Intelligent agent behavior description method based on knowledge graph

Abstract

The invention relates to the technical field of knowledge graph construction, and discloses a knowledge graph-based agent behavior description method, which comprises the following steps of: firstly, analyzing an unstructured agent operation log data stream through a processor, and mapping the unstructured agent operation log data stream into a discretized module access sequence by utilizing a topological structure of a code knowledge graph so as to remove text redundancy; performing multi-dimensional time sequence analysis on the sequence, and calculating resident distribution data representing operation continuity, frequency domain fluctuation data representing switching rhythm and multi-scale coverage extension data representing a traversal range; and then aggregating the data into a fixed-length multi-dimensional index vector, constructing an index node associated with a session entity in a graph database, and writing the vector as a binary structured attribute into a storage field. According to the method, massive unstructured logs are converted into compact graph structured indexes, and quick positioning and direct retrieval of a complex agent operation mode are supported while the storage space is remarkably saved.

Description

Technical Field

[0001] This invention relates to the field of knowledge graph construction technology, and more specifically, to a method for describing agent behavior based on knowledge graphs. Background Technology

[0002] With the widespread application of large language model-driven agents in software engineering, the operation log data generated by code editing agents is exploding. This data meticulously records the entire process of the agent's reasoning, tool calls, and code modifications within the code repository, typically stored as unstructured natural language text streams. To monitor the agent's operational status, audit its job security, or evaluate its task completion quality, existing techniques primarily rely on keyword matching, rule-based regular expression extraction, or simple text similarity calculations of the raw logs, attempting to reconstruct the agent's operational path and perform basic statistical analysis.

[0003] However, existing log analysis methods struggle to effectively capture the complex dynamics and deep statistical properties underlying agent behavior. For example, high-level agents, when handling complex programming tasks, often exhibit non-uniform dwell patterns (manifested as heavy-tailed distributions) alternating between long-term deep reasoning and short-term rapid search in specific key modules, or demonstrate long-range correlated policy switching rhythms (manifested as specific frequency domain noise spectra) across different functional modules, as well as multi-scale fractal coverage of the code topology space. Traditional linear statistical methods or simple frequency aggregation techniques cannot identify these non-linear spatiotemporal mechanisms, leading to the neglect of a large amount of crucial information embedded in temporal fluctuations. This prevents the system from distinguishing between random, ineffective attempts and strategic, deep thinking at the data level.

[0004] Furthermore, while existing code knowledge graph technologies can effectively manage static dependencies between code entities, they lack an effective mapping mechanism to reduce the dimensionality of dynamic temporal data of agents and solidify it into the graph's storage structure. This lack of an indexing technique that integrates dynamic behavioral parameters with static code topology prevents current database systems from supporting direct retrieval and efficient querying of agent operation patterns (e.g., directly searching for session records with specific depth inference rhythms or coverage breadth). This forces analysts to perform inefficient full scans of massive amounts of raw logs, significantly limiting the efficiency of in-depth mining and utilization of large-scale agent behavioral data. Summary of the Invention

[0005] This invention provides a knowledge graph-based method for describing the behavior of intelligent agents, addressing the technical problems mentioned in the background section.

[0006] This invention provides a knowledge graph-based method for describing agent behavior, including: The processor parses the unstructured agent operation log data stream and maps it to a code knowledge graph to generate a discrete module access sequence. Temporal analysis is performed on the module access sequence to calculate residency distribution features representing the persistence of operations within a module, frequency domain features representing the frequency of context switching between modules, and multi-scale coverage extension features representing the scope of code space traversal. All feature data are used to generate a multi-dimensional feature index vector. In the database storage space of the code knowledge graph, index nodes associated with session entities are constructed, and the multi-dimensional feature index vector is written as binary structured data into the attribute fields of the index nodes to support the retrieval of operation modes.

[0007] The beneficial effects of this invention are as follows: By constructing a storage structure of behavioral index nodes and multi-dimensional feature attribute fields in the code knowledge graph database, the invention achieves dimensionality reduction, compression storage, and structured indexing of massive unstructured agent operation logs; This invention transforms the computationally intensive full text scanning and semantic matching tasks into low-latency graph topology traversal and vector distance calculation tasks, significantly reducing the database storage space occupation while greatly improving the I / O throughput efficiency and query response speed of the computer system when handling complex operation pattern matching and historical tracing, thereby optimizing the operating performance of the underlying data management system. Attached Figure Description

[0008] Figure 1 This is a flowchart of the knowledge graph-based intelligent agent behavior description method of the present invention; Figure 2 This is a block diagram of the end-to-end knowledge graph-based intelligent agent behavior description and indexing construction system of the present invention. Detailed Implementation

[0009] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed only to enable those skilled in the art to better understand and implement the subject matter described herein, and changes may be made to the function and arrangement of the elements discussed without departing from the scope of this specification. Various processes or components may be omitted, substituted, or added as needed in the examples. Furthermore, features described in some examples may be combined in other examples.

[0010] like Figure 1 As shown, the knowledge graph-based agent behavior description method includes: The processor parses the unstructured agent operation log data stream and maps it to a code knowledge graph to generate a discrete module access sequence. Temporal analysis is performed on the module access sequence to calculate residency distribution features representing the persistence of operations within a module, frequency domain features representing the frequency of context switching between modules, and multi-scale coverage extension features representing the scope of code space traversal. All feature data are used to generate a multi-dimensional feature index vector. In the database storage space of the code knowledge graph, index nodes associated with session entities are constructed, and the multi-dimensional feature index vector is written as binary structured data into the attribute fields of the index nodes to support the retrieval of operation modes.

[0011] In a preferred embodiment, the processor parses the unstructured agent operation log data stream, maps the agent operation log data stream to a code knowledge graph, and generates a discretized module access sequence, including: The code entity nodes of the code knowledge graph are used to detect community detection algorithms. Divided into A collection of functional module nodes ; For the first in the intelligent agent operation log data stream Step operation records, extracting the set of mentioned code entities from its thought chain text data. ; calculate the first by the following formula The current time step access module : ; in, Represents a collection of code entities With the Each functional module node The number of elements in the intersection; the resulting sequence Defined as the discretized module access sequence.

