Automatic operation compliance auditing method and system for life service agent

Abstract

The invention provides an automatic operation compliance auditing method and system of a life service agent. The method comprises the following steps: initiating an operation request; the authorization verification module analyzes the authority required by the operation request according to a predefined authority matrix, and compares and verifies the authority with an authority set preset by a user; the abnormal operation interception module analyzes the operation represented by the request based on a dynamic rule engine and an isolated forest model; after execution is completed, the log auditing and rule iteration module writes operation related information into a log library, and the log is stored by adopting a Merkel tree or WORM storage technology; relevant information of each life service platform is captured through a crawler technology, the captured information is analyzed by using a natural language processing technology, and key rule parameters are extracted. The invention aims to construct a comprehensive compliance guarantee system, full-process compliance verification, real-time monitoring and abnormity interception are carried out on automatic operation of the life service agent, and meanwhile, a non-tampering log auditing function is provided.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence security, automated process auditing, and digital risk control, specifically to a method and system for compliant auditing of the automated operation of intelligent agents in life services, and particularly focuses on an algorithm for full-process compliance verification, real-time monitoring, and anomaly interception of automated operations of intelligent agents in life service scenarios such as food delivery and e-commerce. Background Technology

[0002] As large model-driven (LLM) agent technology matures, more and more users are choosing to authorize agents to perform various tasks such as ordering food, shopping, and booking tickets. However, this automation faces multiple compliance risks: User-side risks (unauthorized access and privacy): Intelligent agents may, without the user's explicit awareness, engage in overpayment, place incorrect orders, or misuse user location information, potentially leading to financial losses or privacy breaches. For example, an intelligent agent might purchase overpriced goods without the user's consent or disclose the user's location information to a third party.

[0003] Platform-side risks (anti-scraping and blocking): Life service platforms (such as Meituan and Taobao) have strict limits on the frequency of API calls and behavioral guidelines for automated scripts. If an agent makes frequent and mechanical API calls, it is very likely to trigger the platform's Web Application Firewall (WAF) to block or ban the account. For example, if an agent frequently makes requests in a short period of time, it may be identified by the platform as a malicious crawler and blocked.

[0004] Audit deficiencies: Existing automation tools lack complete "black box" records. Once a dispute occurs (such as an agent mistakenly buying a case of expensive red wine), it is impossible to trace whether the error is due to an algorithm error or unclear user instructions, making it difficult to determine responsibility.

[0005] Therefore, there is an urgent need for an automated operation compliance audit algorithm that can span before, during, and after an event, integrating rule engines and machine learning models, in order to ensure the security and compliance of the operation of intelligent agents in life services. Summary of the Invention

[0006] This invention provides a method and system for automating the compliance audit of intelligent life service agents, aiming to build a comprehensive compliance assurance system that performs full-process compliance verification, real-time monitoring and anomaly interception on the automated operations of intelligent life service agents, while providing tamper-proof log auditing function.

[0007] The present invention achieves the above objectives through the following technical solutions: An automated operation compliance auditing method for a life service intelligent agent includes: Step S1: The life service intelligent agent initiates an operation request, which is transmitted to the authorization verification module. The authorization verification module parses the permissions required for the operation request based on the predefined permission matrix and compares and verifies them with the user's preset permission set. If the permissions are insufficient or exceeded, the verification fails and triggers the user's secondary confirmation step. If the permission verification passes, it directly enters the abnormal operation interception module. Step S2: After the request enters the abnormal operation interception module, the module analyzes the operation represented by the request based on a dynamic rule engine and an isolated forest model. The dynamic rule engine makes a preliminary judgment based on the compliance rule library built by the API call restrictions and platform behavior specifications of each life service platform. The isolated forest model identifies abnormal patterns by calculating the path length of data points in a random binary tree. If the operation is determined to be abnormal or non-compliant, it is intercepted, an alarm mechanism is triggered, and the operation is terminated. If the operation is determined to be compliant, the corresponding operation is executed and the API is called. Step S3: After the operation is completed, the log auditing and rule iteration module writes the operation-related information into the log database and uses Merkle tree or WORM storage technology to store the log, taking advantage of the hash chain structure of Merkle tree or the write-once-read-many feature of WORM medium. Step S4: Use web crawling technology to capture relevant information from various life service platforms, use natural language processing technology to parse the captured information and extract key rule parameters; perform hot rule updates based on the extracted rule parameters, and apply the updated rules dynamically to the abnormal operation interception module without restarting the service, so as to achieve continuous iterative optimization of the rules.

[0008] According to the automated operation compliance auditing method of the smart agent for life services provided by the present invention, when the permission verification fails and the user's secondary confirmation is triggered, a secondary confirmation prompt message containing operation details and confirmation request is sent to the user through a preset communication channel. If the user refuses to confirm again within the specified time, the system will immediately terminate the processing flow of the current operation request, not perform any subsequent operations related to the request, and return feedback information of operation termination to the life service intelligent agent. If the user approves the secondary confirmation within the specified time, the system generates a one-time temporary token and returns the request containing the temporary token to the authorization verification module. The authorization verification module re-parses the permissions required by the operation instruction and performs permission verification in conjunction with the temporary token. If the verification passes, the request is forwarded to the abnormal operation interception module for further processing. If the verification still fails, the user's secondary confirmation process is triggered again or the operation is terminated directly.

[0009] According to the present invention, an automated operation compliance auditing method for a life service intelligent agent includes the following: the permission matrix definition and verification logic in the authorization verification module: Define the set of permission granularities: P ={ Pay _ Limit _a, Pay _ Limit _b, Addr _ Read , Addr _ Write , Order _ Create} in, Pay _ Limit _a indicates a single payment limit of a yuan. Pay _ Limit _b indicates a single payment limit of b yuan. Addr _ Read This indicates permission to read address information. Addr _ Write This indicates the permission to write address information. Order _ Create Indicates the permission to create an order; Users pre-set the permission set of the life service intelligent agent based on their own needs. S grant ; When the intelligent agent generates operation instructions Op At that time, the set of permissions required to parse the operation instruction. S need ; Will S need With user-preset permission set S grant To make a comparison, if S need S grant If all required permissions are within the scope of permissions granted by the user, the permission verification is considered successful; otherwise, the verification fails.

