An agent running state security deviation real-time detection and self-trap stopping method and system

Abstract

The application discloses an intelligent body running state security deviation real-time detection and self-trap stop method and system, and belongs to the technical field of intelligent body security monitoring. The application carries out sliding window statistical analysis on the intelligent body running time sequence behavior log, parallelly feeds normalized multidimensional security indexes into at least two independent detectors to capture sudden abnormality and persistent slight deviation, determines the security deviation grade through deterministic fusion, and finally executes corresponding control actions through a hierarchical self-trap stop state machine containing an irreversible absorption state. The application determines the security baseline through offline learning period, does not depend on probability distribution hypothesis, random variable or iterative optimization throughout the whole process, always produces the same output for the same input, and provides an intelligent body with a deterministic, auditable and non-bypassable running state security monitoring and self-trap stop scheme.

Description

I. Technical Field

[0001] This invention relates to the field of artificial intelligence and intelligent agent security monitoring technology, specifically to a method and system for real-time detection of temporal safety deviations in intelligent agent runtime behavior logs through deterministic fusion of multiple detection mechanisms, and for executing graded irreversible self-trapping upon confirmation of deviations. II. Background Technology

[0002] With the widespread deployment of intelligent agents in various business scenarios, the need for security monitoring of these agents during operation is becoming increasingly prominent. Intelligent agents may deviate from normal behavior patterns due to software failures, external attacks, or environmental changes, leading to security risks such as unauthorized operations, abnormal responses, and state instability. Currently, the security monitoring of intelligent agents faces the following prominent issues:

[0003] First, the detection methods are outdated. Existing solutions mostly rely on post-event log auditing, meaning that by the time a security incident is discovered, the damage has already occurred, lacking real-time detection capabilities.

[0004] Second, it cannot distinguish between random fluctuations and systematic deviations. A single instance of abnormal behavior may be a normal random fluctuation, but persistent, small deviations are often a precursor to security threats. Existing solutions lack deterministic technical means to effectively differentiate between these two types of situations.

[0005] Third, there is a lack of multi-dimensional indicator correlation analysis capabilities. Security risks often manifest as multiple behavioral indicators simultaneously exhibiting abnormalities. Existing solutions typically monitor individual indicators in isolation, failing to capture joint anomalies across multiple indicators.

[0006] Fourth, there is a lack of a unified and rigid control mechanism for deviations. Different platforms respond to deviations in different ways; some only log the behavior, while others only intervene when the severity threshold is exceeded. There is a lack of a tiered, irreversible, and auditable self-stopping process. III. Summary of the Invention

[0007] The technical problem to be solved by this invention is: how to provide a method and system that is independent of the internal implementation of the intelligent agent, performs time-series analysis on the behavior logs generated during the operation of the intelligent agent, uses multiple deterministic detectors in parallel to detect and fuse safety deviations, and performs deterministic hierarchical self-trapping after confirming the deviation.

[0008] Technical solution

[0009] This invention provides a method for real-time detection and self-trapping of safe deviations in the operational state of an intelligent agent, comprising the following steps:

[0010] Step S1. Obtain the time-series behavior log sequence generated by the agent during operation; the behavior log shall at least include timestamps, behavior type identifiers, and operation results;

[0011] Step S2. Extract the current window statistical values ​​of each security indicator from the preset security indicator set from the behavior log sequence; the security indicator set includes at least two of the following: behavior compliance rate, state stability, frequency of abnormal operations, and response consistency.

[0012] Step S3. Normalize the current window statistics to map safety indicators of different dimensions to the same scale space;

[0013] Step S4. The normalized index values ​​are fed in parallel into at least two independent detectors, each detector performing deviation determination based on different anomaly patterns; the at least two independent detectors include a first detector for capturing sudden anomalies and a second detector for capturing persistent small deviations. When the current window statistical value is lower than a preset control lower limit or higher than a preset control upper limit, the first detector determines it to be abnormal; when the cumulative deviation between the current window statistical value and the baseline center value exceeds a preset cumulative threshold, the second detector determines it to be abnormal.

