A network security multi-agent cooperation method and system based on granular cell driving and a medium

Abstract

This invention relates to a particle-based network security multi-agent collaborative method, system, and medium. The method includes: extracting raw events from a multi-source heterogeneous database and constructing a unified high-dimensional state vector based on hosts; adaptively dividing the network environment state space into several security particles; dynamically assigning a set of agents to perform sub-tasks to each security particle based on its semantic tags; collecting and packaging all relevant information for the current particle to generate a standard context packet; verifying the quality score of the standard context packet; if the quality score is lower than a preset threshold, rejecting task execution and implementing a replanning strategy; monitoring and analyzing the particle activation sequence of the entire system to detect whether the same particle is repeatedly activated while its global network state remains unchanged; if so, implementing action intervention. This invention achieves dynamic optimization of routing paths and ensures strong context consistency.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a particle-driven multi-agent collaborative method, system, and medium for network security. Background Technology

[0002] Given the escalating nature of cyber threats and increasingly sophisticated and covert attack methods, traditional perimeter defenses and simple blocking strategies are no longer sufficient to effectively mitigate security risks. Enterprises and organizations are facing a shift in perception from "whether it will be compromised" to "when it will be compromised." Therefore, the focus of cybersecurity construction is gradually shifting towards detection and response as the core. Under the premise of "assuming the network has been compromised," a dynamic, closed-loop security defense system integrating prevention, blocking, detection, and rapid response is being built to comprehensively enhance overall security capabilities. A Multi-Agent System (MAS) refers to a computing system composed of multiple autonomous agents. These agents can perceive the environment, make autonomous decisions, cooperate or compete to jointly complete complex tasks or achieve their individual goals. Currently, MAS is widely used in complex cybersecurity tasks or scenarios such as threat detection and incident response.

[0003] A typical example of MAS in the cybersecurity field includes a collaborative agent cluster built on the SOAR (Security Orchestration, Automation, and Response) platform. The entire security response process is broken down into a series of specialized, modular agents, each undertaking a specific sub-task (such as log analysis, host scanning, and policy distribution). These agents do not operate in isolation but collaborate closely under a coordination mechanism: typically driven by a central coordinator or a predefined workflow. The coordinator dynamically schedules relevant agents based on event type and maintains the continuous transmission of contextual information, ensuring seamless integration of each step from detection, investigation, analysis to response. In actual operation, each agent makes decisions based solely on local observations. For example, in a threat hunting scenario, the system may first detect abnormal process behavior on a host by a detection agent; this discovery will immediately trigger a workflow, calling the agent to remotely collect memory snapshots and process lists of the host; subsequently, the analysis agent receives this data, compares it with local malware signature databases or external threat intelligence, and determines whether it matches a known APT toolchain; once a threat is confirmed, the response agent automatically executes containment measures such as isolating the host and blocking network connections.

[0004] In current security automation architectures based on multi-agent systems (MAS), existing task routing mechanisms largely rely on static rules, making them ill-suited for dynamic security scenarios and prone to inefficient task allocation or omission of critical steps. Furthermore, task transfers between agents often result in misjudgments or response delays due to loss of contextual information.

[0005] While existing MAS performs well in simple scenarios, it reveals the following key shortcomings when facing complex cybersecurity environments characterized by high dynamism, high noise, and high adversarialness: 1. Routing misjudgment: The central coordinator or rule engine often assigns tasks based on a single feature (such as IP address or process name), which is susceptible to interference from adversarial examples or spoofing behavior, causing tasks to be incorrectly routed to irrelevant agents, resulting in wasted resources or missed detections.

[0006] 2. Context fragmentation: The information transmitted between intelligent agents is mostly discrete events or structured data fragments (such as JSON fields), lacking complete encapsulation of the decision context (such as historical behavior sequences, confidence levels, and environmental constraints), which leads to the receiver's inability to accurately understand the task intent and cause erroneous operations.

[0007] 3. Risk of infinite loop: When multiple agents repeatedly request each other to perform the same sub-task due to inconsistent information or delayed feedback (e.g., A asks B to verify, and B asks A to provide evidence), the system is prone to getting stuck in an endless interaction loop, reducing response efficiency or even causing service blockage.

[0008] 4. Lack of adaptive granularity control: Existing systems typically use fixed-granularity task division (such as "one task per host"), which cannot dynamically adjust the collaboration granularity according to the severity of the threat, network topology, or resource load, making it difficult to balance efficiency and accuracy.

[0009] The root cause of the above problems is that the existing MAS lacks a dynamic collaborative unit that can adaptively abstract security semantics, encapsulate context boundaries, and ensure the quality of collaboration, making it difficult to achieve refined, robust, and interpretable process control in complex adversarial scenarios.

[0010] Therefore, there is an urgent need for a multi-agent collaborative scheduling mechanism that can dynamically optimize routing paths and ensure strong context consistency. Summary of the Invention

[0011] This invention provides a particle-driven network security multi-agent collaboration method, system, and medium, aiming to achieve dynamic optimization of routing paths and ensure strong context consistency.