[0010] According to the automated operation compliance auditing method for a life service intelligent agent provided by the present invention, the abnormal operation interception module based on isolated forest for real-time abnormal operation interception is implemented in the following way: Extracting multidimensional feature vectors of operational behavior: X =[ x freq , x amount ,x geo_dist , x dev_entropy ] in, x freq This is a feature representing the frequency of operations within the sliding window, used to reflect the frequency of operations. x amount This is a feature representing the deviation of order amount from the historical average, used to measure the degree of deviation of the current order amount from historical levels. x geo_dist The physical distance between the current IP address and the usual delivery location is used to determine the anomaly of the operation initiation location; x dev_entropy The entropy value feature of the device fingerprint is used to detect whether the simulator is frequently changed by calculating the uncertainty of the device fingerprint information; An isolated forest model is constructed by building multiple random binary trees. The construction process of each iTree is as follows: A subset of data is randomly selected from the operational behavior dataset as a subsample set; Randomly select a feature from the subsample set, and randomly select a split point between the maximum and minimum values ​​of the feature. Recursively split the data space according to the relationship between the feature value and the split point until a preset stopping condition is met.

[0011] According to the automated operation compliance auditing method for a life service intelligent agent provided by the present invention, the anomaly score is calculated and expressed by the following formula: in, E ( h ( x )) is a sample x The expected path length on each iTree c ( n () is the given number of samples n The average path length is used to standardize the path length. like S If the value is greater than 0.85, it is considered a high-risk abnormal operation. The automatic interception mechanism is immediately triggered, the HTTP request is terminated, and the account is marked as protected in the system to prevent subsequent operations.

[0012] If 0.6 < S If the value is less than 0.85, it is considered a medium-risk abnormal operation. A verification code check is added, and user identity is verified by calling a third-party captcha solving platform or sending a verification code to the user's mobile phone. Only after successful verification can the operation continue.

[0013] According to the present invention, an automated operation compliance auditing method for a life service intelligent agent is provided. The rules in the compliance rule base are based on the multi-dimensional restrictions imposed by various life service platforms on the operation of the intelligent agent, including the following key factors: Request frequency constraints: Each life service platform sets an upper limit standard for the frequency at which intelligent agents can initiate API requests to it, based on its own system capacity and business security considerations; Request header specifications: To ensure the legitimacy and traceability of the request source, some local service platforms require that the request header must contain specified information to identify the origin of the request and prevent the infiltration of illegal requests; Operational behavior restrictions: Based on its own business characteristics and risk control needs, the life service platform restricts certain operational behaviors of the intelligent agent; When a life service agent initiates an operation request, the dynamic rule engine quickly extracts a set of rules related to the request from the compliance rule base; the dynamic rule engine compares and analyzes each parameter of the agent's request with the extracted rules one by one. If the request parameters fully comply with the requirements of the corresponding rules in the compliance rule base, the request is deemed to have passed the initial compliance judgment and is allowed to enter the compliance review stage in the abnormal mode; if any of the request parameters do not comply with the rules, the request is deemed to have compliance risks, and the request is directly blocked or the corresponding risk handling mechanism is triggered to ensure that the operation of the intelligent agent always complies with the normative requirements of each life service platform.

[0014] According to the automated operation compliance auditing method for a life service intelligent agent provided by the present invention, the implementation of compliance rule iteration in step S4 includes: Deploy a compliant web crawler program. This crawler program runs automatically on a weekly cycle according to a preset scheduled task. Its crawling scope covers a wide range of publicly available information sources from major life service platforms. The crawler program uses intelligent web page parsing technology to identify and extract key information related to the compliance of intelligent agent operations. The pre-trained BERT model is used to perform deep analysis on automatically crawled text information. During the analysis process, the BERT model focuses on extracting key restriction words related to the constraints of agent operation. By extracting and analyzing these key restriction words, unstructured text information is transformed into structured rule parameters. A rule update mechanism is established to automatically and seamlessly update the rule parameters extracted by NLP parsing to the rule files of the dynamic rule engine. The rule hot update process adopts incremental update technology, which only updates the parts of the rule file that have changed, avoiding the risk of system resource consumption and service interruption that may be caused by full updates. At the same time, by monitoring the update status of the rule file in real time, it is ensured that the updated rules can take effect in the rule engine immediately without restarting related services.

[0015] According to the present invention, an automated operation compliance auditing method for a life service intelligent agent is provided. The BERT model performs deep analysis on automatically crawled text information, which is achieved through the following steps: The raw text information obtained by automatic crawling is cleaned and standardized to remove noise information from the text and convert the text into a specified encoding format. The cleaned text is segmented into words using a segmentation algorithm suitable for Chinese or the corresponding language environment, forming a segmentation sequence. Based on the word segmentation sequence, construct a suitable input representation for the BERT model, specifically including: Special classification markers ([CLS]) and separator markers ([SEP]) are added. The [CLS] marker is usually placed at the beginning of the input sequence and is used to aggregate the semantic information of the entire sequence; the [SEP] marker is used to separate different text paragraphs or sentences, helping the model distinguish different semantic units. The word segmentation is mapped to the corresponding word vectors, and the positional encoding information is combined to add the positional information of each word in the sequence in order to preserve the sequential features of the text; The constructed model is fed into the pre-trained BERT model, which performs deep encoding and interactive processing of the input through its multi-layer Transformer architecture. In the output layer of the BERT model, extraction strategies are designed for the key information extraction task, including: for extracting agent operation frequency restriction information, a classifier is trained on the model output to determine whether each position belongs to frequency restriction related key information; or a sequence labeling method is used to label each word to indicate whether it belongs to the key information. The extracted key information is post-processed and output in a structured format so that the rule iteration unit can directly use this information to perform hot rule updates.

[0016] According to the automated operation compliance auditing method for a life service intelligent agent provided by the present invention, the structure definition of the log library includes the following fields: Timestamp: Records the timestamp of the operation. Op_ID: Assign a unique identifier to each operation to uniquely identify and distinguish different operation instances in the system; User_ID: Records the user identifier who initiated the operation, clarifying the responsible party for the operation; Action: Describes the specific content of the operation, including at least the type of operation and the objects involved, and fully reflects the business logic of the operation; Auth_Token: Records the authorization token information used during the operation, which is used to verify the legitimacy of the operation and the source of the authorization; Risk_Score: Records the risk score of an operation after compliance review, reflecting the degree of compliance risk of the operation; Result: Records the final result of the operation, as well as any related error codes or message messages; Among them, a storage technology with tamper-proof characteristics is used to store the operation logs: Merkle tree chained storage: Log data is organized and stored using a Merkle tree data structure. Each leaf node stores the hash value of a log record, and non-leaf nodes store the combined hash of the hash values ​​of their child nodes. WORM CD-ROM Library Storage: Utilizing the physical characteristics of the WORM CD-ROM library, log data can be written once and read multiple times; once the log data is written to the CD-ROM, it cannot be modified or deleted.

