A method, apparatus and equipment for security operation and maintenance based on multi-agent collaboration

Abstract

This invention provides a security operation and maintenance processing method, apparatus, and device based on multi-agent collaboration. It generates task parsing results by identifying the execution intent of security operation and maintenance requests and extracting entities. Based on these results, the security operation and maintenance task is decomposed into multiple sub-tasks with dependencies and assigned to corresponding agents. Reasoning models are selected based on the complexity scores of each sub-task to optimize resource allocation. Simultaneously, the execution results and intermediate analysis results of each agent's sub-tasks are uniformly managed through shared cognitive states. After candidate conclusions are generated through multi-agent collaborative reasoning, a conflict detection and resolution process is executed. This improves the efficiency of parallel processing of multi-step tasks while ensuring the consistency of the final output conclusion.

Description

Technical Field

[0001] This invention relates to the field of security operation and maintenance, and in particular to a security operation and maintenance processing method, apparatus and equipment based on multi-agent collaboration. Background Technology

[0002] Security operations and maintenance tasks are characterized by long chains, multiple steps, and strong dependencies. A complete security incident handling process typically involves multiple stages, including intent understanding, multi-source data collection, correlation analysis, root cause localization, and report generation. In existing technologies, security operations and maintenance systems based on large language models usually employ a single intelligent agent to execute these stages sequentially, meaning that the same model completes intent recognition, tool invocation, data analysis, and conclusion generation in turn.

[0003] However, this serial processing method has the following core problems: When security operation and maintenance tasks involve multiple heterogeneous data sources and the complexity of each analysis stage varies significantly, a single intelligent agent cannot simultaneously meet the differentiated needs of lightweight intent recognition and complex reasoning analysis in a unified context, resulting in low overall processing efficiency and unreasonable allocation of reasoning resources; at the same time, the intermediate results generated by each stage lack a unified state management mechanism. When different analysis paths produce contradictory conclusions, the system cannot effectively detect and resolve conflicts, affecting the consistency and reliability of the final output; in addition, the structural stability of the model output is insufficient, making it difficult to meet the parsing requirements of downstream business systems for fixed field formats.

[0004] In view of the above, this application is hereby submitted. Summary of the Invention

[0005] This invention discloses a security operation and maintenance processing method, device, and equipment based on multi-agent collaboration, which aims to solve the problems of low processing efficiency caused by the lack of task decomposition and differentiated model scheduling mechanism when a single agent processes security operation and maintenance tasks serially, and inconsistent multi-path analysis conclusions caused by the lack of shared state management and conflict resolution mechanism.

[0006] The first embodiment of the present invention provides a security operation and maintenance processing method based on multi-agent collaboration, including:

[0007] The system receives security operation and maintenance requests, performs intent recognition and entity extraction on the security operation and maintenance requests, and generates task parsing results. The task parsing results include task type, key entity set, and constraints. The security operation and maintenance requests include alarm requests generated by real-time system detection and natural language query requests input by the user through the front end.

[0008] Based on the task parsing results, the security operation and maintenance task is broken down into multiple security sub-tasks with dependencies. The security sub-tasks include alarm judgment sub-tasks, source tracing analysis sub-tasks, and handling strategy sub-tasks. A corresponding intelligent agent is assigned to each security sub-task, and the initial task state is written into the shared cognitive state.

[0009] For each subtask in the set of subtasks, a complexity score is calculated based on the task characteristics of the subtask, and a corresponding inference model is selected from the candidate model set according to the complexity score; the agent calls the inference model to execute the subtask and calls the security operation and maintenance tool to obtain security operation and maintenance data; the security operation and maintenance data is written into the evidence set, and the subtask execution result is written into the shared cognitive state;

[0010] Perform time alignment and correlation analysis on the multi-source security operation and maintenance data in the evidence set to generate intermediate analysis results; write the intermediate analysis results into the shared cognitive state;

[0011] Based on the intermediate analysis results in the shared cognitive state, multiple agents perform collaborative reasoning to generate a set of candidate conclusions; conflict detection is performed on the set of candidate conclusions, and when mutually exclusive conclusions are detected, a conflict resolution process is triggered to generate a consistent conclusion and output the security operation and maintenance analysis results.

[0012] Preferably, the dependency relationship is represented in the form of a directed acyclic graph, where the nodes of the directed acyclic graph correspond to the subtasks, and the edges correspond to the data dependencies between the subtasks.

[0013] Preferably, the task features include at least two of the following features: number of key entities, time window span, number of prediction tool calls, and inference type;

[0014] The complexity score is obtained by normalizing and weighting the task features.

[0015] Preferably, each inference model in the candidate model set has a corresponding capability profile, which includes structured output pass rate, average inference latency, and unit call cost; the step of selecting the corresponding inference model from the candidate model set based on the complexity score includes: assigning subtasks with complexity scores below a first threshold to low-capability models, and assigning subtasks with complexity scores above a second threshold to high-capability models.