[0012] To effectively map unstructured logs to structured code knowledge graphs, agent operation logs, existing in natural language, are susceptible to semantic ambiguity and redundant information when directly analyzed. Therefore, a unified mapping carrier needs to be established first. Community detection algorithms can divide the code knowledge graph into functionally cohesive module sets based on the relationships between code entities, forming coarse-grained units with clear semantics from scattered code entities, providing a foundation for log mapping. The agent's thought chain text directly reflects its operational intent; extracting code entity sets from it can accurately capture the objects of interest. Pre-trained named entity recognition models, trained on software engineering corpora, are adaptable to text scenarios mixing natural language and code, ensuring the accuracy of entity extraction. By calculating the number of intersections between the entity set and each module, the degree of association between the agent's current operation and the module can be determined. The module with the largest number of intersections is the current focus of attention, consistent with the logic of majority decision-making. When the log does not mention any code entity, the accessed module from the previous time step is inherited. This considers the continuity of the agent's thinking; the absence of explicit entity mention does not indicate a shift in attention. This design avoids breaks in the module access sequence, ensuring the integrity of the time-series data.

[0013] In a preferred embodiment, time-series analysis is performed on the module access sequence to calculate dwell distribution characteristic data characterizing the persistence of operations within the module, including: Access sequence from the module Extract all that satisfy Calculate the duration of a single stay from consecutive segments. , forming a sequence ; Calculate the empirical probability distribution ; Set the boundary threshold And introduce a reference constant for the unit time step. After dimensionless processing, the following bi-piecewise power-law model is constructed: in, The power-law exponent for the rapid probing phase. The power-law exponent for the metastable dwell stage; the parameters are obtained by solving the following objective functions using the least squares method. and : The calculated and This serves as the residence distribution characteristic data for the persistence of operations within the characterization module.

[0014] Since the agent's operations within a module do not follow a uniform distribution but exhibit two differentiated modes: rapid exploration and deep dwell, a single statistical indicator cannot fully characterize this complex behavior. Firstly, identifying continuous segments in the module access sequence and calculating dwell time allows us to separate the agent's continuous operation process within the same module. The empirical probability distribution calculated based on this sequence reflects the pattern of dwell time occurrence. A bi-segmented power-law model is constructed to adapt to the two behavioral modes separately. The dwell time threshold is set according to the agent's cognitive patterns: short dwell times mostly indicate rapid exploration between modules, while long dwell times correspond to deep thinking or complex operations. Least squares regression fitting in a logarithmic coordinate system transforms the nonlinear power-law relationship into a linear one, facilitating the calculation of the power-law exponent that characterizes the behavioral characteristics of different modes. The first interval power-law exponent reflects the switching efficiency during the rapid exploration phase, while the second interval reflects the level of focus during the deep dwell phase. Combining these two approaches provides a comprehensive characterization of the continuity of operations within a module.

[0015] In a preferred embodiment, time-series analysis is performed on the module access sequence to calculate frequency domain feature data characterizing the context switching frequency between modules, including: Based on the discretized module access sequence Module switching indicator sequence : ; Calculate the mean of the module switching indication sequence. And construct a zero-mean fluctuation sequence ; right Performing a discrete Fourier transform yields the spectral components. And calculate the corresponding power spectral density. ,in For sequence length, For frequency; Within the preset frequency range Internally, a unit frequency reference constant is introduced. With the reference constant of unity power spectral density After dimensionless processing, the following log-linear model is fitted using the least squares method: ; Extract the absolute value of the slope parameter. , which serves as the frequency domain feature data for the context switching frequency between the characterization modules.

[0016] Based on the temporal correlation structure inherent in module switching behavior, direct analysis of time series sequences is insufficient to uncover their deeper patterns. Transforming the module access sequence into a binary switching sequence retains only the core information of whether a module has changed. Mean removal eliminates the interference of DC components on subsequent analysis, allowing the fluctuation characteristics to more purely reflect the switching behavior. Discrete Fourier Transform converts the time-domain signal into a frequency-domain signal, and power spectral density quantifies the energy proportion of different frequency components, thus revealing the frequency distribution characteristics of the switching behavior. Selecting a preset frequency range for linear regression fitting avoids fundamental interference in the low-frequency band and aliasing noise in the high-frequency band, ensuring that the fitting results focus on the frequency range that reflects the essence of the switching rhythm. The absolute value of the slope parameter quantifies the rate at which power spectral density decays with frequency. This rate is directly related to the long-range correlation of switching behavior, thus distinguishing between random, irregular switching and strategically consistent switching, achieving a precise characterization of the frequency characteristics of context switching between modules.

[0017] In a preferred embodiment, temporal analysis is performed on the module access sequence to calculate multi-scale coverage extension feature data characterizing the code space traversal range, including: Define a set of coarse-grained time scales ; For each scale The time axis of the module access sequence is divided into... A length of window ; Identify each window main module ; Calculate the number of coverage modules at this scale ; A power-law decay model of coverage number varying with scale is constructed, and a unit-scale reference constant is introduced. With reference constant of unit time scale Dimensionless processing is performed, and linear fitting is applied to the logarithmic space: ; Extracting regression coefficients , which serves as the multi-scale coverage extended feature data representing the traversal range of the code space.

[0018] This study focuses on the multi-scale characteristics of agent code space exploration. A single temporal granularity cannot fully capture exploration patterns, thus requiring analysis from different dimensions. The set of coarse-grained temporal scales grows geometrically, ensuring coverage from fine to coarse while balancing computational efficiency. The smallest scale focuses on short-term changes in a single operation, while the largest scale is limited to one-eighth of the total time steps of the sequence, ensuring sufficient windows to support statistical reliability even at large granularity. Time windowing divides the continuous sequence into non-overlapping units. The main module of each window is selected as the module with the highest frequency of occurrence, accurately representing the core exploration object of that time period and avoiding interference from accidental visits. The number of covered modules counts the unique number of main modules in different windows, directly reflecting the exploration range at the corresponding scale. The power-law decay model adapts to the natural decay law of the exploration range as the scale expands, while linear fitting in logarithmic space simplifies the solution of model parameters. Finally, the extracted decay index can comprehensively quantify the balance between exploration and deep utilization, achieving an accurate characterization of the code space traversal range.

