Threat management agent MDR Agent method and system based on Agent SecRAG knowledge enhancement engine

Abstract

The invention discloses a threat management agent MDR Agent method and system based on an Agent SecRAG knowledge enhancement engine, dynamic fusion of cross-equipment and long-period alarm is realized by introducing core mechanisms such as heterogeneous data fusion, semantic association analysis, continuous learning evolution and knowledge enhancement reasoning, model parameters are updated in real time through self-supervised learning, and the method and the system have the advantages that the method and the system are simple and convenient to operate, and the system and the method are easy to implement. Dependence on manual rules of experts is eliminated; based on a knowledge graph and a visualization technology, visual threat traceability and auxiliary decision support are provided. Compared with a traditional threat management platform, the automatic level and processing efficiency of safety operation are greatly improved, and a more efficient, more intelligent and lower-cost solution is provided for a large-scale enterprise-level safety protection system.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a threat management agent (MDR Agent) method and system based on the Agentic SecRAG (a security retrieval enhancement generation method with agent initiative) knowledge enhancement engine. Background Technology

[0002] In daily security operations, security teams frequently need to analyze, manage, and identify threats from logs and alerts generated by multiple heterogeneous security devices. These devices typically include firewalls, Web Application Firewalls (WAFs), Intrusion Detection / Prevention Systems (IDS / IPS), Endpoint Detection and Response Systems (EDR), Network Traffic Detection and Response Systems (NDR), and various other security products. Because these devices generate diverse data sources with varying standards and weak correlations, security operations personnel often need to invest significant time in manually filtering, merging, and analyzing massive amounts of logs and alerts. This not only leads to low operational efficiency and significant loss of useful information but also frequently results in conflicting log and alert content and frequent alert duplication, further increasing the complexity of threat identification and the false positive rate. Summary of the Invention

[0003] The purpose of this invention is to provide a threat management agent (MDR Agent) method and system based on the Agentic SecRAG knowledge enhancement engine, so as to solve at least some of the problems in the prior art.

[0004] To achieve the above objectives, one aspect of the present invention provides a threat management agent (MDR) method based on the Agentic SecRAG knowledge enhancement engine, comprising: Step 1: Receive logs and alarm data from multiple heterogeneous security devices, perform format unification processing and semantic feature extraction on the logs and alarm data to obtain vectors from different data sources, and map the vectors from different data sources to a shared semantic space through an attention mechanism and a gating fusion network to form a unified event vector. Step 2: Configure a dedicated AI agent for each type of data source. Each agent performs local inference based on its own data characteristics and shares the inference results. Step 3: Based on the current business scenario and historical alarm distribution, dynamically calculate the fusion weight of each data source, and then fuse the feature vectors of all relevant events at the current moment according to their weights after interacting through an attention mechanism to obtain a unified event vector. Step 4: For each new event vector generated, retrieve similar events of the new event vector in the shared semantic space and construct an event relationship graph; Step 5: Apply the community detection algorithm to the event relationship graph to obtain the attack chain, and generate aggregated events for the attack chain; Step 6: Extract the entities and relationships in the attack chain into triples, store them in the knowledge graph, and use graph neural network reasoning. If it is determined to be a real attack, generate a threat intelligence alert. Step 7: Update the training sample information using the new event vector information.

[0005] Preferably, step one, which involves standardizing the format of logs and alarm data and extracting semantic features, includes: Parse various logs to extract key fields such as timestamp, source / destination IP, port, protocol, and alarm type; Use a traffic parsing engine to extract session features from network traffic; Static and sandbox dynamic analysis are performed on file samples to extract hashes, file attributes, and behavioral features; Extract semantic vectors of alarm information from log text using a pre-trained language model; Autoencoders and graph neural networks are used to extract behavioral vectors from network traffic session features; Extract static and behavioral features from file samples and map them into vectors.

[0006] Preferably, step two includes: Configure a Log Intelligence Advisor (WAF) to identify alert types such as "SQL (Structured Query Language) injection" and "file upload". Configure the logging intelligence EDR to identify process behavior that involves "lateral movement"; Configure the Network Agent (NDR) to identify traffic patterns of "C2 communication" and "data leakage"; A configuration file intelligence agent is used to identify malicious files in uploaded files; Each agent publishes its local inference results and feature vectors via a message bus; the local inference results include entities, labels, and confidence levels.

[0007] Preferably, in step three, the fusion weight of each data source is dynamically calculated based on the current business scenario and historical alarm distribution, including: The fusion weight of each data source is determined based on the number of historical alarms, the historical false alarm rate, and the current event type. The current event type includes one or more of the following: WAF alarms, EDR alarms, NDR alarms, and file alarms.

[0008] Preferably, the construction of the event relationship diagram in step four includes: Retrieve similar historical event vectors to new event vectors in a shared semantic space; Candidate event vectors are obtained by filtering similar historical event vectors through a time window; If the similarity between a candidate event vector and a new event vector meets a threshold condition, an edge relationship is established between the candidate event vector and the new event vector, and the weight of the edge is determined based on the similarity and the time decay factor.

[0009] Preferably, step five includes: The event relationship graph is divided into communities using the Louvain algorithm. The communities include: firewall scan log nodes, WAF SQL injection alarm nodes, WAF webshell (script trojan) upload alarm nodes, EDR lateral movement alarm nodes, and NDR data outgoing alarm nodes. Multiple related nodes are determined based on the edge weights between nodes; The attack chain is determined by sorting the timestamps of multiple related nodes. Generate aggregate events for the attack chain, and set confidence levels and labels.

[0010] Another aspect of this invention provides a threat management agent (MDR) system based on the Agentic SecRAG knowledge enhancement engine, comprising: The data acquisition and processing unit is used to receive logs and alarm data from multiple heterogeneous security devices, perform format unification processing and semantic feature extraction on the logs and alarm data to obtain vectors from different data sources, and map the vectors from different data sources to a shared semantic space through an attention mechanism and a gating fusion network to form a unified event vector. AI agent unit, used to configure a dedicated AI agent for each type of data source. Each agent performs local reasoning based on its own data features and shares the reasoning results. The collaborative processing unit is used to dynamically calculate the fusion weight of each data source based on the current business scenario and historical alarm distribution. It then interacts with the feature vectors of all relevant events at the current moment through an attention mechanism and fuses them according to their weights to obtain a unified event vector. The graph construction unit is used to retrieve similar events to the new event vector in the shared semantic space and construct an event relationship graph for each new event vector generated. The attack chain processing unit is used to apply a community detection algorithm to the event relationship graph to obtain the attack chain and generate aggregated events for the attack chain. The knowledge graph unit is used to extract entities and relationships in the attack chain into triples, store them in the knowledge graph, and generate threat intelligence alerts if the attack is determined to be a real attack through graph neural network reasoning. Online training units are used to update training sample information using new event vector information.

