A network threat response system based on multi-agent cooperation

Abstract

This invention discloses a network threat response system based on multi-agent cooperation, comprising: a trace configuration agent for generating behavioral configuration chains; a configuration aggregation module for generating threat configuration clusters; a trajectory inference agent for generating a threat trajectory grid; a resonance modeling module for executing a pulse-constrained resonance aggregation algorithm to form a threat intent resonance network; a probe pulse agent for executing cooperative probe pulses to form a cooperative probe pulse record set; a response graph generation module for generating an attack response graph; a resonance adjudication agent for constructing an attack relationship graph and executing an improved Tarjan algorithm, introducing a pulse resonance adjudication mechanism to identify strongly connected attack units and determine the minimum blocking node set; and a response execution module for executing network threat response based on the minimum blocking node set. This invention achieves efficient network threat response through the pulse-constrained resonance aggregation algorithm and the improved Tarjan algorithm.

Description

Technical Field

[0001] This invention relates to the field of multi-agent collaboration and network security technology, and in particular to a network threat response system based on multi-agent collaboration. Background Technology

[0002] With the continuous expansion of network scale and the widespread application of technologies such as cloud computing, the Internet of Things, and remote work, attack methods in the network environment are gradually showing a trend towards multi-stage, covert, and collaborative development. Attackers often form complex attack chains in the network through multi-node penetration, lateral movement, and privilege escalation, posing increasing challenges to traditional network threat identification and response technologies based on single-point detection or rule matching. Existing network security protection systems typically rely on log auditing, traffic monitoring, and rule base matching to detect abnormal behavior, but these methods generally suffer from the following problems in practical applications:

[0003] The collected network logs, traffic records, and host behavior data are from complex sources with significant structural differences. Time discrepancies and semantic inconsistencies exist between multiple data sources, making it difficult to accurately establish the correlation between attack behaviors across different data sources and impacting the overall ability to identify continuous attack chains. Existing threat detection methods primarily focus on single-node anomaly identification, lacking the ability to comprehensively model the propagation path of attacks in the network and the collaborative relationships between multiple nodes. This makes it difficult to accurately depict the propagation trajectory of complex attacks across multiple dimensions such as network topology, account permissions, and host processes. Response decisions for multi-stage attacks typically rely on manual analysis or simple rule triggers, lacking automated adjudication mechanisms based on graph structure analysis and intelligent decision-making algorithms. This results in problems such as large response delays, inaccurate selection of blocking nodes, and significant impact on normal business operations during threat response.

[0004] Therefore, how to provide a network threat response system based on multi-agent collaboration is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a network threat response system based on multi-agent collaboration. This invention uses a pulse-constrained resonance aggregation algorithm and an improved Tarjan algorithm to perform structured modeling and correlation analysis on multi-source network behavior data, thereby achieving accurate identification and intelligent response to network threats. By constructing an attack relationship graph, it identifies strongly connected attack units and determines the minimum blocking node set, thereby achieving precise cutting off of attack propagation paths. It has the advantages of high threat identification accuracy, high response efficiency, and minimal impact on normal network services.

[0006] A network threat response system based on multi-agent cooperation according to an embodiment of the present invention includes:

[0007] Trace-based intelligent agents are used to perform behavioral configuration processing on collected network security data and generate behavioral configuration chains.

[0008] The configuration aggregation module is used to perform structural comparison on the behavior configuration chain, generate candidate configurations, and aggregate the candidate configurations to generate threat configuration clusters;

[0009] A trajectory inference agent is used to construct a set of behavior propagation nodes based on the threat configuration cluster, establish connection relationships, and generate a threat trajectory grid;

[0010] The resonance modeling module is used to execute the pulse-constrained resonance aggregation algorithm on the threat trajectory grid, extract key behavior nodes, generate resonance intent units, and connect them to form a threat intent resonance network.

[0011] A probe pulse agent is used to execute cooperative probe pulses at key behavioral nodes based on the threat intent resonance network, and to record the node behavior change information after the cooperative probe pulses are applied, forming a cooperative probe pulse record set;

[0012] The reaction map generation module is used to perform correlation analysis on the behavioral changes of key behavioral nodes before and after the cooperative detection pulse based on the cooperative detection pulse record set, establish the mapping relationship between node behavioral changes and corresponding key behavioral nodes, and organize them according to the behavioral change type and occurrence order to generate an attack reaction map.

[0013] The resonant adjudication agent is used to construct an attack relationship graph based on the threat configuration cluster, threat intent resonant network and attack response map, and execute the improved Tarjan algorithm. The improved Tarjan algorithm introduces a pulse resonant adjudication mechanism to identify strongly connected attack units and determine the minimum blocking node set.

[0014] The response execution module is used to execute network threat responses based on the minimum set of blocking nodes.

[0015] Optionally, the trace configuration agent specifically refers to:

[0016] Collect network security data, including network log data, network traffic data, host behavior data, and access authentication records;

[0017] The network security data is subjected to behavior shaping processing, time alignment processing is performed according to a unified timestamp, and the time-aligned network security data is parsed to extract the behavior source address, behavior target address, access protocol type, operation object identifier, and behavior occurrence time information.

[0018] The parsed network security data is sorted according to the time sequence of the behavior and grouped according to the relationship between the source address and the target address of the behavior.

[0019] Within each group, adjacent behavior records are connected in chronological order to form a behavior node sequence, and the behavior node sequences are chained together according to the behavior triggering order to generate a behavior configuration chain.

[0020] Optionally, the configuration aggregation module specifically comprises:

[0021] Obtain the behavior configuration chain and number the behavior nodes in the behavior configuration chain according to the order of behavior triggering time;

[0022] According to the set length of the sliding window, the sliding is performed on the behavior configuration chain with a step size of one behavior node. Each time, multiple consecutive behavior nodes are extracted from the behavior configuration chain to form a candidate behavior sequence, and the start node number and end node number of the candidate behavior sequence in the behavior configuration chain are recorded.

[0023] A node-by-node structural comparison is performed on different candidate behavior sequences. When the behavior source address, behavior target address, access protocol type, and operation object identifier of the corresponding behavior nodes in two candidate behavior sequences are all the same, the candidate behavior sequence is marked as a duplicate behavior sequence.

[0024] Candidate behavior sequences marked as repeating behavior sequences are combined according to node attributes to generate sequence identifiers, and candidate behavior sequences with the same sequence identifiers are grouped into the same sequence set. The earliest appearing candidate behavior sequence in each sequence set is selected as the standard behavior sequence.

[0025] The occurrence positions of the standard behavior sequence and all candidate behavior sequences in the sequence set are associated and recorded to generate candidate configurations;

[0026] The occurrence count of each candidate configuration in different behavioral configuration chains is counted, and candidate configurations with an occurrence count greater than a preset occurrence count threshold are aggregated to generate a threat configuration cluster.

[0027] Optionally, the trajectory inference agent specifically refers to:

[0028] Obtain the threat configuration clusters, and extract the behavior source address, behavior target address, access protocol type, operation object identifier, and behavior occurrence time corresponding to each behavior node from each threat configuration cluster;

[0029] Using the behavior nodes in the threat configuration cluster as the initial propagation nodes, network access records before the time of the behavior occurrence are retrieved forward based on the communication records between the behavior source address and the behavior target address, and network access records after the time of the behavior occurrence are retrieved backward to determine the associated nodes that have a communication relationship with the initial propagation node, and construct a set of behavior propagation nodes;

[0030] Based on the communication path between the source address and the target address in the set of behavior propagation nodes, a network topology connection relationship is established between device nodes, and the connection is made in the order of the communication path.

