. Greedy k-DPP selection based on spectral space: Select a subset of documents from the eigenvector representation of the determinant point process obtained in step S3.

2. ,in Let k be the number of target documents to be reordered, such that the kernel matrix corresponding to this subset is... Maximizing the determinant is expressed as: in, Representative of a subset of documents The volume of the polyhedron spanned by the median vector. The optimal subset of documents that maximizes the determinant. The complete set of candidate document vectors after spectral mapping. To find the variable operation that maximizes the objective function, a greedy algorithm is used to approximate the maximum a posteriori probability, resulting in a reordered subset of documents that retains the graph topology. The specific implementation method of step S4 includes the following steps: S4.

1. Topology Reuse and Edge Extraction: Based on the reordered document subset that retains the graph topology obtained in step S3, extract the corresponding submatrices from the weighted adjacency matrix. ; For any two nodes in the subset and The formula for determining the existence of an edge is: in, To represent nodes With nodes A binary indicator variable indicating whether there is a connecting edge between them; The two document blocks are strongly connected in both the vector space and entity association. S4.

2. Semantic relation generation: For all satisfying node pairs The data is input into an LLM for in-depth content analysis. Through a predefined set of relationship types, the model is constrained to identify within the following logical categories: support / validation, supplementation / extension, contrast / conflict, and causality / derivation. S4.

3. Generate a structured graph to obtain the output evidence graph. , where the set of nodes It consists of the reordered Top-K document fragments, and the edge set. Includes directed or undirected connections between nodes and their semantic attributes; S4.

4. The Agent infers and generates the final answer based on the output evidence graph.

2. The method for complex threat intelligence analysis and logical reasoning based on intelligent agents according to claim 1, characterized in that, The specific implementation method of step S1 includes the following steps: S1.

1. Construct the global proxy state This includes user queries Decomposition markers Topological types of problems and the generated sequence of subproblems ; S1.

2. Perform semantic complexity evaluation and intent mapping, and receive user queries. Then, the task decomposition module is called to define the decomposition function. The system extracts and classifies the structural features of queries using a large language model, and outputs decomposed decision tuples. ,in A decomposition flag indicating whether decomposition is required. Yes, Indicates no. ,in For serial decomposition, For parallel decomposition, No decomposition. For the generated sequence of subproblems, This is the nth subproblem; S1.

3. Based on state conditions, branch control is applied to the obtained decomposed function. A conditional edge mechanism is used to construct the dynamic control flow, and the control function is defined. If the topology type of the problem is determined to be You can directly enter the tool selection and search node and execute a single search generation process; If the topology type of the problem is determined to be Perform serial dependency chain decomposition, and based on the existence of causal or temporal dependencies between subproblems, construct a recursive execution environment, where the i-th subproblem... The input depends on all preceding subproblems output set , The output corresponding to the (i-1)th subproblem; define the placeholder replacement operation. For each subproblem in the sequence The actual query executed The calculation is as follows: in, To refer to the preceding number The actual reasoning result of the sub-problem The variable symbols, i.e., the placeholders in the system's dynamic parsing subproblem template, are replaced with the actual reasoning results from the preceding steps. ; If the topology type of the problem is determined to be If the elements in the subproblem set are independent of each other and do not constitute context constraints, the system maps the subproblem set to a set of orthogonal execution tasks, triggering execution units in parallel or iteratively.

3. The method for complex threat intelligence analysis and logical reasoning based on intelligent agents according to claim 2, characterized in that, The specific implementation method of step S2 includes the following steps: S2.

1. For the sub-problems obtained in step S1, the Agent calls the LLM to perform intent feature analysis for each specific sub-problem and dynamically selects the retrieval tool, which consists of different vector knowledge base retrieval methods; S2.

2. Perform intent-based differentiated retrieval: For descriptive sub-questions with ambiguous semantics and broad concepts, invoke semantic retrieval based on a vector database and recall relevant documents by calculating vector cosine similarity; For sub-questions containing proper nouns, specific code snippets, or specific model numbers, keyword retrieval based on inverted indexes is invoked to anchor key information through exact matching; S2.

3. Perform relevance cleaning on the original document blocks obtained by retrieval. Based on the preset relevance judgment prompt, drive the Agent to automatically remove noise segments that are irrelevant to the current sub-problem, and further extract the core semantic units in the document blocks, retaining only the text segments containing high-value information to obtain the preliminary candidate documents.

Images