[0016] Preferably, the invocation of the security operation and maintenance tool adopts a unified tool invocation protocol. The request of the unified tool invocation protocol includes a task identifier, a tool identifier, a parameter object, and a time window. The response of the unified tool invocation protocol includes an execution status, returned data, and an error object. When the execution status in the response of the security operation and maintenance tool indicates that the invocation has failed, a retry strategy or a degradation strategy is triggered according to the exception type of the error object.

[0017] Preferably, the shared cognitive state is stored in a key-value structure, including a task status version number, subtask progress, and a set of intermediate conclusions; the agent carries the current version number when writing the shared cognitive state, and performs concurrent writing based on version number verification.

[0018] Preferably, the correlation analysis includes: aligning security operation and maintenance data from different security operation and maintenance tools in the evidence set according to timestamps; performing cross-source correlation on the aligned security operation and maintenance data based on asset identifiers or event identifiers to generate a correlation evidence chain.

[0019] Preferably, the conflict detection includes: extracting the conclusion type and confidence level for each candidate conclusion in the candidate conclusion set; determining whether any two candidate conclusions are mutually exclusive based on a preset mutual exclusion rule base; and marking them as conflicting conclusions when mutual exclusion is detected and the confidence levels of both candidate conclusions are higher than a preset threshold.

[0020] The conflict resolution process includes: collecting additional verification data for the conflict conclusions and writing it into the evidence set; performing a weighted fusion calculation on the conflict conclusions based on the supplemented evidence set to obtain the comprehensive confidence level of each conflict conclusion; selecting the conclusion with the highest comprehensive confidence level as the consensus conclusion; and writing the conflict resolution record into the shared cognitive state.

[0021] The second embodiment of the present invention provides a security operation and maintenance processing device based on multi-agent collaboration, comprising:

[0022] An interaction unit is used to receive security operation and maintenance requests, perform intent recognition and entity extraction on the security operation and maintenance requests, and generate task parsing results. The task parsing results include task type, key entity set and constraints. The security operation and maintenance requests include alarm requests generated by real-time system detection and natural language query requests input by the user through the front end.

[0023] The dependency establishment unit is used to decompose the security operation and maintenance task into multiple security sub-tasks with dependencies based on the task parsing result. The security sub-tasks include alarm judgment sub-tasks, source tracing analysis sub-tasks and handling strategy sub-tasks. The unit also assigns a corresponding intelligent agent to each security sub-task and writes the initial task state into the shared cognitive state.

[0024] The agent selection unit is used to calculate a complexity score for each subtask in the subtask set based on the task characteristics of the subtask, select a corresponding inference model from the candidate model set according to the complexity score, have the agent call the inference model to execute the subtask, and call the security operation and maintenance tool to obtain security operation and maintenance data; write the security operation and maintenance data into the evidence set, and write the subtask execution result into the shared cognitive state.

[0025] The correlation analysis unit is used to perform time alignment and correlation analysis on the multi-source security operation and maintenance data in the evidence set, generate intermediate analysis results, and write the intermediate analysis results into the shared cognitive state.

[0026] The result output unit is used to generate a candidate conclusion set by multiple agents through collaborative reasoning based on the intermediate analysis results in the shared cognitive state; to perform conflict detection on the candidate conclusion set; to trigger a conflict resolution process when mutually exclusive conclusions are detected; to generate a consistent conclusion and output the security operation and maintenance analysis results.

[0027] The third embodiment of the present invention provides a security operation and maintenance processing device based on multi-agent collaboration, characterized in that it includes a memory and a processor, wherein the memory stores a computer program, and the computer program can be executed by the processor to implement a security operation and maintenance processing method based on multi-agent collaboration as described above.

[0028] Based on the security operation and maintenance processing method, apparatus, and equipment provided by this invention, the security operation and maintenance request execution intent recognition and entity extraction generate task parsing results. According to the task parsing results, the security operation and maintenance task is decomposed into multiple sub-tasks with dependencies and assigned to corresponding agents. The reasoning model is selected differently based on the complexity score of each sub-task to optimize resource allocation. At the same time, the execution results of sub-tasks and intermediate analysis results of each agent are uniformly managed by sharing cognitive state. After the candidate conclusions are generated by multi-agent collaborative reasoning, the conflict detection and resolution process is executed, thereby improving the efficiency of parallel processing of multi-step tasks while ensuring the consistency of the final output conclusion. Attached Figure Description

[0029] Figure 1 This is a flowchart illustrating a security operation and maintenance method based on multi-agent collaboration provided in the first embodiment of the present invention.

[0030] Figure 2 This is a schematic diagram of the overall system framework provided by the present invention;

[0031] Figure 3 This is a schematic diagram of a security operation and maintenance processing device based on multi-agent collaboration provided in the second embodiment of the present invention. Detailed Implementation

[0032] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0033] To better understand the technical solution of the present invention, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0034] This invention discloses a security operation and maintenance processing method, device, and equipment based on multi-agent collaboration, which aims to solve the problems of low processing efficiency caused by the lack of task decomposition and differentiated model scheduling mechanism when a single agent processes security operation and maintenance tasks serially, and inconsistent multi-path analysis conclusions caused by the lack of shared state management and conflict resolution mechanism.