[0017] An automated operation compliance auditing system for a life service intelligent agent, the system being applied to the aforementioned automated operation compliance auditing method for a life service intelligent agent, comprising: The authorization verification module is used to verify the permissions required by the smart agent based on the user's preset permission set before the smart agent performs an operation. If the permissions are insufficient or exceed the preset limit, the module will complete the permissions or suspend the operation through a user secondary confirmation mechanism. The abnormal operation interception module uses a dynamic rule engine and an isolated forest algorithm to analyze the behavioral characteristics of the agent during the operation process in real time, and identify and intercept abnormal operations. The log auditing and rule iteration module records all operation logs to an immutable storage medium and dynamically updates the compliance rule library according to the latest laws, regulations and platform behavior guidelines.

[0018] Therefore, compared with the prior art, the automated operation compliance auditing method and system for life service intelligent agents proposed in this invention have the following advantages: 1. This invention employs Role-Based Access Control (RBAC) combined with the OAuth 2.0 Scope mechanism to rigorously check the agent's permissions before any operation. By defining permission granularity, such as single payment limits, address read and write permissions, and order creation permissions, and allowing users to pre-set the agent's permission set, it ensures that the agent can only perform operations within the scope authorized by the user. This fundamentally prevents unauthorized actions by the agent and avoids user financial losses and privacy leaks caused by unauthorized operations. For example, if the user sets a single payment limit of 50 yuan for the agent, when the agent attempts to pay for an order exceeding this limit, the system will automatically intercept it and require the user to confirm again, thereby ensuring the safety of the user's funds.

[0019] 2. The pre-authorization verification mechanism provides users with a clear permission management interface, enabling them to clearly understand the scope of the intelligent agent's operational permissions. Simultaneously, when secondary user confirmation is required, the system promptly informs users of the operation details via push notifications, allowing users to independently decide whether to approve the operation. Therefore, this transparent permission management and user participation approach enhances user trust in the intelligent agent service and improves the user experience. Users can more confidently authorize the intelligent agent to perform various life service operations, thereby promoting the widespread application of intelligent agent technology in the life service field.

[0020] 3. This invention introduces the unsupervised learning algorithm—Isolation Forest—for real-time monitoring and anomaly detection of operational behavior. By extracting multi-dimensional feature vectors of operational behavior, such as operation frequency, order amount deviation, IP address distance, and device entropy, multiple random binary trees are constructed for anomaly detection. This algorithm can quickly and accurately identify abnormal operational behaviors, such as high-frequency mechanical API calls, abnormal payment amounts, and logins from different locations, and immediately intercepts them upon detection to prevent unauthorized operations from harming users and the platform. For example, when an agent frequently initiates the same type of operation requests within a short period, the Isolation Forest algorithm can quickly identify this abnormal behavior and trigger the interception mechanism, avoiding resource waste and business interference caused to the platform by malicious order-brushing and other behaviors.

[0021] 4. Traditional rule engines can only perform anomaly detection based on preset rules, often failing to effectively identify complex and unknown anomaly patterns. In contrast, the Isolation Forest algorithm, as an unsupervised learning algorithm, does not require pre-defined anomaly patterns. It can automatically learn the feature distribution of normal operational behavior and identify anomalies that deviate significantly from it. This allows the real-time anomaly interception mechanism of this invention to adapt to complex and ever-changing risk scenarios, effectively preventing various new types of unauthorized operations. For example, with the development of life service platform businesses and continuous technological advancements, new attack methods and unauthorized operation methods may emerge. The Isolation Forest algorithm can promptly capture and intercept these abnormal behaviors, ensuring the safe and stable operation of the platform.

[0022] 5. This invention records all operation logs of the intelligent agent, including detailed information such as operation time, operation instructions, user authorization information, risk score, and operation results. Merkle tree linked storage or WORM (WriteOnce Read Many) optical disc library storage technology is used to ensure the logs' immutability. In the event of a dispute, these immutable logs can serve as reliable evidence, helping users and the platform trace the operation process and clarify responsibility. For example, when a user objects to a particular operation of the intelligent agent, they can review the logs to understand the details of the operation, including whether the user authorized it and whether the operation was compliant, thereby quickly resolving the dispute and protecting the user's legitimate rights.

[0023] 6. Post-event log auditing not only provides a basis for dispute resolution but also offers crucial support for platform compliance review and rule optimization. Analyzing log data allows for understanding the compliance status of agent operations, identifying potential compliance risks, and promptly adjusting and improving compliance rules. Furthermore, regular log reviews based on changes in laws and regulations and the platform's business development ensure that platform operations always comply with the latest compliance requirements. For example, when regulatory authorities issue new policies and regulations, log data analysis can assess whether existing platform operations comply with the new requirements, and non-compliant operations can be rectified, thereby avoiding legal risks arising from compliance issues.

[0024] 7. The three-tiered compliance assurance system of this invention comprehensively controls the automated operation of intelligent agents in three stages: pre-event, during-event, and post-event. This effectively prevents various compliance risks and enhances the platform's security and stability. Pre-event authorization verification prevents unauthorized behavior, during-event anomaly interception prevents unauthorized operations, and post-event log auditing provides evidence for dispute resolution and compliance review support, forming a closed-loop compliance management mechanism. This mechanism can promptly detect and handle potential security issues, ensuring the normal operation of the platform and providing users with safer and more reliable life services.

[0025] 8. With the widespread application of intelligent agent technology in the life services sector, compliance issues have become a significant factor restricting its development. The automated operation compliance audit algorithm of this invention provides a scientific and effective compliance solution for intelligent agent technology, helping to standardize the operational behavior of intelligent agents and improve the overall compliance level of the industry. By ensuring the security of users and platforms and enhancing user trust in intelligent agent technology, it can effectively solve the compliance risks faced by automated intelligent agent operations in life service scenarios, providing users and platforms with safe and reliable intelligent agent services, and promoting the healthy development of intelligent agent technology in the life services sector.