[0011] Preferably, the collaborative processing unit is used for: The fusion weight of each data source is determined based on the number of historical alarms, the historical false alarm rate, and the current event type. The current event type includes one or more of the following: WAF alarms, EDR alarms, NDR alarms, and file alarms.

[0012] Preferably, the graph building unit is used for: Retrieve similar historical event vectors to new event vectors in a shared semantic space; Candidate event vectors are obtained by filtering similar historical event vectors through a time window; If the similarity between a candidate event vector and a new event vector meets a threshold condition, an edge relationship is established between the candidate event vector and the new event vector, and the weight of the edge is determined based on the similarity and the time decay factor.

[0013] Preferably, the attack chain processing unit is used for: The event relationship graph is divided into communities using the Louvain algorithm. The communities include: firewall scan log nodes, WAF SQL injection alarm nodes, WAF webshell upload alarm nodes, EDR lateral movement alarm nodes, and NDR data outgoing alarm nodes. Multiple related nodes are determined based on the edge weights between nodes; The attack chain is determined by sorting the timestamps of multiple related nodes. Generate aggregate events for the attack chain, and set confidence levels and labels.

[0014] Compared with the prior art, the present invention has at least the following beneficial effects: By introducing core mechanisms such as heterogeneous data fusion, semantic association analysis, continuous learning evolution, and knowledge-enhanced reasoning, dynamic fusion of cross-device, long-cycle alarms is achieved. Furthermore, self-supervised learning updates model parameters in real time, eliminating reliance on manually generated rules from experts. Simultaneously, leveraging knowledge graphs and visualization technologies, intuitive threat attribution and decision support are provided. Compared to traditional threat management platforms, this significantly improves the automation level and processing efficiency of security operations, offering a more efficient, intelligent, and cost-effective solution for large-scale enterprise-level security protection systems. Attached Figure Description

[0015] Figure 1 This is a flowchart illustrating a threat management agent (MDR Agent) method based on the Agentic SecRAG knowledge enhancement engine, as provided in Embodiment 1 of the present invention.

[0016] Figure 2This is a schematic diagram of the structure of a threat management agent (MDR Agent) system based on the Agentic SecRAG knowledge enhancement engine, as provided in Embodiment 2 of the present invention.

[0017] Figure 3 This is a flowchart illustrating a threat management agent (MDR Agent) method based on the Agentic SecRAG knowledge enhancement engine, as provided in Embodiment 3 of the present invention. Detailed Implementation

[0018] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0019] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be used interchangeably where appropriate to understand the embodiments of the invention described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a product or device comprising a series of units is not necessarily limited to those explicitly listed, but may include other units not explicitly listed or inherent to such product or device.

[0020] In this invention, the terms "upper," "lower," "left," "right," "front," "rear," "top," "bottom," "inner," "outer," "middle," "vertical," "horizontal," "lateral," and "longitudinal" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. These terms are primarily for the purpose of better describing the invention and its embodiments, and are not intended to limit the indicated devices, elements, or components to having a specific orientation, or to be constructed and operated in a specific orientation.

[0021] Furthermore, in addition to indicating direction or positional relationship, some of the aforementioned terms may also have other meanings. For example, the term "above" may also be used in certain situations to indicate a dependency or connection. Those skilled in the art can understand the specific meaning of these terms in this invention based on the specific circumstances.

[0022] Furthermore, the terms "installation," "setup," "equipped with," "connection," "linking," and "socketing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral structure; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium, or an internal connection between two devices, components, or parts. Those skilled in the art can understand the specific meaning of these terms in this invention based on the specific circumstances.

[0023] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0024] Example 1 This invention provides a threat management agent MDRAgent method based on the Agentic SecRAG knowledge enhancement engine. Figure 1 A flowchart illustrating this method is shown, as follows: Figure 1 As shown, the method includes the following steps.

[0025] Step 101: Receive logs and alarm data from multi-source heterogeneous security devices, perform format unification processing and semantic feature extraction on the logs and alarm data to obtain vectors from different data sources, and map the vectors from different data sources to a shared semantic space through an attention mechanism and a gating fusion network to form a unified event vector.

[0026] This includes standardizing the format of log and alarm data and extracting semantic features, which may include: Parse various logs to extract key fields such as timestamp, source / destination IP, port, protocol, and alarm type; Use a traffic parsing engine to extract session features from network traffic; Static and sandbox dynamic analysis are performed on file samples to extract hashes, file attributes, and behavioral features; Extract semantic vectors of alarm information from log text using a pre-trained language model; Autoencoders and graph neural networks are used to extract behavioral vectors from network traffic session features; Extract static and behavioral features from file samples and map them into vectors.

[0027] In one alternative implementation, this step may include the following key operations: data acquisition and data preprocessing and feature extraction from multi-source heterogeneous security devices.

[0028] Data acquisition from multi-source heterogeneous security devices may include: The system achieves seamless access to various security device data sources (firewalls, web application firewalls, intrusion detection / prevention systems, endpoint detection and response systems, network traffic detection and response systems, etc.) through a unified scheduling layer, and supports common transmission protocols such as Syslog, Kafka, HTTP / HTTPS, and SFTP. Automated adapters or plugins (Logstash and device-specific SDKs) are used to capture log streams and alarm events in real time. For security services in the cloud environment, data is retrieved through authenticated API calls. For network traffic data (PCAP) and file samples (malware, email attachments), raw data is collected through traffic mirroring or file upload interfaces to ensure data integrity and security.

[0029] Data preprocessing and feature extraction may include: Standardized formatting: Parse various log formats (JSON, Syslog, CEF, LEEF, etc.) to extract key fields such as timestamp, source / destination IP, port, protocol, and alarm type; use the traffic analysis engine (Tshark) to extract session features from network traffic (PCAP); and perform static analysis (extract hash and file attributes) and sandbox dynamic analysis (extract behavioral features) on file samples.

[0030] Cleaning and noise reduction: Remove invalid logs (debugging information, heartbeat packets) and duplicate logs; standardize and align timestamps; normalize IP addresses, domain names, etc. (e.g., remove ports, unify case).