[0035] Please see Figure 1 and Figure 2 The first embodiment of the present invention provides a security operation and maintenance processing method based on multi-agent collaboration, which can be executed by a security operation and maintenance processing device based on multi-agent collaboration (hereinafter referred to as processing device or system), specifically, by one or more processors within the processing device, to at least implement the following steps:

[0036] S101, Receive a security operation and maintenance request, perform intent recognition and entity extraction on the security operation and maintenance request, and generate a task parsing result; the task parsing result includes task type, key entity set and constraints.

[0037] In this embodiment of the invention, the user interaction module receives security operation and maintenance requests input by operation and maintenance personnel. These requests can be alarm descriptions, anomaly investigation instructions, or attack analysis requirements in natural language. The user interaction module encapsulates the received security operation and maintenance requests into standardized request objects, which include original text, session context, and user permission information. The request object is then passed to the task parsing and scheduling module. The task parsing and scheduling module performs intent recognition and entity extraction processing on the request object. Intent recognition determines the type of operation the operation and maintenance personnel expect to perform, such as alarm tracing, vulnerability investigation, attack chain analysis, or generation of handling suggestions. Entity extraction identifies key information elements related to the security operation and maintenance task from the original text. After the above processing, a task parsing result is generated, which includes at least three parts: task type, key entity set, and constraints. The task type represents the business scenario category corresponding to the current security operation and maintenance request. The key entity set contains core information elements extracted from the original text, such as IP address, domain name, process name, alarm number, asset identifier, user account, and attack feature identifier. Constraints are used to define the boundary scope and priority requirements of task execution. Specifically, they include at least one of the following: time window, target asset scope, and disposal priority. The time window specifies the start and end time interval for data querying and analysis; the target asset scope limits the set of hosts, network devices, or application systems to be included in the analysis; and the disposal priority characterizes the urgency of the current task so that the subsequent scheduling module can allocate computing resources and execution order accordingly. The task parsing result serves as the sole input for subsequent task decomposition and agent allocation, ensuring that the entire processing flow is based on a unified semantic understanding result.

[0038] In one possible implementation of this invention, the security operation and maintenance requests received by the system are divided into two types based on the initiation channel. The first type is alarm requests generated by real-time system detection. These requests are automatically generated by the security operation and maintenance system deployed in the customer's environment during continuous monitoring. They are proactively triggered when the system detects abnormal events or potential threats, such as abnormal spikes in host CPU usage, memory usage exceeding preset thresholds, abnormally prolonged response times of business sites, or a large number of access failures. The system automatically generates corresponding security operation and maintenance requests. The second type is natural language query requests input by users through the front end. These requests are proactively initiated by security operation and maintenance personnel based on actual operation and maintenance needs. They input query content in natural language form through the interactive interface provided by the system, such as "analyze the cause of CPU abnormalities on host 192.168.1.100 in the past 24 hours" or "investigate the root cause of response timeouts on business sites in the past week," etc.

[0039] S102, based on the task parsing results, the security operation and maintenance task is decomposed to generate a subtask set containing multiple subtasks, and the dependency relationship between the multiple subtasks is established; a corresponding intelligent agent is assigned to each subtask in the subtask set, and the initial task state is written in the shared cognitive state, wherein the security subtask set includes, but is not limited to, alarm judgment subtask, source tracing analysis subtask, and handling strategy subtask.

[0040] The system breaks down security operation and maintenance tasks based on the task parsing results, generates a set of subtasks containing multiple subtasks, establishes dependencies between multiple subtasks, assigns a corresponding intelligent agent to each subtask in the set of subtasks, and writes the initial task state into the shared cognitive state.

[0041] After receiving the task parsing results, the system breaks down the complete security operations and maintenance task into multiple sub-tasks according to the core security operations and maintenance process. A sub-task is the smallest executable unit bound to the core security operations and maintenance process. Each sub-task represents an event behavior with clear security semantics, distinct from massive amounts of raw log information. Extracting only a few or even hundreds of records from raw log data often fails to reveal complete attack characteristics, making it difficult for operations and maintenance personnel to draw effective conclusions based on this isolated data. Sub-tasks, on the other hand, are executable units with judgment value formed after aggregating and analyzing raw data, and their outputs can directly support security decisions. The outputs of sub-tasks include, but are not limited to, threat type tags, attack timestamps, qualitative information such as involved asset IPs, attack path information such as attack chain graphs, impact scope information such as a list of affected assets, and response decision information such as tiered handling judgments.

