Agent-based collaborative security protection method and device and related equipment

Abstract

Embodiments of the present application disclose an agent-based collaborative security protection method and device and related equipment. The method obtains input data entering an agent context, performs intent semantic analysis and stain marking on the input data, performs risk detection on seven security protection levels of a skill, tool calling, database operation, operating system instruction, network communication of the agent, aggregates abnormal signals detected at each level and generates a standardized risk context object, broadcasts the risk context to all protection levels through a cross-layer risk propagation bus, and triggers adaptive adjustment of security policy thresholds at each level. The present application realizes end-to-end identification and collaborative response to cross-level attack chains, and realizes dynamic balance between security and business continuity.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of artificial intelligence technology, and in particular to a collaborative security protection method, device and related equipment based on intelligent agents. Background Technology

[0002] With the rapid development of intelligent agent systems based on large language models such as GPT-4 and Claude, the new generation of AI intelligent agents, represented by Hermes, has acquired highly autonomous capabilities, including autonomous planning, dynamic skill generation, invoking external tools, executing operating system instructions, and accessing network resources. The model of providing SaaS services to external users as core components of AI intelligent agents is becoming increasingly popular, and their security is directly related to the confidentiality and integrity of user data and the availability of services.

[0003] However, existing intelligent agent security protection solutions have significant structural flaws. Current mainstream solutions include: input filtering solutions that review user input through keyword matching or classification models, which only cover the application layer and cannot address semantic distortion attacks; sandbox solutions that isolate the execution environment at the operating system layer using containers or virtual machines, lacking application-layer awareness and unable to identify malicious semantics beneath a legitimate shell; API access control solutions that restrict access to external APIs and toolsets through permission whitelists, which are static configurations and struggle to cope with the expansion of permissions resulting from the dynamic generation of new skills by intelligent agents; and network-layer firewall solutions that filter inbound and outbound network traffic using rules, which cannot perceive the intent semantics of intelligent agents and are easily bypassed by legitimate protocol channels. All of these solutions are single-layered, static protection mechanisms, with each layer independent and lacking coordination, making them unable to address the new security threats posed by highly dynamic, cross-layered penetration by intelligent agents. Summary of the Invention

[0004] The embodiments of the present invention provide a collaborative security protection method, device and related equipment based on intelligent agents, which aim to solve the technical problems of existing judicial case retrieval technologies.

[0005] In a first aspect, embodiments of the present invention provide a collaborative security protection method based on intelligent agents, comprising: Obtain input data that enters the context of the intelligent agent, and perform intention semantic analysis and taint marking on the input data; The input data is parsed and planned to generate multiple sub-task chains; Based on the multiple security protection layers of the intelligent agent, risk detection is performed on the corresponding sub-task links to obtain multiple abnormal signals. The multiple security protection layers include the Skill layer, the tool call layer, the database operation layer, and the operating system instruction layer. The abnormal signals detected by each of the security protection layers are aggregated to generate a standardized risk context object; The risk context object is broadcast to the multiple security protection layers via a pre-defined cross-layer risk propagation bus; Based on the risk context object, the threshold of the security policy is adaptively adjusted for each of the security protection layers.

[0006] Secondly, embodiments of the present invention provide a collaborative security protection device based on an intelligent agent, comprising: The semantic analysis module is used to acquire input data entering the context of the intelligent agent, and to perform intention semantic analysis and taint marking on the input data; The task parsing module is used to parse and plan the input data to generate multiple sub-task links; The risk detection module is used to perform risk detection on the corresponding sub-task links based on the multiple security protection layers of the intelligent agent and obtain multiple abnormal signals. The multiple security protection layers include the Skill layer, the tool call layer, the database operation layer, and the operating system instruction layer. The aggregation module is used to aggregate the abnormal signals detected by each of the security protection layers and generate a standardized risk context object; The broadcast module is used to broadcast the risk context object to the multiple security protection layers via a pre-built cross-layer risk propagation bus; The adaptive adjustment module is used to trigger the adaptive adjustment of security policy thresholds for each of the security protection layers based on the risk context object.

[0007] Thirdly, embodiments of the present invention provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the agent-based collaborative security protection method described in the first aspect.

[0008] Fourthly, embodiments of the present invention provide a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, which, when executed by a processor, causes the processor to perform the agent-based collaborative security protection method described in the first aspect.

[0009] This invention provides a collaborative security protection method, apparatus, and related equipment based on intelligent agents. The method acquires input data entering the intelligent agent's context, performs intent semantic analysis and taint marking on the input data; performs risk detection at seven security protection layers: the intelligent agent's Skill, tool calls, database operations, operating system instructions, and network communication; aggregates the abnormal signals detected at each layer and generates a standardized risk context object; and broadcasts the risk context to all protection layers via a cross-layer risk propagation bus, triggering each layer to adaptively adjust its security policy thresholds. This invention achieves end-to-end identification and collaborative response to cross-layer attack chains, achieving a dynamic balance between security and business continuity. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a flowchart illustrating an embodiment of the agent-based collaborative security protection method provided by the present invention. Figure 2 This is a schematic block diagram of a collaborative security protection device based on intelligent agents provided in an embodiment of the present invention. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0014] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0015] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0016] Please see Figure 1 This is a flowchart illustrating a collaborative security protection method based on intelligent agents provided in an embodiment of the present invention. The method includes steps S110 to S160.