[0031] Semantic feature extraction: Extract semantic vectors of alarm information from log text using a pre-trained language model; Autoencoders and graph neural networks are used to extract behavioral vectors from network traffic session features; Extract static features (PE structure, strings) and behavioral features (API call sequence) from file samples and map them into vectors; Semantic vectors are also extracted from external text such as threat intelligence and vulnerability descriptions.

[0032] Multi-source feature fusion: Vectors from different data sources are mapped to a shared semantic space through attention mechanisms and gating fusion networks to form a unified "event vector" that supports subsequent cross-source association.

[0033] In this step, the data sources can be summarized as: log sources, traffic sources, file sample sources, and threat intelligence sources.

[0034] When performing multi-source feature fusion, the multi-source features are first projected to the same dimension through linear transformation to obtain a feature vector of the same dimension. Then, a multi-head self-attention mechanism is introduced to combine the feature vectors of each source into a matrix, calculate the attention weights, and after concatenation, a linear transformation is performed to obtain an interactively enhanced feature matrix. Then, the importance of each source is dynamically adjusted through a learnable gating unit, and adaptive weighted summation is performed to finally fuse and obtain a unified event vector.

[0035] The resulting unified event vector dynamically compresses the information from all sources into a fixed-dimensional vector, thus achieving a shared semantic space. For example, the unified "event vector" can be a 4096-dimensional vector.

[0036] Step 102: Configure a dedicated AI agent for each type of data source. Each agent performs local reasoning based on its own data features and shares the reasoning results.

[0037] This step may include: Configure a Log Intelligence Advisor (WAF) to identify alert types such as "SQL Injection" and "File Upload". Configure the logging intelligence EDR to identify process behavior that involves "lateral movement"; Configure the Network Agent (NDR) to identify traffic patterns of "C2 communication" and "data leakage"; A configuration file intelligence agent is used to identify malicious files in uploaded files; Each agent publishes its local inference results and feature vectors via a message bus; the local inference results include entities, labels, and confidence levels.

[0038] In one implementation, this step may include: local agent configuration operation, local inference operation, and collaborative sharing operation. In other implementations, it may also include cross-source association operation.

[0039] The local agent configuration operation may include configuring a dedicated AI agent (Log Agent, Network Agent, File Agent, ThreatIntel Agent) for each type of data source (log stream, traffic metadata, file sample, threat intelligence).

[0040] Local inference includes: each agent performs preliminary analysis based on its own data characteristics, such as: Log Agent: identifying alarm type, attack stage (MITRE ATT&CK mapping), and extracting key entities (IP, domain name, hash); Network Agent: detecting abnormal traffic patterns (DDoS, C2 communication) and extracting session associations; File Agent: determining file malice and extracting family tags; Threat Intel Agent: matching known threat intelligence and marking relevant IOCs.

[0041] Collaborative sharing includes publishing local analysis results, feature vectors, and confidence scores to shared memory or distributed caches via a unified message bus (Kafka).

[0042] Cross-source association includes: using vector nearest neighbor search (FAISS) to match similar events in a shared semantic space, and combining graph algorithms (such as community detection, tag propagation, etc.) to discover multi-stage attack chains, thereby achieving intelligent aggregation of cross-device alarms.

[0043] Step 103: Based on the current business scenario and historical alarm distribution, dynamically calculate the fusion weight of each data source, and after the feature vectors of all relevant events at the current moment interact through an attention mechanism, fuse them according to their weights to obtain a unified event vector.

[0044] This includes dynamically calculating the fusion weights of each data source based on the current business scenario and historical alarm distribution, which may include: The fusion weight of each data source is determined based on the number of historical alarms, the historical false alarm rate, and the current event type. The current event type includes one or more of the following: WAF alarms, EDR alarms, NDR alarms, and file alarms.

[0045] In this step, based on the current business scenario (key assets and attack types) and historical alert distribution, the fusion weights of features from various data sources are adaptively calculated (through reinforcement learning or online optimization) to make the normalized vectors better reflect the current threat landscape. In one example, a reward function is introduced during the near-end policy optimization process, providing rewards based on event analysis. Positive rewards are given when an event is confirmed as a real attack, negative rewards are given when an event is a false alarm or a missed alarm is detected, and neutral rewards are given when an event is suspicious and requires further analysis. Every hour, Bayesian optimization is used to search for the optimal weight combination and adjust the weights. The current weight is then weighted and averaged with the previous weight in a 3:7 ratio to ensure a smooth transition and avoid drastic weight fluctuations.

[0046] Step 104: For each new event vector generated, retrieve similar events of the new event vector in the shared semantic space and construct an event relationship graph.

[0047] Constructing an event relationship diagram may include: Retrieve similar historical event vectors to new event vectors in a shared semantic space; Candidate event vectors are obtained by filtering similar historical event vectors through a time window; If the similarity between a candidate event vector and a new event vector meets a threshold condition, an edge relationship is established between the candidate event vector and the new event vector, and the weight of the edge is determined based on the similarity and the time decay factor.

[0048] In one implementation, when a new event arrives, only the new vector is searched for nearest neighbors to identify alarms that may be associated with existing events (e.g., by calling FAISS's search method to filter similar events with a similarity greater than a threshold), achieving real-time incremental fusion and avoiding full computation; and intelligent deduplication is performed. For example, an adaptive computation method is used to derive corresponding similarity thresholds based on different purposes. By setting multi-level similarity thresholds (precise deduplication, semantic approximation deduplication, attack chain aggregation), duplicate alarms and similar alarms are merged, while retaining the metadata of the original alarms for auditing.

[0049] Step 105: Apply the community detection algorithm to the event relationship graph to obtain the attack chain and generate aggregate events for the attack chain.

[0050] The event relationship graph is divided into communities using the Louvain algorithm. Communities include the following types of nodes: firewall scan log nodes, WAF SQL injection alarm nodes, WAF webshell upload alarm nodes, EDR lateral movement alarm nodes, and NDR data outgoing alarm nodes. Multiple related nodes are determined based on the edge weights between nodes; The attack chain is determined by sorting the timestamps of multiple related nodes. Generate aggregate events for the attack chain, and set confidence levels and labels.

[0051] In one implementation, graph algorithms (such as community detection and tag propagation) are combined to discover multi-stage attack chains, enabling intelligent aggregation of cross-device alerts.