[0012] This invention provides a particle-driven multi-agent cooperative method for network security, the method comprising the following steps: Step S10: Extract raw events from multi-source heterogeneous databases through the network state awareness module, and construct a unified high-dimensional state vector based on the host through feature engineering. The multi-source heterogeneous database includes at least one of EDR, NDR, asset database, and identity authentication system; Step S20: Based on the high-dimensional state vector, the particle generation engine is used. A clustering algorithm is used to adaptively divide the network environment state space into several safe spheres, and each safe sphere is defined as a hypersphere in a high-dimensional feature space. =( , , , , ),in, As the center vector, For radius, For internal sample set, For semantic tags, Rate the quality; Step S30: Based on the semantic tags of the security particles, the particle-smart agent binder... Determine the most suitable agent type for handling tasks within the corresponding region, and assign each security sphere to it. Dynamically allocate a group of agents to perform sub-tasks; In step S40, when a cross-particle migration task is required, all relevant information of the current particle is collected and packaged through the context wrapper to generate a standard context package including particle metadata and decision chain. ; Step S50: The standard context packet is evaluated by the quality evaluator. The information in the packet is verified, and the standard context packet is validated. The quality score, if the standard context package If the quality score is lower than a preset threshold, the task will be refused and the loop detection and intervention module will be notified to record an "invalid activation". At the same time, a replanning strategy will be executed. Step S60: By monitoring and analyzing the logs of all particle activation history recorded by the loop detection and intervention module, the activation sequence of particles in the entire system is monitored and analyzed to detect whether there is a situation where the same particle is repeatedly activated while its global network state has not changed; if so, action intervention is performed.

[0013] A further technical solution of the present invention is that the high-dimensional state vector in step S10... The structure is based on a single host, with each host... Aggregation is performed within the sliding time window to generate a Dimensional vector: = [proc_ps_count, net_smb_out_bytes, auth_kerb_fail_rate, mem_injection_score, dns_dga_likelihood, asset_criticality, pred_lateral_prob]∈R d ; Among them, proc_ps_count is the number of suspicious process creations, net_smb_out_bytes is the number of SMB protocol bytes sent outwards, auth_kerb_fail_rate is the Kerberos authentication failure rate, mem_injection_score is the memory injection risk score, dns_dga_likelihood is the probability that DNS requests conform to the DGA domain name generation algorithm, asset_criticality is the host's asset importance level, and pred_lateral_prob is the predicted value of the short-term network state evolution trend by the lightweight model.

[0014] A further technical solution of the present invention is that the security particle covers a specific network region and contains semantic tags and quality scores of all activities within that region, and step S20 includes: Step S201: Assess the current network environment state space. = { , , …, Adaptive partitioning is performed, treating the state vector as sample points, to generate a set of safe particles that satisfy the quality constraints. .

[0015] A further technical solution of the present invention is that step S201 specifically includes: Step S2011: Select any point as the initial center. Let the initial radius be... =0, then repeat steps S2012 to S2014 until all sample points are covered: Step S2012, gradually increase the radius r, until it satisfies Points ≤ r are included in the current safe sphere. ; Step S2013: Perform a quality assessment and calculate the current safe particle size. Quality rating The calculation formula is:

[0016] in, The semantic labels for particles are generated by a pre-trained classifier. Sure; Semantic tags and the embedding vector of the current global security target; For similarity calculation, cosine similarity is used, i.e. ; This represents the maximum number of host machines that can be covered by a single ball. Refers to internal purity; Refers to coverage efficiency; Refers to target alignment; Step S2014, if the current safe particle Quality rating If the value is less than the set threshold, then in the current safe particle... The subset with the highest purity is selected internally as the new center, splitting into sub-spheres, with the remaining points continuing to participate in subsequent sphere generation; if the current sphere is safe... Quality rating If the value is greater than or equal to the set threshold, then the current safe particle is accepted. Fix its center vector and radius, remove interior points, and for each already generated safe sphere Extract its center vector and input it into a pre-trained secure semantic classifier. , obtain a predefined set of threat semantic tags.

[0017] A further technical solution of the present invention is that the classifier During the training phase, supervised learning is performed using labeled host behavior sequences, and the semantic separability of the embedding space is optimized through contrastive learning for the classifier. The training method is as follows: Use historical APT drills or red-blue team exercises; label the actual attack phase of each host window; use contrastive learning to enhance semantic boundaries, so that the center vectors of "lateral movement" and "normal operation and maintenance" are far apart in the embedding space.

[0018] A further technical solution of the present invention is that each semantic tag Pre-associating an agent capability template, step S30 includes: If multiple security particles have the same label, scheduling is based on resource availability and asset priority: high-priority assets are assigned high-performance agents first; under the same priority, idle agents are assigned using a round-robin or load balancing strategy.