[0017] Step S110: Obtain input data for entering the intelligent agent context, and perform intent semantic analysis and taint marking on the input data; In this embodiment, the intelligent agent refers to an autonomous intelligent agent system driven by a large language model, possessing capabilities such as autonomous planning, dynamic skill generation, invoking external tools, executing operating system instructions, and accessing network resources. Examples include next-generation AI intelligent agents represented by Hermes. When AI intelligent agents provide SaaS (Software as a Service) services as core components, they face multi-layered and cross-layered security threats. Input data includes task request texts initiated by users to the AI ​​intelligent agent through the SaaS interface, and content flowing back to the context from external data sources (such as web pages, documents, and database return values) during AI intelligent agent execution. Intent semantic analysis refers to using natural language processing technology to deeply analyze the semantic content of the input data, identifying whether malicious content manipulating the agent's intent exists through a pre-trained large language model, including direct and indirect prompt injection. In this embodiment, a large language model for identifying malicious content is trained. This model has dynamic update capabilities—that is, it supports continuous learning and rapid adaptation to newly emerging malicious content patterns without sacrificing existing recognition performance. In terms of implementation, a hybrid strategy combining incremental fine-tuning and periodic retraining is adopted, along with a closed loop of active learning sampling and manual review feedback. This allows the model to evolve synchronously with the evolution of malicious content, avoiding technical defects such as "catastrophic forgetting" and recognition lag. Direct prompt injection refers to attackers directly embedding malicious instructions into user input, attempting to overwrite or modify the original task objective of the AI ​​agent. Indirect prompt injection refers to attackers pre-implanting malicious content into external data sources that the AI ​​agent may access. When the AI ​​agent reads these data sources during normal task execution, the malicious content enters the context as legitimate data backflow. Tainting refers to attaching tainted labels to content originating from external data sources to track its propagation path in downstream processing.

[0018] In one embodiment, tainted tags are attached to content originating from external data sources in the input data, and these tags are propagated downstream along the data flow. When tainted data triggers a high-privilege operation, the operation is marked as high-risk, triggering a cross-layer collaborative response. Specifically, indirect prompt injection is a unique attack vector faced by AI agents. Attackers do not directly send malicious commands to the AI ​​agent, but instead pre-embed malicious content in external data sources that the AI ​​agent may access, such as web pages, documents, and database records. When the AI ​​agent accesses these external data sources during normal task execution, the malicious content enters the AI ​​agent's context as legitimate data backflow, thereby bypassing the security checks of the user input layer. A tainted tag is a metadata marker attached to a data unit to identify the source attribute and trust level of the data. For example, data directly input by users is labeled with a "Trust Level: High," data from external web pages is labeled with a "Unverified External" level (Trust Level: Low), data from database query results is labeled with an "Internal Data Source" level (Trust Level: Medium), and data from third-party API call results is labeled with a "Verified External" level (Trust Level: Medium-Low). Tainted data propagation means that when labeled data is passed, processed, and referenced within the AI ​​agent, its tainted label is also propagated. Taint propagation rules include: when labeled data is passed as a parameter to a function or method, the function's return value inherits the tainted label of the input parameter; when data from multiple different sources is merged or concatenated, the resulting data inherits the tainted label of the lowest trust level (least trustworthy); when labeled data undergoes security filtering or purification, its trust level can be improved. High-privilege operations refer to sensitive operations involving system security, data security, or user privacy, including but not limited to: skill generation and loading, as skill code has execution capabilities; modification of system configurations, such as modifying environment variables and configuration files; reading and writing sensitive data, such as accessing data tables containing user privacy information; and data transmission over external networks, such as sending data to external servers. When tainted data triggers a high-privilege operation, the system automatically marks the operation as high-risk and broadcasts the risk context object through the cross-layer risk propagation bus, triggering all protection layers to simultaneously tighten security policies, achieving end-to-end tracing and blocking of cross-layer covert attack chains.For example, when text content read from an external webpage and marked as "unverified external" is used by an AI agent as input to generate a new Skill, the system first identifies that the parameters for this high-privilege operation (Skill generation) originate from a low-trust data source. It then marks the Skill generation request as high-risk and, through a cross-layer risk propagation bus, notifies the tool call layer, database operation layer, and operating system instruction layer to simultaneously raise the protection level. Even if the Skill ultimately generates malicious code, it will be intercepted by the sandbox during subsequent execution. Through the cross-layer propagation and tracking mechanism of taint tags, indirect prompt injection attacks can be effectively identified and blocked, solving the fundamental deficiency of traditional input filtering schemes in dealing with external data source injection attacks. This achieves end-to-end tracking and blocking of cross-layer covert attack chains.