[0026] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments. Attached Figure Description

[0027] Figure 1 This is a flowchart of an embodiment of an automated operation compliance auditing method for a life service intelligent agent according to the present invention.

[0028] Figure 2 This is a flowchart illustrating the principle of the automated operation compliance auditing method for a life service intelligent agent according to an embodiment of the present invention.

[0029] Figure 3 This is a schematic diagram of the authorization verification principle of the authorization verification module in an embodiment of the automated operation compliance auditing method for a life service intelligent agent of the present invention.

[0030] Figure 4 This is a structural diagram of an abnormal operation interception model based on the isolated forest model in an embodiment of an automated operation compliance auditing method for a life service intelligent agent according to the present invention.

[0031] Figure 5 This is a flowchart illustrating the dynamic iteration and update of the compliance rule base in an embodiment of the automated operation compliance auditing method for a life service intelligent agent according to the present invention. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0033] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0034] See Figures 1 to 5 This embodiment provides an automated operation compliance auditing method for a life service intelligent agent, including: Step S1: The life service intelligent agent initiates an operation request, which is transmitted to the authorization verification module. The authorization verification module parses the permissions required for the operation request based on the predefined permission matrix and compares and verifies them with the user's preset permission set. If the permissions are insufficient or exceeded, the verification fails and triggers the user's secondary confirmation step. If the permission verification passes, it directly enters the abnormal operation interception module. Step S2: After the request enters the abnormal operation interception module, the module analyzes the operation represented by the request based on a dynamic rule engine and an isolated forest model. The dynamic rule engine makes a preliminary judgment based on the compliance rule library built by the API call restrictions and platform behavior specifications of each life service platform. The isolated forest model identifies abnormal patterns by calculating the path length of data points in a random binary tree. If the operation is determined to be abnormal or non-compliant, it is intercepted, an alarm mechanism is triggered, and the operation is terminated. If the operation is determined to be compliant, the corresponding operation is executed and the API is called. Step S3: After the operation is completed, the log auditing and rule iteration module writes the operation-related information into the log database and stores the log using Merkle tree or WORM storage technology. By utilizing the hash chain structure of Merkle tree or the write-once-read-many feature of WORM medium, the integrity and immutability of the log are ensured. Step S4: Use web crawling technology to capture relevant information from various life service platforms, and use natural language processing technology to parse the captured information and extract key rule parameters; perform hot rule updates based on the extracted rule parameters, and apply the updated rules dynamically to the abnormal operation interception module without restarting the service, so as to realize continuous iteration and optimization of rules to adapt to ever-changing compliance requirements.

[0035] When the permission verification fails and triggers the user's secondary confirmation process, a secondary confirmation prompt message containing operation details and confirmation request is sent to the user through preset communication channels, such as mobile push notification, SMS or in-app message. The operation details include, but are not limited to, the operation type, amount involved, and target address information of the life service smart agent application. If the user refuses to confirm again within the specified time, the system will immediately terminate the processing flow of the current operation request, not perform any subsequent operations related to the request, and return feedback information of operation termination to the life service intelligent agent. If the user approves the secondary confirmation within the specified time, the system generates a one-time temporary token and returns the request containing the temporary token to the authorization verification module. The authorization verification module re-parses the permissions required by the operation instruction and performs permission verification in conjunction with the temporary token. If the verification passes, the request is forwarded to the abnormal operation interception module for further processing. If the verification still fails, the user's secondary confirmation process is triggered again or the operation is terminated directly.

[0036] In this embodiment, the permission matrix definition and verification logic in the authorization verification module includes: Define the set of permission granularities: P ={ Pay _ Limit _a, Pay _ Limit _b, Addr _ Read , Addr _ Write , Order _ Create} in, Pay _ Limit _a indicates a single payment limit of a yuan. Pay _ Limit _b indicates a single payment limit of b yuan. For example, Pay_Limit_50 means a single payment limit of 50 yuan, and Pay_Limit_200 means a single payment limit of 200 yuan. Addr _ Read This indicates permission to read address information. Addr _ Write This indicates the permission to write address information. Order _ Create This indicates the permission to create an order.

[0037] Users pre-set the permission set of the life service intelligent agent based on their own needs. S grant For example, users can configure the smart agent to order takeout with a single order limit of 50 yuan, and only read the default address. Sgrant Include Pay _ Limit _50 and Addr _ Read Permissions; When the intelligent agent generates operation instructions Op At that time, the set of permissions required to parse the operation instruction. Sneed ; Will S need Compared with user preset S grant To make a comparison, if S need S grant If all required permissions are within the scope of permissions granted by the user, the permission verification is considered successful; otherwise, the verification fails.

[0038] If the operation command Op Amount parameters Op . amount If the transaction amount exceeds 50 yuan, meaning it exceeds the single transaction limit of 50 yuan, the system will immediately suspend the operation and send a push notification to the user via preset communication channels such as mobile phone push notification, SMS, or in-app message. The notification will read, "The agent requests payment of [specific amount, which is greater than 50 yuan] to purchase [specific product or service name]. Do you approve?" After the user clicks "Approve", the system will generate a one-time temporary token (EphemeralToken) and return the request with the token to the authorization verification module for permission verification. Once the verification is successful, the operation will be allowed.

[0039] In this embodiment, the real-time abnormal operation interception based on isolated forest in the abnormal operation interception module is implemented in the following way: Extracting multidimensional feature vectors of operational behavior: X =[ x freq , x amount , x geo_dist , x dev_entropy ] in, x freq The operation frequency characteristic within the sliding window is obtained by statistically calculating the number of times the agent performs operations within a preset time window, and is used to reflect the frequency of operations. x amount The deviation of order amount from historical average is characterized by the Z-Score method, which is used to calculate the deviation. This is used to measure the degree of deviation between the current order amount and historical data; x geo_dist The physical distance characteristics between the current IP address and the usual delivery address are obtained through the distance calculation method between two points in the geographic information system, and are used to determine the anomaly of the operation initiation location. x dev_entropy The entropy value is a feature of device fingerprint. By calculating the uncertainty of device fingerprint information, it is used to detect whether the simulator is frequently changed. The higher the entropy value, the greater the uncertainty of the device fingerprint and the higher the probability of changing the simulator. An isolated forest model is constructed by building multiple random binary trees (iTrees). The construction process of each iTree is as follows: A subset of data is randomly selected from the operational behavior dataset as a subsample set; Randomly select a feature from the subsample set, and randomly select a split point between the maximum and minimum values ​​of the feature. Recursively split the data space according to the relationship between the feature value and the split point until a preset stopping condition is met (such as the tree reaching a specified height or the subsample set containing only one data point).