[0052] For example, when a new event is detected, the FAISS search method is called to filter similar events with a similarity greater than a threshold. A dynamic event relationship graph is built based on the results, and incremental graph updates are used to optimize performance. New events that cannot be associated are added to the graph as isolated nodes, to be associated with subsequent events. Events are clustered into communities, and events within each community are sorted in ascending order by timestamp to obtain an event sequence. Communities containing only a few events are considered isolated alarms. Multiple attribution is retained for cases where the same event is shared by multiple communities. All events within each community are aggregated into a single security event, and structured information is output.

[0053] Step 106: Extract entities and relationships from the attack chain into triples, store them in the knowledge graph, and use graph neural network reasoning. If it is determined to be a real attack, generate a threat intelligence alert.

[0054] In one implementation, this step includes the following main operations: Triple extraction: Extract entities (IP, domain name, file hash, vulnerability number, etc.) and their relationships (attack, access, resolution, inclusion, etc.) from alerts, logs and threat intelligence to form (entity-relationship-entity) triples; Entity alignment and disambiguation: By using entity linking technology (BERT-based similarity matching), the same entity (internal network IP) from different devices is mapped to a unique identifier, eliminating redundant representations in heterogeneous data; Graph Reasoning and Threat Discovery: Triples are stored in a graph database (Neo4j), and graph neural networks (GraphSAGE) or rule engines are applied for reasoning to automatically discover hidden attack paths and abnormal relationships (such as unexpected port communication), generating threat clues. For example, events are clustered into communities, and events within each community are sorted in ascending order by timestamp to obtain an event sequence; communities containing only a few events are considered isolated alerts; multiple attribution is maintained for cases where the same event is shared by multiple communities; all events within each community are aggregated into a single security event, outputting structured information. Dynamic updates: As new data continues to flow in, the knowledge graph is updated incrementally, and historical changes are recorded through version control, supporting time-backtracking analysis.

[0055] Step 107: Update the training sample information using the new event vector information.

[0056] This step includes adaptive learning and continuous optimization, including active learning, online model fine-tuning, performance monitoring, and self-tuning. Active learning: For alarms or unknown threats with low confidence in model identification, the system automatically pushes them to security analysts for annotation, and feeds the annotation results back into the training set to continuously improve the model's accuracy; Online model fine-tuning: Utilizing streaming computing frameworks (Kafka Streams + TensorFlow Serving) to achieve online incremental training of models, enabling models to quickly adapt to new attack methods and changes in data distribution; for example, using Kafka Streams to build a real-time data processing pipeline, preprocessing and extracting features from incoming raw logs, and using TensorFlow IO's Kafka dataset interface to implement streaming data reading, continuously monitoring the data stream, and performing an incremental update every time a micro-batch arrives, updating one version per day; Performance monitoring and self-tuning: Real-time monitoring of KPIs such as alarm merging rate, false alarm rate, and processing latency; automatic parameter rollback or adjustment of similarity threshold when performance degrades to ensure the system is always in optimal working condition.

[0057] In this embodiment of the invention, a query and visualization interface may also be provided, including: Intelligent retrieval: Supports natural language query ("displays alerts for the database server in the past 24 hours"), entity retrieval (IP / domain / hash) and similar event retrieval (upload alert samples), and returns related events and knowledge graph paths; Threat graph query: Provides GraphQL or Cypher interface, supports path analysis, neighbor query, and attack chain tracing; Visual interaction: The interactive canvas displays the alarm-related networks, attack timeline, and deduplication decision logic, helping to quickly understand the overall threat picture and supporting drill-down to view the raw logs.

[0058] In this embodiment of the invention, by introducing core mechanisms such as heterogeneous data fusion, semantic association analysis, continuous learning evolution, and knowledge-enhanced reasoning, dynamic fusion of cross-device, long-cycle alarms is achieved. Furthermore, self-supervised learning updates model parameters in real time, eliminating reliance on manually generated rules from experts. Simultaneously, relying on knowledge graphs and visualization technologies, intuitive threat attribution and decision support are provided. Compared to traditional threat management platforms, this significantly improves the automation level and processing efficiency of security operations, offering a more efficient, intelligent, and cost-effective solution for large-scale enterprise-level security protection systems.

[0059] Example 2 Based on the same technical concept as Embodiment 1 above, this embodiment of the invention provides a threat management agent (MDR Agent) method based on the AgenticSecRAG knowledge enhancement engine, used to implement the methods described in Embodiment 1 and any of its embodiments. The specific implementation of each unit of this system can be referred to the corresponding description in Embodiment 1 above. Figure 2 A schematic diagram of the system structure is shown. For example... Figure 2 As shown, the system includes: The data acquisition and processing unit 21 is used to receive logs and alarm data from multi-source heterogeneous security devices, perform format unification processing and semantic feature extraction on the logs and alarm data to obtain vectors from different data sources, and map the vectors from different data sources to a shared semantic space through an attention mechanism and a gating fusion network to form a unified event vector. AI agent unit 22 is used to configure a dedicated AI agent for each type of data source. Each agent performs local reasoning based on its own data features and shares the reasoning results. The collaborative processing unit 23 is used to dynamically calculate the fusion weight of each data source based on the current business scenario and historical alarm distribution, and to fuse the feature vectors of all relevant events at the current moment according to the weight after the interaction of the attention mechanism. Graph construction unit 24 is used to retrieve similar events of the new event vector in the shared semantic space and construct an event relationship graph for each new event vector generated. Attack chain processing unit 25 is used to apply a community detection algorithm to the event relationship graph to obtain attack chains and generate aggregated events for the attack chains. Knowledge graph unit 26 is used to extract entities and relationships in the attack chain into triples, store them in the knowledge graph, and generate threat intelligence prompts if the attack is determined to be a real attack through graph neural network reasoning. Online training unit 27 is used to update training sample information using new event vector information.

[0060] In one embodiment, the data acquisition and processing unit 21 is used for: Parse various logs to extract key fields such as timestamp, source / destination IP, port, protocol, and alarm type; Use a traffic parsing engine to extract session features from network traffic; Static and sandbox dynamic analysis are performed on file samples to extract hashes, file attributes, and behavioral features; Extract semantic vectors of alarm information from log text using a pre-trained language model; Autoencoders and graph neural networks are used to extract behavioral vectors from network traffic session features; Extract static and behavioral features from file samples and map them into vectors.