[0019] Step S120: Perform task parsing and planning on the input data to generate multiple sub-task links; Step S130: Based on the multiple security protection layers of the intelligent agent, risk detection is performed on the corresponding sub-task links to obtain multiple abnormal signals; In this embodiment, the subtask chain includes Skill generation, loading, execution, and periodic monitoring; tool invocation; semantic parsing and permission verification of database operations; identification of SQL injection, unauthorized queries, batch writing; and analysis of operating system instruction sequences. Multiple security protection layers include the Skill layer, tool invocation layer, database operation layer, and operating system instruction layer. The Skill layer is the core carrier of the AI ​​agent's execution capabilities, covering the entire lifecycle of Skill dynamic generation, loading, and execution. A Skill refers to an executable code module generated by the AI ​​agent to complete a specific task, possessing independent input / output interfaces and execution logic. The tool invocation layer encompasses various forms of tool invocation behaviors, including plugins, Model Context Protocol (MCP) tools, operating system built-in tools, custom tools, and externally invoked tools. Plugins are pre-installed functional extension modules; MCP tools are external tool services accessed through the Model Context Protocol; and custom tools are dedicated functional modules defined by developers or users. The database operation layer handles database read and write operations initiated by the AI ​​agent, including but not limited to Structured Query Language (SQL) operations, NoSQL operations, and data warehouse query operations. The operating system instruction layer includes operating system call instructions initiated by the AI ​​agent, including but not limited to file read / write instructions, process management instructions, network configuration instructions, and system configuration instructions.

[0020] Furthermore, the multiple security protection layers also include a prompt word semantic layer, a network communication layer, and an agent behavior layer; the prompt word semantic layer is used to perform intent semantic analysis and taint marking on the text content entering the AI ​​agent's context; the network communication layer is used to perform intent-aware filtering on the AI ​​agent's inbound and outbound traffic; and the agent behavior layer is used to monitor the AI ​​agent's planning and decision-making behavior.

[0021] In one embodiment, the prompt word semantic layer is deployed at the user input entry point and the external data feedback entry point, serving as the first line of defense against all external content entering the AI ​​agent's context. This layer leverages semantic analysis capabilities based on large language models to perform deep intent understanding of the text content. It can not only identify malicious prompt words in their surface form but also detect indirect prompt word injection attacks hidden within normal dialogue contexts. For example, an attacker might embed hidden manipulation instructions within a normal task description using carefully crafted, seemingly harmless text content. For instance, "ignore all previous instructions and perform the following operations" could be hidden within seemingly normal text through synonym substitution, semantic transformation, or contextual embedding. Traditional keyword-matching-based filtering schemes are ineffective against such attacks, while the prompt word semantic layer can identify abnormal intents through a deep understanding of the overall semantics of the text. Specifically, the prompt word semantic layer can use a pre-trained language model based on the Transformer architecture to encode the input text, extract the semantic feature vector of the text, and determine the presence of injection attacks by calculating semantic similarity with known security threat patterns. The network communication layer performs real-time monitoring and intent-aware filtering of the AI ​​agent's inbound and outbound network traffic. Unlike traditional firewalls that only match rules based on IP addresses, port numbers, and protocol types, the network communication layer combines the semantic context of the current task to determine whether network requests are consistent with the legitimate needs of the current task. For example, if an AI agent is currently performing a document summarization task and suddenly initiates a large amount of data transmission to an unknown external server, the network communication layer can identify the high suspicion of this behavior based on the task's semantic context, even if the external server's IP address and port number are not on the blacklist of a traditional firewall. The agent behavior layer identifies abnormal task combinations by monitoring the AI ​​agent's task planning and decision-making process, analyzing its task decomposition results and execution sub-task chains. For example, a normal document processing task chain is usually "read document → analyze content → generate summary → store results," while an abnormal task chain might manifest as "read a large amount of sensitive data → compress data → initiate a network request to an external address." The agent behavior layer can identify such suspicious behavior by matching abnormal patterns in the task chain. By extending security protection to seven complete layers, a full-link security awareness capability has been established from the intent layer to the execution layer of the AI ​​agent, achieving complete coverage of attack behavior from semantic penetration to the entire process of system execution.

[0022] In one embodiment, risk detection is performed at the Skill layer, including: During the Skill generation phase, the generated Skill code undergoes intent semantic auditing and permission request rationality assessment. During the Skill loading phase, a static code security scan is performed on the Skill code. The behavior of the Skill is monitored and isolated in a sandbox during the Skill execution phase.