[0040] The outlier score is calculated using the following formula: in, E ( h ( x )) is a sample x The expected path length on each iTree c ( n () is the given number of samples n The average path length is used to standardize the path length. like S If the value is greater than 0.85, it is considered a high-risk abnormal operation. The automatic interception mechanism is immediately triggered, the HTTP request is terminated, and the account is marked as protected in the system to prevent subsequent operations.

[0041] If 0.6 < S If the value is less than 0.85, it is considered a medium-risk abnormal operation. A verification code check is added, and user identity is verified by calling a third-party captcha solving platform or sending a verification code to the user's mobile phone. Only after successful verification can the operation continue.

[0042] In this embodiment, the dynamic rule engine constructs a comprehensive and detailed compliance rule base based on the API call restrictions and behavioral norms of a wide range of lifestyle service platforms, including but not limited to various food delivery platforms and e-commerce transaction platforms. The rules in the compliance rule base are based on the multi-dimensional restrictions imposed by each lifestyle service platform on agent operations, including the following key factors: Request frequency constraints: Each lifestyle service platform sets an upper limit on the frequency at which agents can initiate API requests based on its own system capacity and business security considerations. For example, some platforms explicitly stipulate that the API's QPS (queries per second) must be less than a specific threshold to prevent agents from making too many requests to the server or to carry out malicious operations.

[0043] Request header specifications: To ensure the legitimacy and traceability of the request source, some local service platforms require that the request header must contain specified information, such as the real Referer, to identify the origin of the request and prevent the infiltration of illegal requests.

[0044] Operational Restrictions: Based on their own business characteristics and risk control needs, lifestyle service platforms restrict certain operational behaviors of intelligent agents. For example, to avoid abnormal business operations, intelligent agents are prohibited from placing orders across cities within a short period of time; in critical business processes involving payments, some platforms require payment interfaces to carry a signature to verify the legality and integrity of requests, while disabling specific fingerprints (such as Selenium specific fingerprints) to prevent unauthorized simulation operations.

[0045] For example, the compliance rule library includes Meituan rules (API QPS < 1, Header must include real Referer, and short-term cross-city ordering is prohibited) and Taobao rules (Payment interface must include signature, and Selenium specific fingerprints are disabled).

[0046] By deploying a "compliance crawler" to crawl platform rules weekly, using the BERT model to extract key restriction words, and automatically updating them to the Drools rule file, hot updates of rules are achieved.

[0047] When a life service agent initiates an operation request, the dynamic rule engine quickly extracts a set of rules related to the request from the compliance rule base. The dynamic rule engine compares and analyzes the various parameters of the agent's request, including request frequency, request header information, and operation behavior characteristics, with the extracted rules one by one. If the request parameters fully comply with the requirements of the corresponding rules in the compliance rule base, the request is deemed to have passed the initial compliance judgment and is allowed to enter the compliance review stage in the abnormal mode. If any of the request parameters do not comply with the rules, the request is deemed to have compliance risks, and the request is directly blocked or the corresponding risk handling mechanism is triggered, such as requiring the agent to perform secondary confirmation or adding additional verification steps, to ensure that the agent's operation always complies with the normative requirements of each life service platform.

[0048] In this embodiment, the implementation method of compliance rule iteration in step S4 includes: A highly flexible and adaptable compliance-compliant web crawler is deployed, running automatically on a weekly basis according to preset scheduled tasks. Its crawling scope broadly covers publicly available information sources from major lifestyle service platforms, including but not limited to official platform documents such as "User Agreements" and "Developer Guidelines," as well as relevant technical documents and announcements from official platform technical blogs. The crawler employs intelligent webpage parsing technology, accurately identifying and extracting key information related to the compliance of intelligent agent operations, ensuring the comprehensiveness and accuracy of the information obtained.

[0049] A pre-trained BERT model was used for deep analysis of automatically crawled text information. Leveraging its powerful natural language understanding capabilities, the BERT model accurately identifies semantic structures and key information points within the text. During analysis, the model focused on extracting key constraint words related to agent operation restrictions, such as statements explicitly limiting the frequency of agent operations (e.g., "maximum [X] requests per minute") and descriptions of specific behaviors prohibited from being performed by the agent (e.g., "prohibit the agent from creating fake orders"). By extracting and analyzing these key constraint words, unstructured text information was transformed into structured rule parameters, providing an accurate data foundation for subsequent rule updates.

[0050] An efficient rule update mechanism is established to automatically and seamlessly update the rule parameters extracted by NLP parsing to the rule files (.drl) of the dynamic rule engine (such as Drools). The rule hot-update process employs incremental update technology, updating only the changed parts of the rule file, avoiding the system resource consumption and service interruption risks that may arise from full updates. Simultaneously, by monitoring the update status of the rule files in real time, it is ensured that the updated rules take effect immediately in the rule engine without restarting related services. This enables rapid response to rule changes on the life service platform and guarantees the continuous compliance of intelligent agent operations.

[0051] In this embodiment, the BERT model performs deep analysis on the automatically crawled text information through the following steps: The raw text information obtained by automatic crawling is cleaned and standardized to remove noise information such as special characters, irrelevant symbols, and HTML tags. The text is then uniformly converted into a specific encoding format (such as UTF-8) to ensure the consistency and processability of the text.

[0052] The cleaned text is segmented into words using a word segmentation algorithm suitable for Chinese or the corresponding language environment (such as a dictionary-based word segmentation algorithm or a deep learning-based word segmentation model). This segmentation algorithm divides the text into semantically meaningful words or sub-word units, forming a word segmentation sequence.

[0053] Based on the word segmentation sequence, construct a suitable input representation for the BERT model, specifically including: Special classification markers ([CLS]) and separation markers ([SEP]) are added. The [CLS] marker is usually placed at the beginning of the input sequence and is used to gather the semantic information of the entire sequence for subsequent overall classification or judgment. The [SEP] marker is used to separate different text paragraphs or sentences, helping the model distinguish different semantic units.