[0061] In one implementation, the AI ​​agent unit 22 is used for: Configure a Log Intelligence Advisor (WAF) to identify alert types such as "SQL Injection" and "File Upload". Configure the logging intelligence EDR to identify process behavior that involves "lateral movement"; Configure the Network Agent (NDR) to identify traffic patterns of "C2 communication" and "data leakage"; A configuration file intelligence agent is used to identify malicious files in uploaded files; Each agent publishes its local inference results and feature vectors via a message bus; the local inference results include entities, labels, and confidence levels.

[0062] In one implementation, the collaborative processing unit 23 is used to: The fusion weight of each data source is determined based on the number of historical alarms, the historical false alarm rate, and the current event type. The current event type includes one or more of the following: WAF alarms, EDR alarms, NDR alarms, and file alarms.

[0063] In one implementation, graph construction unit 24 is used for: Retrieve similar historical event vectors to new event vectors in a shared semantic space; Candidate event vectors are obtained by filtering similar historical event vectors through a time window; If the similarity between a candidate event vector and a new event vector meets a threshold condition, an edge relationship is established between the candidate event vector and the new event vector, and the weight of the edge is determined based on the similarity and the time decay factor.

[0064] In one implementation, the attack chain processing unit 25 is used to: The event relationship graph is divided into communities using the Louvain algorithm. The communities include: firewall scan log nodes, WAF SQL injection alarm nodes, WAF webshell upload alarm nodes, EDR lateral movement alarm nodes, and NDR data outgoing alarm nodes. Multiple related nodes are determined based on the edge weights between nodes; The attack chain is determined by sorting the timestamps of multiple related nodes. Generate aggregate events for the attack chain, and set confidence levels and labels.

[0065] Example 3 Based on the same technical concept as Embodiment 1, this embodiment of the invention provides a threat management agent (MDR Agent) method based on the Agentic SecRAG knowledge enhancement engine, which can be applied to... Figure 2 The system shown. Figure 3 A flowchart illustrating this method is shown, as follows: Figure 3 As shown, the method includes the following steps.

[0066] Step 301: Multi-source heterogeneous data acquisition.

[0067] The system accesses data from various security devices in real time through a unified data collection layer: Firewall: Generates allow / block logs, recording the session where source IP 203.0.113.5 accesses target 192.168.1.100:80. WAF: Generates two alerts: ① SQL injection attempt, source IP 203.0.113.5, target URL / login.php; ② Suspicious file upload, uploaded file shell.php, target server 192.168.1.100. EDR: Detects an abnormal process cmd.exe starting on server 192.168.1.100, connecting to internal network IP 192.168.1.200:445, generating an alert for lateral movement (SMB). NDR: Detects a large amount of data being sent from 192.168.1.200 to external IP 198.51.100.10, generating an alert for data outflow (high traffic). All logs and alarms are transmitted in real time to the system's data acquisition unit via Syslog, Kafka, or API, and are marked with metadata such as timestamps, device types, and original content.

[0068] Step 302, data preprocessing and feature extraction.

[0069] The system performs the following operations on each piece of collected data: Format standardization: Parses the WAF alarm JSON, extracting fields such as time, source IP, target IP, alarm type, URL, and filename. Parses the EDR log (CEF format), extracting process name, parent process, connection IP, and port. Parses the NDR traffic metadata, extracting the quintuple, traffic size, and protocol. Cleaning and noise reduction: Filters the firewall's regular allowed logs (retaining only blocked or abnormal sessions). Standardizes the URLs in the WAF alarms (removing the influence of parameter order). Semantic feature extraction: WAF alarm text (e.g., "SQL injection attempt") is fed into a pre-trained model. EDR alarms (process behavior descriptions) are fed into a behavioral encoder. NDR alarms (traffic features) are fed into an autoencoder. If uploaded files are involved, static analysis is performed on the file samples (e.g., MalConv extracts PE features). Multi-source fusion preparation: Projects each vector to a unified dimension through a linear layer.

[0070] Step 303, AI agent collaborative analysis.

[0071] The system assigns a dedicated AI agent to each type of data source to perform local inference and share the results: Log Agent (WAF): identifies alarm types as "SQL injection" and "file upload" with a confidence level of 0.9; extracts entities: IP 203.0.113.5, file shell.php, and maps them to MITREATT&CK technology (T1190 - utilizing public applications).

[0072] Log Agent (EDR): Identified process behavior as "lateral movement," associated with MITRET1021 (remote service), confidence level 0.85; extracted entities: source 192.168.1.100, destination 192.168.1.200. Network Agent: Identified traffic patterns as "C2 communication" and "data leakage," associated with T1041 (application layer protocol communication), confidence level 0.8; extracted entity: external IP 198.51.100.10. FileAgent (if present): Analysis of the uploaded file shell.php indicates it is a malicious WebShell belonging to the ReGeorg family. Each agent publishes its local inference results (entities, labels, confidence levels) and feature vectors via the message bus (Kafka) for subsequent collaborative use.

[0073] Step 304, Adaptive heterogeneous data fusion.

[0074] The system dynamically calculates the fusion weights of each data source based on the current business scenario and historical alarm distribution: State characteristics: recent alarm counts for each source, false alarm rate (EDR false alarm rate is low, WAF false alarm rate is moderate), and current event type (initially determined to be a web attack). The reinforcement learning policy network takes these states as input and outputs the weights for each source: WAF: 0.5, EDR: 0.3, NDR: 0.1, File: 0.1 (Weight adaptive: WAF has the highest weight because the current event involves a web server; however, the EDR weight will automatically increase when a laterally moving alarm occurs). The feature vectors of all relevant events (WAF alarms, EDR alarms, NDR alarms) at the current moment are interacted through an attention mechanism and then fused according to their weights to obtain a unified event vector. Due to the chronological order, the system processes events at each moment separately and generates their respective event vectors.

[0075] Step 305: Vector nearest neighbor retrieval and event relationship graph construction.

[0076] For each new event vector generated, the system performs the following operations: Similar event retrieval: Using the FAISS index, retrieve the 20 most similar historical event vectors in the shared semantic space. The new WAF alarm vector has a similarity of 0.92 with other scan alarms from the same source IP 203.0.113.5 within the past hour, matching a known attack pattern. The new EDR alarm vector has a similarity of 0.75 with previous WAF alarm vectors (although the devices are different, they semantically belong to the same attack chain). Time window filtering: Only candidate events with timestamps within ±1 hour are retained. Construct an event relationship graph: Nodes: Current event and all candidate historical events. Edges: If similarity > threshold, an edge is created, with a weight of similarity × time decay factor (the more recent the time, the higher the weight).