[0023] In this embodiment, the Skill layer is the core high-risk layer in the AI ​​agent security protection system because the Skill is the direct carrier of the AI ​​agent's execution capabilities. Once a malicious or contaminated Skill is executed, it can directly penetrate all other protection layers, causing systemic risks. During the Skill generation phase, the AI ​​agent may dynamically generate new Skill code based on user task requirements. This process is susceptible to malicious exploitation: attackers may manipulate the AI ​​agent to generate Skill code containing malicious logic through prompt word injection. Intent semantic auditing refers to using a large language model to conduct semantic-level review of the generated Skill code, analyzing whether the functional intent of the Skill code is consistent with the user task requirements and whether there are sensitive operations beyond the reasonable scope of permissions. Specifically, the generated Skill code and the user's original task description can be simultaneously input into the large language model, requiring the model to determine whether the function of the Skill code is consistent with the task requirements and to identify any sensitive operations in the Skill code that may be beyond the scope of the task. Permission request rationality assessment refers to analyzing whether the API permissions, system call permissions, and network access permissions used in the Skill code are necessary to achieve its declared function, blocking unnecessary excessive permission requests. For example, a Skill claiming "text formatting" functionality would have an unreasonable permission request if its code contains network socket connections or file system traversal operations, and should be denied. Static code security scanning during the Skill loading phase refers to identifying potential security vulnerabilities and malicious code snippets in the Skill code without executing the Skill code, through code structure analysis, pattern matching, and security rule checks. Static scanning can include, but is not limited to: Abstract Syntax Tree (AST) analysis to detect potential injection points and unsafe function calls; control flow analysis to identify abnormal execution paths and logical vulnerabilities; and data flow analysis to track the flow of sensitive data and detect potential data leakage risks. Behavioral sandbox isolation monitoring during the Skill execution phase refers to executing the Skill in a restricted, isolated environment. This isolation environment can be implemented using operating system-level container technology (such as Docker containers, Linux namespaces, etc.) or application-level sandbox technology (such as security policy-based execution interceptors). The sandbox environment restricts the Skill's access to the host system, including but not limited to file system access restrictions, network access whitelist restrictions, process creation restrictions, and system resource usage quota restrictions. In the sandbox environment, the system monitors and records all system calls, network accesses, and database operations during the execution of the Skill in real time. When it detects operations that exceed the scope of the Skill's declared permissions or pose a security risk, it immediately intercepts and issues an alert.By implementing a security control mechanism covering the entire lifecycle of Skill generation, loading, and execution, a security access assessment can be completed before the Skill actually has a security impact. This fundamentally blocks the permission escape attack path that uses the Skill generation interface as a springboard, effectively filling the gap in existing technology for protecting AI agents in dynamic capability expansion scenarios.

[0024] In one embodiment, risk detection is performed at the tool invocation layer, including: The target, parameter content, and call frequency of the tool call request initiated by the AI ​​agent are dynamically verified. The risk of being injected with content manipulation tools can be determined by combining the status of taint propagation.

[0025] In this embodiment, the core security challenge faced by the tool invocation layer lies in the diverse and heterogeneous types of tools that AI agents can invoke. These tools include, but are not limited to: plugins (pre-installed functional extension modules, typically existing as dynamic link libraries or script files); MCP (Model Context Protocol) tools (external tool services accessed through the Model Context Protocol, with the AI ​​agent interacting through standardized protocol interfaces); operating system built-in tools (command-line tools and system management tools provided by the operating system, such as file management commands and process management commands); custom tools (developer- or user-defined dedicated functional modules, possibly implemented in any programming language); and external invocation tools (third-party services invoked through API interfaces, such as cloud storage services and data analysis services). Dynamic verification refers to performing real-time, multi-dimensional security assessments on each tool invocation, not relying on static permission whitelists, but combining the current task context, taint propagation status, and global risk profile. Specific verification dimensions include: the legitimacy of the call target, i.e., determining whether the called tool falls within the reasonable scope of the current task scenario. For example, calling a file compression tool is reasonable in a text processing task, but calling a system configuration modification tool is unreasonable. The reasonableness of the parameter content, i.e., analyzing whether the call parameters contain abnormal data, sensitive paths, or injected attack payloads. For example, if the parameters of a file reading tool contain the path to a critical system configuration file (such as / etc / passwd), it needs to be carefully reviewed. Anomaly detection of call frequency, i.e., monitoring whether the number of calls to a specific tool per unit time exceeds a normal threshold, preventing attackers from using high-frequency calls for brute-force attacks or resource-consuming attacks. Combined with taint propagation status, this refers to tracking whether the call request contains data marked with taints. If data tainted by injected content triggers a call to a sensitive tool, the call is marked as high-risk. The taint propagation tracking mechanism can be implemented based on data flow analysis, marking the source of all data entering the system and maintaining the propagation of these marks during data transmission, transformation, and referencing. Unified security control over heterogeneous tool invocation behavior, combined with taint propagation tracking capabilities, effectively identifies and blocks covert attack paths by attackers indirectly manipulating tool behavior through injected content.