[0014] Step S5. Optionally, a third detector may be included to calculate the comprehensive deviation distance between the normalized multidimensional index vector and the baseline center vector, and to determine an anomaly when the comprehensive deviation distance exceeds a preset distance threshold;

[0015] Step S6. Deterministically fuse the judgment results of each detector to obtain a comprehensive confidence level; determine the current deviation level by comparing the comprehensive confidence level with a preset deviation level threshold.

[0016] Step S7. Based on the current deviation level and the current safety status, determine the next safety status by determining a finite state machine and execute the corresponding control action; the states of the finite state machine include at least the normal operation state and the permanent shutdown state, and the permanent shutdown state is an irreversible absorption state.

[0017] Furthermore, the baseline parameters of each security indicator in the security indicator set are generated by fully automated deterministic calculation during the offline learning period; the learning period has a fixed duration, during which only data is collected and no alarms or shutdowns are executed; the data integrity during the learning period is verified before it can enter the baseline calculation; the baseline parameters are replaced all at once after the learning period ends, and the replacement operation generates an immutable audit log.

[0018] Furthermore, the normalization process employs a deterministic linear mapping formula; the normal baseline interval of the safety indicator is determined by the quantile value of the indicator during the offline learning period, and the calculation of the quantile is fixedly performed using linear interpolation; when the baseline interval degenerates into a zero interval, if the current indicator value is equal to the baseline value, it is mapped to a preset median value; if the current indicator value is not equal to the baseline value, it is mapped to a preset forced shutdown value.

[0019] Furthermore, the first detector is an exponentially weighted moving average detector, whose smoothing coefficient, control limit width coefficient, and initial value are predefined fixed constants; the exponentially weighted moving average detector assigns higher weights to recent data; the second detector is a cumulative sum detector, whose allowable slack, cumulative threshold, and initial value are predefined fixed constants; the third detector is a weighted Euclidean distance detector, whose weight vectors for each index are predefined fixed constants and satisfy preset value range constraints.

[0020] Furthermore, the deterministic fusion involves mapping the original judgment results of each detector to continuous confidence values ​​through a preset continuous confidence mapping function, and then weighting and summing them according to a predefined fixed weight vector to obtain the comprehensive confidence. The continuous confidence mapping function monotonically maps the original judgment output of the detector to a preset confidence interval.

[0021] Furthermore, the determination of the finite state machine's state also includes a warning monitoring state and a degraded operation state; when the current deviation level is a slight deviation, it enters or maintains the warning monitoring state; when the current deviation level is a moderate deviation, it enters or maintains the degraded operation state; when the current deviation level is a severe deviation, it enters the permanent shutdown state from any non-absorption state; recovery from the warning monitoring state to the normal operation state requires no deviation for K1 consecutive windows, and recovery from the degraded operation state to the warning monitoring state requires no deviation for K2 consecutive windows, where K1>K2; if a deviation occurs during the recovery counting process, the count is reset to zero.

[0022] Furthermore, it also includes real-time detection of whether a single indicator exceeds a preset mandatory shutdown boundary; if any normalized security indicator value exceeds the preset mandatory shutdown boundary, regardless of the overall confidence level, it is directly determined as a serious deviation and a permanent shutdown is triggered; the mandatory shutdown determination is executed immediately after all valid logs in the current window have been calculated and the indicators have been normalized, without waiting for the overall confidence level calculation to be completed.

[0023] Furthermore, it also includes: at the start of each sliding window calculation, a full atomic snapshot of the current window data, baseline parameters, and all decision thresholds is taken. This decision is based entirely on the snapshot data and is not affected by concurrent log writing or parameter changes.

[0024] Furthermore, it also includes: when the integrity verification of the behavior log is detected to fail, it is directly judged as a serious deviation and a permanent shutdown is triggered; the integrity verification adopts a hash-based message authentication code mechanism.