[0031] Based on the login relationship between the account identifier and the device identifier in the access authentication record, establish an account permission connection relationship between the account node and the device node;

[0032] Based on the derivation relationship between the process identifier and the parent process identifier in the host behavior data, host process connection relationships are established between process nodes;

[0033] Based on the access records between the operation object identifier and the access device identifier in the file access records, establish a file access connection relationship between the device node and the file node;

[0034] Network device nodes, account nodes, process nodes, and file nodes are uniformly numbered according to their corresponding connection relationships, and the connection relationships are mapped to directed connection edges between nodes to generate a threat trajectory grid.

[0035] Optionally, the resonance modeling module specifically comprises:

[0036] Extract the occurrence time of the behavior, node type, and connection relationship between nodes from the threat trajectory grid, and generate node propagation paths according to the connection relationship;

[0037] The pulse-constrained resonance aggregation algorithm is executed. The time difference is obtained by subtracting the occurrence time of the behavior of adjacent nodes in the node propagation path. When the time difference is less than the preset pulse time threshold, the corresponding connection relationship is marked as a pulse propagation connection, and multiple consecutive pulse propagation connections are combined to form a pulse propagation path.

[0038] For each pulse propagation path, the nodes are counted according to their node types. The number of times the same node type appears in the pulse propagation path is accumulated, and the accumulated result is divided by the total number of nodes in the pulse propagation path to obtain the node resonance coefficient. When the node resonance coefficient is greater than the preset resonance threshold, the corresponding node is marked as a key behavior node.

[0039] Using the key behavior node as the central node, the adjacent nodes that are directly connected to the key behavior node are traversed in the threat trajectory grid. The time difference is obtained by subtracting the time of the behavior occurrence between the key behavior node and the adjacent node. When the time difference is less than the preset resonance time threshold, the key behavior node and the adjacent node are combined according to the connection relationship to form a resonance node set.

[0040] Each set of resonant nodes is defined as a resonant intent unit, and the number of shared nodes between different resonant intent units is counted. When the number of shared nodes between two resonant intent units is greater than a preset sharing threshold, a connection relationship is established between the two resonant intent units.

[0041] Using resonant intent units as nodes and directed connections established between resonant intent units according to the chronological order of their actions as edges, a threat intent resonant network is formed.

[0042] Optionally, the probe pulse agent specifically refers to:

[0043] The resonant intent units in the threat intent resonant network are sorted according to the order of the occurrence of the behavior, and the key behavior nodes and the corresponding connection relationships of each resonant intent unit are extracted.

[0044] Cooperative detection pulses are executed sequentially at the key behavior nodes according to the time sequence of their actions.

[0045] The collaborative detection pulse includes a session delay pulse and an authentication challenge pulse. The session delay pulse delays the data response process of the network session by adding a preset time delay to the network connection corresponding to the key behavior node. The authentication challenge pulse inserts an authentication verification request into the access session corresponding to the key behavior node, performs identity authentication verification on the access request, and returns the authentication response result.

[0046] The behavior changes of key behavioral nodes before and after the collaborative detection pulse are recorded, including changes in communication targets and changes in access frequency.

[0047] The key behavior node identifier, connection relationship identifier, cooperative detection pulse type, pulse trigger time, pulse duration and corresponding node behavior change information are associated and recorded to generate node behavior change records;

[0048] The records of node behavior changes are collected according to the chronological order of the behavior of the resonant intent unit to form a collaborative detection pulse record set.

[0049] Optionally, the reaction spectrum generation module specifically comprises:

[0050] The node behavior change records in the collaborative detection pulse record set are sorted according to the pulse trigger time, and the key behavior node identifier, connection relationship identifier, collaborative detection pulse type, pulse trigger time, pulse duration and node behavior change information are extracted from each node behavior change record.

[0051] The behavior change information of each key behavior node before the collaborative detection pulse is taken as the pre-pulse behavior segment, and the behavior change information of each key behavior node after the collaborative detection pulse is taken as the post-pulse behavior segment. The pre-pulse behavior segment and the post-pulse behavior segment are paired according to the same key behavior node identifier and the same connection relationship identifier.

[0052] A correlation analysis was performed on the pre-pulse and post-pulse behavior segments after pairing. The communication target address and access frequency in the pre-pulse and post-pulse behavior segments were compared item by item. When the communication target address changed, it was marked as a communication target change event. When the access frequency increased or decreased, it was marked as an access frequency change event. The communication target change event and the access frequency change event were recorded as behavior change types, respectively.

[0053] Using key behavior node identifiers as graph nodes, and connection relationship identifiers, cooperative detection pulse types, and behavior change types as node attributes, directed connections are established between graph nodes according to the order of pulse triggering times of key behavior nodes to generate an attack response graph.

[0054] Optionally, the resonance adjudication agent specifically refers to:

[0055] Based on the source address and target address of the behavior in the threat configuration cluster, configuration nodes are established, and directed connections are established between configuration nodes in the order of the occurrence of the behavior.

[0056] Map the resonant intent units in the threat intent resonant network to resonant nodes, and establish directed connections between resonant nodes according to the chronological order of the behaviors of the resonant intent units.

[0057] Key behavioral nodes in the attack response graph are mapped to response nodes, and directed connection edges are established between response nodes according to the directed connection relationships in the attack response graph.

[0058] When the source address or target address of the behavior in the configuration node is consistent with the node identifier in the resonance node, a directed connection edge is established between the configuration node and the resonance node; when the node identifier in the resonance node is consistent with the key behavior node identifier in the response node, a directed connection edge is established between the resonance node and the response node, and an attack relationship graph is constructed.

[0059] An improved Tarjan algorithm is executed on the attack graph, and a pulse resonance adjudication mechanism is introduced to identify all strongly connected attack units in the attack graph.

[0060] Traverse each strongly connected attack unit in the attack relationship graph, identify the cross-unit directed connection edges from the current strongly connected attack unit to other strongly connected attack units, and record the starting node of each cross-unit directed connection edge.

[0061] The starting nodes corresponding to all cross-unit directed connection edges are counted to obtain the number of cross-unit connections for each node; the nodes are sorted in descending order of the number of cross-unit connections, and the nodes with the highest number of cross-unit connections are selected as candidate blocking nodes.

[0062] In the attack relationship graph, candidate blocking nodes and their associated directed edges are removed sequentially. After each removal, it is checked whether there is still a directed connection path between the strongly connected attack unit containing the resonant node and other strongly connected attack units. When the detection result is that there is no directed connection path, all the currently selected candidate blocking nodes are determined as the minimum blocking node set.

[0063] Optionally, the step of executing the improved Tarjan algorithm on the attack graph, introducing a pulse resonance adjudication mechanism to identify all strongly connected attack units in the attack graph, specifically involves:

[0064] A depth-first traversal is performed on each node in the attack relationship graph. During the traversal, an initial access number and a backtracking number are written for each node, and the node is pushed onto the traversal node stack. The initial access number is written in ascending order according to the order in which the node is accessed by the depth-first traversal. The backtracking number is written with the same value as the initial access number when the node is initialized. The backtracking number of the current node is updated according to the initial access number or backtracking number of the adjacent node reached by the current node through the directed connection edge, so that the backtracking number always represents the earliest access node number reached by the current node through the traversed path.