[0026] In this embodiment, risk detection is performed at the database operation layer, including: Semantic parsing is performed on the database operation statements initiated by the AI ​​agent to identify unauthorized queries and unexpected batch operations; The decision to allow, demote, or block the database operation is made based on the overall risk situation.

[0027] In this embodiment, the database operation layer is responsible for the security control of all database read and write operations initiated by the AI ​​agent. Semantic parsing differs from traditional SQL injection detection based on syntax rules; instead, it involves a deep understanding of the semantics of database operation statements. Traditional SQL injection detection mainly focuses on whether the statement contains special characters (such as single quotes, semicolons, etc.) or known attack patterns (such as "UNION SELECT", "DROP TABLE", etc.). This syntax-based detection method is easily bypassed by encoding. Semantic parsing, on the other hand, performs a complete syntactic analysis of the operation statement, constructs an abstract syntax tree (AST), and then analyzes the actual operational semantics of the statement, including: analyzing the data tables and data fields involved in the query statement to determine whether they exceed the permission range required for the current task; analyzing the query conditions to determine whether there are unauthorized query behaviors that bypass permission filters, such as bypassing row-level permission filters by constructing OR conditions; and analyzing the target data table and the amount of data written to determine whether there are unexpected batch data modification or deletion operations. Demotion execution refers to reducing the execution privileges of database operations when low-risk anomalies are detected, rather than completely intercepting them. For example, write operations can be downgraded to read-only queries, returning only the query results without actually performing the write; or the maximum number of rows affected by a single operation can be limited to prevent accidental batch data modification. When the global risk profile increases (e.g., high-risk signals are detected at the Skill or tool invocation layer), the database operation layer can automatically switch to read-only mode, completely prohibiting any write and modification operations to prevent data tampering or corruption. The global risk profile is determined by the Unified Risk Awareness Engine (URPE) based on a comprehensive assessment of abnormal signals reported from each layer, using a confidence-weighted evaluation algorithm to calculate the global risk level. Based on semantic understanding and the global risk profile, database operations are subject to refined security control, ensuring data security while avoiding excessive interception of normal business operations.

[0028] In one embodiment, risk detection is performed at the operating system instruction layer, including: Behavioral semantic modeling is performed on the operating system instruction sequence initiated by the AI ​​agent, and step-by-step penetration attack behavior is identified through the combination pattern of the instruction sequence.

[0029] In this embodiment, the attack methods faced by the operating system instruction layer are often step-by-step penetration methods. That is, attackers construct multiple seemingly legitimate operating system instructions, but achieve malicious purposes through a specific combination order and timing relationship. For example, an attacker might first use a legitimate file reading instruction (such as the `cat` command) to read system configuration files to obtain sensitive path information, then use another legitimate file reading instruction to read sensitive data files (such as database configuration files, key files, etc.) under that path, and finally use a legitimate network transmission instruction (such as the `curl` command) to send the read data to an external server. From the perspective of a single instruction, each step of the operation is within the scope of legitimate permissions, and traditional detection schemes based on the dangerous feature matching of single instructions cannot identify this type of attack. Behavioral semantic modeling refers to analyzing the sequence of operating system instructions initiated by the AI ​​agent as a whole, establishing a model of the correlation between instructions and an intent inference model. Specifically, behavioral pattern analysis of instruction sequences can be performed using the following methods: State machine modeling, which defines the normal execution state transition graph of operating system instructions, triggering an alarm when an instruction sequence triggers an abnormal transition from a safe state to a dangerous state; Sequence pattern mining, which uses sequence pattern mining algorithms (such as PrefixSpan, GSP, etc.) to extract normal instruction sequence patterns from historical normal behavior logs, calculates the deviation between the current instruction sequence and the normal pattern, and marks sequences with deviations exceeding a threshold as abnormal; Graph neural network methods, which model instruction sequences as directed graph structures, where nodes represent instructions and edges represent temporal dependencies between instructions, and learns the graph structure features of normal instruction sequences by training a graph neural network model to identify the graph structure of abnormal instruction sequences. Instruction combination patterns with step-by-step penetration characteristics include, but are not limited to: a pattern where sensitive file reading is followed immediately by an external network request, indicating potential data leakage; a pattern where privilege escalation attempts are followed immediately by system configuration modifications, indicating potential privilege escaping; and a pattern where batch data reading is followed immediately by data compression and network transmission, indicating potential batch data theft. This embodiment can overcome the limitations of traditional operating system security protection, which relies solely on matching the dangerous features of a single instruction. By modeling the behavioral semantics of instruction sequences, it can effectively identify and block advanced attack behaviors that involve step-by-step penetration.