[0042] The subtask set includes, but is not limited to, alarm analysis, source tracing, and response strategy subtasks. The alarm analysis subtask verifies the authenticity and assesses the threat level of alarm events involved in security operations requests, determines whether an alarm represents a real threat and its severity, and outputs a threat type label and preliminary risk rating. The source tracing subtask reconstructs the attack path and locates the attack source of confirmed security threats. Based on the logical association of timing and behavioral data in the MITREATT&CK attack chain, it forms a traceable threat evidence chain and outputs an attack chain graph and a list of involved assets. The response strategy subtask generates targeted security response measures based on the source tracing analysis results, outputting a tiered response judgment and specific response recommendations.

[0043] The system establishes dependencies between multiple subtasks, represented by a directed acyclic graph (DAG). Nodes in the DAG correspond to subtasks, and edges represent data dependencies between them. These data dependencies stem from the input data associations required when different subtasks call pre-packaged interfaces within the toolkit. Taking a scenario where a customer's cloud server runs a business website as an example, the alarm analysis subtask needs to collect host hardware metrics to determine resource anomalies. The source tracing analysis subtask, based on the alarm analysis results, further correlates these metrics with multi-dimensional indicators such as website access trends, response code distribution, and request IP characteristics for a comprehensive judgment. The handling strategy subtask, on the other hand, needs to formulate response measures based on the attack chain graph and asset list output by the source tracing analysis. These subtasks form sequential data flow dependencies, with the output of a preceding subtask serving as the input for a subsequent subtask.

[0044] The system assigns a corresponding agent to each subtask in the subtask set to perform specific tasks. The alarm analysis subtask assigns an alarm analysis agent, which has the ability to identify alarm features and assess threats; the source tracing analysis subtask assigns a source tracing analysis agent, which has the ability to reconstruct attack chains and perform multi-source data correlation analysis; and the response strategy subtask assigns a response strategy agent, which has the ability to generate security policies and recommend response solutions. The system writes the initial task state of each subtask into the shared cognitive state, including the subtask identifier, the assigned agent, the current execution stage, and the list of dependent preceding subtasks, providing a foundation for subsequent agent collaborative execution and state synchronization.

[0045] It should be noted that the system achieves collaborative work among various intelligent agents through a cognitive state sharing mechanism. The core of cognitive state sharing lies in using a routing model pre-trained with industry data to uniformly identify the intent and resolve the state of security operation and maintenance requests. Based on the Qwen3Guard model, the system pre-trains it with security operation and maintenance industry data, enabling the model to possess a deep understanding of input content in the security domain, forming a routing model for task intent recognition. This routing model receives security operation and maintenance requests as input, performs semantic analysis and feature extraction on the request content, and generates cognitive state information that reflects the characteristics of attack events or abnormal events. Cognitive state information includes three core elements: state label, threat level, and event type. The state label identifies the current stage of the security event, such as detection, confirmation, and response stages; the threat level quantifies the severity of the security event, such as high-risk, medium-risk, and low-risk levels; and the event type describes the specific category of the security event, such as intrusion attack, abnormal access, resource abuse, and data leakage. Through the cognitive state information generated by the routing model, the system can accurately assess the nature and urgency of security events.

[0046] S103, for each subtask in the subtask set, calculate a complexity score based on the task characteristics of the subtask, select a corresponding inference model from the candidate model set according to the complexity score; the agent calls the inference model to execute the subtask, and calls the security operation and maintenance tool to obtain security operation and maintenance data; write the security operation and maintenance data into the evidence set, and write the subtask execution result into the shared cognitive state;

[0047] In this embodiment, the model capability management module calculates a complexity score for each subtask in the subtask set based on its task characteristics. Task characteristics include multiple dimensions such as the number of key entities, time window span, estimated tool call count, tool call dependency depth, number of required evidence types, inference type, and alarm risk level. The model capability management module normalizes these task characteristics and then performs a weighted calculation to obtain the complexity score for each subtask. The model capability management module maintains a candidate model set, where each inference model has a corresponding capability profile. This profile includes metrics such as structured output pass rate, average inference latency, and unit call cost, used to characterize the performance and resource consumption of each inference model in different task scenarios. The model capability management module selects the corresponding inference model from the candidate model set based on complexity scores. Specifically, subtasks with complexity scores below a first threshold are assigned to low-capability models. These subtasks are typically lightweight processing tasks such as intent confirmation and simple entity queries, and using low-capability models can reduce inference costs and shorten response latency. Subtasks with complexity scores above a second threshold are assigned to high-capability models. These subtasks typically involve complex inference scenarios such as multi-source evidence fusion, attack chain reasoning, and root cause analysis, requiring high-capability models to provide stronger semantic understanding and logical reasoning capabilities. Subtasks with complexity scores between the first and second thresholds are dynamically assigned an appropriate inference model based on the current system load and real-time requirements. Through this differentiated model scheduling strategy, the overall allocation of computing resources can be optimized while ensuring analysis quality.