[0019] A further technical solution of the present invention is that the replanning strategy in step S50 includes particle refinement, context enhancement, and manual intervention; The particle refinement refers to requesting the particle generation engine to split the source region to generate purer sub-particles; The context enhancement involves invoking additional data-collecting agents to supplement evidence. The manual intervention involves reporting a loop risk to the loop detection and intervention module if two consecutive replanning attempts fail. The loop detection and intervention module then makes a comprehensive judgment on whether manual intervention is necessary.

[0020] A further technical solution of the present invention is that the work intervention in step S60 includes: freezing the safety particle task chain; triggering the quality evaluator to initiate a replanning strategy; if the replanning still fails and a cyclical risk is received, then manual intervention and assessment are performed.

[0021] To achieve the above objectives, the present invention also proposes a particle-based network security multi-agent cooperative system, the system comprising a memory, a processor, and a particle-based network security multi-agent cooperative program stored on the processor, wherein the particle-based network security multi-agent cooperative program is executed by the processor to perform the steps of the method described above.

[0022] To achieve the above objectives, the present invention also proposes a computer-readable storage medium storing a particle-based network security multi-agent cooperative program, wherein the particle-based network security multi-agent cooperative program is executed by a processor to perform the steps of the method described above.

[0023] The beneficial effects of this invention, based on a particle-driven multi-agent cooperative method, system, and medium for network security, are as follows: This invention introduces a "security particle" as the basic semantic unit for multi-agent collaboration and constructs a particle-driven closed-loop collaboration mechanism, effectively overcoming the core defects of existing network security multi-agent systems, such as rigid task routing, context fragmentation, frequent infinite loops, and granularity mismatch. Specifically: 1. Achieve precise task routing with semantic awareness This invention abandons traditional static rule-based routing based on single-point features (such as IP address or process name), and instead performs high-level intent-level scheduling based on the semantic labels of granular balls (such as "lateral movement" or "C2 communication"). Since granular balls are generated by clustering high-dimensional behavior vectors and labeled by a secure semantic classifier, their labels have strong semantic consistency, significantly reducing the rate of task misassignment and the risk of missing critical steps.

[0024] 2. Ensure strong consistency across agent contexts The context encapsulator packages and transmits metadata such as the center, radius, quality score, decision chain, and confidence level of the particle, ensuring that the task carries complete reasoning during migration. The receiving agent can make accurate judgments based on sufficient context, fundamentally eliminating misjudgments or response delays caused by information fragmentation.

[0025] 3. Proactively block invalid collaboration paths to improve system robustness. The quality evaluator dynamically gates the incoming context, rejecting low-quality task flows; the loop detection and intervention module monitors the activation sequence based on state hashing, identifying repeated calls without progress. Together, they form a dual closed-loop intervention mechanism, effectively preventing resource waste and service blockage, and ensuring the stability and timeliness of the response process.

[0026] 4. Supports adaptive multi-granularity collaboration, balancing efficiency and accuracy. The granular ball can dynamically split or merge (generalized response) based on threat severity, asset value, or resource load, enabling hierarchical coordination of "coarse-grained guidance and fine-grained execution" in large-scale networks. This mechanism avoids both fine-grained overload and coarse-grained false negatives, achieving a dual optimization of efficiency and accuracy. Attached Figure Description

[0027] Figure 1 This is a flowchart illustrating a preferred embodiment of the particle-driven multi-agent cooperative network security method of the present invention. Figure 2 This is a schematic diagram of the system architecture of the particle-driven multi-agent collaborative network security system of the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0029] This invention proposes a multi-agent collaborative method for network security based on a granular ball-driven approach. The main technical solution employed in this invention lies in introducing a "Security Granular Ball" as an adaptive semantic coverage unit for the network state space and task execution space. Each Security Granular Ball is defined as a hypersphere in a high-dimensional feature space. This region not only covers a set of semantically similar sample points (such as multiple hosts exhibiting similar abnormal behaviors), but also encapsulates task context, execution strategy, confidence level, and quality indicators, serving as a basic semantic unit to reconstruct the collaborative mechanism among multiple agents.

[0030] Specifically, such as Figure 1 As shown, a preferred embodiment of the particle-driven multi-agent cooperative network security method of the present invention includes the following steps: Step S10: Extract raw events from multi-source heterogeneous databases through the network state awareness module, and construct a unified high-dimensional state vector based on the host through feature engineering. The multi-source heterogeneous database includes at least one of EDR, NDR, asset database, and identity authentication system.