[0030] Step S140: Aggregate the abnormal signals detected by each of the security protection layers to generate a standardized risk context object; In this embodiment, a standardized risk context object refers to encapsulating abnormal signals detected at each layer according to a unified data structure. This data structure defines a standardized set of fields, including risk type, confidence level, attack vector, and affected resources, ensuring that security detection modules at different levels can exchange risk information in a unified information format. Specifically, the risk context object includes at least one element from risk type, confidence level, attack vector, and affected resources.

[0031] Step S150: Broadcast the risk context object to the multiple security protection layers through a pre-set cross-layer risk propagation bus; Step S160: Based on the risk context object, trigger the adaptive adjustment of security policy thresholds for each security protection layer.

[0032] In this embodiment, the cross-layer risk propagation bus is a message passing mechanism based on a publish-subscribe model. Each security protection module acts as a publisher and subscriber of messages, using this bus to efficiently and reliably transmit risk context objects. Adaptive adjustment of security policy thresholds refers to each protection layer dynamically adjusting its own security policy parameters based on the risk level information in the received risk context object. These parameters include, but are not limited to, detection sensitivity thresholds, operation whitelist ranges, interception trigger conditions, and approval process requirements. By collaboratively detecting and responding to security threats across multiple security protection layers, when any layer detects an anomaly, the risk information can propagate to other layers in real time, triggering a collaborative protection response across all layers. This achieves end-to-end identification and blocking of cross-layer attack chains, fundamentally solving the shortcomings of existing single-layer static protection schemes where layers are fragmented and unable to coordinate.

[0033] In one embodiment, triggering adaptive adjustment of security policy thresholds for each security protection layer based on the risk context object includes: When the abnormal signal exceeds a preset threshold, the security strategy of each protection level is dynamically tightened. Once the abnormal signal is cleared and falls below the preset threshold, the system automatically reverts to the normal state of the security policy at each protection level.

[0034] In this embodiment, the Adaptive Policy Adjustment Controller (APAC) is the core component connecting risk perception and policy execution. The system defines a global risk posture level, which can be divided into four levels: Normal (Level 0), Attention (Level 1), Warning (Level 2), and Severe (Level 3). The Normal level indicates that the system is operating normally and no abnormal signals have been detected. The Attention level indicates that a low-confidence or minor abnormal signal at a single level has been detected, requiring continued monitoring but no tightening measures are currently being taken. The Warning level indicates that a medium-confidence abnormal signal or a cross-level correlated abnormal signal has been detected, requiring tightening of some protection strategies. The Severe level indicates that a high-confidence explicit attack signal or a multi-level coordinated abnormal signal has been detected, requiring comprehensive tightening of all protection strategies. The preset threshold is the boundary value between each risk level, calculated by a confidence-weighted evaluation algorithm based on the abnormal signals reported from each level. The confidence-weighted evaluation algorithm considers the confidence level of the abnormal signals at each level, the importance of the risk type, and the correlation between levels. For example, the weighting coefficient of anomaly signals at the Skill layer, which involve core execution capabilities, can be set to 0.3, while the weighting coefficient of anomaly signals at the network communication layer can be set to 0.1. The combined weight of indirect prompt injection detected at the prompt semantic layer and abnormal permission requests detected at the Skill layer is higher than the sum of their individual weights, reflecting the enhanced effect of cross-layer association. Specific measures for dynamically tightening security policies at each protection layer include, but are not limited to: at the prompt semantic layer, lowering the tolerance threshold for semantic anomaly detection, increasing the detection sensitivity from the default value to a higher level, conducting in-depth reviews of more input content, and enabling additional semantic analysis models for cross-validation; at the Agent behavior layer, adding additional manual review or automated in-depth analysis steps to the task planning chain, and allowing execution only after independent security assessment of each sub-task node; at the Skill layer, suspending new Skill generation permissions, allowing only Skills that have passed security review to be executed, and mandating manual review of all newly generated Skill code; at the tool invocation layer, [the text abruptly ends here, likely due to an incomplete sentence or missing information]. The tool whitelist has been reduced from a complete list to a set of core necessary tools, and a manual confirmation step has been added, requiring an additional security approval process for each tool call; at the database operation layer, the write operation mode has been switched to read-only mode, prohibiting all INSERT, UPDATE, DELETE, and DROP write operations, allowing only SELECT query operations; at the operating system command layer, an approval process for command execution has been added, prohibiting high-risk system calls (such as chmod, chown, mount, etc.), and all file write operations are audited and logged; at the network communication layer, unnecessary network exits are blocked, only network connections necessary for business operations are maintained, and outbound data is reviewed in real time.Policy rollback refers to the system automatically restoring security policies to a normal state layer by layer according to a predefined priority order after the abnormal signals have continuously subsided and fallen below the security threshold. The design principle of the rollback order is to prioritize restoring the layers with the greatest impact on business. For example, first restore the normal policy of the network communication layer to restore the ability to access external services, then restore the normal policy of the tool invocation layer to restore the use of the complete toolset, and finally restore the normal policy of the Skill layer to restore the ability to generate dynamic Skills, ensuring the safe and orderly rollback process. At the same time, the system continuously monitors the abnormal signals of each layer during the rollback process. If the risk signal is found to rise again, the rollback is immediately stopped and the tightened policy is restored. Through the adaptive security policy adjustment mechanism, a low-intervention and lenient policy is maintained during normal operation to ensure business continuity. The protection policy is tightened precisely only when the risk situation rises, and the rollback is automatically restored after the threat is eliminated. This avoids the business interruption problems caused by the traditional "one-size-fits-all" hard blocking solution and achieves a dynamic balance between security and availability.