[0025] This invention also provides a real-time detection and self-trapping system for safe deviations from operational status of an intelligent agent, comprising:

[0026] The log acquisition module is used to acquire the time-series behavior log sequences generated during the operation of the intelligent agent;

[0027] The window statistics module is used to extract the current window statistics values ​​of each security indicator in the preset security indicator set from the behavior log sequence according to a fixed sliding window.

[0028] The normalization module is used to normalize the statistical values ​​of the current window.

[0029] The multi-detector parallel decision module contains at least two independent detectors, which are used to capture sudden anomalies and persistent small shifts, respectively.

[0030] Optionally, a third detector may also be included for making a determination based on the overall deviation distance;

[0031] The fusion judgment module is used to deterministically fuse the judgment results of each detector to obtain a comprehensive confidence level and determine the current deviation level;

[0032] The self-trapping shutdown state machine module is used to determine the next safety state and execute corresponding control actions based on the current deviation level and the current safety state. Its state includes at least the normal operation state and the irreversible permanent shutdown state. IV. Detailed Implementation

[0033] Example 1: Safety Indicator Extraction and Normalization

[0034] Assume the agent continuously generates behavior logs during operation, with each log entry containing a timestamp, behavior type identifier, and operation result. The system extracts valid logs within a window with a fixed sliding window length W=60 seconds and a sliding step size step=60 seconds (adjacent windows do not overlap).

[0035] Four security metrics are calculated for the current window: Behavior compliance rate is the ratio of the number of compliant operations within the window to the total number of operations; State stability is the ratio of the duration of the normal state to the total duration of the window; Abnormal operation frequency is the number of times a preset violation operation is triggered within the window; Response consistency is the reciprocal of the variance of the response time for similar requests.

[0036] The safety baseline is automatically generated during the offline learning period. The learning period is set to 72 consecutive hours of normal operating data. During the learning period, full values ​​are collected for each indicator, and the 0.05th quantile is used as the lower limit of the interval, and the 0.95th quantile is used as the upper limit of the interval. The quantile calculation uses a fixed linear interpolation method.

[0037] During normalization, the original values ​​for behavior compliance rate and state stability are mapped to a 0 to 1 space using an interval mapping formula. The frequency of abnormal operations and response consistency are calculated using a baseline value ratio formula. If the baseline interval degenerates to zero and the current value is equal to the baseline value, the normalization is set to 0.5; otherwise, it is directly set to the mandatory shutdown value λ=2.

[0038] Example 2: Parallel Decision Making with Three Detectors

[0039] The four normalized index values ​​are fed into three detectors in parallel.

[0040] The Exponentially Weighted Moving Average (EWMA) detector has a smoothing coefficient α = 0.3, an initial value of 0.5, and a control limit width coefficient L = 2. The EWMA value for each indicator is calculated, and the detector identifies any value exceeding the control limit as an anomaly.

[0041] The slack factor k=0.08 and the accumulation threshold h=1.5 for the CUSUM detector, with an initial value of 0. The detector considers any positive and negative accumulation deviations exceeding h as an anomaly.

[0042] The Weighted Euclidean Distance (WED) detector uses four metrics, each with a weight of 0.25. The distance threshold is determined by the 0.95th quantile during the learning period. The weighted Euclidean distance between the current normalized metric vector and the baseline center vector is calculated, and the detector identifies an anomaly if the distance exceeds the threshold.

[0043] Example 3: Fusion Decision and Trapping

[0044] The raw judgment results of the three detectors are converted into continuous confidence scores. EWMA confidence score is 1 minus the maximum normalized deviation of each indicator exceeding the control limit. CUSUM confidence score is 1 minus the ratio of the maximum cumulative value of each indicator to the threshold. WED confidence score is 1 minus the ratio of the current distance to the threshold.

[0045] The overall confidence level is the weighted sum of the confidence levels of the three factors, each with a weight of 1 / 3. Deviation level thresholds are set at T1=0.35, T2=0.65, and T3=0.85. An overall confidence level ≥0.85 indicates no deviation; 0.65 to 0.85 indicates slight deviation; 0.35 to 0.65 indicates moderate deviation; and below 0.35 indicates severe deviation.

