An AI agent abnormal behavior detection method and device based on a network layer intention graph

Abstract

The application provides an AI agent abnormal behavior detection method and device based on a network layer intention graph, extracts protocol layer features and encrypted load statistical features from captured traffic on a network edge router, matches an AI agent behavior mode library to identify AI agent communication traffic, thereby completing identification at the network edge before the traffic reaches the server; further, a context block is allocated for each agent session to record its identity, opposite end and historical intention sequence, a current intention is obtained through real-time classification by a lightweight model, and the sequence is written back; each agent is taken as a node, agent-to-agent traffic is taken as an edge, and intention types and confidence are taken as edge weights, a dynamic intention graph is constructed within a sliding time window, and originally isolated multiple sessions are associated as a global view; finally, based on the graph, multi-dimensional calculations such as intention distribution deviation, opposite end change and tool boundary crossing are integrated to obtain a comprehensive abnormal score, and a hierarchical response is made according to the score, thereby detecting multi-agent cooperative abnormal behaviors that cannot be found in a single session perspective.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a method and apparatus for detecting abnormal behavior of AI agents based on network layer intent graphs. Background Technology

[0002] With the development of Agentic AI technology, a large number of machine-to-machine communications initiated autonomously by AI agents have emerged in enterprise networks. This type of communication differs from traditional human-computer interaction traffic. It is often carried in encrypted form on protocols such as HTTP / 2 and gRPC, and agents collaborate frequently to complete complex business processes through tool calls, task allocation, and state synchronization.

[0003] For intent recognition in AI agent communication, existing technologies (such as the solution disclosed in publication number CN121301230A) typically employ a multi-agent conversation system deployed at the server application layer. The LLM central routing module located at the application layer receives user requests and distributes them to the corresponding agents for processing based on the intent recognition results. Session switching between agents is achieved by redirecting the activity pointer of the private context block in memory.

[0004] However, the aforementioned intent recognition scheme is designed for service optimization purposes. It can only serially track and switch multi-turn intents within a single session of human-computer interaction. It cannot identify AI agent communication traffic at the network boundary before it reaches the server, nor can it establish a relational view across multiple independent agent sessions in terms of communication counterparts, intent types, and call sequences. Therefore, when attackers use multiple seemingly compliant AI agents to collaboratively carry out complex behaviors such as data leakage and unauthorized tool calls in a chain-like manner, the aforementioned scheme cannot timely identify and block these complex behaviors at the network boundary because the behavior of any agent within its single session falls within the normal service intent range of that agent. This allows the attack traffic to penetrate the network infrastructure, reach the target AI asset, and cause actual damage.

[0005] In view of the above, this application is hereby submitted. Summary of the Invention

[0006] This invention discloses an AI agent abnormal behavior detection method and device based on network layer intent graph, which aims to solve the technical problem that existing solutions, due to their deployment on the server side and limitation to a single session perspective, cannot identify AI agent communication traffic at the network edge and detect abnormal behavior of multi-agent collaboration across sessions.

[0007] The first embodiment of the present invention provides a method for detecting abnormal behavior of AI agents based on network layer intent graphs, including: The protocol layer features and statistical features of the encrypted payload are extracted from the network traffic captured by the network edge router, and the target traffic belonging to the AI ​​agent communication traffic is determined based on the matching of the AI ​​agent behavior pattern library. In the cache of the network edge router, a proxy session context block is allocated for the AI ​​proxy session to which the target traffic belongs. The proxy session context block is used to record the proxy identity, communication peer set and historical intent sequence corresponding to the AI ​​proxy session. A lightweight intent classification model is used to classify the communication content of the target traffic to obtain the current intent, and the current intent is appended to the historical intent sequence of the proxy session context block; Using the AI ​​agent corresponding to each of the agent session context blocks as nodes, the target traffic between the AI ​​agents as directed edges, and information including at least intent type and confidence level as edge weights, a dynamic intent graph is constructed and updated within a sliding time window. Based on the historical intent sequence of each node in the dynamic intent graph and the set of communication peers, the intent distribution offset, communication peer change and tool call out-of-bounds degree are integrated to calculate the comprehensive anomaly score of each AI agent. Based on the comparison result between the comprehensive anomaly score and the preset threshold, a graded response strategy, including allowing, limiting, and blocking, is implemented on the target traffic. The second embodiment of the present invention provides an AI agent abnormal behavior detection device based on network layer intent graph, comprising: The proxy traffic identification unit is used to extract protocol layer features and statistical features of encrypted payloads from the network traffic captured by the network edge router, and to determine the target traffic belonging to AI proxy communication traffic in the network traffic based on the matching of the AI ​​proxy behavior pattern library. The session state management unit is used to allocate a proxy session context block in the cache of the network edge router for the AI ​​proxy session to which the target traffic belongs. The proxy session context block is used to record the proxy identity, communication peer set and historical intent sequence corresponding to the AI ​​proxy session. The intent classification unit is used to classify the communication content of the target traffic using a lightweight intent classification model, obtain the current intent, and append the current intent to the historical intent sequence of the proxy session context block. The graph update unit is used to construct and update a dynamic intent graph within a sliding time window, using the AI ​​agent corresponding to each of the agent session context blocks as nodes, the target traffic between the AI ​​agents as directed edges, and information including at least intent type and confidence as edge weights. The intent graph analysis unit is used to calculate the comprehensive anomaly score of each AI agent based on the historical intent sequence of each node in the dynamic intent graph and the set of communication peers, by integrating the intent distribution offset, the communication peer change degree and the tool call out-of-bounds degree. The arbitration unit is used to implement a graded response strategy, including allowing, limiting, and blocking, on the target traffic based on the comparison result between the comprehensive anomaly score and the preset threshold.