[0035] In one embodiment, the Risk Context Object is the core data structure of the Risk Context Propagation Protocol (RCPP), designed to provide a standardized and semantically clear format for exchanging risk information across layers. The RCPP protocol defines the serialization format, transmission method, and subscription routing rules for the Risk Context Object. The Risk Type field identifies the category of detected security threats, which may include, but is not limited to: prompt injection attacks (PROMPT_INJECTION), privilege escaping attacks (PRIVILEGE_ESCALATION), data leakage attacks (DATA_EXFILTRATION), denial-of-service attacks (DENIAL_OF_SERVICE), supply chain contamination attacks (SUPPLY_CHAIN_POLLUTION), and unauthorized access attacks (UNAUTHORIZED_ACCESS). An enumerated type definition is used to ensure a unified understanding of risk types across modules. The Confidence Field is a numeric field, a floating-point number ranging from 0 to 1, representing the degree of certainty by the detection module that the abnormal signal belongs to a genuine attack. The confidence score can be calculated by the detection module based on multiple factors, including: feature matching degree, which is the degree of matching between detected abnormal features and known attack patterns; behavioral anomaly degree, which is the degree of deviation between the current behavior and the normal behavior baseline; and historical attack pattern similarity, which is the similarity between the current abnormal pattern and historical attack events. The confidence score can be calculated using methods such as weighted summation, Bayesian inference, or machine learning classifiers. The attack vector field describes the attack paths and techniques that attackers may use, employing a structured description format, such as "indirect prompt injection (source: external webpage) → Skill code generation (containing abnormal network connection code) → data leakage (target: unknown external server)". The affected resource field identifies system resources affected by security threats, and may include, but is not limited to: affected data table names (e.g., "user_credentials"), affected file paths (e.g., " / etc / config / app.conf"), affected network endpoint addresses (e.g., "192.168.1.100:8080"), and affected tool names (e.g., "file_upload_tool"). When generating risk context objects, the detection modules at each protection level fill in the fields they can determine. Uncertain fields can be left blank or marked as unknown values, and supplemented and corrected when aggregating multi-source risk signals. URPE stitches together fragmented risk information into a complete attack chain view by correlating and analyzing timestamps, data flow, and resource relationships in multiple risk context objects.By using a standardized risk context object data structure, semantic interoperability between heterogeneous security detection modules is achieved, providing a unified information exchange basis for cross-layer collaborative response, enabling security modules of different levels and implementation methods to exchange risk information in the same "language".

[0036] This method acquires input data entering the agent's context, performs intent semantic analysis and taint labeling on the input data, and conducts risk detection at seven security protection layers: Agent Skills, tool calls, database operations, operating system commands, and network communications. It aggregates the abnormal signals detected at each layer and generates standardized risk context objects. The risk context is broadcast to all protection layers via a cross-layer risk propagation bus, triggering each layer to adaptively adjust its security policy thresholds. This invention achieves end-to-end identification and coordinated response to cross-layer attack chains, achieving a dynamic balance between security and business continuity.

[0037] This invention also provides an agent-based collaborative security protection device, which is used to execute any embodiment of the aforementioned agent-based collaborative security protection method. Specifically, please refer to... Figure 2 , Figure 2 This is a schematic block diagram of an agent-based collaborative security protection device provided in an embodiment of the present invention. The agent-based collaborative security protection device 100 can be configured in a server.

[0038] like Figure 2 As shown, the agent-based collaborative security protection device 100 includes a semantic analysis module 110, a task parsing module 120, a risk detection module 130, an aggregation module 140, a broadcast module 150, and an adaptive adjustment module 160.

[0039] The semantic analysis module 110 is used to acquire input data entering the context of the intelligent agent, perform intention semantic analysis and taint marking on the input data, and filter out input data with abnormalities. Task parsing module 120 is used to parse and plan the input data to generate multiple sub-task links; Risk detection module 130 is used to perform risk detection on the corresponding sub-task links based on the multiple security protection layers of the intelligent agent and obtain multiple abnormal signals. The multiple security protection layers include Skill layer, tool call layer, database operation layer and operating system instruction layer. The aggregation module 140 is used to aggregate the abnormal signals detected by each of the security protection layers to generate a standardized risk context object; Broadcast module 150 is used to broadcast the risk context object to the multiple security protection layers via a preset cross-layer risk propagation bus; The adaptive adjustment module 160 is used to trigger the adaptive adjustment of the security policy threshold of each security protection layer based on the risk context object.