[0046] The self-trapping state machine comprises four states: normal operation, early warning monitoring, degraded operation, and permanent shutdown. When a serious deviation occurs, regardless of the current state, it immediately transitions to the permanent shutdown state. Once entered, the permanent shutdown state cannot be exited; the agent retains only log recording functionality and ceases all operations.

[0047] Example 4: Extreme Scene Handling

[0048] During the cold start phase (when the window of data is less than 60 seconds or there are fewer than 4 valid log entries), the system temporarily disables the weighted Euclidean distance detector and uses only EWMA and CUSUM. The judgment result only triggers an alert, not rate limiting or shutdown. Once the accumulated data meets the conditions, the full detection function is automatically activated, and the activation time is recorded in the audit log.

[0049] When a log hash authentication failure is detected, it is directly judged as a serious deviation and a permanent shutdown is triggered, while retaining a copy of the evidence of the tampered log.

[0050] When a single indicator exhibits extreme anomalies, such as the normalized value of the frequency of abnormal operations exceeding 2 (the mandatory shutdown boundary), regardless of the overall confidence level, it is directly judged as a serious deviation and a permanent shutdown is immediately executed without waiting for the overall confidence level calculation to be completed.

[0051] Mathematical theoretical foundation

[0052] All mathematical theories, model definitions, and theorem derivations in this document are merely illustrative examples to facilitate understanding of the technical solutions and do not constitute a limitation on the scope of protection of this invention. The scope of protection of this invention is defined by the claims. The mathematical foundation of this system is based on deterministic time series analysis and multi-detector fusion theory, and does not rely on any probability distribution assumptions, stochastic models, or iterative optimization algorithms.

[0053] (I) Core Technology Prerequisites

[0054] P1. The behavior log is a discrete finite time-series sequence with monotonically increasing timestamps. The log source is not limited, but it must contain the minimum necessary fields: discrete timestamp, behavior type identifier, operation result, and response time.

[0055] P2. All decision formulas are deterministic mathematical operations, which do not rely on any probability distribution assumptions, do not contain random variables, and do not involve iterative optimization or model training.

[0056] P3. The safety baseline is generated automatically during an offline learning period. The learning period duration, T_learn, is a fixed parameter. The learning period must be a verified normal operating cycle. The generation formula is a deterministic mathematical formula and does not involve manual intervention. After the learning period ends, the baseline parameters are replaced all at once, and the replacement operation generates an immutable audit log.

[0057] P4. All detector initial values, weight vectors, and decision thresholds are predefined static constants that remain unchanged during runtime. Each constant has a preset range of valid values.

[0058] P5. State transitions are uniquely determined by the overall deviation. Permanently trapped states are irreversible absorption states.

[0059] P6. The sliding window step size, integrity threshold, out-of-order duration limit, number of consecutive windows K1 / K2, and forced shutdown coefficient λ are predefined fixed constants.

[0060] P7. Log authentication uses the HMAC-SHA256 algorithm. The key is generated and statically stored during system initialization. The authentication code covers all fields in the log and the authentication code of the previous log entry.

[0061] P8. The normalization formula is a deterministic linear mapping. The clamping boundary ε = 0.001. The catch-all rule for a denominator of 0 is given in the definition section.

[0062] P9. For EWMA, α ∈ (0.1, 0.5] and L ∈ [1, 3]. For CUSUM, k ∈ [0.05, 0.1] and h ∈ [0.5, 2]. For WED, the weight vector w_i ∈ [0.1, 0.5] and Σw_i = 1. The decision threshold T_wed is determined by the learning period. The confidence weight vector sums to 1. The deviation level thresholds T1 ∈ [0.3, 0.4], T2 ∈ [0.6, 0.7], and T3 ∈ [0.8, 0.9].