[0019] In a preferred embodiment, a multidimensional feature index vector is generated using all feature data, including: Define the basic feature vector (basic feature set). ,in These are the two power-law exponents in the residence distribution characteristic data. The absolute value of the slope parameter in the frequency domain feature data. The attenuation index in the multi-scale coverage extended feature data; The following derived feature parameters are calculated based on the basic feature vectors: Heavy-tailed asymmetry (Heavy-tailed asymmetry) ; Time-frequency coupling strength characteristic parameters ; Coverage compression ratio characteristic parameters ; in To prevent division by zero of small constants; Constructing the original behavioral feature vector ; Using the preset global statistical mean and standard deviation The normalized multidimensional feature index vector is calculated using the following formula. : .

[0020] Single-dimensional features cannot fully represent the complex behavior of an agent; feature fusion is necessary to form a unified index. The basic feature group integrates core parameters such as dwell distribution, frequency domain switching, and multi-scale coverage, encompassing the core dimensions of behavior. Heavy-tailed asymmetry captures the behavioral differences between rapid probing and deep dwelling through the difference between two power-law exponents; time-frequency coupling strength quantifies the synergistic effect of deep dwelling and switching coherence; and coverage compression rate measures the efficiency of converting time consumption into spatial coverage. Three types of derived features supplement the correlation information of the basic features from different perspectives, making the behavior description more comprehensive. The original behavioral feature vector is concatenated with the basic and derived features to form a complete behavioral description dimension. Preset global statistical mean and standard deviation vectors are used for standardization, eliminating dimensional differences between different feature dimensions and ensuring balanced weights for each feature in the index vector. The resulting multi-dimensional feature index vector has fixed-length and normalized characteristics.

[0021] In a preferred embodiment, in the database storage space of the code knowledge graph, index nodes associated with session entities are constructed, and the multidimensional feature index vector is written as binary structured data into the attribute fields of the index nodes to support the retrieval of operation patterns through the attribute fields, including: Create a session index node in the graph database and the multidimensional feature index vector Write it to its attribute field; For the module access sequence Each functional module node involved Calculate their total stay duration and access frequency : ; ; Create a connection to the session index node. With functional module nodes Related edges And set the edge attributes as follows: Weight ; frequency ; Calculate the current session index node and any historical session index node behavioral vector distance between : Create inter-session similarity association edges and the distance of the behavior vector Stored as an attribute of the edge.

[0022] A structured association between behavioral features and code knowledge graphs is established to integrate dynamic behaviors with static code entities. Session entity index nodes serve as independent carriers, specifically storing multi-dimensional feature index vectors, enabling behavioral data to form independent and traceable units within the graph. Total dwell time and access frequency statistically determine the interaction strength between the agent and each functional module. Directed association edges clarify the access relationship between sessions and modules, while weight and frequency attributes quantify this association, making the interaction strength computable. The introduction of historical session index nodes is to construct horizontal associations of behavioral patterns. Euclidean distance effectively measures the similarity between current and historical session feature vectors, and similarity association edges solidify this similarity into graph topological relationships, allowing sessions with similar behavioral patterns to naturally cluster within the graph. By vertically associating code modules and horizontally associating similar sessions, a two-layer heterogeneous network is formed, transforming previously scattered behavioral data into a structured index that supports efficient retrieval, enabling rapid location of operational patterns.

[0023] Code knowledge graphs are the basic data carriers for storing code-related entities and the dependencies between entities. They include various code entities such as classes, functions, variables, and API calls, as well as the relationships between entities such as references and calls, providing structured support for subsequent functional module division and log mapping.

[0024] The code entity node set is the collective term for all code entities in the code knowledge graph. It covers all core elements involved in software engineering, such as classes, functions, variables, and interfaces, that need to be manipulated or mentioned by intelligent agents. It is the basic unit for module division.

[0025] Community detection algorithms are the core algorithms used to partition code knowledge graphs. The Louvain algorithm is preferred. Based on the principle of maximizing modularity, this algorithm can automatically cluster closely related code entities together to form non-overlapping functional modules.

[0026] The functional module node set is the result of the community discovery algorithm. It consists of multiple non-overlapping subsets, each of which corresponds to a functional module. The code entities within the set are highly cohesive in terms of function. For example, user authentication-related classes and functions are grouped into a subset.

[0027] The total number of functional modules refers to the number of subsets contained in the set of functional module nodes. The value should be adapted to the project size. The preferred range for medium-sized projects is 5 to 20, which is determined automatically by the community discovery algorithm or preset in advance.

[0028] The agent operation log data stream is the raw input data generated by the agent during the code editing process. It is recorded continuously in chronological order and includes complete operation records such as the agent's reasoning, tool calls, and code modifications. It exists in the form of an unstructured natural language text stream.

[0029] The time step index is a time sequence marker for each operation in the agent's operation log data stream. It starts from 1 and increments sequentially to clarify the time sequence of each operation record, making it convenient to process the log in time sequence.

[0030] The operation record at step t is a single operation record in the log data stream corresponding to the index t of time step t. It contains a description of the agent's behavior, thought process, or operation result at that moment and is the direct source for extracting code entities.

[0031] The thought chain text data is the natural language description part contained in the operation record of step t. It records the thinking logic of the agent when it operates, such as checking the verification function of the login module. It is the key text source for extracting code entities.

[0032] Pre-trained Named Entity Recognition (NER) models are specifically designed to extract code entities from thought chain text. Trained on large-scale corpora in the software engineering field, they can accurately identify hidden code entities such as class names and function names in text.

[0033] It should be noted that the pre-training process of the pre-trained Named Entity Recognition (NER) model is based on a large-scale corpus in the software engineering field. This corpus includes commit logs from open-source code repositories, discussion records from technical Q&A communities, and project development documents. The training samples use the BIO or BIOES sequence labeling system to perform fine-grained annotation on code entities such as class names, function names, variable names, and API calls in the corpus to form text sequence-label sequence pairs. During the training phase, the model guides parameter updates by calculating the cross-entropy loss function between the predicted label probability distribution and the true label distribution or the negative log-likelihood loss function based on conditional random fields (CRF). By minimizing this loss function, the model learns the feature representation ability to accurately locate and classify code entities in the complex thought chain text context of natural language and code.

[0034] Large-scale software engineering corpora serve as training data sources for pre-trained NER models, encompassing commit logs from open-source code repositories, discussion records from technical Q&A communities, project development documents, and more, providing the models with rich industry text samples.