[0031] The high-dimensional state vector in step S10 The structure is based on a single host, with each host... Aggregation is performed within the sliding time window to generate a Dimensional vector: = [proc_ps_count, net_smb_out_bytes, auth_kerb_fail_rate, mem_injection_score, dns_dga_likelihood, asset_criticality, pred_lateral_prob]∈R d ; Among them, proc_ps_count is the number of suspicious process creations, net_smb_out_bytes is the number of SMB protocol bytes sent outwards, auth_kerb_fail_rate is the Kerberos authentication failure rate, mem_injection_score is the memory injection risk score, dns_dga_likelihood is the probability that DNS requests conform to the DGA domain name generation algorithm, asset_criticality is the host's asset importance level, and pred_lateral_prob is the predicted value of the short-term network state evolution trend by the lightweight model.

[0032] Step S20: Based on the high-dimensional state vector, the particle generation engine is used. A clustering algorithm is used to adaptively divide the network environment state space into several safe spheres, and each safe sphere is defined as a hypersphere in a high-dimensional feature space. =( , , , , ),in, As the center vector, For radius, For internal sample set, For semantic tags, Rate the quality.

[0033] In this embodiment, the security particle covers a specific network region and contains semantic labels and quality scores for all activities within that region. Step S20 specifically includes: Step S201: Assess the current network environment state space. = { , , …, Adaptive partitioning is performed, treating the state vector as sample points, to generate a set of safe particles that satisfy the quality constraints. .

[0034] Step S201 specifically includes: Step S2011: Select any point as the initial center. Let the initial radius be... =0, then repeat steps S2012 to S2014 until all sample points are covered: Step S2012, gradually increase the radius r, until it satisfies Points ≤ r are included in the current safe sphere. ; Step S2013: Perform a quality assessment and calculate the current safe particle size. Quality rating The calculation formula is:

[0035] in, The semantic labels for particles are generated by a pre-trained classifier. Sure; Semantic tags and the embedding vector of the current global security target; For similarity calculation, cosine similarity is used, i.e. ; This represents the maximum number of host machines that can be covered by a single ball. Refers to internal purity; Refers to coverage efficiency; Refers to target alignment; Step S2014, if the current safe particle Quality rating If the value is less than the set threshold, then in the current safe particle... The subset with the highest purity is selected internally as the new center, splitting into sub-spheres, with the remaining points continuing to participate in subsequent sphere generation; if the current sphere is safe... Quality rating If the value is greater than or equal to the set threshold, then the current safe particle is accepted. Fix its center vector and radius, remove interior points, and for each already generated safe sphere Extract its center vector and input it into a pre-trained secure semantic classifier. , obtain a predefined set of threat semantic tags.

[0036] The classifier During the training phase, supervised learning is performed using labeled host behavior sequences, and the semantic separability of the embedding space is optimized through contrastive learning for the classifier. The training method is as follows: Use historical APT drills or red-blue team exercises; label the actual attack phase of each host window; use contrastive learning to enhance semantic boundaries, so that the center vectors of "lateral movement" and "normal operation and maintenance" are far apart in the embedding space.

[0037] Step S30: Based on the semantic tags of the security particles, the particle-smart agent binder... Determine the most suitable agent type for handling tasks within the corresponding region, and assign each security sphere to it. Dynamically allocate a group of agents to perform subtasks.

[0038] In this embodiment, each semantic tag Pre-associating an agent capability template, step S30 specifically includes: If multiple security particles have the same label, scheduling is based on resource availability and asset priority: high-priority assets are assigned high-performance agents first; under the same priority, idle agents are assigned using a round-robin or load balancing strategy.

[0039] In step S40, when a cross-particle migration task is required, all relevant information of the current particle is collected and packaged through the context wrapper to generate a standard context package including particle metadata and decision chain. .

[0040] Step S50: The standard context packet is evaluated by the quality evaluator. The information in the packet is verified, and the standard context packet is validated. The quality score, if the standard context package If the quality score is lower than a preset threshold, the task will be refused and the loop detection and intervention module will be notified to record an "invalid activation". At the same time, a replanning strategy will be executed.

[0041] The replanning strategies in step S50 include particle refinement, context enhancement, and manual intervention. The particle refinement refers to requesting the particle generation engine to split the source region to generate purer sub-particles; The context enhancement involves invoking additional data-collecting agents to supplement evidence. The manual intervention involves reporting a loop risk to the loop detection and intervention module if two consecutive replanning attempts fail. The loop detection and intervention module then makes a comprehensive judgment on whether manual intervention is necessary.

[0042] Step S60: By monitoring and analyzing the logs of all particle activation history recorded by the loop detection and intervention module, the activation sequence of particles in the entire system is monitored and analyzed to detect whether there is a situation where the same particle is repeatedly activated while its global network state has not changed; if so, action intervention is performed.

[0043] The work intervention in step S60 includes: freezing the safety particle task chain; triggering the quality evaluator to initiate a replanning strategy; if the replanning still fails and a cyclical risk is received, then manual intervention and assessment are performed.

[0044] The following combination Figure 1 and Figure 2 The present invention provides a more detailed description of the multi-agent cooperative method for network security based on particle-driven principles.