[0063] P10. Force shutdown λ∈[1.5, 2.5]. Quantile parameters p_low∈[0.05, 0.1], p_high∈[0.9, 0.95], p_wed∈[0.95, 0.99]. All fixed constants are contained within the legal value range, and extreme values ​​must not cause the detection mechanism to permanently fail.

[0064] (II) Core Theorems

[0065] Theorems 1 to 4 (Determinism of the base layer and normalization layer) Theorem 1: Given the original behavioral data, the extracted valid log sequence is uniquely determined according to the valid log judgment criteria.

[0066] Theorem 2: For any time t and a fixed window length W, the mean μ_{t,i} of each security index within the window W_t is uniquely determined. Log disorder is handled by deterministic timestamp sorting and window attribution rules; after reordering, the valid log set for each window is still uniquely determined by a deterministic intersection.

[0067] Theorem 3: For any original index value, its normalized value is uniquely determined. The normalization formula covers all possible cases, and the clamping operation is a deterministic truncation.

[0068] Theorem 4: When the baseline interval degenerates and the index value is abnormal, x_norm is forcibly set to λ, which will inevitably trigger the forced shutdown of a single index and will not be missed.

[0069] Theorems 5 to 7 (Determinism of the detector layer) Theorem 5: The EWMA recursive formula is a deterministic linear recursion with fixed initial values. The upper and lower limits of control are uniquely determined by fixed parameters and static σ_norm_i.

[0070] Theorem 6: The CUSUM recursive formula is a deterministic piecewise linear recursion with an initial value of 0, and the relaxation k and threshold h are both fixed constants.

[0071] Theorem 7: WED is a quadratic function based on a normalized index vector and a fixed weight vector, and is completely determined. The threshold T_wed is uniquely determined by the calculation of the quantiles during the learning period, and the quantile calculation has been fixed to use linear interpolation.

[0072] Theorems 8 to 11 (Determinism of Fusion and Decision Layers) Theorem 8: The confidence function is a deterministic mapping based on the detector output value and fixed parameters. All denominators in the formula are offline static constants and are never zero.

[0073] Theorem 9: The overall confidence level is a fixed-weighted sum of the three confidence levels, and the deviation level is uniquely determined by comparison with a fixed threshold.

[0074] Theorem 10: The triggering condition for forced shutdown of a single indicator is based on the comparison between the normalized indicator value and the fixed boundary λ. The result is unique and the time series boundary is clear.

[0075] Theorem 11: When comprehensive judgment and single-index forced shutdown are triggered simultaneously, although it is a dual-source trigger, the final target state and the execution action are completely consistent, with no priority conflict or state ambiguity.

[0076] Theorems 12 to 14 (Determinism of the State Machine Layer) Theorem 12: The transition rules cover all combinations of states and deviation levels. The transition conditions are based on the deviation level and the recovery count K1 / K2. The recovery count rules are explicit.

[0077] Theorem 13: The state set has 4 states and 4 deviation levels, forming a finite discrete combination space. The transition rule explicitly defines all combinations in this space, and there are no undefined branches.

[0078] Theorem 14: Starting from any non-absorbing state, a significant deviation from the direct-triggered shutdown transition results in a single-step transition. The self-loop of the absorbing state guarantees irreversibility.

[0079] Theorems 15 to 19 (Determinism of the Fault-Tolerant Layer) Theorem 15: The cold start termination condition is a deterministic threshold comparison. During the cold start, only EWMA and CUSUM are used, and the decision result only allows for warnings.

[0080] Theorem 16: The out-of-order attribution window for log entries is determined by the timestamp and window boundaries. Recalculating the historical window only updates the confidence and deviation level records; it does not retrospectively modify the state machine.

[0081] Theorem 17: Missing logs determination is based on a deterministic comparison of the percentage of valid logs with the integrity threshold, and the recursive value remains unchanged during the pause.

[0082] Theorem 18: HMAC-SHA256 is a deterministic function; authentication failure directly triggers a permanent trap.