[0048] The intelligent agent invokes the inference model selected by the model capability management module to execute the corresponding sub-task, and during execution, invokes security operation and maintenance tools to obtain security operation and maintenance data. The security operation and maintenance tool access module interfaces with heterogeneous external tools such as log systems, monitoring systems, security device interfaces, asset management platforms, and work order systems, providing a unified tool invocation protocol to shield against underlying interface differences. The unified tool invocation protocol request includes a task identifier, a tool identifier, a parameter object, and a time window. The task identifier associates the current invocation with the associated security operation and maintenance task; the tool identifier specifies the specific security operation and maintenance tool to be invoked; the parameter object encapsulates the query conditions and filtering parameters required by the tool; and the time window limits the start and end time range of the data query. The unified tool invocation protocol response includes execution status, returned data, and an error object. The execution status indicates whether the tool invocation was successful; the returned data contains the security operation and maintenance data output by the tool; and the error object carries the exception type and error description information when an exception occurs. When the execution status indication call fails in the response of the security operation and maintenance tool, the security operation and maintenance tool access module triggers the corresponding exception handling strategy according to the exception type of the error object. For recoverable exceptions such as network timeout and temporary service unavailability, a retry strategy is triggered, and the tool call is re-initiated within a preset number of retries. For unrecoverable exceptions such as insufficient permissions and incorrect parameters, or if the retries still fail, a degradation strategy is triggered, and an alternative tool is used to obtain approximate data or the data source is marked as unavailable and the subsequent process continues to be executed, so as to ensure that the overall task chain is not interrupted due to a single point of failure of the tool.

[0049] The agent writes security operation and maintenance data obtained by calling security operation and maintenance tools into an evidence set, which serves as the data foundation for subsequent correlation analysis and collaborative reasoning. Simultaneously, the agent writes the subtask execution results into a shared cognitive state, stored in a key-value structure, including fields such as task status version number, subtask progress, and intermediate conclusion set. The task status version number identifies the current version of the shared cognitive state, the subtask progress records the execution status and completion of each subtask, and the intermediate conclusion set stores the phased analysis conclusions generated by each agent during execution. When writing to the shared cognitive state, the agent carries the current version number. The shared cognitive state handles concurrent writes based on version number verification. When a write request is detected to have a version number inconsistent with the latest version number, the write request is rejected, and the latest state difference is returned, triggering the agent to synchronize its execution state and retry the write, thus avoiding state overwriting and data inconsistency issues caused by concurrent writes from multiple agents. Regarding the execution order of subtasks, subtasks with dependencies are executed in the order of dependencies represented by the directed acyclic graph. That is, only after the preceding subtask has been completed and its result has been written into the shared cognitive state can subsequent subtasks that depend on the result begin to be executed. Subtasks without dependencies are executed in parallel by the corresponding agents to make full use of the system's computing resources and shorten the overall task completion time.

[0050] S104, Perform time alignment and correlation analysis on the multi-source security operation and maintenance data in the evidence set to generate intermediate analysis results; Write the intermediate analysis results into the shared cognitive state;

[0051] In this embodiment, the data aggregation and correlation analysis module performs time alignment and correlation analysis on the multi-source security operation and maintenance data in the evidence set, generating intermediate analysis results. Since the security operation and maintenance data in the evidence set originates from multiple heterogeneous data sources such as log systems, monitoring systems, security devices, and asset management platforms, the time recording methods, time precision, and time zone settings of each data source may differ. Therefore, the data aggregation and correlation analysis module first aligns the security operation and maintenance data from different security operation and maintenance tools in the evidence set according to timestamps. Specifically, the data aggregation and correlation analysis module extracts the original timestamp field of each security operation and maintenance data, converts timestamps of different formats into a standard time format, and normalizes the timestamps to a unified time zone based on the time zone configuration information of each data source. This eliminates data misalignment caused by differences in time recording, ensuring that security events from different data sources but actually occurring within the same time period can be accurately correlated in the time dimension.

[0052] After time alignment, the data aggregation and correlation analysis module performs cross-source correlation on the aligned security operations data based on asset identifiers or event identifiers, generating a chain of related evidence. Asset identifiers include fields that uniquely identify network assets, such as IP address, hostname, device number, and application system identifier. Event identifiers include fields that can be associated with the same security event, such as alarm number, session identifier, process identifier, and request identifier. The data aggregation and correlation analysis module scans the aligned security operations data, extracts the asset identifiers and event identifiers contained therein, and aggregates and correlates data records with the same asset identifier or event identifier to establish the correlation between data records. For example, it can correlate multiple sources of data such as firewall alarms, intrusion detection alarms, host logs, and network traffic records generated by a certain IP address within a specific time window into a complete event view for that asset, or correlate multiple access logs with the same session identifier into a complete request chain. Through the aforementioned cross-source association processing, the data aggregation and association analysis module integrates fragmented security operation and maintenance data originally scattered across various data sources into a chain of associated evidence with temporal and entity relationships. This chain of evidence can fully present the occurrence process and scope of impact of security events, providing structured evidentiary support for subsequent collaborative reasoning by intelligent agents. The data aggregation and association analysis module writes the generated intermediate analysis results into a shared cognitive state for subsequent intelligent agents such as the association reasoning agent and the security analysis agent to read and use.