[0065] When visiting adjacent nodes during depth-first traversal, if both the current node and its adjacent node are responding nodes, a pulse resonance adjudication mechanism is executed. This mechanism determines the cooperative detection pulse type and pulse triggering time of the current node and its adjacent node. If the cooperative detection pulse type is consistent and the difference in pulse triggering time is less than a set tolerance threshold, depth-first traversal continues along the corresponding directed connection edge. If at least one of the current node and its adjacent node is not a responding node, depth-first traversal continues according to the directed connection relationship between the nodes.

[0066] When the backtracking sequence number of a node matches the first access sequence number, nodes are popped sequentially from the traversal node stack until the current node. The popped nodes are then used to form a strong connectivity attack unit, and all strong connectivity attack units in the attack relationship graph are identified.

[0067] Optionally, the response execution module specifically comprises:

[0068] Read the candidate blocking node identifiers from the minimum blocking node set, and determine the blocking target based on the network address, host identifier, and account identifier corresponding to the candidate blocking node identifier;

[0069] For each blocked object, a corresponding blocking instruction is generated, including a network connection blocking instruction, an access control blocking instruction, and a session termination instruction;

[0070] The blocking command is sent to the corresponding network devices, security gateways, and host terminals for execution, thus completing the network threat response.

[0071] The beneficial effects of this invention are:

[0072] This invention addresses the challenges of forming a unified attack propagation structure from multi-source network behavior data and the inaccurate selection of blocking nodes in existing network threat response technologies by synergistically combining the pulse-constrained resonance aggregation algorithm with the improved Tarjan algorithm. First, a trace-configuration agent processes network security data to generate behavior configuration chains. Then, in the configuration aggregation module, these chains are structurally compared to form threat configuration clusters, enabling discrete network behaviors to form attack behavior patterns with stable characteristics. Next, a trajectory inference agent constructs a threat trajectory grid, achieving a multi-dimensional structured expression of attack behavior propagation paths. Based on this, the resonance modeling module executes the pulse-constrained resonance aggregation algorithm, filtering key behavior nodes and generating resonance intent units based on the time difference of behavior occurrence and node resonance coefficients, thus constructing a threat intent resonance network. A probe pulse agent executes collaborative probe pulses at key behavior nodes and records node behavior change information. The response graph generation module generates an attack response graph based on this node behavior change information, thereby expressing the attack behavior evolution process in a graph structure. Finally, an attack relationship graph is constructed using a resonant adjudication agent, and an improved Tarjan algorithm is executed. A pulse resonant adjudication mechanism is introduced to identify strongly connected attack units, and the minimum set of blocking nodes is selected based on the number of cross-unit connections. This achieves precise cutting off of the attack propagation path, effectively disrupting the attack propagation closed-loop structure while reducing the number of blocking nodes, thereby improving the accuracy and efficiency of network threat response. Attached Figure Description

[0073] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0074] Figure 1 This is a schematic diagram of the structure of a network threat response system based on multi-agent cooperation proposed in this invention;

[0075] Figure 2 This diagram illustrates the implementation of an improved Tarjan algorithm for identifying strongly connected attack units in a network threat response system based on multi-agent collaboration, as proposed in this invention. Detailed Implementation

[0076] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0077] refer to Figure 1 and Figure 2 A network threat response system based on multi-agent collaboration, comprising:

[0078] Trace-based intelligent agents are used to perform behavioral configuration processing on collected network security data and generate behavioral configuration chains.

[0079] The configuration aggregation module is used to perform structural comparison on the behavior configuration chain, generate candidate configurations, and aggregate the candidate configurations to generate threat configuration clusters;

[0080] A trajectory inference agent is used to construct a set of behavior propagation nodes based on the threat configuration cluster, establish connection relationships, and generate a threat trajectory grid;

[0081] The resonance modeling module is used to execute the pulse-constrained resonance aggregation algorithm on the threat trajectory grid, extract key behavior nodes, generate resonance intent units, and connect them to form a threat intent resonance network.

[0082] A probe pulse agent is used to execute cooperative probe pulses at key behavioral nodes based on the threat intent resonance network, and to record the node behavior change information after the cooperative probe pulses are applied, forming a cooperative probe pulse record set;

[0083] The reaction map generation module is used to perform correlation analysis on the behavioral changes of key behavioral nodes before and after the cooperative detection pulse based on the cooperative detection pulse record set, establish the mapping relationship between node behavioral changes and corresponding key behavioral nodes, and organize them according to the behavioral change type and occurrence order to generate an attack reaction map.

[0084] The resonant adjudication agent is used to construct an attack relationship graph based on the threat configuration cluster, threat intent resonant network and attack response map, and execute the improved Tarjan algorithm. The improved Tarjan algorithm introduces a pulse resonant adjudication mechanism to identify strongly connected attack units and determine the minimum blocking node set.

[0085] The response execution module is used to execute network threat responses based on the minimum set of blocking nodes.

[0086] In this embodiment, the trace configuration agent is specifically:

[0087] Collect network security data, including network log data, network traffic data, host behavior data, and access authentication records;

[0088] The network security data is subjected to behavior shaping processing, time alignment processing is performed according to a unified timestamp, and the time-aligned network security data is parsed to extract the behavior source address, behavior target address, access protocol type, operation object identifier, and behavior occurrence time information.

[0089] The parsed network security data is sorted according to the time sequence of the behavior and grouped according to the relationship between the source address and the target address of the behavior.

[0090] Within each group, adjacent behavior records are connected in chronological order to form a behavior node sequence, and the behavior node sequences are chained together in the order of behavior triggering to generate a behavior configuration chain.

[0091] In its implementation, the trace-based intelligent agent first collects network security data in real time from network devices, server hosts, and identity authentication systems. It then performs behavioral configuration processing on this data, aligning timestamps from different sources using a unified time source to eliminate time discrepancies. From the time-aligned network security data, it extracts the source address, target address, access protocol type, operation object identifier, and behavior occurrence time information, and sorts the data according to the order of behavior occurrence. Further, based on the correlation between the source and target addresses, the sorted data is grouped. Within each group, adjacent behavior records are connected in chronological order to form a sequence of behavior nodes. These behavior node sequences are then concatenated according to the order of behavior triggering, generating a behavioral configuration chain. This chain reflects continuous behavioral relationships within the network security data, providing structured foundational data for threat configuration cluster identification and threat trajectory mesh construction.

[0092] In this embodiment, the configuration aggregation module specifically comprises:

[0093] Obtain the behavior configuration chain and number the behavior nodes in the behavior configuration chain according to the order of behavior triggering time;

[0094] According to the set length of the sliding window, the sliding is performed on the behavior configuration chain with a step size of one behavior node. Each time, multiple consecutive behavior nodes are extracted from the behavior configuration chain to form a candidate behavior sequence, and the start node number and end node number of the candidate behavior sequence in the behavior configuration chain are recorded.

[0095] A node-by-node structural comparison is performed on different candidate behavior sequences. When the behavior source address, behavior target address, access protocol type, and operation object identifier of the corresponding behavior nodes in two candidate behavior sequences are all the same, the candidate behavior sequence is marked as a duplicate behavior sequence.

[0096] Candidate behavior sequences marked as repeating behavior sequences are combined according to node attributes to generate sequence identifiers, and candidate behavior sequences with the same sequence identifiers are grouped into the same sequence set. The earliest appearing candidate behavior sequence in each sequence set is selected as the standard behavior sequence.