[0035] The BIO / BIOES sequence labeling system is a standard way to label text in a corpus. It is used to identify which parts of the text are code entities and their types, and to form a correspondence between the text sequence and the label sequence required for model training.

[0036] Code entity type refers to the specific entity category that the NER model needs to identify, including core code elements commonly found in software engineering such as class names, function names, variable names, and API calls, to ensure the model's entity extraction is targeted.

[0037] Text sequence-label sequence pairs are the training sample format for pre-trained NER models. The text sequence is the original thought chain text, and the label sequence corresponds to the labeled entity type information, allowing the model to learn the mapping relationship between text and entities.

[0038] Cross-entropy loss function is one of the parameter update criteria for pre-trained NER models. It guides the model to adjust parameters and improve entity recognition accuracy by calculating the difference in probability distribution between the model's predicted labels and the true labels.

[0039] The negative log-likelihood loss function of conditional random fields is another parameter update criterion for pre-trained NER models. It is suitable for sequence labeling tasks, can better handle the dependencies between entity contexts, and optimize the model recognition performance.

[0040] The code entity set for step t is the set of all code entities extracted from the thought chain text of the operation record for step t. Each element belongs to the code entity node set. For example, the set extracted from the validate method of the UserLogin class contains UserLogin and validate.

[0041] Number of intersections | S t ∩M k | represents the number of overlapping elements between the code entity set at step t and the code entity set contained in the k-th functional module. It is used to determine which functional module the agent's current operation is most closely related to. For example, if the set contains 2 entities that overlap with a certain module, the number of intersections is 2.

[0042] The module accessed at step t is the key functional module that the agent operates on at the current time step. It is determined by selecting the module corresponding to the maximum number of intersections. If multiple modules have the same number of intersections, the module that appears earliest can be selected first.

[0043] The access module at step t-1 is the access module determined in the previous time step. When the code entity cannot be extracted at step t, it is used to inherit and determine the current access module, simulating the continuity of the agent's thinking.

[0044] The initial time-idle module is a special preset module for the initial time step (t=1) where code entities cannot be extracted. It is used to avoid module missing at the beginning of the sequence and ensure the integrity of the module access sequence.

[0045] Discretized module access sequences are sequences of all accessed modules arranged in chronological order. They transform unstructured log text into structured module index sequences, eliminating text ambiguity and redundancy. For example, a sequence could be [user authentication module, user authentication module, database module, ...].

[0046] The total time steps of the sequence is the total length of the discretized module access sequence, corresponding to the total number of operation records in the agent operation log data stream, reflecting the total number of steps of agent operation in a session.

[0047] A continuous segment is a subsequence in a module access sequence that continuously maintains the same functional module. It must satisfy the condition that the starting and ending modules are different from the adjacent modules. For example, the part of the sequence of user authentication module-user authentication module-user authentication module is a continuous segment.

[0048] The fragment start index is the starting position marker of a continuous fragment in the module access sequence, corresponding to the time step index of the sequence. For example, if a continuous fragment starts from the 3rd time step, its start index 'a' is 3.

[0049] The segment end index is the marker of the end position of a continuous segment in the module access sequence, corresponding to the time step index of the sequence. For example, if a continuous segment ends at the 7th time step, its end index b is 7.

[0050] The single dwell time is the duration of a single continuous segment, calculated by subtracting the start index from the end index of the segment and then adding 1. For example, a segment with a start index of 3 and an end index of 7 has a single dwell time of 5 time steps.

[0051] The dwell time sequence is a set of all single dwell times arranged in the order of their occurrence. Each element corresponds to the duration of a continuous segment, reflecting the distribution of the agent's dwell time in each module.

[0052] The total number of segments is the number of elements contained in the dwell time sequence, corresponding to the total number of consecutive segments in the module access sequence. For example, if the module access sequence is split into 8 consecutive segments, the total number of segments J is 8.

[0053] The empirical probability distribution is a frequency distribution calculated based on the dwell time sequence. It reflects the probability of a specific dwell time occurring and is obtained by dividing the number of times the dwell time occurs in the sequence by the total number of segments.

[0054] The dwell time threshold is the critical value that divides the two intervals of the bi-segmented power law model. It is preferably 3 to 10 time steps, with a common value of 5. Dwell time less than or equal to this value belongs to the rapid trial phase, while dwell time greater than this value belongs to the metastable dwell phase.

[0055] The bisegmented power-law model is a mathematical model that describes the distribution of dwell time. It divides the distribution into two intervals by a dwell time threshold and fits each interval with a different power-law function. This model can accurately capture the behavioral characteristics of an agent that combines fast browsing and deep manipulation.

[0056] The first interval is the interval with shorter dwell time in the bi-segmented power law model, ranging from 1 to the dwell time threshold. It corresponds to the rapid exploration phase of the agent, where dwell time is mostly for rapid browsing between modules.

[0057] The second interval is the interval with a longer dwell time in the bisegmented power law model. The range is greater than the dwell time threshold, which corresponds to the metastable dwell stage of the agent. The dwell time in this stage is mostly for deep thinking or complex code modification.

[0058] The first power-law decay function is a function that describes the distribution of dwell time in the first interval. It can reflect the decay law of dwell time with probability during the rapid exploration phase and embody the behavior pattern of rapid exploration by the agent.

[0059] The second power-law decay function is a function that describes the distribution of dwell time in the second interval. It can reflect the decay law of dwell time in the deep dwell stage with probability, and reflect the behavior pattern of the agent's focused operation.

[0060] The first interval power law exponent is the core parameter of the first power law decay function, reflecting the behavioral characteristics of the rapid exploration phase. The larger the value, the more the agent tends to switch modules quickly and explores with strong fluidity. For example, when β1=2.8, the agent has a clear tendency to browse quickly.

[0061] The second interval power law exponent is the core parameter of the second power law decay function, reflecting the behavioral characteristics of the deep dwell phase. The smaller the value (closer to 1), the more significant the heavy-tailed effect, and the easier it is for the agent to perform long-term deep operations. For example, when β2=1.2, the agent has a clear tendency to focus and stay.

[0062] Logarithmic coordinates are the coordinate system used for regression fitting. By taking the logarithm of dwell time and probability, the nonlinear power-law relationship is transformed into a linear relationship, which makes it easier to fit the parameters using the least squares method.