[0045] This invention is based on a granular ball-driven multi-agent collaborative method for network security. First, the network environment state space (composed of host behavior, traffic characteristics, log sequences, etc.) is adaptively divided into several "security granular balls." Each security granular ball is defined as a hypersphere in a high-dimensional feature space. =( , , , , ).in, ∈ The center vector represents the typical behavioral pattern of the region; c∈R + X is the radius used to define the coverage boundary; D is the internal sample set (such as host, session or event); For semantic tags (such as "suspected lateral movement", "C2 communication"); ∈[0,1] represents the quality score, which is calculated by combining purity, coverage, and alignment with the global security objective.

[0046] formula =( , , , , This describes the data structure of the "safety sphere," the basic collaborative unit. Among them, It is the center vector in the high-dimensional feature space. It extracts the most typical and representative behavior pattern of the region by aggregating the behavioral features of all sample points (such as the host). It is a positive real number, which serves as the radius of the hypersphere and precisely defines the coverage area of ​​the particle in the feature space, i.e., which sample points belong to this particle. It is the collection of internal samples covered by the sphere, such as a group of hosts exhibiting similar anomalous behavior; It is a high-level threat label (such as "lateral movement" or "C2 communication") assigned by a pre-trained security semantic classifier, which abstracts complex low-dimensional features into human-understandable security intentions; finally, q is a quality score between 0 and 1 (the quality score formula is introduced later), which is used to quantify the reliability and effectiveness of the particle as a collaborative unit, and is a key basis for subsequent task scheduling and loop detection.

[0047] The system involved in this invention's particle-driven network security multi-agent cooperative method comprises six core modules: a network state awareness module, a particle generation engine, a particle-agent binding device, a context encapsulator, a quality evaluator, and a loop detection and intervention module. The module connection diagram is shown below. Figure 2 As shown below. The detailed functions and interaction logic between each module will be described in detail below: 1. Network Status Awareness Module The main function of this module is to extract raw events from multi-source heterogeneous data, including EDR (process creation, memory injection, registry modification, file writing), NDR (NetFlow records (source / destination IP, port, protocol, byte count, packet count), DNS lookup, TLS fingerprint), asset database (host roles (domain controller, database, terminal), sensitivity level), and authentication system (login failure count, etc.), and to construct a unified high-dimensional state vector (such as process behavior sequences, network flow statistics, login frequency, etc.) through feature engineering. State Vector The structure is based on a single host, with each host... Aggregate behaviors within a sliding time window (e.g., 5 minutes, the specific value is not limited here) to generate a Dimensional vector: =[proc_ps_count, net_smb_out_bytes, auth_kerb_fail_rate, mem_injection_score, dns_dga_likelihood, asset_criticality, pred_lateral_prob (from the prediction model)]∈R d .

[0048] This formula is used to construct the host state vector that forms the basis of network state. It describes how to fuse heterogeneous data from multiple sources, such as EDR, NDR, and asset databases, into a unified, high-dimensional numerical vector. This vector is based on a single host... Aggregation is performed within a sliding time window (e.g., 5 minutes) and its dimensions include specific observable metrics, such as the number of suspicious process creations (proc_ps_count), the number of SMB protocol bytes sent out (net_smb_out_bytes), the Kerberos authentication failure rate (auth_kerb_fail_rate), the memory injection risk score (mem_injection_score), the probability that DNS requests conform to the DGA domain name generation algorithm (dns_dga_likelihood), and the asset criticality level of the host (asset_criticality).

[0049] The vector also includes a predictive feature output by a lightweight predictive model (such as LSTM)—the probability of initiating a lateral movement in the future (pred_lateral_prob). This vector transforms the original, discrete security events into a continuous numerical space that can be processed by clustering algorithms, thus enabling the adaptive generation of "security spheres".

[0050] The final dimension, `pred_lateral_prob`, is a prediction of short-term network state evolution trends by a lightweight model (such as LSTM or Transformer Encoder, the specific model is not limited here), for example, "the probability of initiating a lateral movement within the next 5 minutes," with a value ranging from [0,1]. This prediction result is not used for direct decision-making, but rather serves as one of the input features of the particle generation engine to achieve forward-looking particle construction and avoid response lag: even if lateral behavior has not yet occurred, hosts with high predicted probabilities will be clustered into the "potential attack springboard" region in advance.

[0051] 2. Particle Generation Engine Based on the acquired high-dimensional state vector, the network space is automatically partitioned using algorithms (such as K-means or DBSCAN clustering methods) to create secure spheres. These spheres not only cover specific network regions but also contain semantic labels and quality scores for all activities within those regions for subsequent processing.