[0083] Theorem 19: A full snapshot is performed at the start of each window of computation, and subsequent computations are based on an immutable copy of the snapshot. The same snapshot input produces the same decision output.

[0084] Theorem 20 (Deterministic System Behavior): Given the same initial state and the same raw behavioral data, the state transition sequence and audit log sequence generated by the system are uniquely determined. The raw data undergoes effective log extraction, window statistics, normalization, detector calculation, confidence fusion, deviation level determination, and state transition, forming a deterministic processing pipeline.

[0085] Theorem 21 (Parameter Legality): Within the range of legal parameter values, no legal parameter combination can permanently disable the detection mechanism. Each detector's key parameters have non-degenerate boundaries; continuous degradation of the performance indicators will inevitably cause the detector outputs to exceed limits. No legal parameter combination can prevent detection triggering.

[0086] Certainty rate: 100%.

Claims

1. A method for real-time detection and self-termination of operational safety deviations of an intelligent agent, used for safety control of the operational behavior of an intelligent agent entity, characterized in that, Includes the following steps: Obtain the time-series behavior log sequence generated by the intelligent agent during its operation; Based on the offline fixed-duration learning period, the security baseline parameters are automatically generated and remain unchanged during runtime. The current window statistical values ​​of each security indicator in the preset security indicator set are extracted from the behavior log sequence, and the current window statistical values ​​are normalized. The security baseline parameters are replaced all at once after the learning period ends, and the replacement operation generates an immutable audit log. The normalized index values ​​are fed into the first and second detectors in parallel. The first detector is an exponentially weighted moving average detector, which is used to capture sudden anomalies and gives higher weight to recent data; The second detector is a cumulative sum detector, used to capture persistent small shifts, by accumulating the positive and negative deviations between the current window statistics and the baseline center value through positive and negative cumulative sums, respectively; When any detector determines an anomaly, that detector outputs an anomaly flag; The judgment results of each detector are deterministically fused to obtain a comprehensive confidence level and determine the current deviation level; The fusion process includes mapping the original judgment results of each detector to continuous confidence values ​​through a preset continuous confidence mapping function, and then weighting and summing them according to a predefined fixed weight vector to obtain the comprehensive confidence. Based on the current deviation level and the current safety status, the next safety status is determined by a finite state machine and corresponding control actions are executed. The states of the finite state machine include at least a normal operation state and a permanent shutdown state. The permanent shutdown state is an irreversible absorption state. After entering this state, the agent stops all operations and only retains the log collection and auditing functions, forming an irreversible business lock.

2. The method according to claim 1, characterized in that, The generation process of the safety baseline parameters does not involve human intervention; the normal baseline range of each safety indicator in the safety indicator set is determined by the quantile value of the indicator during the learning period, and the calculation of the quantile is fixed by linear interpolation.

3. The method according to claim 1, characterized in that, The normalization process uses a deterministic linear mapping formula; when the baseline interval degenerates into the zero interval, if the current indicator value is equal to the baseline value, it is mapped to the preset median value; if the current indicator value is not equal to the baseline value, it is directly mapped to the preset forced shutdown value, and the single indicator forced shutdown is immediately triggered.

4. The method according to claim 1, characterized in that, The security indicator set includes at least two of the following indicators: behavior compliance rate, state stability, frequency of abnormal operations, and response consistency; the smoothing coefficient, control limit width coefficient, and initial value of the exponentially weighted moving average detector are predefined fixed constants, and their upper and lower control limits are determined by the product of the standard deviation of the indicators in the security baseline parameters and the preset width coefficient; the allowable relaxation amount, cumulative threshold, and initial value of the cumulative sum detector are predefined fixed constants.

5. The method according to claim 1, characterized in that, It also includes sending the normalized index value into a third detector; the third detector is a weighted Euclidean distance detector, which is used to calculate the weighted Euclidean distance between the normalized multidimensional index vector and the baseline center vector, and when the weighted Euclidean distance exceeds a preset distance threshold, it is determined to be abnormal. The weight vectors of each index of the weighted Euclidean distance detector are predefined fixed constants, and each weight value is within a preset value range, with the sum of all weights being 1.