[0063] Least squares method: This is an optimization method used for regression fitting. By minimizing the sum of squared errors between the actual data and the fitted line, it obtains the model parameters that best fit the data distribution, ensuring the accuracy of parameters such as the power law exponent.

[0064] The objective function for the first interval is to find the optimal expression for the power law exponent β1 in the first interval. The optimal value of β1 is determined by minimizing the sum of squared errors between the empirical probability distribution and the fitted line in the logarithmic coordinate system.

[0065] The objective function for the second interval is an optimization expression for solving the power law exponent β2 in the second interval. The principle is the same as that for the objective function of the first interval, and it is used to determine the optimal value of β2.

[0066] The first interval regression intercept is the intercept term of the logarithmic regression line of the first interval, corresponding to the logarithmic value of the normalization constant in the power law function. It is used to improve the fitting model and ensure that the model can accurately reflect the distribution pattern of the first interval.

[0067] The second interval regression intercept is the intercept term of the logarithmic regression line in the second interval. Its function is similar to that of the first interval regression intercept, used to optimize the fitting effect of the second interval.

[0068] The residence distribution characteristic data is the core data characterizing the persistence of operations within the agent module. It consists of the first interval power law exponent and the second interval power law exponent, and can comprehensively reflect the behavioral characteristics of the agent in both rapid exploration and deep operation.

[0069] The module switching indicator sequence is a binary sequence converted from the module access sequence. It is used to mark whether the module changes in adjacent time steps. When the module in the current time step is different from that in the previous time step, it is marked as 1 (switching state) and when they are the same, it is marked as 0 (holding state). For example, if the module access sequence is [M1,M1,M2], the corresponding switching indicator sequence is [0,1].

[0070] The switching indicator sequence mean is the arithmetic mean of all elements in the module switching indicator sequence, reflecting the average frequency of module switching in the entire sequence. It is obtained by summing all elements in the sequence and then dividing by the total length of the sequence.

[0071] The zero-mean fluctuation sequence is the sequence obtained by removing the mean from the module switching indicator sequence. It is obtained by subtracting the mean of the switching indicator sequence from each element. This is used to eliminate the interference of the DC component on subsequent spectrum analysis and make the data more in line with the requirements of frequency domain analysis.

[0072] The Discrete Fourier Transform (DFT) is a signal processing algorithm that transforms a zero-mean fluctuation sequence in the time domain into frequency domain data. It can convert the time characteristics of the sequence into frequency characteristics, providing a basis for subsequent power spectral density calculations.

[0073] The Fast Fourier Transform (FFT) is an efficient implementation algorithm of the Discrete Fourier Transform (DFT) and is preferred in engineering applications. It can significantly improve the computational efficiency of frequency domain transformation and is suitable for the rapid processing of large-scale sequences.

[0074] Spectral component indexes are markers for different frequency components in the frequency domain. Each index corresponds to a specific frequency and is used to distinguish and locate various signal components in the frequency domain.

[0075] Complex spectral components are frequency domain signal components obtained after discrete Fourier transform processing. They are represented in complex form and contain the amplitude and phase information of the frequency components. They are the core data for calculating power spectral density.

[0076] Frequency is the specific frequency value corresponding to the spectral component index k, reflecting the speed of signal fluctuation in the frequency domain. Different frequencies correspond to different rhythmic characteristics of the switching of agent modules.

[0077] Power spectral density is the power distribution density corresponding to a frequency. It is calculated by dividing the square of the magnitude of the complex spectral component by the total length of the sequence and can reflect the energy proportion of different frequency components in the signal.

[0078] The minimum frequency is the lower limit of the preset frequency range. It is preferred to take a value of 2 divided by the total length of the sequence to avoid interference from the lowest frequency fundamental wave and ensure that the fitted frequency range has practical significance.

[0079] The maximum frequency is the upper limit of the preset frequency range, preferably set to 1 / 4 (i.e., one-quarter of the sampling rate), to avoid aliasing noise in the high-frequency band and ensure the reliability of the fitted data.

[0080] The preset frequency range is the effective frequency range for fitting log-linear models. It is defined by the minimum and maximum frequencies. The frequency components within this range can truly reflect the patterns of the agent's switching behavior.

[0081] The log-linear model is a linear regression model constructed in a logarithmic coordinate system. It is used to fit the relationship between power spectral density and frequency, transforming nonlinear frequency domain characteristics into a linear relationship, which facilitates the extraction of slope parameters.

[0082] The absolute value of the slope parameter is the core indicator of frequency domain feature data, reflecting how fast the power spectral density decays with frequency. When the value is close to 1, it means that the switching of the agent module has long-range correlation, the strategy is coherent, and it is an efficient behavior; when it is close to 0, the switching is random and it is an ineffective trial. The γ value of efficient agents is mostly between 0.8 and 1.2.

[0083] The model intercept is the intercept term of a logarithmic linear model. It is related to the total energy of the signal and is used to refine the fitted model, ensuring that the model can accurately reflect the linear relationship between power spectral density and frequency.

[0084] The residual term is the error term of the logarithmic linear model, reflecting the deviation between the actual data and the fitted model. The smaller the deviation, the better the model fit and the higher the reliability of the parameter γ.

[0085] Frequency domain feature data is the core data characterizing the frequency characteristics of context switching between agent modules. It consists of the absolute value of the slope parameter and can quantify the coherence and strategy of the agent's switching behavior.

[0086] The set of coarse-grained temporal scales is a combination of time scales that grows exponentially. It is used to analyze the coverage features of the module access sequence from different time dimensions. Each scale represents an analysis granularity, such as gradually expanding from a short time window to a long time window, to comprehensively capture the exploration patterns of the agent.

[0087] The minimum scale is the starting value of the set of coarse-grained time scales, preferably 1, which corresponds to the finest time granularity, i.e. a single time step, used to capture short-term module access changes of the agent.

[0088] The common ratio of scale growth is the proportionality coefficient of geometric progression, preferably 2, that is, each subsequent scale is twice the previous one. For example, it can be gradually increased from 1, 2, 4, 8 to balance computational efficiency and analytical comprehensiveness.

[0089] The maximum scale is the maximum value of the set of coarse-grained time scales. The preferred value is one-eighth of the total time steps of the sequence. This ensures that there are still enough time windows for statistical analysis at large scales, and avoids the distortion of results due to too few windows.