[0054] The word segments are mapped to corresponding word vectors, and positional encoding information is combined to add the positional information of each word in the sequence to preserve the text's sequential features. Furthermore, paragraph encoding and other information can be added as needed to further enrich the input representation.

[0055] The constructed model is fed into the pre-trained BERT model, which uses its multi-layer Transformer architecture to perform deep encoding and interactive processing of the input. The self-attention mechanism in the model can automatically capture the semantic associations and dependencies between different words in the text, thereby accurately identifying the semantic structure in the text.

[0056] In the output layer of the BERT model, specific extraction strategies are designed for key information extraction tasks. For example, to extract information on agent operation frequency restrictions, a classifier can be trained on the model output to determine whether each position belongs to key information related to frequency restrictions; or sequence labeling can be used to label each word to indicate whether it is part of key information. Through these methods, key information points related to agent operation restrictions in the text can be accurately extracted, such as frequency restriction values ​​and descriptions of prohibited behaviors.

[0057] The extracted key information is post-processed, including removing duplicate information, merging related segments, and performing semantic normalization, in order to improve the quality and usability of the key information.

[0058] The processed key information is output in a structured format (such as JSON, XML, etc.) so that the subsequent rule update module can directly use this information to perform hot rule update operations.

[0059] In this embodiment, the structure definition of the log library includes the following fields: Timestamp: Accurately records the timestamp of an operation, using a standard time format to ensure the accuracy and consistency of time information, so as to accurately trace the time sequence of operations; Op_ID: Assign a unique identifier to each operation to uniquely identify and distinguish different operation instances in the system, facilitating subsequent querying and auditing of specific operations; User_ID: Records the user identifier that initiated the operation, clearly identifies the responsible party for the operation, and facilitates tracing the source of the operation during the audit process; Action: Describes the specific details of the operation, including the type of operation (such as query, order placement, payment, etc.), the objects involved in the operation (such as product ID, service type, etc.), and fully reflects the business logic of the operation; Auth_Token: Records the authorization token information used during the operation, which is used to verify the legality of the operation and the source of the authorization, ensuring that the operation is carried out within the legal authorization scope; Risk_Score: Records the risk score of an operation after compliance review, reflecting the degree of compliance risk of the operation and providing a basis for subsequent risk assessment and decision-making; Result: Records the final result of the operation, such as success, failure, or interception status information, as well as related error codes or prompts, to facilitate understanding of the operation's execution status.

[0060] Among them, a storage technology with tamper-proof characteristics is used to store the operation logs: Merkle Tree chained storage: Log data is organized and stored using a Merkle tree data structure. Each leaf node stores the hash value of a log record, while non-leaf nodes store a combined hash of the hash values ​​of their child nodes. This chained structure ensures that any modification to the log data will result in a change in the hash value of the relevant nodes, allowing for rapid detection of data tampering. Furthermore, by incorporating blockchain and other technological concepts, the root hash of the Merkle tree is stored in an immutable storage area or periodically notarized, further enhancing the log's credibility.

[0061] WORM (Write Once Read Many) CD-ROM storage: Utilizing the physical characteristics of WORM CD-ROM libraries, log data can be written once and read many times. Once log data is written to the CD-ROM, it cannot be modified or deleted, effectively preventing administrators or other personnel from tampering with historical logs, ensuring the originality and integrity of the logs, and meeting the requirements for data authenticity in judicial evidence collection.

[0062] In summary, the method provided in this embodiment constructs a "three-line defense" similar to bank transaction risk control. The specific process is as follows: Preemptive defense (S1): Role-based access control (RBAC) combined with the OAuth 2.0 Scope mechanism is used to verify the agent's permissions before any operation. First, the permission granularity is defined, with the user pre-setting the agent's permission set. When the agent generates an operation command, the required permissions are parsed. If the required permissions are within the user-defined permission set, the verification passes; otherwise, the system suspends the operation, sends a push notification to the user's mobile phone, and after the user clicks "Approve," a one-time temporary token is generated to allow the operation.

[0063] In-process defense (S2): Introducing the unsupervised learning algorithm—Isolation Forest—for anomaly detection. First, extract multi-dimensional feature vectors of operational behavior, including operation frequency, deviation of order amount from historical averages, physical distance between the current IP address and frequently used delivery locations, and entropy of the device fingerprint. Then, construct multiple random binary trees (iTrees) to detect anomalies by partitioning the data space. Calculate anomaly scores; if the score exceeds a threshold, trigger automatic interception or add a CAPTCHA verification step.

[0064] Post-event defense (S3 / S4): Record the agent's operation logs, using Merkle Tree linked storage or WORM (Write Once Read Many) CD-ROM library storage technology to ensure the logs' immutability. Simultaneously, deploy a "compliance crawler" to scrape the "User Agreement," "Developer Guidelines," and technical blogs from major platforms weekly, using the BERT model to extract key restrictive words and automatically updating them to the Drools rule file, achieving hot rule updates.

[0065] An Example of an Automated Operation Compliance Audit System for a Life Service Intelligent Agent This embodiment provides an automated operation compliance auditing system for a life service intelligent agent, including: The authorization verification module is used to verify the permissions required by the smart agent based on the user's preset permission set before the smart agent performs an operation. If the permissions are insufficient or exceed the preset limit, the module will complete the permissions or suspend the operation through a user secondary confirmation mechanism. The abnormal operation interception module uses a dynamic rule engine and an isolated forest algorithm to analyze the behavioral characteristics of the agent during the operation process in real time, and identify and intercept abnormal operations. The log auditing and rule iteration module records all operation logs to an immutable storage medium and dynamically updates the compliance rule library according to the latest laws, regulations and platform behavior guidelines.

[0066] The authorization verification module includes: The permission matrix definition unit defines a set of permission granularities, including but not limited to payment limits, address read / write permissions, and order creation permissions. The user configuration unit allows users to pre-set the permission set for intelligent agents; The verification logic unit parses the permissions required for the intelligent agent to generate operation instructions and compares them with the user's preset permission set. If the required permissions are within the preset range, the verification passes; otherwise, a secondary confirmation mechanism is triggered.