[0052] This module accesses the current state space. ={ , , …, Adaptive partitioning is performed, treating these state vectors as sample points to generate a set of safe spheres that satisfy the quality constraints. First, choose any point as the initial center. Let the initial radius be... =0. Then, repeat the following process until all sample points are covered: Gradually increase , will satisfy Points ≤ r are included in the current sphere. ; Perform quality assessment and calculate the current number of pellets. The quality score is calculated using the following formula: The internal purity is explained as follows: if a particle contains 40 main units, and 38 of them are classified as "moving laterally" by the classifier, then the purity = 38 / 40 = 0.95. The semantic labels for particles are determined by a pre-trained classifier; Tags respectively and the embedding vector of the current global security target; For similarity calculation, cosine similarity can be used. ; (Settable and adjustable), representing a single ball covering a maximum of 50 hosts (to prevent overgeneralization).

[0053] If quality score Less than the set threshold, in The process internally selects the subset with the highest purity (e.g., the k points with the most consistent labels) as the new center, splits it into sub-spheres, and the remaining points continue to participate in subsequent sphere generation. This process ensures that each final sphere is a compact, high-purity, and high-coverage semantic unit. The sphere generation terminates when all host state vectors are covered by at least one sphere.

[0054] If quality score If the value is greater than the threshold (which can be set to 0.7), then the particle is accepted and fixed. , Remove internal points. For each generated sphere... Extract its center vector ∈ ,Will By inputting a pre-trained security semantic classifier, a predefined set of threat semantic labels can be obtained (e.g., {“lateral movement”, “C2 communication”, “credential dump”, “no anomaly”}). Different semantic particles can be distinguished because of their center vectors. In high-dimensional space, they fall into different semantic regions. (Classifier) During the training phase, supervised learning is performed using labeled host behavior sequences, and the semantic separability of the embedding space is optimized through contrastive learning for the classifier. The training method is as follows: (1) Use historical APT exercise or red-blue team battle data; (2) Mark the "real attack phase" for each host window; (3) Employ contrastive learning to enhance semantic boundaries, so that the center vectors of "lateral movement" and "normal operation and maintenance" are far apart in the embedding space.

[0055] 3. Particle-Intelligent Agent Binding Device This module is for each sphere A set of agents is dynamically assigned to execute subtasks, that is, the most suitable agent type for handling tasks within a region is determined based on the semantic label of each security sphere. This dynamic binding mechanism ensures that tasks are executed by the most appropriate agent while maintaining the consistency of the task execution context.

[0056] In practical implementation, each semantic tag Pre-associate an agent capability template (e.g., "Lateral Movement" → [Memory Analysis Agent, Host Isolation Agent]), where special cases are handled as follows: If multiple spheres have the same label (such as two "lateral movement" spheres), scheduling is performed based on resource availability and asset priority: high-priority assets (such as domain controller servers) are assigned high-performance agents first; under the same priority, idle agents are assigned using round-robin or load balancing strategies; at the same time, this module supports agent reuse: the same agent can be bound to multiple non-conflicting spheres (execution independence is guaranteed through context isolation mechanism).

[0057] 4. Context wrapper When a task requires cross-sphere migration, the context wrapper collects and packages all relevant information about the current sphere (such as center point, radius, label, quality score, etc.) into a standardized context package. This context package is then passed to the next sphere to ensure the consistency and integrity of the context during task execution. Therefore, this module needs to generate a standardized context package when a task requires cross-sphere migration (e.g., expanding from sphere A to sphere B). The format of the encapsulated content is as follows: { "source_ball_id": "B102", "center": [0.72, -0.15, ...], "radius": 0.38, "semantic_label": "lateral_movement", "quality_score": 0.86, "decision_chain": ["detected_ps_injection", "confirmed_wmi_abuse"], "confidence": 0.91, "boundary_conditions": {"time_window": "2026-03-26T16:00~16:10", "asset_scope": ["H1", "H2"]} } 5. Quality evaluator When a context packet is received from the context wrapper, the quality evaluator verifies the information within it. This module is crucial for preventing the propagation of low-quality decisions. Verification The quality score. If (default If the quality score of a context packet falls below a preset threshold, the task will be rejected. When the quality evaluator rejects a low-quality context, it notifies the loop detection and intervention module to record an "invalid activation" and sequentially sends replanning requests to relevant modules until the problem is resolved. The replanning strategies include: A. Particle refinement: Request the particle generation engine to split the source region to generate purer sub-particles; B. Context Enhancement: Invoking additional data collection agents (such as registry snapshots) to supplement evidence; C. Manual intervention: If two consecutive replanning attempts fail, a loop risk is reported to the loop detection and intervention module, which will then make a comprehensive judgment on whether manual intervention is necessary.