[0090] A time window is a non-overlapping time segment that divides a module access sequence at a certain scale. The length of each window is equal to the current scale value. For example, when the scale is 4, the window is a module access segment containing 4 consecutive time steps.

[0091] The window index is a serial number marker for the time windows divided at each scale, starting from 1 and incrementing sequentially. It is used to distinguish different time windows and facilitate the statistics of the main modules and coverage of each window.

[0092] The number of windows is the total number of time windows at a certain scale. It is obtained by dividing the total time steps of the sequence by the current scale value and rounding down. For example, when the total time steps of the sequence are 100 and the scale is 4, the number of windows is 25.

[0093] The main module is the module that appears most frequently within each time window. If multiple modules have the same frequency, the module that appears earliest is selected first. For example, if module A appears 3 times and module B appears 2 times within a certain window, then module A is the main module.

[0094] The number of covered modules is the total number of distinct modules among the main modules of all time windows at a certain scale. It reflects the scope of modules explored by the agent at that time granularity. For example, if the main modules of 5 windows are A, A, B, C, and B, the number of covered modules is 3.

[0095] The power-law decay model is used to characterize the change of the number of covered modules with time at a coarse-grained scale. It can accurately reflect the decay characteristics of the agent's exploration range as it expands over time, and embody the fractal properties of exploration.

[0096] Logarithmic space is the coordinate system used when fitting a power-law decay model. By taking the logarithm of the number of covering modules and the scale value, the nonlinear power-law relationship is transformed into a linear relationship, which makes it easier to solve the model parameters using the least squares method.

[0097] The regression equation is a linear equation in logarithmic space, used to fit the linear relationship between the number of covered modules and the scale. The decay exponent can be extracted through this equation to quantify the decay rate of the exploration range.

[0098] The decay index is a core indicator for multi-scale coverage of extended feature data, characterizing the range of code space traversal of an agent. When the value approaches 0, it indicates that the agent is trapped in a local loop, and when it approaches 1, it indicates overexploration. An intermediate value (such as 0.5) represents a balance between exploration and deep utilization. In code refactoring tasks, a value of 0.4 to 0.6 is preferred.

[0099] The model intercept is a constant term in the regression equation, used to refine the fitted model, ensuring that the model accurately reflects the linear relationship between the number of covered modules and the scale in logarithmic space, and improving the accuracy of parameter estimation.

[0100] The residual term is the error term of the regression equation, reflecting the deviation between the actual number of covered modules and the fitted model. The smaller the deviation, the better the model fit and the higher the reliability of the decay index.

[0101] Multi-scale coverage extended feature data is the core data characterizing the traversal range of the agent's code space. It consists of a decay index and can comprehensively reflect the agent's exploration strategy and coverage capability at different time granularities.

[0102] The basic feature set is the foundational data set for constructing multidimensional feature index vectors. It consists of two power-law exponents of the resident distribution features, the absolute value of the slope parameter of the frequency domain features, and the decay exponent of the multi-scale coverage features, covering the core basic features of agent behavior.

[0103] The heavy-tailed asymmetry is a derived feature calculated based on the basic feature set. It is obtained by the difference between the values ​​of two power-law exponents and is used to quantify the difference between the agent's rapid exploration and deep dwell modes. The larger the difference, the more obvious the contrast between the two behaviors. For example, when the difference is 2.0, the agent's switching characteristics between rapid browsing and deep thinking are significant.

[0104] The tiny constant used to prevent division by zero is a preset constant used to avoid the denominator being zero in division operations. It is preferably set to 10 to the power of negative 6, which is extremely small and will not affect the accuracy of the calculation results. At the same time, it can ensure the smooth calculation of derived features such as time-frequency coupling strength and coverage compression ratio.

[0105] The time-frequency coupling strength characteristic parameter is a derived feature calculated based on the basic feature set. It is obtained by dividing the power law exponent of the second interval by the sum of the absolute value of the slope parameter and a small constant. It is used to capture the synergistic relationship between deep dwell capability and switching coherence. The larger the value, the better the synergy between the two. For example, when the value is 1.22, the agent can perform both deep operations and coherent switching.

[0106] The coverage compression ratio characteristic parameter is a derived feature calculated based on the basic feature set. It is obtained by dividing the sum of the power law exponent of the second interval and the absolute value of the slope parameter by the sum of the decay exponent and the small constant. It is used to measure the conversion efficiency of time consumption to spatial coverage. The closer the value is to 1, the higher the conversion efficiency.

[0107] The original behavior feature vector is a seven-dimensional vector consisting of a basic feature group and three derived features. It fully integrates the basic and coupled features of the agent's behavior, providing a complete data foundation for subsequent standardization processing.

[0108] The global statistical mean vector is a pre-defined standardized parameter obtained based on large-scale historical agent behavior data. Each dimension corresponds to the mean of the corresponding dimension in the original behavioral feature vector, which is used to eliminate the difference in the dimensions of different feature dimensions.

[0109] The global statistical standard deviation vector is a preset standardization parameter used in conjunction with the global statistical mean vector. Each dimension corresponds to the standard deviation of the corresponding dimension in the original behavioral feature vector, and is used to transform the original feature vector into a normalized standard vector.

[0110] The multidimensional feature index vector is a vector obtained by standardizing the original behavioral feature vector. It has the characteristics of fixed length and normalization, and can be used as binary structured data storage, supporting fast vector distance calculation and pattern matching.

[0111] The session entity index node is a node instantiated in the code knowledge graph specifically used to store session behavior characteristics. It is tagged as a session entity, with each session corresponding to an independent node. It is the core carrier connecting behavior characteristics and code modules.

[0112] Vector attributes are fields in the session entity index node specifically used to store multidimensional feature index vectors. They are stored in a binary structured format to ensure efficient reading, writing, and retrieval of vector data.

[0113] Functional module nodes are the nodes corresponding to the functional modules that the agent has actually visited in the module access sequence. These nodes come from the functional module division results of the code knowledge graph and are the associated objects of the session entity index nodes.

[0114] Indicator functions are auxiliary functions used for statistical counting. They take the value 1 when the condition within the parentheses is true, and 0 otherwise. They are mainly used to calculate total dwell time and access frequency to ensure the accuracy of statistical results.