[0053] S105, based on the intermediate analysis results in the shared cognitive state, multiple agents perform collaborative reasoning to generate a candidate conclusion set; conflict detection is performed on the candidate conclusion set, and when mutually exclusive conclusions are detected, a conflict resolution process is triggered to generate a consistent conclusion and output the security operation and maintenance analysis results.

[0054] In this embodiment, multiple agents perform collaborative reasoning based on intermediate analysis results from a shared cognitive state to generate a candidate conclusion set. Specifically, the security analysis agent reads intermediate analysis results and related evidence chains from the shared cognitive state, performs analysis and reasoning on dimensions such as security threat type, attack method characteristics, and abnormal behavior patterns, and outputs candidate conclusions. The correlation reasoning agent also obtains intermediate analysis results from the shared cognitive state, performs reasoning on dimensions such as event causality, attack chain path, and root cause localization, and outputs candidate conclusions. In addition to textual descriptions, the candidate conclusions output by each agent also include structured metadata, which includes at least the conclusion type, confidence level, and a set of supporting evidence identifiers. The conclusion type represents the analysis dimension category to which the conclusion belongs, the confidence level represents the degree of the agent's assessment of the correctness of the conclusion, and the set of supporting evidence identifiers records the evidence data index on which the conclusion is based. The candidate conclusions output by multiple agents are aggregated to form a candidate conclusion set.

[0055] The intermediate result verification layer in the multi-agent collaboration module performs conflict detection on the candidate conclusion set. During conflict detection, the intermediate result verification layer extracts the conclusion type and confidence level for each candidate conclusion in the candidate conclusion set, and determines whether any two candidate conclusions are mutually exclusive based on a preset mutual exclusion rule base. The mutual exclusion rule base stores combinations of conclusion types with logically exclusive relationships in the security operations and maintenance domain. For example, classifying the same alarm event as a false alarm and classifying it as a real attack are mutually exclusive conclusions, as are classifying the same abnormal behavior as internal violations and external intrusion attacks. When the intermediate result verification layer detects that two candidate conclusions meet the mutual exclusion conditions in the mutual exclusion rule base, and the confidence levels of both candidate conclusions are higher than a preset threshold, it marks them as conflicting conclusions and triggers the conflict resolution process.

[0056] The conflict resolution process includes the following steps. First, the multi-agent collaboration module drives the data acquisition agent to supplement and verify the conflicting conclusions. The data acquisition agent determines the data types and data sources to be supplemented based on the type of the conflicting conclusion and the gaps in supporting evidence, and calls the corresponding security operation and maintenance tools to obtain the supplementary data and write it into the evidence set. Then, the intermediate result verification layer performs a weighted fusion calculation on the conflicting conclusions based on the supplemented evidence set. This calculation comprehensively considers the original confidence level of each conflicting conclusion, the degree of support of the supplementary evidence for each conclusion, and the reliability weight of the evidence source to obtain the overall confidence level of each conflicting conclusion. The intermediate result verification layer selects the conclusion with the highest overall confidence level as the consensus conclusion and writes the conflict resolution record into the shared cognitive state. This conflict resolution record includes the cause of the conflict, the identifier of the supplemented evidence, the fusion calculation process, and the final selection basis, for reuse in subsequent tasks and audit traceability.

[0057] The structured output control module performs structured integration and format validation on the consistency conclusions to generate security operation and maintenance analysis results. Format validation includes field existence validation, field type validation, and value range validation. Field existence validation confirms that the security operation and maintenance analysis results contain all required fields as specified in the preset output template. Field type validation confirms that the data types of each field conform to preset specifications. Value range validation confirms that the values ​​of numeric fields are within a reasonable range. When a field is detected as missing, the structured output control module triggers the corresponding agent to regenerate the missing field, ensuring that the final output security operation and maintenance analysis results are complete and meet the parsing requirements of downstream systems.

[0058] The domain knowledge and experience accumulation module stores key conclusions from security operation and maintenance analysis results in a domain knowledge base. This storage includes conclusion descriptions, summaries of related evidence, confidence levels, handling suggestions, and manual confirmation status. During subsequent security operation and maintenance tasks, the agent can retrieve historical conclusions relevant to the current task from the domain knowledge base. These historical conclusions serve as reference information to aid in the reasoning and analysis of the current task, thereby enabling the continuous accumulation and reuse of security operation and maintenance experience and improving the system's efficiency and accuracy in handling similar security incidents.

[0059] Please see Figure 3 The second embodiment of the present invention provides a security operation and maintenance processing device based on multi-agent collaboration, comprising:

[0060] The interaction unit 201 is used to receive security operation and maintenance requests, perform intent recognition and entity extraction on the security operation and maintenance requests, and generate task parsing results; the task parsing results include task type, key entity set and constraints, wherein the security operation and maintenance requests include alarm requests generated by real-time system detection and natural language query requests input by the user through the front end;

[0061] The dependency establishment unit 202 is used to decompose the security operation and maintenance task into multiple security sub-tasks with dependencies based on the task parsing result. The security sub-tasks include alarm judgment sub-tasks, source tracing analysis sub-tasks and handling strategy sub-tasks. The unit also assigns a corresponding intelligent agent to each security sub-task and writes the initial task state into the shared cognitive state.