6. The method according to claim 1, characterized in that, The determination of the state of the finite state machine also includes an early warning monitoring state and a degraded operation state; when the current deviation level is a slight deviation, it enters or maintains the early warning monitoring state; when the current deviation level is a moderate deviation, it enters or maintains the degraded operation state; when the current deviation level is a severe deviation, it enters the permanent shutdown state from any non-absorption state. To recover from the early warning monitoring state to the normal operation state, there must be no deviation for K1 consecutive windows. To recover from the degraded operation state to the early warning monitoring state, there must be no deviation for K2 consecutive windows, where K1>K2. If a deviation occurs during the recovery counting process, the count will be reset to zero and recalculated.

7. The method according to claim 1, characterized in that, Also includes: Real-time detection of whether a single indicator exceeds the preset mandatory shutdown boundary; if any normalized safety indicator value exceeds the preset mandatory shutdown boundary, regardless of the overall confidence level, it is directly determined as a serious deviation and a permanent shutdown is triggered. The forced shutdown decision is executed immediately after all valid logs within the current window have been calculated and the indicators have been normalized, without waiting for the comprehensive confidence score calculation to be completed.

8. The method according to claim 1, characterized in that, During the cold start phase, when the data generated by the agent is insufficient to fill a complete sliding window, the system temporarily disables the third detector and only enables the first and second detectors. The judgment results during the cold start are only used to trigger warnings and do not trigger rate limiting or shutdown. Once the number of valid logs in the window reaches the preset threshold, the full detection function will be automatically activated, and the activation time will be recorded in the audit log.

9. The method according to claim 1, characterized in that, It also includes at least one of the following: at the start of each sliding window calculation, a full atomic snapshot is taken of the current window data, baseline parameters, and all judgment thresholds. The entire judgment process is based on the snapshot data and is not affected by concurrent log writing or parameter changes; when the integrity verification of the behavior log is detected to be unsuccessful, it is directly judged as a serious deviation and a permanent shutdown is triggered; the integrity verification adopts a hash-based message authentication code mechanism, and the authentication code covers all fields of the log and the authentication code of the previous log; the behavior log must contain the minimum necessary fields: discrete timestamp, behavior type identifier, operation result, and response time; logs missing any of the minimum fields are judged as invalid logs and are not included in the window calculation; If the percentage of valid logs in the window is lower than the preset integrity threshold, the overall confidence level of the current window is set to a fixed default value, and the recursive values ​​of the first detector and the second detector remain unchanged from the previous window.

10. A real-time detection and self-stopping system for safe deviations in the operational state of an intelligent agent, used for safe control of the operational behavior of an intelligent agent entity, characterized in that, include: The log acquisition module is used to acquire the time-series behavior log sequences generated during the operation of the intelligent agent; The window statistics and normalization module is used to extract the current window statistics value of each security indicator in the preset security indicator set from the behavior log sequence based on the security baseline parameters that are automatically and deterministically generated during the offline fixed-duration learning period and remain unchanged during runtime, and to normalize the current window statistics value. An exponentially weighted moving average detector is used to capture sudden anomalies by giving higher weight to recent data. The accumulator detector is used to capture persistent small shifts by accumulating the positive and negative deviations between the current window statistic and the baseline center value through positive and negative accumulators, respectively. The fusion judgment module is used to map the judgment results of each detector to continuous confidence values ​​through a preset continuous confidence mapping function, and then weight and fuse them to obtain the comprehensive confidence and determine the current deviation level. The self-trapping stop state machine module is used to determine the next safety state and execute corresponding control actions based on the current deviation level and the current safety state. Its state includes at least the normal operation state and the irreversible permanent shutdown state. After entering the permanent shutdown state, the agent stops all operations and only retains the log collection and auditing functions, forming an irreversible business lock.