[0077] Step 306: The graph algorithm discovers the attack chain.

[0078] The system applies a community discovery algorithm to the incrementally updated event relationship graph: using the Louvain algorithm to divide communities, it discovers a community containing 5 nodes, involving: firewall scan logs (deduplicated and merged), WAF SQL injection alerts, WAF webshell upload alerts, EDR lateral movement alerts, NDR data outflow alerts. The nodes within this community are closely connected, with an average edge weight of 0.85, indicating that these events are highly correlated. Sort by timestamp, the attack chain is as follows: t0: 203.0.113.5 Scans 192.168.1.100:80 t1: 203.0.113.5 SQL injection attempt → Upload shell.php t2: 192.168.1.100 Connects to 192.168.1.200 via SMB t3: 192.168.1.200 Sends a large amount of data to 198.51.100.10 The system generates aggregate events for this attack chain with a confidence score of 0.92, and labels the MITRE ATT&CK stages as: Initial Access (T1190), Execution (T1059), Lateral Movement (T1021), and Exposure (T1041).

[0079] Step 307, Construction and reasoning of the security knowledge graph.

[0080] The system extracts entities and relationships from the attack chain into triples and stores them in the knowledge graph: Entities: 203.0.113.5 (external IP), 192.168.1.100 (web server), shell.php (malicious file), 192.168.1.200 (internal network host), 198.51.100.10 (C2 server).

[0081] Relationship: 203.0.113.5 → [Attack] → 192.168.1.100; 192.168.1.100 → [Upload] → shell.php; 192.168.1.100 → [Lateral Movement] → 192.168.1.200; 192.168.1.200 → [External Connection] → 198.51.100.10.

[0082] Through graph neural network reasoning, it was found that the attack pattern was highly consistent with the TTPs of the known APT group "Dark Force", generating threat intelligence alerts.

[0083] Step 308, Adaptive Learning and Continuous Optimization.

[0084] Online Training: The attack chain described above was confirmed as a real attack. The system used relevant alerts and their aggregation results as positive samples, feeding them into the online training module via Kafka stream. TensorFlow IO was used to consume samples from Kafka, incrementally fine-tuning the feature extraction model to make it more sensitive to this type of attack pattern. Simultaneously, the reinforcement learning module received a positive reward for this successful detection, updating the policy network. In future similar scenarios, the EDR weights will be automatically increased. Performance Monitoring: The system detected a 2.3-second latency for this attack chain discovery (from the arrival of the last alert to the completion of aggregation), a 98% deduplication rate, and a 0% false positive rate, all meeting the performance metrics. Model Hot Update: The newly trained model version was saved to the model directory and automatically loaded by TensorFlowServing. Subsequent inference requests will use the updated model without requiring a service restart.

[0085] Example 4 Based on the same technical concept as Embodiment 1 above, this embodiment of the invention provides a threat management agent (MDR Agent) method based on the AgenticSecRAG knowledge enhancement engine, used to implement the method described in Embodiment 1 above and any of its implementations. The specific implementation of each unit of the system can refer to the corresponding description in Embodiment 1 above. The system includes a data acquisition unit, a data preprocessing unit, a multimodal feature engine unit, an AI agent cluster unit, an adaptive normalization and deduplication unit, a security knowledge graph management unit, a model management and online learning unit, and may also include a user interaction and view layer, and a security and logging unit.

[0086] 1) The data acquisition unit may include: Device access module: includes Syslog server, Kafka consumer, HTTP / HTTPS receiver, supports common security device log formats; File acquisition module: Supports PCAP file upload and sandbox sample submission interfaces; API collection module: Connects to the REST API of cloud security services and threat intelligence platforms to achieve scheduled or real-time data retrieval; Adapter Plugin Framework: Allows for the extension of parsing plugins for new device types.

[0087] 2) The data preprocessing unit may include: Parsing and standardization module: integrates log parser library (Grok rules, regular expressions), traffic parsing engine (Tshark), and file analysis engine (static analysis tool, sandbox); The cleaning module implements timestamp alignment, field filtering, and duplicate detection. Feature extraction module: Loads pre-trained models to generate vectors.

[0088] 3) The multimodal feature engine unit may include: Dedicated encoder modules include: text encoder (LogBERT), traffic encoder (NetFlowAutoencoder), file encoder (MalConv), and threat intelligence encoder; Joint projection layer module: Using a multimodal Transformer and attention fusion network, the outputs of each encoder are mapped to a unified semantic space.

[0089] 4) An AI agent cluster may include: Local agent pool module: Each agent corresponds to a type of data source and encapsulates a dedicated model (such as Log Agent containing ATT&CK classifier and entity recognition model). Collaborative communication bus module: Enables asynchronous communication and data sharing between agents based on message queues (Kafka); Collaborative reasoning engine module: Implements cross-source association based on the vector retrieval library (FAISS) and graph algorithm library (NetworkX, PyG).

[0090] 5) The adaptive normalization and deduplication unit may include: Distribution awareness module: Real-time statistics on the distribution of various alarm types and vector similarity distribution, and calculation of dynamic weights; Similarity retrieval layer module: integrates FAISS index, supports high-speed nearest neighbor query; Deduplication decision engine module: Performs alarm merging and conflict resolution based on preset strategies (such as thresholds and business rules).

[0091] 6) A security knowledge graph management system may include: Triple Extractor Module: Extracts entity relationships from logs and threat intelligence based on OpenIE or custom rules; Entity Aligner Module: Uses a BERT-based entity linking model; Graph database module: Neo4j stores graphs; Inference Engine Module: Integrates GNN model (GraphSAGE) and rule engine (Drools) to perform threat path mining and contradiction detection.

[0092] 7) The model management and online learning unit may include: Training data pool module: stores manually labeled samples and automatically collected difficult examples; Online training framework module: based on TensorFlow Serving, supporting streaming incremental updates; Monitoring and tuning module: Tracks KPIs in real time and triggers automatic parameter tuning or model rollback.

[0093] 8) User interaction and view layer units may include: Visual dashboard module: Based on ECharts, it displays alarm trends, correlation graphs, and deduplication effects; Query interface module: Provides natural language query (integrated with Elasticsearch) and GraphQL API; Feedback collection interface module: Allows analysts to annotate and correct model results.

[0094] 9) The security and logging unit may include: Access control module: RBAC-based permission verification ensures data security; Operation audit module: Records all queries, annotations, and configuration changes to meet compliance requirements.