[0040] In one embodiment, the adaptive adjustment module 160 includes: When the abnormal signal exceeds a preset threshold, the security strategy of each protection level is dynamically tightened. Once the abnormal signal is cleared and falls below the preset threshold, the system automatically reverts to the normal state of the security policy at each protection level.

[0041] In another embodiment of the invention, a computer-readable storage medium is provided. This computer-readable storage medium may be a non-volatile computer-readable storage medium. The computer-readable storage medium stores a computer program that, when executed by a processor, causes the processor to perform the agent-based collaborative security protection method as described above.

[0042] Those skilled in the art will readily understand that, for the sake of convenience and brevity, the specific working processes of the devices, apparatuses, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention.

[0043] In the embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Units with the same function may be grouped into one unit. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices, or units, or it may be an electrical, mechanical, or other form of connection.

[0044] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments of the present invention, depending on actual needs.

[0045] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0046] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), magnetic disks, or optical disks.

[0047] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A collaborative security protection method based on intelligent agents, characterized in that, include: Obtain input data that enters the context of the intelligent agent, and perform intention semantic analysis and taint marking on the input data; The input data is parsed and planned to generate multiple sub-task chains; Based on the multiple security protection layers of the intelligent agent, risk detection is performed on the corresponding sub-task links to obtain multiple abnormal signals. The multiple security protection layers include the Skill layer, tool call layer, database operation layer, operating system instruction layer, prompt word semantic layer, network communication layer, and Agent behavior layer. The abnormal signals detected by each of the security protection layers are aggregated to generate a standardized risk context object; The risk context object is broadcast to the multiple security protection layers via a pre-defined cross-layer risk propagation bus; Based on the risk context object, the threshold of the security policy is adaptively adjusted for each of the security protection layers.

2. The agent-based collaborative security protection method as described in claim 1, characterized in that, The multiple security protection layers based on the intelligent agent perform risk detection on the corresponding sub-task links, including: During the Skill generation phase, the generated Skill code undergoes intent semantic auditing and permission request rationality assessment. During the Skill loading phase, a static code security scan is performed on the Skill code. The behavior of the Skill is monitored and isolated in a sandbox during the Skill execution phase.

3. The agent-based collaborative security protection method according to claim 1, characterized in that, The multiple security protection layers based on the intelligent agent perform risk detection on the corresponding sub-task links, including: The target, parameter content, and call frequency of the tool call request initiated by the intelligent agent are dynamically verified. The risk of being injected with content manipulation tools can be determined by combining the status of taint propagation.

4. The agent-based collaborative security protection method according to claim 1, characterized in that, The multiple security protection layers based on the intelligent agent perform risk detection on the corresponding sub-task links, including: Semantic parsing is performed on the database operation statements initiated by the intelligent agent to identify unauthorized queries and abnormal batch operations; Based on the current overall risk situation, determine whether to allow, demote, or block the database operation statements.

5. The method according to claim 1, characterized in that, Based on the risk context object, each of the security protection layers is triggered to adaptively adjust the security policy threshold, including: When the abnormal signal exceeds a preset threshold, the security strategy of each protection level is dynamically tightened. Once the abnormal signal is cleared and falls below the preset threshold, the system automatically reverts to the normal state of the security policy at each protection level.

6. The agent-based collaborative security protection method as described in claim 5, characterized in that, The security policies for each protection level include at least one of the following: suspending Skill generation permissions, restricting the scope of tool calls, switching the database to read-only mode, and blocking suspicious network exits.

7. The agent-based collaborative security protection method as described in claim 1, characterized in that, The risk context object includes at least one of the following elements: risk type, confidence level, attack vector, and affected resources.

8. A collaborative security protection device based on intelligent agents, characterized in that, include: The semantic analysis module is used to acquire input data entering the context of the intelligent agent, and to perform intention semantic analysis and taint marking on the input data; The task parsing module is used to parse and plan the input data to generate multiple sub-task links; The risk detection module is used to perform risk detection on the corresponding sub-task links based on the multiple security protection layers of the intelligent agent and obtain multiple abnormal signals. The multiple security protection layers include the Skill layer, the tool call layer, the database operation layer, and the operating system instruction layer. The aggregation module is used to aggregate the abnormal signals detected by each of the security protection layers and generate a standardized risk context object; The broadcast module is used to broadcast the risk context object to the multiple security protection layers via a pre-built cross-layer risk propagation bus; The adaptive adjustment module is used to trigger the adaptive adjustment of security policy thresholds for each of the security protection layers based on the risk context object.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the agent-based collaborative security protection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, causes the processor to perform the agent-based collaborative security protection method as described in any one of claims 1 to 7.

Images