[0115] Total dwell time is the total number of time steps a certain functional module node spends in the module access sequence. It is obtained by counting the number of times the module appears in the sequence using an indicator function, reflecting the agent's focus time on the module.

[0116] Access frequency is the total number of times a certain functional module node is switched into by an agent from other modules. It is obtained by counting the number of times the agent switches from other modules to this module through an indicator function, reflecting the frequency of the agent's access to this module.

[0117] A directed association edge is a directed edge that connects a session entity index node and a functional module node. The edge type is defined as an access relationship, which is used to clarify the association between the session and the accessed module, and to reflect the vertical mapping between behavior and code entity.

[0118] Weight is one of the core attributes of directed edges. It is obtained by dividing the total dwell time of a module by the total time steps of the sequence. It reflects the proportion of time that module spends in the session. The larger the weight, the higher the agent's focus on the module. For example, when the weight is 0.6, 60% of the session time is spent on the module.

[0119] Frequency is another core attribute of directed association edges. It is obtained by dividing the access frequency of a module by the total time steps of the sequence, reflecting the access density of that module. The higher the frequency, the more frequently the agent switches to that module.

[0120] The edge attribute field is a data field that stores the weight and frequency attributes in directed edges. It is used to persistently store these two quantitative attributes to provide data support for subsequent retrieval and analysis.

[0121] Historical session index nodes are existing session entity index nodes in the database. These nodes store multi-dimensional feature index vectors of past agent sessions, which are used to compare similarity with the current session nodes.

[0122] Historical feature vectors are vector attributes of historical session index nodes, that is, multi-dimensional feature index vectors of past sessions after standardization. They are the core data for calculating the similarity between the current session and historical sessions.

[0123] Euclidean distance is an indicator used to measure the similarity between the current session's multidimensional feature index vector and the historical feature vector. The smaller the distance, the more similar the behavioral patterns of the two sessions are. For example, when the distance is 0.3, the behavioral patterns of the two sessions are highly consistent.

[0124] Similarity-related edges are undirected edges that connect the current session entity index node with the historical session index node. The edge type is defined as similarity relation and is used to construct lateral associations of behavioral patterns in the graph.

[0125] The distance attribute is a field that stores the Euclidean distance in similarity-related edges. It measures vector similarity as an edge attribute, making it easier to quickly find sessions with similar behaviors through graph topology traversal.

[0126] like Figure 2 As shown, firstly, the agent on the left generates an operation log data stream. This data stream enters the log parsing and mapping module, and after unstructured log parsing and entity extraction, it is mapped to the central code knowledge graph. In the graph, code entity nodes are divided into functional modules (through a community detection algorithm), transforming the originally continuous operation stream into a discrete module access sequence. Subsequently, this sequence enters the time-series feature analysis stage, where the system extracts three types of key features in parallel: residence distribution features representing the persistence of operations within a module (displayed as distribution histograms and curves), frequency domain switching features representing the switching frequency between modules (displayed as fluctuating waveforms), and multi-scale coverage features representing the code traversal range (displayed as nested boxes). These three types of features are finally converged to generate a multi-dimensional feature index vector. The process ends at the graph database storage on the right, where the system constructs session index nodes. These nodes are associated with specific functional module nodes through weight and frequency edges, and similarity associations with historical session nodes are established by calculating Euclidean distance. This structured storage method ultimately supports efficient operation pattern retrieval.

[0127] like Figure 2 As shown, Figure 2 This paper demonstrates the end-to-end knowledge graph-based intelligent agent behavior description and indexing system architecture, presenting the complete flow from unstructured logs to structured retrieval indexes: The unstructured operation log data stream generated by the intelligent agent on the left is processed by the log parsing and mapping module. Combined with the functional module division results of the code knowledge graph, code entities are extracted and matched with corresponding modules to generate a discrete module access sequence. After the sequence enters the time-series feature analysis module, it extracts in parallel the residence distribution features representing the persistence of operations within the module, the frequency domain switching features representing the switching frequency between modules, and the multi-scale coverage features representing the traversal range of the code space. The three types of features are converged to generate a multi-dimensional feature index vector. Finally, in the graph database on the right, index nodes of associated session entities are constructed and the vector is stored. At the same time, the index nodes are connected to the functional module nodes through directed association edges with weight and frequency attributes, and the current and historical session nodes are connected through similarity association edges with Euclidean distance attributes, forming a structured graph storage system that supports efficient operation mode retrieval.

[0128] It should be noted that before performing entity extraction, the original operation log data stream to be parsed is first cleaned using regular expressions to remove code highlighting marks, Extensible Markup Language (XML) formatting tags, and invisible escape characters. Then, the plain text data segment stripped of formatting tags is input into the natural language processing module for unified conversion of full-width and half-width characters and removal of stop words, thereby purifying the complex and messy underlying operation stream into a clear and coherent thought chain text sequence.

[0129] It should be noted that, in order to avoid spectral leakage caused by direct truncation of finite-length sequences during frequency domain conversion, which would lead to distortion of high-frequency fluctuation characteristics, the system applies a Hamming window function to the zero-mean fluctuation sequence obtained after mean-reduction processing before performing the discrete Fourier transform operation for time-domain weighted smoothing. By smoothly attenuating the values ​​at both ends of the sequence to near zero, the continuity of the fluctuation signal during periodic extension is ensured, thereby ensuring that the subsequently extracted power spectral density slope parameter can accurately map the real context switching frequency characteristics.

[0130] It should be noted that, for the preset global mean and standard deviation used to perform normalization operations, the system adopts a maintenance strategy that combines offline benchmark initialization with online exponential smoothing adaptive updates. In the initial stage of the system, a fixed-size historical session behavior data pool is extracted for full statistical analysis to establish the initial benchmark values. During the normal operation of the system, whenever a new original behavior feature vector is generated and imported, the system assigns a fixed decay weight coefficient to the latest observation value and integrates it into the existing mean and standard deviation state. This ensures that the normalization parameters can keenly capture and adapt to the dynamic drift of the operation mode data distribution over time.

[0131] It should be noted that, in order to avoid the search latency bottleneck caused by full table scans of the database, when calculating the behavioral feature distance between the current session index node and the historical session index node to establish similarity associations, the system introduces a hierarchical navigable small-world graph index structure in the underlying vector retrieval framework of the graph database. When performing similarity comparison, the system first relies on this hierarchical index network to quickly recall several candidate historical node clusters that are closest in distance in the vector space from top to bottom. Then, it performs accurate Euclidean distance calculation only for nodes within this small candidate cluster. Finally, it selects target historical nodes whose distance is lower than the preset judgment threshold to establish the final similarity network edge.