[0095] The hardware and network facilities in this embodiment of the invention may include: Computing cluster: Composed of CPU+GPU servers, supporting distributed training and inference; Storage system: Distributed file system (HDFS) or object storage (Ceph) stores raw logs, feature vectors, and graph data; Backup and recovery module: regular snapshots and off-site disaster recovery.

[0096] In this embodiment of the invention, by introducing core mechanisms such as heterogeneous data fusion, semantic association analysis, continuous learning evolution, and knowledge-enhanced reasoning, dynamic fusion of cross-device, long-cycle alarms is achieved. Furthermore, self-supervised learning updates model parameters in real time, eliminating reliance on manually generated rules from experts. Simultaneously, relying on knowledge graphs and visualization technologies, intuitive threat attribution and decision support are provided. Compared to traditional threat management platforms, this significantly improves the automation level and processing efficiency of security operations, offering a more efficient, intelligent, and cost-effective solution for large-scale enterprise-level security protection systems.

[0097] In the embodiments of the present invention: 1. Adaptive Heterogeneous Data Normalization and Fusion Layer For logs, alarms and traffic data generated by multi-source heterogeneous security devices such as firewalls, web application firewalls, intrusion detection / prevention systems, endpoint detection and response systems, and network traffic detection and response systems, the system dynamically calculates the normalization coefficient based on the current data distribution and statistical characteristics, and uniformly maps data of different formats and semantic granularities to a shared vector space. By using adaptive normalization, semantic biases caused by differences in device type, log format, and collection protocol are eliminated, significantly improving the accuracy of cross-source alarm similarity calculation and laying the foundation for subsequent correlation analysis.

[0098] 2. Real-time semantic association analysis and dynamic intelligent deduplication engine A pre-trained language model and a dedicated encoder are used to extract multimodal semantic embeddings of logs, alarms, and file behaviors, and an event relationship graph based on time windows and attack chains is constructed. By leveraging graph neural networks (GNNs) and dynamic threshold pruning algorithms, it can identify semantically similar alarms, conflicting alarms, and duplicate alarms in real time. It can achieve intelligent aggregation and deduplication across devices and over long periods at the layer level, significantly reducing alarm storms and supporting online processing of massive event streams.

[0099] 3. Adaptive Log Parsing and Processing Driver Framework The parsing engine automatically selects the optimal parsing strategy (such as Grok template matching, regular expressions, and deep learning models) based on device type, log format, and business scenario, and dynamically switches the strategy when a new device is connected or the attack mode changes, without the need for manual writing or updating of parsing rules. With its built-in policy operator library, the system supports dynamic allocation of computing resources and adjustment of analysis priorities based on asset importance and threat level, thereby improving overall processing throughput and response time to critical alarms.

[0100] 4. Threat knowledge base update module with self-learning and continuous optimization Combining active learning and online reinforcement learning frameworks, the system automatically collects analyst feedback after alarm merging, threat assessment, and knowledge graph increment, and updates model parameters, deduplication thresholds, and association rules in real time. A closed-loop learning system is constructed to achieve continuous adaptive optimization of core parameters such as semantic matching rules, attack chain identification logic, and knowledge graph reasoning weights, significantly reducing the maintenance cost of expert rules and enabling the system to quickly adapt to new threats.

[0101] 5. Visualized threat maps and smooth policy delivery It provides a dynamic visualization interface based on security knowledge graphs, which intuitively displays the alarm correlation network, attack chain path and conflict alarm distribution, and supports analysts to quickly locate key threats and perform manual verification and correction. The rules and policies adopt a plug-in design, allowing operations and maintenance personnel to dynamically configure merging thresholds, conflict handling strategies, and alarm priority mappings through a graphical interface. The system loads and takes effect in real time, achieving zero-interruption policy optimization and smooth delivery.

[0102] Through the above aspects, an adaptive, real-time, and sustainable intelligent multi-source heterogeneous security threat management system is formed, which significantly improves the accuracy of alarm merging, the speed of threat identification and the level of automated operation, and greatly reduces the manual burden of the security operation and maintenance team.

[0103] The solution provided in this embodiment of the invention has the following effects: Effect (1) Through the adaptive normalization mechanism, the deep integration and collaborative analysis of logs and alarm data from multiple heterogeneous security devices (firewalls, web application firewalls, intrusion detection / prevention systems, endpoint detection and response systems, network traffic detection and response systems, etc.) are realized, breaking through the limitations of traditional reliance on a single data source or simple rule association, and improving the comprehensiveness of cross-device threat perception. Effect (2) The Agentic SecRAG knowledge enhancement engine with autonomous learning and reasoning capabilities is embedded in the threat management agent to automatically identify and summarize the semantic association and attack chain logic between logs of different devices, improve the accuracy of alarm association, and significantly reduce the workload of manual conflict judgment and mismerging. Effect (3) By adopting real-time semantic association analysis and dynamic deduplication technology, the instant alarm aggregation of massive log streams and the intelligent resolution of duplicate / conflicting alarms are realized, thereby improving the speed of threat identification and handling and data integrity. Effect (4) Through adaptive rule generation and online learning mechanism, log parsing, feature extraction and alarm priority strategy are automatically generated and dynamically updated, reducing the dependence on security experts to continuously and manually maintain rules, and significantly reducing the cost of manual configuration and rule tuning; Effect (5) Supports dynamic model optimization and adaptive policy adjustment, enabling the system to quickly learn and maintain high-precision threat identification and data fusion performance when business scenarios (such as industry environment and attack mode) change frequently and new types of devices are connected; Effect (6) Reduces the workload of manual alarm filtering, merging, verification and preliminary judgment, fully realizes the automation and intelligence of multi-source log processing and threat identification process, and improves the overall work efficiency and emergency response capability of the security operation and maintenance team; Effect (7) By integrating multi-dimensional log information and advanced retrieval logic, a dynamically evolving security knowledge graph is constructed, providing rich, accurate, and structured security knowledge assets for subsequent attack tracing, threat hunting, compliance auditing, and decision support, thereby strengthening the organization's overall security defense capabilities.