[0062] The agent selection unit 203 is used to calculate a complexity score for each subtask in the subtask set based on the task characteristics of the subtask, select a corresponding inference model from the candidate model set according to the complexity score; have the agent call the inference model to execute the subtask, and call the security operation and maintenance tool to obtain security operation and maintenance data; write the security operation and maintenance data into the evidence set, and write the subtask execution result into the shared cognitive state;

[0063] The correlation analysis unit 204 is used to perform time alignment and correlation analysis on the multi-source security operation and maintenance data in the evidence set, generate intermediate analysis results, and write the intermediate analysis results into the shared cognitive state.

[0064] The result output unit 205 is used to generate a candidate conclusion set by multiple agents through collaborative reasoning based on the intermediate analysis results in the shared cognitive state; to perform conflict detection on the candidate conclusion set; to trigger a conflict resolution process when mutually exclusive conclusions are detected; to generate a consistent conclusion and output the security operation and maintenance analysis results.

[0065] The third embodiment of the present invention provides a security operation and maintenance processing device based on multi-agent collaboration, characterized in that it includes a memory and a processor, wherein the memory stores a computer program, and the computer program can be executed by the processor to implement a security operation and maintenance processing method based on multi-agent collaboration as described above.

[0066] Based on the security operation and maintenance processing method, apparatus, and equipment provided by this invention, the security operation and maintenance request execution intent recognition and entity extraction generate task parsing results. According to the task parsing results, the security operation and maintenance task is decomposed into multiple sub-tasks with dependencies and assigned to corresponding agents. The reasoning model is selected differently based on the complexity score of each sub-task to optimize resource allocation. At the same time, the execution results of sub-tasks and intermediate analysis results of each agent are uniformly managed by sharing cognitive state. After the candidate conclusions are generated by multi-agent collaborative reasoning, the conflict detection and resolution process is executed, thereby improving the efficiency of parallel processing of multi-step tasks while ensuring the consistency of the final output conclusion.

[0067] The fourth embodiment of the present invention provides a computer-readable storage medium storing a computer program, which can be executed by the processor of the device where the computer-readable storage medium is located, to implement a security operation and maintenance processing method based on multi-agent collaboration as described in any of the above embodiments.

[0068] Exemplary examples show that the computer program described in the third and fourth embodiments of the present invention can be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in implementing a multi-agent collaborative security operation and maintenance processing device. For example, the apparatus described in the second embodiment of the present invention.

[0069] The processor referred to can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. This processor is the control center of the aforementioned multi-agent collaborative security operation and maintenance processing method, connecting various parts of the method through various interfaces and lines.

[0070] The memory can be used to store the computer programs and / or modules. The processor, by running or executing the computer programs and / or modules stored in the memory and calling the data stored in the memory, implements various functions of a security operation and maintenance processing method based on multi-agent collaboration. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, text conversion function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, text message data, etc.). In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0071] If the implemented module is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0072] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0073] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A security operation and maintenance method based on multi-agent collaboration, characterized in that, include: Receive a security operation and maintenance request, perform intent recognition and entity extraction on the security operation and maintenance request, and generate task parsing results; The task parsing results include task type, key entity set and constraints, wherein the security operation and maintenance request includes alarm requests generated by real-time system detection and natural language query requests entered by the user through the front end; Based on the task parsing results, the security operation and maintenance task is broken down into multiple security sub-tasks with dependencies. The security sub-tasks include alarm judgment sub-tasks, source tracing analysis sub-tasks, and handling strategy sub-tasks. A corresponding intelligent agent is assigned to each security sub-task, and the initial task state is written into the shared cognitive state. For each subtask in the set of subtasks, a complexity score is calculated based on the task characteristics of the subtask, and a corresponding inference model is selected from the candidate model set according to the complexity score; the agent calls the inference model to execute the subtask and calls the security operation and maintenance tool to obtain security operation and maintenance data; the security operation and maintenance data is written into the evidence set, and the subtask execution result is written into the shared cognitive state; Perform time alignment and correlation analysis on the multi-source security operation and maintenance data in the evidence set to generate intermediate analysis results; write the intermediate analysis results into the shared cognitive state; Based on the intermediate analysis results in the shared cognitive state, multiple agents perform collaborative reasoning to generate a set of candidate conclusions; conflict detection is performed on the set of candidate conclusions, and when mutually exclusive conclusions are detected, a conflict resolution process is triggered to generate a consistent conclusion and output the security operation and maintenance analysis results. The conflict detection includes: extracting the conclusion type and confidence level of each candidate conclusion in the candidate conclusion set; determining whether any two candidate conclusions are mutually exclusive based on a preset mutual exclusion rule base; and marking a conflict conclusion when mutual exclusion is detected and the confidence levels of both candidate conclusions are higher than a preset threshold. The conflict resolution process includes: collecting additional verification data for the conflict conclusions and writing it into the evidence set; performing a weighted fusion calculation on the conflict conclusions based on the supplemented evidence set to obtain the comprehensive confidence level of each conflict conclusion; selecting the conclusion with the highest comprehensive confidence level as the consensus conclusion; and writing the conflict resolution record into the shared cognitive state.