[0067] The abnormal operation interception module includes: The feature extraction unit extracts multi-dimensional feature vectors from the agent's operation process, including but not limited to operation frequency, amount deviation, IP address distance, and device entropy value. The isolated forest model unit constructs multiple random binary trees based on the extracted feature vectors, and identifies abnormal operations by calculating the path length of data points in the binary trees; The judgment logic unit classifies the risk of an operation based on the anomaly score. When the anomaly score exceeds a preset threshold, it triggers automatic interception or adds a CAPTCHA verification step.

[0068] The log auditing and rule iteration module includes: The log recording unit uses Merkel tree-chain storage or WORM optical disc library storage technology to record all operation logs, ensuring that the logs are tamper-proof. The compliance rule base construction unit builds and maintains the compliance rule base based on the API call restrictions and behavioral norms of various life service platforms; The rule iteration unit automatically crawls platform specifications, extracts key restriction words using NLP technology, and dynamically updates the compliance rule base, enabling hot updates of rules without restarting the service.

[0069] In this embodiment, the compliance rule base construction unit further includes: The platform rules definition sub-unit defines specific rules such as API call frequency limits, request header requirements, and prohibited behaviors for different life service platforms; The rule mapping subunit maps platform rules into rule expressions that can be recognized internally by the algorithm, so that the rule engine can process and match them.

[0070] In this embodiment, the rule iteration unit further includes: The data collection subunit deploys compliant web crawlers to regularly collect user agreements, developer guidelines, and technical blogs from various lifestyle service platforms. NLP parsing subunits utilize natural language processing models such as BERT to extract key limiting words and rule parameters; The rule update subunit automatically updates the extracted rule parameters into the compliance rule base, enabling dynamic iteration of rules.

[0071] Through the above technical solutions, the present invention can effectively solve the compliance risk issues faced by the automated operation of life service intelligent agents, and provide users and platforms with safe and reliable intelligent agent services.

[0072] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0073] The above embodiments are merely preferred embodiments of the present invention and should not be construed as limiting the scope of protection of the present invention. Any non-substantial changes and substitutions made by those skilled in the art based on the present invention shall fall within the scope of protection claimed by the present invention.

Claims

1. A method for automated operation compliance auditing of a life service intelligent agent, characterized in that, include: Step S1: The life service intelligent agent initiates an operation request, which is transmitted to the authorization verification module; The authorization verification module parses the permissions required for the operation request based on the predefined permission matrix and compares and verifies them with the user's preset permission set; If insufficient or excessive permissions are detected, the verification will fail, triggering a second confirmation step for the user; if the permission verification passes, the system will directly enter the abnormal operation interception module. Step S2: After the request enters the abnormal operation interception module, the module analyzes the operation represented by the request based on a dynamic rule engine and an isolated forest model. The dynamic rule engine makes a preliminary judgment based on the compliance rule library built by the API call restrictions and platform behavior specifications of each life service platform. The isolated forest model identifies abnormal patterns by calculating the path length of data points in a random binary tree. If the operation is determined to be abnormal or non-compliant, it is intercepted, an alarm mechanism is triggered, and the operation is terminated. If the operation is determined to be compliant, the corresponding operation is executed and the API is called. Step S3: After the operation is completed, the log auditing and rule iteration module writes the operation-related information into the log database and stores the log using Merkle tree or WORM storage technology; Step S4: Use web crawling technology to capture relevant information from various life service platforms, use natural language processing technology to parse the captured information and extract key rule parameters; perform hot rule updates based on the extracted rule parameters, and apply the updated rules dynamically to the abnormal operation interception module without restarting the service, so as to achieve continuous iterative optimization of the rules.

2. The method according to claim 1, characterized in that: When permission verification fails and triggers a secondary confirmation step for the user, a secondary confirmation prompt message containing operation details and a confirmation request is sent to the user through a preset communication channel; If the user refuses to confirm again within the specified time, the system will immediately terminate the processing flow of the current operation request, not perform any subsequent operations related to the request, and return feedback information of operation termination to the life service intelligent agent. If the user approves the second confirmation within the specified time, the system generates a one-time temporary token and returns a request containing the temporary token to the authorization verification module; The authorization verification module re-parses the permissions required by the operation command and performs permission verification in conjunction with the temporary token. If the verification passes, the request is forwarded to the abnormal operation interception module for further processing. If the verification still fails, the user's secondary confirmation process is triggered again or the operation is terminated directly.

3. The method according to claim 1, characterized in that, The permission matrix definition and verification logic in the authorization verification module include: Define the set of permission granularities: P ={ Pay _ Limit _a, Pay _ Limit _b, Addr _ Read , Addr _ Write , Order _ Create } in, Pay _ Limit _a indicates a single payment limit of a yuan. Pay _ Limit _b indicates a single payment limit of b yuan. Addr _ Read This indicates permission to read address information. Addr _ Write This indicates the permission to write address information. Order _ Create Indicates the permission to create an order; Users pre-set the permission set of the life service intelligent agent based on their own needs. S grant ; When the intelligent agent generates operation instructions Op At that time, the set of permissions required to parse the operation instruction. S need ; Will S need With user-preset permission set S grant To make a comparison, if S need S grant If all required permissions are within the scope of permissions granted by the user, the permission verification is considered successful; otherwise, the verification fails.

4. The method according to claim 1, characterized in that, The abnormal operation interception module, which uses isolated forests for real-time abnormal operation interception, is implemented in the following way: Extracting multidimensional feature vectors of operational behavior: X =[ x freq , x amount , x geo_dist , x dev_entropy ] in, x freq This is a feature representing the frequency of operations within the sliding window, used to reflect the frequency of operations. x amount This is a feature representing the deviation of order amount from the historical average, used to measure the degree of deviation of the current order amount from historical levels. x geo_dist The physical distance between the current IP address and the usual delivery location is used to determine the anomaly of the operation initiation location; x dev_entropy The entropy value feature of the device fingerprint is used to detect whether the simulator is frequently changed by calculating the uncertainty of the device fingerprint information; An isolated forest model is constructed by building multiple random binary trees. The construction process of each iTree is as follows: A subset of data is randomly selected from the operational behavior dataset as a subsample set; Randomly select a feature from the subsample set, and randomly select a split point between the maximum and minimum values ​​of the feature. Recursively split the data space according to the relationship between the feature value and the split point until a preset stopping condition is met.