[0104] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Those skilled in the art should understand that modifications can be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A threat management agent (MDR) method based on the Agentic SecRAG knowledge enhancement engine, characterized in that, include: Step 1: Receive logs and alarm data from multiple heterogeneous security devices, perform format unification processing and semantic feature extraction on the logs and alarm data to obtain vectors from different data sources, and map the vectors from different data sources to a shared semantic space through an attention mechanism and a gating fusion network to form a unified event vector. Step 2: Configure a dedicated AI agent for each type of data source. Each agent performs local inference based on its own data characteristics and shares the inference results. Step 3: Based on the current business scenario and historical alarm distribution, dynamically calculate the fusion weight of each data source, and then fuse the feature vectors of all relevant events at the current moment according to their weights after interacting through an attention mechanism to obtain a unified event vector. Step 4: For each new event vector generated, retrieve similar events of the new event vector in the shared semantic space and construct an event relationship graph; Step 5: Apply the community detection algorithm to the event relationship graph to obtain the attack chain, and generate aggregated events for the attack chain; Step 6: Extract the entities and relationships in the attack chain into triples, store them in the knowledge graph, and use graph neural network reasoning. If it is determined to be a real attack, generate a threat intelligence alert. Step 7: Update the training sample information using the new event vector information.

2. The threat management agent MDRAgent method based on the Agentic SecRAG knowledge enhancement engine according to claim 1, characterized in that, Step one involves standardizing the format of log and alarm data and extracting semantic features, including: Parse various logs to extract key fields such as timestamp, source / destination IP, port, protocol, and alarm type; Use a traffic parsing engine to extract session features from network traffic; Static and sandbox dynamic analysis are performed on file samples to extract hashes, file attributes, and behavioral features; Extract semantic vectors of alarm information from log text using a pre-trained language model; Autoencoders and graph neural networks are used to extract behavioral vectors from network traffic session features; Extract static and behavioral features from file samples and map them into vectors.

3. The threat management agent MDRAgent method based on the Agentic SecRAG knowledge enhancement engine according to claim 1, characterized in that, Step two includes: Configure a Log Intelligence Advisor (WAF) to identify alert types such as "SQL Injection" and "File Upload". Configure the logging intelligence EDR to identify process behavior that involves "lateral movement"; Configure the Network Agent (NDR) to identify traffic patterns of "C2 communication" and "data leakage"; A configuration file intelligence agent is used to identify malicious files in uploaded files; Each agent publishes its local inference results and feature vectors via a message bus; the local inference results include entities, labels, and confidence levels.

4. The threat management agent MDRAgent method based on the Agentic SecRAG knowledge enhancement engine according to claim 1 or 3, characterized in that, Step three involves dynamically calculating the fusion weights of each data source based on the current business scenario and historical alarm distribution, including: The fusion weight of each data source is determined based on the number of historical alarms, the historical false alarm rate, and the current event type. The current event type includes one or more of the following: WAF alarms, EDR alarms, NDR alarms, and file alarms.

5. The threat management agent MDRAgent method based on the Agentic SecRAG knowledge enhancement engine according to claim 4, characterized in that, Step four, constructing the event relationship diagram, includes: Retrieve similar historical event vectors to new event vectors in a shared semantic space; Candidate event vectors are obtained by filtering similar historical event vectors through a time window; If the similarity between a candidate event vector and a new event vector meets a threshold condition, an edge relationship is established between the candidate event vector and the new event vector, and the weight of the edge is determined based on the similarity and the time decay factor.

6. The threat management agent MDRAgent method based on the Agentic SecRAG knowledge enhancement engine according to claim 5, characterized in that, Step five includes: The event relationship graph is divided into communities using the Louvain algorithm; communities include the following types of nodes: firewall scan log nodes, WAF SQL injection alarm nodes, WAF webshell upload alarm nodes, EDR lateral movement alarm nodes, and NDR data outgoing alarm nodes; Multiple related nodes are determined based on the edge weights between nodes; The attack chain is determined by sorting the timestamps of multiple related nodes. Generate aggregate events for the attack chain, and set confidence levels and labels.

7. A threat management agent (MDR) system based on the Agentic SecRAG knowledge enhancement engine, characterized in that, include: The data acquisition and processing unit is used to receive logs and alarm data from multiple heterogeneous security devices, perform format unification processing and semantic feature extraction on the logs and alarm data to obtain vectors from different data sources, and map the vectors from different data sources to a shared semantic space through an attention mechanism and a gating fusion network to form a unified event vector. AI agent unit, used to configure a dedicated AI agent for each type of data source. Each agent performs local reasoning based on its own data features and shares the reasoning results. The collaborative processing unit is used to dynamically calculate the fusion weight of each data source based on the current business scenario and historical alarm distribution. It then interacts with the feature vectors of all relevant events at the current moment through an attention mechanism and fuses them according to their weights to obtain a unified event vector. The graph construction unit is used to retrieve similar events to the new event vector in the shared semantic space and construct an event relationship graph for each new event vector generated. The attack chain processing unit is used to apply a community detection algorithm to the event relationship graph to obtain the attack chain and generate aggregated events for the attack chain. The knowledge graph unit is used to extract entities and relationships in the attack chain into triples, store them in the knowledge graph, and generate threat intelligence alerts if the attack is determined to be a real attack through graph neural network reasoning. Online training units are used to update training sample information using new event vector information.

8. The threat management agent MDRAgent system based on the Agentic SecRAG knowledge enhancement engine according to claim 7, characterized in that, The collaborative processing unit is used for: The fusion weight of each data source is determined based on the number of historical alarms, the historical false alarm rate, and the current event type. The current event type includes one or more of the following: WAF alarms, EDR alarms, NDR alarms, and file alarms.

9. The threat management agent MDRAgent system based on the Agentic SecRAG knowledge enhancement engine according to claim 8, characterized in that, Graph building units are used for: Retrieve similar historical event vectors to new event vectors in a shared semantic space; Candidate event vectors are obtained by filtering similar historical event vectors through a time window; If the similarity between a candidate event vector and a new event vector meets a threshold condition, an edge relationship is established between the candidate event vector and the new event vector, and the weight of the edge is determined based on the similarity and the time decay factor.

10. The threat management agent MDRAgent system based on the Agentic SecRAG knowledge enhancement engine according to claim 9, characterized in that, The attack chain processing unit is used for: The event relationship graph is divided into communities using the Louvain algorithm. The communities include: firewall scan log nodes, WAF SQL injection alarm nodes, WAF webshell upload alarm nodes, EDR lateral movement alarm nodes, and NDR data outgoing alarm nodes. Multiple related nodes are determined based on the edge weights between nodes; The attack chain is determined by sorting the timestamps of multiple related nodes. Generate aggregate events for the attack chain, and set confidence levels and labels.

Images