[0097] The occurrence positions of the standard behavior sequence and all candidate behavior sequences in the sequence set are associated and recorded to generate candidate configurations;

[0098] The occurrence count of each candidate configuration in different behavioral configuration chains is counted, and candidate configurations with an occurrence count greater than a preset occurrence count threshold are aggregated to generate a threat configuration cluster;

[0099] In this invention, the configuration aggregation module first acquires the behavior configuration chain generated by the trace configuration agent and sequentially numbers the behavior nodes according to the behavior trigger time order to ensure that the candidate behavior sequence extraction process has a unified time reference. Then, a sliding window length of 5 behavior nodes and a sliding step size of 1 behavior node are set, and candidate behavior sequences are extracted step-by-step on the behavior configuration chain. Each candidate behavior sequence records its corresponding start node number and end node number. Setting the sliding window length to 5 behavior nodes can cover the common multi-step operation structure in typical attack behaviors, thereby improving the stability of repetitive behavior sequence identification, while avoiding a decrease in matching accuracy due to an excessively long window. After the candidate behavior sequence extraction is completed, a node-by-node structure comparison is performed on different candidate behavior sequences. When the corresponding position's behavior source address and behavior target... When the address, access protocol type, and operation object identifier are completely identical, the corresponding candidate behavior sequence is marked as a repeating behavior sequence. Then, a sequence identifier is generated based on the combination of the behavior source address, behavior target address, access protocol type, and operation object identifier. Candidate behavior sequences with the same sequence identifier are grouped into the same sequence set. The earliest appearing candidate behavior sequence in each sequence set is selected as the standard behavior sequence and associated with the occurrence positions of all candidate behavior sequences in the sequence set to generate candidate configurations. Furthermore, the occurrence frequency of each candidate configuration in different behavior configuration chains is counted, and a preset occurrence frequency threshold is set to 3 times. When the occurrence frequency of a candidate configuration is greater than 3 times, the candidate configuration is classified into a threat configuration cluster, thereby filtering out attack behavior patterns with stable repeating characteristics and improving the accuracy and reliability of threat configuration identification.

[0100] In this embodiment, the trajectory inference agent is specifically:

[0101] Obtain the threat configuration clusters, and extract the behavior source address, behavior target address, access protocol type, operation object identifier, and behavior occurrence time corresponding to each behavior node from each threat configuration cluster;

[0102] Using the behavior nodes in the threat configuration cluster as the initial propagation nodes, network access records before the time of the behavior occurrence are retrieved forward based on the communication records between the behavior source address and the behavior target address, and network access records after the time of the behavior occurrence are retrieved backward to determine the associated nodes that have a communication relationship with the initial propagation node, and construct a set of behavior propagation nodes;

[0103] Based on the communication path between the source address and the target address in the set of behavior propagation nodes, a network topology connection relationship is established between device nodes, and the connection is made in the order of the communication path.

[0104] Based on the login relationship between the account identifier and the device identifier in the access authentication record, establish an account permission connection relationship between the account node and the device node;

[0105] Based on the derivation relationship between the process identifier and the parent process identifier in the host behavior data, host process connection relationships are established between process nodes;

[0106] Based on the access records between the operation object identifier and the access device identifier in the file access records, establish a file access connection relationship between the device node and the file node;

[0107] Network device nodes, account nodes, process nodes, and file nodes are uniformly numbered according to their corresponding connection relationships, and the connection relationships are mapped to directed connection edges between nodes to generate a threat trajectory grid.

[0108] In this invention, a trajectory inference agent tracks behavior propagation relationships based on threat configuration clusters and establishes multi-layered connections across four dimensions: network topology, account permission, host process, and file access, thereby constructing a threat trajectory grid. Specifically, using behavior nodes in the threat configuration cluster as initial propagation nodes, the communication records between the behavior source address and the behavior target address are traced over time. Network access records prior to the behavior occurrence time are retrieved, and network access records after the behavior occurrence time are retrieved to identify device nodes with communication associations with the initial propagation node and construct a set of behavior propagation nodes. Based on this, network topology connections are established through communication paths between devices, account permission connections are established through login relationships between accounts and devices, host process connections are established through derivation relationships between processes and parent processes, and file access connections are established through access records between devices and files. Finally, device nodes, account nodes, process nodes, and file nodes are uniformly numbered, and the corresponding relationships are mapped to directed edges to form a threat trajectory grid. By using the aforementioned multi-dimensional relationship fusion method, previously scattered network behavior data can be uniformly mapped onto a structured threat trajectory grid, thereby achieving accurate characterization of attack behavior propagation paths, improving the ability to identify and trace complex attack chains, and providing a structured data foundation for threat intent modeling and response decisions.

[0109] In this embodiment, the resonance modeling module specifically comprises:

[0110] Extract the occurrence time of the behavior, node type, and connection relationship between nodes from the threat trajectory grid, and generate node propagation paths according to the connection relationship;

[0111] The pulse-constrained resonance aggregation algorithm is executed. The time difference is obtained by subtracting the occurrence time of the behavior of adjacent nodes in the node propagation path. When the time difference is less than the preset pulse time threshold, the corresponding connection relationship is marked as a pulse propagation connection, and multiple consecutive pulse propagation connections are combined to form a pulse propagation path.

[0112] For each pulse propagation path, the nodes are counted according to their node types. The number of times the same node type appears in the pulse propagation path is accumulated, and the accumulated result is divided by the total number of nodes in the pulse propagation path to obtain the node resonance coefficient. When the node resonance coefficient is greater than the preset resonance threshold, the corresponding node is marked as a key behavior node.

[0113] Using the key behavior node as the central node, the adjacent nodes that are directly connected to the key behavior node are traversed in the threat trajectory grid. The time difference is obtained by subtracting the time of the behavior occurrence between the key behavior node and the adjacent node. When the time difference is less than the preset resonance time threshold, the key behavior node and the adjacent node are combined according to the connection relationship to form a resonance node set.

[0114] Each set of resonant nodes is defined as a resonant intent unit, and the number of shared nodes between different resonant intent units is counted. When the number of shared nodes between two resonant intent units is greater than a preset sharing threshold, a connection relationship is established between the two resonant intent units.

[0115] Using resonant intent units as nodes and directed connections established between resonant intent units according to the order of behavior occurrence as edges, a threat intent resonant network is formed.

[0116] After the threat trajectory mesh is generated, the occurrence time of the behavior, node type, and connection relationships between nodes are extracted from the nodes in the threat trajectory mesh. Node propagation paths are then generated according to these connections. To achieve rapid aggregation and identification of attack behaviors in the time dimension, a pulse-constrained resonance aggregation algorithm is executed in the resonance modeling module. Specifically, the occurrence times of adjacent nodes in the node propagation path are subtracted. When the time difference is less than 2 seconds, the corresponding connection relationship is marked as a pulse propagation connection. Three or more consecutive pulse propagation connections are combined to form a pulse propagation path, thereby identifying attack behavior sequences that propagate continuously within a short period. Subsequently, the nodes in each pulse propagation path are statistically analyzed according to node type. The number of occurrences of the same node type in the pulse propagation path is accumulated, and the accumulated result is divided by the total number of nodes in the pulse propagation path. The node resonance coefficient is used to identify nodes with a value greater than 0.6. Nodes with a resonance coefficient greater than 0.6 are marked as key behavior nodes, thus filtering out nodes with significant behavioral concentration during propagation. Further, using the key behavior node as the central node, the threat trajectory grid is traversed to find adjacent nodes directly connected to it. The occurrence times of the behaviors between the key behavior node and its adjacent nodes are subtracted. When the time difference is less than 5 seconds, the key behavior node and its adjacent nodes are combined according to their connection relationships to form a resonant node set. Each resonant node set is then defined as a resonant intent unit, and the number of shared nodes between different resonant intent units is counted. When the number of shared nodes is greater than 3, a connection is established between the two resonant intent units, and directed connections are established according to the order of behavior occurrence time, ultimately constructing a threat intent resonance network. Through this process, attack behavior combinations with temporal pulse characteristics and structural resonance characteristics can be identified in complex network behaviors. This strengthens the expression of implicit correlations between attack behaviors within the network structure, thereby improving the accuracy of multi-stage attack path identification and providing a structured decision-making basis for threat adjudication.