5. The method according to claim 4, characterized in that: The outlier score is calculated using the following formula: in, E ( h ( x )) is a sample x The expected path length on each iTree c ( n () is the given number of samples n The average path length is used to standardize the path length. like S If the value is greater than 0.85, it is judged as a high-risk abnormal operation. The automatic interception mechanism is immediately triggered to terminate the HTTP request and mark the account in the protection mode in the system to prevent its subsequent operations. If 0.6 < S If the value is less than 0.85, it is considered a medium-risk abnormal operation. A verification code check is added, and user identity is verified by calling a third-party captcha solving platform or sending a verification code to the user's mobile phone. Only after successful verification can the operation continue.

6. The method according to claim 1, characterized in that, The rules in the compliance rule base are based on the multi-dimensional restrictions imposed by various lifestyle service platforms on the operation of intelligent agents, including the following key factors: Request frequency constraints: Each life service platform sets an upper limit standard for the frequency at which intelligent agents can initiate API requests to it, based on its own system capacity and business security considerations; Request header specifications: To ensure the legitimacy and traceability of the request source, some local service platforms require that the request header must contain specified information to identify the origin of the request and prevent the infiltration of illegal requests; Operational behavior restrictions: Based on its own business characteristics and risk control needs, the life service platform restricts certain operational behaviors of the intelligent agent; When a life service agent initiates an operation request, the dynamic rule engine quickly extracts a set of rules related to the request from the compliance rule base; the dynamic rule engine compares and analyzes each parameter of the agent's request with the extracted rules one by one. If the request parameters fully comply with the requirements of the corresponding rules in the compliance rule base, the request is deemed to have passed the initial compliance judgment and is allowed to enter the compliance review stage in the abnormal mode; if any of the request parameters do not comply with the rules, the request is deemed to have compliance risks, and the request is directly blocked or the corresponding risk handling mechanism is triggered to ensure that the operation of the intelligent agent always complies with the normative requirements of each life service platform.

7. The method according to claim 1, characterized in that, The implementation methods for compliance rule iteration in step S4 include: Deploy a compliant web crawler program. This crawler program runs automatically on a weekly cycle according to a preset scheduled task. Its crawling scope covers a wide range of publicly available information sources from major life service platforms. The crawler program uses intelligent web page parsing technology to identify and extract key information related to the compliance of intelligent agent operations. The pre-trained BERT model is used to perform deep analysis on automatically crawled text information. During the analysis process, the BERT model focuses on extracting key restriction words related to the constraints of agent operation. By extracting and analyzing these key restriction words, unstructured text information is transformed into structured rule parameters. A rule update mechanism is established to automatically and seamlessly update the rule parameters extracted by NLP parsing to the rule files of the dynamic rule engine. The rule hot update process adopts incremental update technology, which only updates the parts of the rule file that have changed, avoiding the risk of system resource consumption and service interruption that may be caused by full updates. At the same time, by monitoring the update status of the rule file in real time, it is ensured that the updated rules can take effect in the rule engine immediately without restarting related services.

8. The method according to claim 7, characterized in that, The BERT model performs deep analysis on automatically crawled text information through the following steps: The raw text information obtained by automatic crawling is cleaned and standardized to remove noise information from the text and convert the text into a specified encoding format. The cleaned text is segmented into words using a segmentation algorithm suitable for Chinese or the corresponding language environment, forming a segmentation sequence. Based on the word segmentation sequence, construct a suitable input representation for the BERT model, specifically including: Special classification markers ([CLS]) and separator markers ([SEP]) are added. The [CLS] marker is usually placed at the beginning of the input sequence and is used to aggregate the semantic information of the entire sequence; the [SEP] marker is used to separate different text paragraphs or sentences, helping the model distinguish different semantic units. The word segmentation is mapped to the corresponding word vectors, and the positional encoding information is combined to add the positional information of each word in the sequence in order to preserve the sequential features of the text; The constructed model is fed into the pre-trained BERT model, which performs deep encoding and interactive processing of the input through its multi-layer Transformer architecture. In the output layer of the BERT model, extraction strategies are designed for the key information extraction task, including: for extracting agent operation frequency restriction information, a classifier is trained on the model output to determine whether each position belongs to frequency restriction related key information; or a sequence labeling method is used to label each word to indicate whether it belongs to the key information. The extracted key information is post-processed and output in a structured format so that the rule iteration unit can directly use this information to perform hot rule updates.

9. The method according to any one of claims 1 to 8, characterized in that: The structure definition of the log library includes the following fields: Timestamp: Records the timestamp of the operation. Op_ID: Assign a unique identifier to each operation to uniquely identify and distinguish different operation instances in the system; User_ID: Records the user identifier who initiated the operation, clarifying the responsible party for the operation; Action: Describes the specific content of the operation, including at least the type of operation and the objects involved, and fully reflects the business logic of the operation; Auth_Token: Records the authorization token information used during the operation, which is used to verify the legitimacy of the operation and the source of the authorization; Risk_Score: Records the risk score of an operation after compliance review, reflecting the degree of compliance risk of the operation; Result: Records the final result of the operation, as well as any related error codes or message messages; Among them, a storage technology with tamper-proof characteristics is used to store the operation logs: Merkle tree chained storage: Log data is organized and stored using a Merkle tree data structure. Each leaf node stores the hash value of a log record, and non-leaf nodes store the combined hash of the hash values ​​of their child nodes. WORM CD-ROM Library Storage: Utilizing the physical characteristics of the WORM CD-ROM library, log data can be written once and read multiple times; once the log data is written to the CD-ROM, it cannot be modified or deleted.

10. An automated operation compliance auditing system for a life service intelligent agent, characterized in that, This system is applied to an automated operation compliance auditing method for a life service intelligent agent as described in any one of claims 1 to 9, the system comprising: The authorization verification module is used to verify the permissions required by the smart agent based on the user's preset permission set before the smart agent performs an operation. If the permissions are insufficient or exceed the preset limit, the module will complete the permissions or suspend the operation through a user secondary confirmation mechanism. The abnormal operation interception module uses a dynamic rule engine and an isolated forest algorithm to analyze the behavioral characteristics of the agent during the operation process in real time, and identify and intercept abnormal operations. The log auditing and rule iteration module records all operation logs to an immutable storage medium and dynamically updates the compliance rule library according to the latest laws, regulations and platform behavior guidelines.

Images