[0058] 6. Cyclic Detection and Intervention Module This module maintains a log that records the history of all particle activations (activation refers to the start of the agent bound to the particle executing a task related to that particle). .in, The timestamp of the kth activation. Indicates the activated granules. Indicates time Complete network status (including all host behavior vectors, alarm lists, task queues, etc.). This is a hash digest of the current global network state, and `snapshot` is its serialized representation. This applies whenever the network state changes (e.g., new logs, new connections, policy updates). This will change. This module monitors and analyzes the activation sequence of particles across the entire system to detect situations where the same particle is repeatedly activated without any change in its global network state (i.e., an infinite loop). A typical scenario is: Agent A requests B to verify whether host H1 has been compromised; B, due to insufficient evidence, requests A to provide more memory snapshots; A calls the forensics module again, but still cannot obtain new data due to permission or timing issues; B refuses to make a judgment again…

[0059] When this module detects a potential loop, it actively queries the historical scores of the quality evaluator to determine whether the repeated failures are due to quality degradation, and makes a comprehensive judgment: if a certain ball exists... satisfy: ∧ ≥ This means that the same task unit (particle) is called more than 3 times consecutively, but the overall network appears unchanged. If this condition is true, the module will perform the following intervention: 1. Freeze the task chain of this particle; 2. Trigger the quality evaluator, and have this module initiate a replanning process (as described in the previous section); 3. If replanning still fails and the risk of a loop is reported back from the previous module, then manual intervention and assessment will be carried out.

[0060] The beneficial effects of this invention's particle-driven multi-agent cooperative network security method are: This invention introduces a "security particle" as the basic semantic unit for multi-agent collaboration and constructs a particle-driven closed-loop collaboration mechanism, effectively overcoming the core defects of existing network security multi-agent systems, such as rigid task routing, context fragmentation, frequent infinite loops, and granularity mismatch. Specifically: 1. Achieve precise task routing with semantic awareness This invention abandons traditional static rule-based routing based on single-point features (such as IP address or process name), and instead performs high-level intent-level scheduling based on the semantic labels of granular balls (such as "lateral movement" or "C2 communication"). Since granular balls are generated by clustering high-dimensional behavior vectors and labeled by a secure semantic classifier, their labels have strong semantic consistency, significantly reducing the rate of task misassignment and the risk of missing critical steps.

[0061] 2. Ensure strong consistency across agent contexts The context encapsulator packages and transmits metadata such as the center, radius, quality score, decision chain, and confidence level of the particle, ensuring that the task carries complete reasoning during migration. The receiving agent can make accurate judgments based on sufficient context, fundamentally eliminating misjudgments or response delays caused by information fragmentation.

[0062] 3. Proactively block invalid collaboration paths to improve system robustness. The quality evaluator dynamically gates the incoming context, rejecting low-quality task flows; the loop detection and intervention module monitors the activation sequence based on state hashing, identifying repeated calls without progress. Together, they form a dual closed-loop intervention mechanism, effectively preventing resource waste and service blockage, and ensuring the stability and timeliness of the response process.

[0063] 4. Supports adaptive multi-granularity collaboration, balancing efficiency and accuracy. The granular ball can dynamically split or merge (generalized response) based on threat severity, asset value, or resource load, enabling hierarchical coordination of "coarse-grained guidance and fine-grained execution" in large-scale networks. This mechanism avoids both fine-grained overload and coarse-grained false negatives, achieving a dual optimization of efficiency and accuracy.

[0064] To achieve the above objectives, the present invention also proposes a particle-driven network security multi-agent cooperative system. The system includes a memory, a processor, and a particle-driven network security multi-agent cooperative program stored on the processor. The particle-driven network security multi-agent cooperative program is executed by the processor to perform the steps of the method described in the above embodiments, which will not be repeated here.

[0065] To achieve the above objectives, the present invention also proposes a computer-readable storage medium storing a particle-based network security multi-agent cooperative program. When the particle-based network security multi-agent cooperative program is run by a processor, the steps of the method described above are executed, which will not be repeated here.

[0066] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A particle-driven multi-agent cooperative method for network security, characterized in that, The method includes the following steps: Step S10: Extract raw events from multi-source heterogeneous databases through the network state awareness module, and construct a unified high-dimensional state vector based on the host through feature engineering. The multi-source heterogeneous database includes at least one of EDR, NDR, asset database, and identity authentication system; Step S20: Based on the high-dimensional state vector, the particle generation engine is used. A clustering algorithm is used to adaptively divide the network environment state space into several safe spheres, and each safe sphere is defined as a hypersphere in a high-dimensional feature space. =( , , , , ),in, As the center vector, For radius, For internal sample set, For semantic tags, Rate the quality; Step S30: Based on the semantic tags of the security particles, the particle-smart agent binder... Determine the most suitable agent type for handling tasks within the corresponding region, and assign each security sphere to it. Dynamically allocate a group of agents to perform sub-tasks; In step S40, when a cross-particle migration task is required, all relevant information of the current particle is collected and packaged through the context wrapper to generate a standard context package including particle metadata and decision chain. ; Step S50: The standard context packet is evaluated by the quality evaluator. The information in the packet is verified, and the standard context packet is validated. The quality score, if the standard context package If the quality score is lower than the preset threshold, the task will be refused and the loop detection and intervention module will be notified to record an "invalid activation". At the same time, the replanning strategy will be executed. Step S60: By monitoring and analyzing the logs of all particle activation history recorded by the loop detection and intervention module, the activation sequence of particles in the entire system is monitored and analyzed to detect whether there is a situation where the same particle is repeatedly activated while its global network state has not changed; if so, action intervention is performed.