[0117] In this embodiment, the probe pulse agent is specifically:

[0118] The resonant intent units in the threat intent resonant network are sorted according to the order of the occurrence of the behavior, and the key behavior nodes and the corresponding connection relationships of each resonant intent unit are extracted.

[0119] Cooperative detection pulses are executed sequentially at the key behavior nodes according to the time sequence of their actions.

[0120] The collaborative detection pulse includes a session delay pulse and an authentication challenge pulse. The session delay pulse delays the data response process of the network session by adding a preset time delay to the network connection corresponding to the key behavior node. The authentication challenge pulse inserts an authentication verification request into the access session corresponding to the key behavior node, performs identity authentication verification on the access request, and returns the authentication response result.

[0121] The behavior changes of key behavioral nodes before and after the collaborative detection pulse are recorded, including changes in communication targets and changes in access frequency.

[0122] The key behavior node identifier, connection relationship identifier, cooperative detection pulse type, pulse trigger time, pulse duration and corresponding node behavior change information are associated and recorded to generate node behavior change records;

[0123] The records of node behavior changes are collected according to the time sequence of the behavior of the resonant intention unit to form a collaborative detection pulse record set;

[0124] During the execution of the collaborative probe pulse, the probe pulse agent first sorts the key behavior nodes according to the occurrence time of the behavior of each resonant intent unit in the threat intent resonance network, and then triggers the collaborative probe pulse in chronological order. The session delay pulse is implemented by adding a preset time delay to the network connection corresponding to the key behavior node. The time delay is set to 200 milliseconds, so that the network session corresponding to the key behavior node generates a stable timing disturbance in the data response phase, thereby observing the path adjustment of the attack behavior after being interfered with by the network delay. The authentication challenge pulse is implemented by inserting an authentication verification request into the access session corresponding to the key behavior node. The authentication verification request is triggered in the third data interaction cycle after the session is established, and requires a re-authentication verification to detect the response changes of abnormal access behavior in the authentication process. Before and after the collaborative probe pulse is triggered, the probe pulse agent continuously collects the changes in communication targets and access frequency of the key behavior nodes, and uniformly numbers and stores the node behavior change records according to the pulse trigger time to form a collaborative probe pulse record set. By implementing coordinated perturbations of session delay pulses and authentication challenge pulses at key behavioral nodes, potential attack behaviors can be induced to cause path deviations or changes in access policies without terminating network connections. This improves the accuracy of threat identification and provides a more reliable behavioral basis for determining the minimum blocking node set.

[0125] In this embodiment, the reaction spectrum generation module specifically comprises:

[0126] The node behavior change records in the collaborative detection pulse record set are sorted according to the pulse trigger time, and the key behavior node identifier, connection relationship identifier, collaborative detection pulse type, pulse trigger time, pulse duration and node behavior change information are extracted from each node behavior change record.

[0127] The behavior change information of each key behavior node before the collaborative detection pulse is taken as the pre-pulse behavior segment, and the behavior change information of each key behavior node after the collaborative detection pulse is taken as the post-pulse behavior segment. The pre-pulse behavior segment and the post-pulse behavior segment are paired according to the same key behavior node identifier and the same connection relationship identifier.

[0128] A correlation analysis was performed on the pre-pulse and post-pulse behavior segments after pairing. The communication target address and access frequency in the pre-pulse and post-pulse behavior segments were compared item by item. When the communication target address changed, it was marked as a communication target change event. When the access frequency increased or decreased, it was marked as an access frequency change event. The communication target change event and the access frequency change event were recorded as behavior change types, respectively.

[0129] Using key behavior node identifiers as graph nodes, and connection relationship identifiers, cooperative detection pulse types, and behavior change types as node attributes, directed connections are established between graph nodes according to the order of pulse triggering times of key behavior nodes to generate an attack response graph.

[0130] This invention performs time-sequencing and structured analysis on node behavior change records in a cooperative probe pulse (CPP) record set. It pairs and analyzes the behavior changes of key behavioral nodes before and after the PCP, and identifies behavior change types by comparing communication target addresses and access frequencies. Based on this, key behavioral nodes are used as graph nodes, with connection relationship identifiers, PCP types, and behavior change types as node attributes. Directed connections between nodes are established according to the order of pulse triggering times, thus constructing an attack response graph. This method can structure the evolution of key behavioral nodes' behavior under PCP, organizing and presenting attack behavior change paths in a graph structure. This improves the ability to characterize attack propagation patterns and provides an accurate data foundation for identifying the minimum blocking node set based on graph structure, thereby enhancing the accuracy and efficiency of network threat response decisions.

[0131] In this embodiment, the resonance adjudication agent is specifically:

[0132] Based on the source address and target address of the behavior in the threat configuration cluster, configuration nodes are established, and directed connections are established between configuration nodes in the order of the occurrence of the behavior.

[0133] Map the resonant intent units in the threat intent resonant network to resonant nodes, and establish directed connections between resonant nodes according to the chronological order of the behaviors of the resonant intent units.

[0134] Key behavioral nodes in the attack response graph are mapped to response nodes, and directed connection edges are established between response nodes according to the directed connection relationships in the attack response graph.

[0135] When the source address or target address of the behavior in the configuration node is consistent with the node identifier in the resonance node, a directed connection edge is established between the configuration node and the resonance node; when the node identifier in the resonance node is consistent with the key behavior node identifier in the response node, a directed connection edge is established between the resonance node and the response node, and an attack relationship graph is constructed.

[0136] An improved Tarjan algorithm is executed on the attack graph, and a pulse resonance adjudication mechanism is introduced to identify all strongly connected attack units in the attack graph.

[0137] Traverse each strongly connected attack unit in the attack relationship graph, identify the cross-unit directed connection edges from the current strongly connected attack unit to other strongly connected attack units, and record the starting node of each cross-unit directed connection edge.

[0138] The starting nodes corresponding to all cross-unit directed connection edges are counted to obtain the number of cross-unit connections for each node; the nodes are sorted in descending order of the number of cross-unit connections, and the nodes with the highest number of cross-unit connections are selected as candidate blocking nodes.

[0139] In the attack relationship graph, candidate blocking nodes and their associated directed connection edges are removed sequentially. After each removal, it is checked whether there is still a directed connection path between the strongly connected attack unit containing the resonance node and other strongly connected attack units. When the detection result is that there is no directed connection path, all the currently selected candidate blocking nodes are determined as the minimum blocking node set.

[0140] In this invention, by sorting cross-unit connection nodes and prioritizing nodes with higher connection counts as candidate blocking nodes, the blocking operation is concentrated on key hub positions in the attack propagation structure, thereby effectively cutting off the attack propagation path with fewer node interventions. Compared with random blocking or node-by-node traversal blocking strategies, this method can quickly destroy the attack propagation closed-loop structure while minimizing the number of blocking nodes, avoiding unnecessary impact on a large number of normal nodes in the network, improving the accuracy and execution efficiency of network threat response, and reducing the degree of interference with network service continuity during the implementation of security policies.