[0132] The embodiments of this example have been described above. However, this example is not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms based on the guidance of this example, and all of them are within the protection scope of this example.

Claims

1. A knowledge graph-based method for describing agent behavior, characterized in that, include: The processor parses the unstructured agent operation log data stream and maps the agent operation log data stream to the code knowledge graph to generate a discretized module access sequence. The module access sequence is subjected to time series analysis to calculate the dwell distribution feature data representing the persistence of operations within the module, the frequency domain feature data representing the frequency of context switching between modules, and the multi-scale coverage extension feature data representing the code space traversal range; a multi-dimensional feature index vector is generated using all feature data. In the database storage space of the code knowledge graph, index nodes associated with session entities are constructed, and the multidimensional feature index vector is written as binary structured data into the attribute fields of the index nodes so as to support the retrieval of operation modes through the attribute fields.

2. The method for describing agent behavior based on knowledge graphs according to claim 1, characterized in that, The processor parses the unstructured agent operation log data stream and maps it to a code knowledge graph to generate a discretized module access sequence, including: The code knowledge graph is partitioned using a community detection algorithm, and code entity nodes in the code knowledge graph are assigned to non-overlapping sets of functional module nodes. Each operation record in the agent's operation log data stream is traversed chronologically, and the mentioned code entity set is extracted from the thought chain text data of the operation record. The number of intersections between the code entity set and the code entities contained in each functional module node is calculated. The functional module node corresponding to the maximum number of intersections is selected as the access module for the current time step. If the number of intersections is empty, the access module from the previous time step is inherited. All access modules determined at all time steps are arranged chronologically to form the discretized module access sequence.

3. The method for describing agent behavior based on knowledge graphs according to claim 2, characterized in that, Perform time-series analysis on the module access sequence to calculate dwell distribution characteristic data representing the persistence of operations within the module, including: The system identifies segments in the module access sequence that continuously belong to the same functional module node, and calculates the duration of each segment to generate a single dwell time sequence. Based on the single dwell time sequence, it calculates an empirical probability distribution. A bi-segmented power-law model is constructed, with a preset dwell time threshold as the boundary. A first power-law decay function and a second power-law decay function are defined in a first interval less than or equal to the threshold and a second interval greater than the threshold. In a logarithmic coordinate system, least squares regression is performed on the empirical probability distribution data of the first and second intervals to obtain the first interval power-law index and the second interval power-law index. The first interval power-law index and the second interval power-law index are used as dwell distribution feature data representing the persistence of operations within the module.

4. The method for describing agent behavior based on knowledge graphs according to claim 3, characterized in that, Perform time-series analysis on the module access sequence and calculate frequency domain feature data characterizing the context switching frequency between modules, including: The discretized module access sequence is transformed into a binary switching sequence, where a switching state is marked when the accessed module changes in adjacent time steps, and a hold state is marked otherwise. The binary switching sequence is then subjected to mean-removal processing to obtain a zero-mean fluctuation sequence. A discrete Fourier transform is performed on the zero-mean fluctuation sequence to calculate the power spectral density values ​​corresponding to each frequency component. A preset frequency band is selected to establish a linear regression model of the power spectral density values ​​and frequency values ​​in a logarithmic coordinate system. The absolute value of the slope parameter of the linear regression model is calculated as the frequency domain feature data representing the context switching frequency between modules.

5. The method for describing agent behavior based on knowledge graphs according to claim 4, characterized in that, Perform time-series analysis on the module access sequence to calculate multi-scale coverage extension feature data representing the code space traversal range, including: A set of coarse-grained time scales that grow geometrically are defined. For each coarse-grained time scale, the discretized module access sequence is divided into non-overlapping time windows. The access module with the highest frequency in each time window is determined as the main module of that window. The total number of distinct modules in the main modules corresponding to all time windows under the coarse-grained time scale is counted as the number of covered modules for that scale. A power-law decay model is established to describe the number of covered modules as a function of the coarse-grained time scale. The power-law decay model is fitted in a logarithmic coordinate system, and its decay exponent is extracted as the multi-scale coverage extension feature data representing the code space traversal range.

6. The method for describing agent behavior based on knowledge graphs according to claim 5, characterized in that, Generate a multidimensional feature index vector using all feature data, including: Extract the power-law exponents of the first and second intervals from the residence distribution feature data, the absolute values ​​of the slope parameters from the frequency domain feature data, and the attenuation index from the multi-scale coverage extension feature data to form a basic feature group; calculate the numerical difference between the power-law exponents of the first and second intervals as the heavy-tailed asymmetry; calculate the ratio of the absolute value of the power-law exponent of the second interval to the slope parameter as the time-frequency coupling strength feature parameter; calculate the sum of the absolute values ​​of the power-law exponent of the second interval and the slope parameter, and then divide it by the attenuation index to obtain the coverage compression ratio feature parameter; concatenate the basic feature group, the heavy-tailed asymmetry, the time-frequency coupling strength feature parameter, and the coverage compression ratio feature parameter into an original behavioral feature vector; standardize the original behavioral feature vector using a preset mean vector and standard deviation vector to obtain the multi-dimensional feature index vector.

7. The method for describing agent behavior based on knowledge graphs according to claim 6, characterized in that, In the database storage space of the code knowledge graph, index nodes associated with session entities are constructed, and the multi-dimensional feature index vector is written as binary structured data into the attribute fields of the index nodes to support the retrieval of operation patterns through the attribute fields, including: In the code knowledge graph, an index node of type session entity is instantiated, and the multidimensional feature index vector is stored as a vector attribute of the index node; the total dwell time and access frequency of each functional module node in the module access sequence are counted; a directed association edge is established between the index node and each accessed functional module node; the proportion of the total dwell time to the total sequence time is calculated as a weight attribute, and the weight attribute and the access frequency are written into the data field of the directed association edge; the Euclidean distance between the multidimensional feature index vector of the currently established index node and the vector of the existing historical index node in the database is calculated; a similarity association edge is established between the current index node and the historical index node, and the Euclidean distance is recorded as the edge attribute of the similarity association edge.

Images