2. The multi-agent cooperative method for network security based on particle-driven approach according to claim 1, characterized in that, The high-dimensional state vector in step S10 The structure is based on a single host, with each host... Aggregation is performed within the sliding time window to generate a Dimensional vector: = [proc_ps_count, net_smb_out_bytes, auth_kerb_fail_rate, mem_injection_score, dns_dga_likelihood, asset_criticality, pred_lateral_prob]∈R d ; Among them, proc_ps_count is the number of suspicious process creations, net_smb_out_bytes is the number of SMB protocol bytes sent outwards, auth_kerb_fail_rate is the Kerberos authentication failure rate, mem_injection_score is the memory injection risk score, dns_dga_likelihood is the probability that DNS requests conform to the DGA domain name generation algorithm, asset_criticality is the host's asset importance level, and pred_lateral_prob is the predicted value of the short-term network state evolution trend by the lightweight model.

3. The multi-agent cooperative method for network security based on particle-driven approach according to claim 2, characterized in that, The security particle covers a specific network region and contains semantic labels and quality scores for all activities within that region. Step S20 includes: Step S201: Assess the current network environment state space. = { , , …, Adaptive partitioning is performed, treating the state vector as sample points, to generate a set of safe particles that satisfy the quality constraints. .

4. The multi-agent cooperative method for network security based on particle-driven approach according to claim 3, characterized in that, Step S201 specifically includes: Step S2011: Choose any point as the initial center and set the initial radius. =0, then repeat steps S2012 to S2014 until all sample points are covered: Step S2012, gradually increase the radius r, until it satisfies The point is included in the current security sphere ; Step S2013: Perform a quality assessment and calculate the current safe particle size. Quality rating The calculation formula is: in, For sphere semantic labels, a pre-trained secure semantic classifier is used. Sure; Semantic tags and the embedding vector of the current global security target; For similarity calculation, cosine similarity is used, i.e. ; This represents the maximum number of host machines that can be covered by a single ball. Refers to internal purity; Refers to coverage efficiency; Refers to target alignment; Step S2014, if the current safe particle Quality rating If the value is less than the set threshold, then in the current safe particle... The subset with the highest purity is selected internally as the new center, splitting into sub-spheres, with the remaining points continuing to participate in subsequent sphere generation; if the current sphere is safe... Quality rating If the value is greater than or equal to the set threshold, then the current safe particle is accepted. Fix its center vector and radius, remove interior points, and for each already generated safe sphere Extract its center vector and input it into a pre-trained secure semantic classifier. , obtain a predefined set of threat semantic tags.

5. The multi-agent cooperative method for network security based on particle-driven approach according to claim 4, characterized in that, The pre-trained security semantic classifier During the training phase, supervised learning is performed using labeled host behavior sequences, and the semantic separability of the embedding space is optimized through contrastive learning. A pre-trained secure semantic classifier is then developed. The training method is as follows: Use historical APT drills or red-blue team exercises; label the actual attack phase of each host window; employ contrastive learning to enhance semantic boundaries, so that the center vectors of "lateral movement" and "normal operation and maintenance" are far apart in the embedding space.

6. The multi-agent cooperative method for network security based on particle-driven approach according to claim 5, characterized in that, Each semantic tag Pre-associating an agent capability template, step S30 includes: If multiple security particles have the same label, scheduling is based on resource availability and asset priority: high-priority assets are assigned high-performance agents first; under the same priority, idle agents are assigned using a round-robin or load balancing strategy.

7. The multi-agent cooperative method for network security based on particle-driven approach according to claim 6, characterized in that, The replanning strategies in step S50 include particle refinement, context enhancement, and manual intervention. The particle refinement refers to requesting the particle generation engine to split the source region to generate purer sub-particles; The context enhancement involves invoking additional data-collecting agents to supplement evidence. The manual intervention involves reporting a loop risk to the loop detection and intervention module if two consecutive replanning attempts fail. The loop detection and intervention module then makes a comprehensive judgment on whether manual intervention is necessary.

8. The multi-agent cooperative method for network security based on particle-driven approach according to claim 7, characterized in that, The work intervention in step S60 includes: freezing the safety particle task chain; triggering the quality evaluator to initiate a replanning strategy; if the replanning still fails and a cyclical risk is received, then manual intervention and assessment are performed.

9. A network security multi-agent cooperative system based on particle-driven architecture, characterized in that, The system includes a memory, a processor, and a particle-based network security multi-agent cooperative program stored on the processor, wherein the particle-based network security multi-agent cooperative program is executed by the processor to perform the steps of the method as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a particle-based network security multi-agent cooperative program, which, when executed by a processor, performs the steps of the method as described in any one of claims 1 to 8.

Images