[0141] In this embodiment, the step of executing the improved Tarjan algorithm on the attack graph and introducing a pulse resonance adjudication mechanism to identify all strongly connected attack units in the attack graph specifically involves:

[0142] A depth-first traversal is performed on each node in the attack relationship graph. During the traversal, an initial access number and a backtracking number are written for each node, and the node is pushed onto the traversal node stack. The initial access number is written in ascending order according to the order in which the node is accessed by the depth-first traversal. The backtracking number is written with the same value as the initial access number when the node is initialized. The backtracking number of the current node is updated according to the initial access number or backtracking number of the adjacent node reached by the current node through the directed connection edge, so that the backtracking number always represents the earliest access node number reached by the current node through the traversed path.

[0143] When visiting adjacent nodes during depth-first traversal, if both the current node and its adjacent node are responding nodes, a pulse resonance adjudication mechanism is executed. This mechanism determines the cooperative detection pulse type and pulse triggering time of the current node and its adjacent node. If the cooperative detection pulse type is consistent and the difference in pulse triggering time is less than a set tolerance threshold, depth-first traversal continues along the corresponding directed connection edge. If at least one of the current node and its adjacent node is not a responding node, depth-first traversal continues according to the directed connection relationship between the nodes.

[0144] When the backtracking number of a node matches the first access number, pop the nodes from the traversal node stack in sequence until the current node, and form a strong connectivity attack unit by popping the nodes, and identify all strong connectivity attack units in the attack relationship graph.

[0145] Specifically, during the depth-first traversal of the attack relationship graph, each visited node is assigned an incrementing first-visit sequence number, which is written into the node's backtracking sequence number field. Simultaneously, the node is pushed onto the traversal node stack to record the current traversal path. Then, adjacent nodes are visited along the directed connection edges of the node. When an adjacent node has not yet been visited, a depth-first traversal is recursively performed on the adjacent node, and upon recursion, the backtracking sequence number of the current node is updated to the smaller of the current node's backtracking sequence number and the adjacent node's backtracking sequence number. When an adjacent node already exists in the traversal node stack, the backtracking sequence number of the current node is updated to the smaller of the current node's backtracking sequence number and the adjacent node's first-visit sequence number, ensuring that the backtracking sequence number always represents the smallest first-visit sequence number that the current node can reach through the visited paths.

[0146] During the traversal, when both the current node and its adjacent nodes are responding nodes, a pulse resonance adjudication mechanism is executed. This mechanism synchronously determines the cooperative probe pulse type and pulse trigger time corresponding to the current node and its adjacent nodes. The tolerance threshold for the pulse trigger time difference is set to 2 seconds. When the cooperative probe pulse type is consistent and the pulse trigger time difference does not exceed 2 seconds, the depth traversal continues along the corresponding directed connection edge. When at least one of the current node and its adjacent nodes is not a responding node, the depth traversal continues according to the directed connection relationship between the nodes. When the backtracking sequence number of a node is equal to the first access sequence number of that node, it indicates that a closed connected structure has been formed in the depth-first traversal path rooted at that node. At this time, nodes are popped sequentially from the top of the traversal node stack until the current node. All popped nodes are merged into the same strongly connected attack unit, and the above process is repeated in subsequent depth traversals to identify all strongly connected attack units in the attack relationship graph. By introducing a pulse resonance adjudication mechanism on the basis of the traditional Tarjan strong connectivity component identification algorithm, the formation of strong connectivity attack units can simultaneously satisfy the constraints of topological connectivity and cooperative detection pulse time consistency. This allows the identified strong connectivity attack units to more realistically reflect the propagation correlation structure of network attacks among multiple nodes, filter irrelevant connection paths with large time spans, improve the accuracy of attack propagation loop identification, provide a more reliable basis for determining the minimum blocking node set, and improve the accuracy and execution efficiency of network threat response strategies.

[0147] In this embodiment, the response execution module specifically comprises:

[0148] Read the candidate blocking node identifiers from the minimum blocking node set, and determine the blocking target based on the network address, host identifier, and account identifier corresponding to the candidate blocking node identifier;

[0149] For each blocked object, a corresponding blocking instruction is generated, including a network connection blocking instruction, an access control blocking instruction, and a session termination instruction;

[0150] The blocking command is sent to the corresponding network devices, security gateways, and host terminals for execution, thus completing the network threat response.

[0151] Example 1: To verify the feasibility of this invention in practice, it was tested in an internal network security monitoring environment of an enterprise. This network environment consisted of multiple core switching devices, business servers, and office terminals. Business system servers, database servers, and file servers were deployed within the network, and approximately 800 terminal devices accessed the network through the local area network. Network security devices continuously collected network security data. In this network environment, attackers typically entered the internal network through remote access points and gradually spread their attacks between different nodes through account logins, file access, and remote calls.

[0152] Because attacks often span multiple nodes and propagate within a short period, traditional network threat response systems often struggle to accurately identify the complete attack propagation path in practical applications. Their specific operational process involves network security devices continuously collecting network log and traffic data and detecting abnormal behavior using pre-defined rules. For example, when the system detects a terminal device sending access requests to multiple servers within a short period, it marks that terminal device as an abnormal node. Subsequently, the system blocks the terminal device according to fixed rules, specifically by adding access control rules to the security gateway to block the network connection between the terminal device and the server. Simultaneously, the system records this abnormal event and awaits further analysis and processing by the security administrator. While this method can block some abnormal access behavior in practice, because it only judges a single node, it struggles to identify the complete attack path when the attack has propagated to multiple nodes. Therefore, blocking strategies often require simultaneous blocking of multiple nodes, which can easily disrupt normal business communication.

[0153] The system of this invention is deployed in the same network environment and connected to a network security data acquisition platform. During system operation, it first continuously receives network log data, network traffic data, host behavior data, and access authentication records. Then, a trace-configuration intelligent agent performs behavioral configuration processing on the multi-source network security data, enabling discrete network behavior records to form behavioral configuration chains in a time series. After the behavioral configuration chains are generated, a configuration aggregation module performs structural comparison on the chains and generates threat configuration clusters, allowing recurring attack behavior patterns to be reliably identified. Subsequently, a trajectory inference intelligent agent constructs a threat trajectory grid across network topology connections, account permission connections, host process connections, and file access connections, thereby structurally representing the propagation path of attack behaviors in the network.

[0154] After the threat trajectory mesh is constructed, the resonance modeling module executes the impulse constraint resonance aggregation algorithm to identify key behavioral nodes and generate a threat intent resonance network. The probe impulse agent executes cooperative probe impulses at key behavioral nodes, triggering behavioral changes in key behavioral nodes through session delay impulses and authentication challenge impulses, and records the node behavioral change information before and after the cooperative probe impulses. Subsequently, the response graph generation module generates an attack response graph based on the node behavioral change information, so that the propagation and change process of attack behavior in the network can be expressed in the form of a graph structure. Finally, the resonance adjudication agent constructs an attack relationship graph and executes the improved Tarjan algorithm to identify strongly connected attack units, thereby determining the minimum blocking node set, and the response execution module executes the network threat response.

[0155] During continuous system operation, a comparative test was conducted between the traditional network threat response system and the system of this invention. The comparison results are shown in Table 1 below.