2. The security operation and maintenance processing method based on multi-agent collaboration according to claim 1, characterized in that, The dependencies are represented in the form of a directed acyclic graph, where nodes correspond to subtasks and edges correspond to data dependencies between subtasks.

3. The security operation and maintenance method based on multi-agent collaboration according to claim 1, characterized in that, The task characteristics include the following features: At least two of the following: number of key entities, time window span, number of prediction tool calls, and inference type; The complexity score is obtained by normalizing and weighting the task features.

4. The security operation and maintenance method based on multi-agent collaboration according to claim 1, characterized in that, Each inference model in the candidate model set has a corresponding capability profile, which includes structured output pass rate, average inference latency, and unit call cost. The step of selecting the corresponding inference model from the candidate model set based on the complexity score includes: assigning subtasks with complexity scores below a first threshold to low-capacity models, and assigning subtasks with complexity scores above a second threshold to high-capacity models.

5. A security operation and maintenance processing method based on multi-agent collaboration according to claim 1, characterized in that, The security operation and maintenance tool is invoked using a unified tool invocation protocol. The request of the unified tool invocation protocol includes a task identifier, a tool identifier, a parameter object, and a time window. The response of the unified tool invocation protocol includes an execution status, returned data, and an error object. When the execution status in the response of the security operation and maintenance tool indicates that the invocation has failed, a retry strategy or a degradation strategy is triggered based on the exception type of the error object.

6. A security operation and maintenance method based on multi-agent collaboration according to claim 1, characterized in that, The shared cognitive state is stored in a key-value structure, including the task status version number, subtask progress, and intermediate conclusion set; when the agent writes the shared cognitive state, it carries the current version number and performs concurrent writing based on version number verification.

7. A security operation and maintenance processing method based on multi-agent collaboration according to claim 1, characterized in that, The correlation analysis includes: aligning security operation and maintenance data from different security operation and maintenance tools in the evidence set according to timestamps; performing cross-source correlation on the aligned security operation and maintenance data based on asset identifiers or event identifiers to generate a correlation evidence chain.

8. A security operation and maintenance processing device based on multi-agent collaboration, characterized in that, include: An interaction unit is used to receive security operation and maintenance requests, perform intent recognition and entity extraction on the security operation and maintenance requests, and generate task parsing results. The task parsing results include task type, key entity set and constraints, wherein the security operation and maintenance request includes alarm requests generated by real-time system detection and natural language query requests entered by the user through the front end; The dependency establishment unit is used to decompose the security operation and maintenance task into multiple security sub-tasks with dependencies based on the task parsing result. The security sub-tasks include alarm judgment sub-tasks, source tracing analysis sub-tasks and handling strategy sub-tasks. The unit also assigns a corresponding intelligent agent to each security sub-task and writes the initial task state into the shared cognitive state. The agent selection unit is used to calculate a complexity score for each subtask in the subtask set based on the task characteristics of the subtask, select a corresponding inference model from the candidate model set according to the complexity score, have the agent call the inference model to execute the subtask, and call the security operation and maintenance tool to obtain security operation and maintenance data; write the security operation and maintenance data into the evidence set, and write the subtask execution result into the shared cognitive state. The correlation analysis unit is used to perform time alignment and correlation analysis on the multi-source security operation and maintenance data in the evidence set, generate intermediate analysis results, and write the intermediate analysis results into the shared cognitive state. The result output unit is used to generate a candidate conclusion set by multiple intelligent agents through collaborative reasoning based on the intermediate analysis results in the shared cognitive state; to perform conflict detection on the candidate conclusion set; to trigger a conflict resolution process when mutually exclusive conclusions are detected; to generate a consistent conclusion and output the security operation and maintenance analysis results. The conflict detection includes: extracting the conclusion type and confidence level of each candidate conclusion in the candidate conclusion set; determining whether any two candidate conclusions are mutually exclusive based on a preset mutual exclusion rule base; and marking a conflict conclusion when mutual exclusion is detected and the confidence levels of both candidate conclusions are higher than a preset threshold. The conflict resolution process includes: collecting additional verification data for the conflict conclusions and writing it into the evidence set; performing a weighted fusion calculation on the conflict conclusions based on the supplemented evidence set to obtain the comprehensive confidence level of each conflict conclusion; selecting the conclusion with the highest comprehensive confidence level as the consensus conclusion; and writing the conflict resolution record into the shared cognitive state.

9. A security operation and maintenance processing device based on multi-agent collaboration, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program that can be executed by the processor to implement a security operation and maintenance processing method based on multi-agent collaboration as described in any one of claims 1 to 7.

Images