[0156] Table 1 Comparative Analysis of Network Threat Response Performance

[0157] Indicator Items Traditional network threat response systems This invention system Number of attack events identified 124 times 130 times Number of complete attack paths identified 36 times 114 times Attack path identification accuracy 29.0% 87.7% Average number of blocking nodes 13 5 Attack propagation interruption time 7.2 seconds 2.4 seconds Impact on normal business 17.9% 3.5% Number of attack propagation loop identifications 19 76 Threat response success rate 63.4% 93.8%

[0158] As can be seen from the data in Table 1 above, traditional network threat response systems have significant shortcomings in identifying attack propagation structures. Of the attack events surveyed, the traditional system identified 124 attack events, but only 36 of them could identify the complete attack path, resulting in an attack path identification accuracy rate of only 29.0%. This indicates that it struggles to accurately depict the overall propagation relationship of attack behaviors when facing multi-node propagation attacks. Furthermore, due to the lack of overall analysis capabilities of the attack propagation structure, the traditional system requires an average of 13 nodes to be blocked when implementing blocking strategies, with an attack propagation interruption time of 7.2 seconds and a 17.9% impact on normal business communications. In addition, the traditional system only identified 19 closed-loop attack propagation structures, resulting in a threat response success rate of 63.4%, indicating low overall response efficiency. In contrast, the system of this invention uses a multi-agent collaborative analysis mechanism to perform structured modeling of network behavior. Under the same data scale, it identified 130 attack events, of which 114 could identify complete attack paths, achieving an attack path identification accuracy of 87.7%. Simultaneously, the system of this invention only needs to block an average of 5 nodes when generating blocking strategies, reducing the attack propagation interruption time to 2.4 seconds, decreasing the impact on normal business to 3.5%, and identifying 76 attack propagation closed-loop structures, improving the threat response success rate to 93.8%. Therefore, it is evident that the system of this invention significantly outperforms traditional network threat response systems in both attack propagation identification capabilities and threat response efficiency.

[0159] As can be seen from this embodiment, the system of the present invention can perform unified modeling and collaborative analysis of multi-source network security data in complex network environments, enabling originally dispersed network behaviors to form a continuous attack propagation relationship in structure. By constructing a threat trajectory grid, a threat intent resonance network, and an attack response graph, the propagation process of attack behavior in the network can be expressed in a graph structure, thereby improving the overall identification capability of multi-stage attack behavior. At the same time, by executing the improved Tarjan algorithm on the attack relationship graph to identify strongly connected attack units and generating response strategies based on the minimum blocking node set, the threat response can be concentrated on key nodes in the attack propagation structure, reducing the blocking range while achieving precise cutting off of the attack propagation path, thereby improving the accuracy and execution efficiency of network threat response and reducing the impact on normal network services.

[0160] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A network threat response system based on multi-agent collaboration, characterized in that, include: Trace-based intelligent agents are used to perform behavioral configuration processing on collected network security data and generate behavioral configuration chains. The configuration aggregation module is used to perform structural comparison on the behavior configuration chain, generate candidate configurations, and aggregate the candidate configurations to generate threat configuration clusters; A trajectory inference agent is used to construct a set of behavior propagation nodes based on the threat configuration cluster, establish connection relationships, and generate a threat trajectory grid; The resonance modeling module is used to execute the pulse-constrained resonance aggregation algorithm on the threat trajectory grid, extract key behavior nodes, generate resonance intent units, and connect them to form a threat intent resonance network. A probe pulse agent is used to execute cooperative probe pulses at key behavioral nodes based on the threat intent resonance network, and to record the node behavior change information after the cooperative probe pulses are applied, forming a cooperative probe pulse record set; The reaction map generation module is used to perform correlation analysis on the behavioral changes of key behavioral nodes before and after the cooperative detection pulse based on the cooperative detection pulse record set, establish the mapping relationship between node behavioral changes and corresponding key behavioral nodes, and organize them according to the behavioral change type and occurrence order to generate an attack reaction map. The resonant adjudication agent is used to construct an attack relationship graph based on the threat configuration cluster, threat intent resonant network and attack response map, and execute the improved Tarjan algorithm. The improved Tarjan algorithm introduces a pulse resonant adjudication mechanism to identify strongly connected attack units and determine the minimum blocking node set. The response execution module is used to execute network threat responses based on the minimum set of blocking nodes.

2. The network threat response system based on multi-agent collaboration according to claim 1, characterized in that, The trace configuration agent is specifically: Collect network security data, including network log data, network traffic data, host behavior data, and access authentication records; The network security data is subjected to behavior shaping processing, time alignment processing is performed according to a unified timestamp, and the time-aligned network security data is parsed to extract the behavior source address, behavior target address, access protocol type, operation object identifier, and behavior occurrence time information. The parsed network security data is sorted according to the time sequence of the behavior and grouped according to the relationship between the source address and the target address of the behavior. Within each group, adjacent behavior records are connected in chronological order to form a behavior node sequence, and the behavior node sequences are chained together according to the behavior triggering order to generate a behavior configuration chain.

3. A network threat response system based on multi-agent collaboration according to claim 1, characterized in that, The configuration aggregation module is specifically: Obtain the behavior configuration chain and number the behavior nodes in the behavior configuration chain according to the order of behavior triggering time; According to the set length of the sliding window, the sliding is performed on the behavior configuration chain with a step size of one behavior node. Each time, multiple consecutive behavior nodes are extracted from the behavior configuration chain to form a candidate behavior sequence, and the start node number and end node number of the candidate behavior sequence in the behavior configuration chain are recorded. A node-by-node structural comparison is performed on different candidate behavior sequences. When the behavior source address, behavior target address, access protocol type, and operation object identifier of the corresponding behavior nodes in two candidate behavior sequences are all the same, the candidate behavior sequence is marked as a duplicate behavior sequence. Candidate behavior sequences marked as repeating behavior sequences are combined according to node attributes to generate sequence identifiers, and candidate behavior sequences with the same sequence identifiers are grouped into the same sequence set. The earliest appearing candidate behavior sequence in each sequence set is selected as the standard behavior sequence. The occurrence positions of the standard behavior sequence and all candidate behavior sequences in the sequence set are associated and recorded to generate candidate configurations; The occurrence count of each candidate configuration in different behavioral configuration chains is counted, and candidate configurations with an occurrence count greater than a preset occurrence count threshold are aggregated to generate a threat configuration cluster.

4. A network threat response system based on multi-agent collaboration according to claim 1, characterized in that, The trajectory deduction agent is specifically: Obtain the threat configuration clusters, and extract the behavior source address, behavior target address, access protocol type, operation object identifier, and behavior occurrence time corresponding to each behavior node from each threat configuration cluster; Using the behavior nodes in the threat configuration cluster as the initial propagation nodes, network access records before the time of the behavior occurrence are retrieved forward based on the communication records between the behavior source address and the behavior target address, and network access records after the time of the behavior occurrence are retrieved backward to determine the associated nodes that have a communication relationship with the initial propagation node, and construct a set of behavior propagation nodes; Based on the communication path between the source address and the target address in the set of behavior propagation nodes, a network topology connection relationship is established between device nodes, and the connection is made in the order of the communication path. Based on the login relationship between the account identifier and the device identifier in the access authentication record, establish an account permission connection relationship between the account node and the device node; Based on the derivation relationship between the process identifier and the parent process identifier in the host behavior data, host process connection relationships are established between process nodes; Based on the access records between the operation object identifier and the access device identifier in the file access records, establish a file access connection relationship between the device node and the file node; Network device nodes, account nodes, process nodes, and file nodes are uniformly numbered according to their corresponding connection relationships, and the connection relationships are mapped to directed connection edges between nodes to generate a threat trajectory grid.

5. A network threat response system based on multi-agent collaboration according to claim 1, characterized in that, The resonance modeling module is specifically as follows: Extract the occurrence time of the behavior, node type, and connection relationship between nodes from the threat trajectory grid, and generate node propagation paths according to the connection relationship; The pulse-constrained resonance aggregation algorithm is executed. The time difference is obtained by subtracting the occurrence time of the behavior of adjacent nodes in the node propagation path. When the time difference is less than the preset pulse time threshold, the corresponding connection relationship is marked as a pulse propagation connection, and multiple consecutive pulse propagation connections are combined to form a pulse propagation path. For each pulse propagation path, the nodes are counted according to their node types. The number of times the same node type appears in the pulse propagation path is accumulated, and the accumulated result is divided by the total number of nodes in the pulse propagation path to obtain the node resonance coefficient. When the node resonance coefficient is greater than the preset resonance threshold, the corresponding node is marked as a key behavior node. Using the key behavior node as the central node, the adjacent nodes that are directly connected to the key behavior node are traversed in the threat trajectory grid. The time difference is obtained by subtracting the time of the behavior occurrence between the key behavior node and the adjacent node. When the time difference is less than the preset resonance time threshold, the key behavior node and the adjacent node are combined according to the connection relationship to form a resonance node set. Each set of resonant nodes is defined as a resonant intent unit, and the number of shared nodes between different resonant intent units is counted. When the number of shared nodes between two resonant intent units is greater than a preset sharing threshold, a connection relationship is established between the two resonant intent units. Using resonant intent units as nodes and directed connections established between resonant intent units according to the chronological order of their actions as edges, a threat intent resonant network is formed.

6. A network threat response system based on multi-agent collaboration according to claim 1, characterized in that, The probe pulse agent is specifically: The resonant intent units in the threat intent resonant network are sorted according to the order of the occurrence of the behavior, and the key behavior nodes and the corresponding connection relationships of each resonant intent unit are extracted. Cooperative detection pulses are executed sequentially at the key behavior nodes according to the time sequence of their actions. The collaborative detection pulse includes a session delay pulse and an authentication challenge pulse. The session delay pulse delays the data response process of the network session by adding a preset time delay to the network connection corresponding to the key behavior node. The authentication challenge pulse inserts an authentication verification request into the access session corresponding to the key behavior node, performs identity authentication verification on the access request, and returns an authentication response result. The behavior changes of key behavioral nodes before and after the collaborative detection pulse are recorded, including changes in communication targets and changes in access frequency. The key behavior node identifier, connection relationship identifier, cooperative detection pulse type, pulse trigger time, pulse duration and corresponding node behavior change information are associated and recorded to generate node behavior change records; The records of node behavior changes are collected according to the chronological order of the behavior of the resonant intent unit to form a collaborative detection pulse record set.

7. A network threat response system based on multi-agent collaboration according to claim 1, characterized in that, The reaction spectrum generation module specifically comprises: The node behavior change records in the collaborative detection pulse record set are sorted according to the pulse trigger time, and the key behavior node identifier, connection relationship identifier, collaborative detection pulse type, pulse trigger time, pulse duration and node behavior change information are extracted from each node behavior change record. The behavior change information of each key behavior node before the collaborative detection pulse is taken as the pre-pulse behavior segment, and the behavior change information of each key behavior node after the collaborative detection pulse is taken as the post-pulse behavior segment. The pre-pulse behavior segment and the post-pulse behavior segment are paired according to the same key behavior node identifier and the same connection relationship identifier. A correlation analysis was performed on the pre-pulse and post-pulse behavior segments after pairing. The communication target address and access frequency in the pre-pulse and post-pulse behavior segments were compared item by item. When the communication target address changed, it was marked as a communication target change event. When the access frequency increased or decreased, it was marked as an access frequency change event. The communication target change event and the access frequency change event were recorded as behavior change types, respectively. Using key behavior node identifiers as graph nodes, and connection relationship identifiers, cooperative detection pulse types, and behavior change types as node attributes, directed connections are established between graph nodes according to the order of pulse triggering times of key behavior nodes to generate an attack response graph.

8. A network threat response system based on multi-agent collaboration according to claim 1, characterized in that, The resonance adjudication agent is specifically: Based on the source address and target address of the behavior in the threat configuration cluster, configuration nodes are established, and directed connections are established between configuration nodes in the order of the occurrence of the behavior. Map the resonant intent units in the threat intent resonant network to resonant nodes, and establish directed connections between resonant nodes according to the chronological order of the behaviors of the resonant intent units. Key behavioral nodes in the attack response graph are mapped to response nodes, and directed connection edges are established between response nodes according to the directed connection relationships in the attack response graph. When the source address or target address of the behavior in the configuration node is consistent with the node identifier in the resonance node, a directed connection edge is established between the configuration node and the resonance node. When the node identifier in the resonance node is consistent with the key behavior node identifier in the response node, a directed connection edge is established between the resonance node and the response node to construct an attack relationship graph. An improved Tarjan algorithm is executed on the attack graph, and a pulse resonance adjudication mechanism is introduced to identify all strongly connected attack units in the attack graph. Traverse each strongly connected attack unit in the attack relationship graph, identify the cross-unit directed connection edges from the current strongly connected attack unit to other strongly connected attack units, and record the starting node of each cross-unit directed connection edge. The starting nodes corresponding to all cross-unit directed connection edges are counted to obtain the number of cross-unit connections for each node; the nodes are sorted in descending order of the number of cross-unit connections, and the nodes with the highest number of cross-unit connections are selected as candidate blocking nodes. In the attack relationship graph, candidate blocking nodes and their associated directed edges are removed sequentially. After each removal, it is checked whether there is still a directed connection path between the strongly connected attack unit containing the resonant node and other strongly connected attack units. When the detection result is that there is no directed connection path, all the currently selected candidate blocking nodes are determined as the minimum blocking node set.

9. A network threat response system based on multi-agent collaboration according to claim 8, characterized in that, The improved Tarjan algorithm is executed on the attack graph, and a pulse resonance adjudication mechanism is introduced to identify all strongly connected attack units in the attack graph. Specifically: A depth-first traversal is performed on each node in the attack relationship graph. During the traversal, an initial access number and a backtracking number are written for each node, and the node is pushed onto the traversal node stack. The initial access number is written in ascending order according to the order in which the node is accessed by the depth-first traversal. The backtracking number is written with the same value as the initial access number when the node is initialized. The backtracking number of the current node is updated according to the initial access number or backtracking number of the adjacent node reached by the current node through the directed connection edge, so that the backtracking number always represents the earliest access node number reached by the current node through the traversed path. When visiting adjacent nodes during depth-first traversal, if both the current node and its adjacent node are responding nodes, a pulse resonance adjudication mechanism is executed. This mechanism determines the cooperative detection pulse type and pulse triggering time of the current node and its adjacent node. If the cooperative detection pulse type is consistent and the difference in pulse triggering time is less than a set tolerance threshold, depth-first traversal continues along the corresponding directed connection edge. If at least one of the current node and its adjacent node is not a responding node, depth-first traversal continues according to the directed connection relationship between the nodes. When the backtracking sequence number of a node matches the first access sequence number, nodes are popped sequentially from the traversal node stack until the current node. The popped nodes are then used to form a strong connectivity attack unit, and all strong connectivity attack units in the attack relationship graph are identified.

10. A network threat response system based on multi-agent collaboration according to claim 1, characterized in that, The response execution module is specifically: Read the candidate blocking node identifiers from the minimum blocking node set, and determine the blocking target based on the network address, host identifier, and account identifier corresponding to the candidate blocking node identifier; For each blocked object, a corresponding blocking instruction is generated, including a network connection blocking instruction, an access control blocking instruction, and a session termination instruction; The blocking command is sent to the corresponding network devices, security gateways, and host terminals for execution, thus completing the network threat response.

Images