[0008] The third embodiment of the present invention provides an AI agent abnormal behavior detection device based on network layer intent graph, including a memory and a processor. The memory stores a computer program, which can be executed by the processor to implement the AI ​​agent abnormal behavior detection method based on network layer intent graph as described in any of the above embodiments.

[0009] The fourth embodiment of the present invention provides a computer-readable storage medium, characterized in that it stores a computer program, which can be executed by the processor of the device where the computer-readable storage medium is located, to implement the AI ​​agent abnormal behavior detection method based on network layer intent graph as described in any of the above claims.

[0010] Based on the AI ​​agent abnormal behavior detection method and device based on network layer intent graph provided by this invention, protocol layer features and encrypted payload statistical features are extracted from captured traffic on the network edge router. These features are then matched with an AI agent behavior pattern library to identify AI agent communication traffic, thus completing the identification at the network edge before the traffic reaches the server. Furthermore, a context block is allocated to each agent session to record its identity, peer, and historical intent sequence. The current intent is then classified in real time using a lightweight model and written back to the sequence. A dynamic intent graph is constructed within a sliding time window, with each agent as a node, inter-agent traffic as edges, and intent type and confidence level as edge weights, linking multiple previously isolated sessions into a global view. Finally, a comprehensive anomaly score is calculated based on the graph, considering multiple dimensions such as intent distribution offset, peer changes, and tool boundary violations. A graded response is then implemented to detect multi-agent collaborative abnormal behaviors that cannot be detected from a single session perspective. Attached Figure Description

[0011] Figure 1 This is a flowchart illustrating an AI agent abnormal behavior detection method based on network layer intent graph provided in the first embodiment of the present invention. Figure 2 This is a schematic diagram of a module of an AI agent abnormal behavior detection device based on network layer intent graph provided in the second embodiment of the present invention. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] To better understand the technical solution of the present invention, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0014] This invention discloses an AI agent abnormal behavior detection method and device based on network layer intent graph, which aims to solve the technical problem that existing solutions, due to their deployment on the server side and limitation to a single session perspective, cannot identify AI agent communication traffic at the network edge and detect abnormal behavior of multi-agent collaboration across sessions.

[0015] Please see Figure 1 The first embodiment of the present invention provides a method for detecting abnormal behavior of AI agents based on network layer intent graphs, which can be executed by a detection device (or system), specifically by one or more processors within the detection device, to at least implement the following steps: S101, extract protocol layer features and statistical features of encrypted payloads from the network traffic captured by the network edge router, and determine the target traffic belonging to AI agent communication traffic in the network traffic based on the matching of the AI ​​agent behavior pattern library; In this embodiment, the network edge router performs bypass capture or in-line collection of network traffic on its network interface, and reassembles the flow according to the five-tuple to obtain the traffic to be identified in units of sessions. Subsequently, the proxy traffic fingerprinting engine extracts the protocol layer features and statistical features of the encrypted payload in parallel from the traffic to be identified: In terms of protocol layer features, the SNI field in the ClientHello message during the TLS handshake phase is parsed to match the characteristics of common AI service domain names, the ALPN extension field is parsed to identify commonly used AI proxy bearer protocols such as HTTP / 2 and gRPC, and the frame size distribution and setting parameters of the SETTINGS frame when the HTTP / 2 connection is established are extracted; In terms of statistical features of the encrypted payload, the data packet size distribution, data packet arrival interval, flow duration, and uplink / downlink traffic ratio are extracted from the encrypted traffic that cannot be decrypted, thereby characterizing the behavioral profile of the traffic without decrypting the content. The engine then concatenates the aforementioned protocol layer features and statistical features into a feature vector for the session, which is then input into a pre-built AI agent behavior pattern library for matching. This pattern library is constructed by reverse modeling known AI agent frameworks such as AutoGPT, CrewAI, LangChain, and Semantic Kernel, combining pre-training with public datasets, and continuously collecting feature vectors in a simulation environment. When the similarity between the feature vector of the traffic to be identified and the feature vector of a certain framework in the pattern library exceeds a preset threshold, the session is determined to be AI agent communication traffic and identified as target traffic, which is then handed over to subsequent steps for processing. Otherwise, it is forwarded according to the normal routing process and will not enter the intent analysis link.

[0016] S102, allocate a proxy session context block in the cache of the network edge router for the AI ​​proxy session to which the target traffic belongs. The proxy session context block is used to record the proxy identity, communication peer set and historical intent sequence corresponding to the AI ​​proxy session. In this embodiment, the proxy session state management module pre-allocates a proxy session context heap in the fast cache of the network edge router. This fast cache can be implemented by the router's tri-state content-addressable memory or static random access memory to meet the real-time read and write requirements in high-throughput scenarios. When the target traffic is determined, the module allocates an independent proxy session context block in the context heap for the AI ​​proxy session to which the target traffic belongs, and writes session metadata into it, including a proxy identity identifier composed of at least two of the API Key hash, digital certificate fingerprint, and User-Agent hash, as well as the set of communication peers, historical intent sequence, current session stage, and session timestamp of the session. The use of multiple identifiers to jointly constitute the identity identifier can avoid session misjudgment and confusion caused by the forgery or absence of a single identifier. In high-concurrency scenarios with multiple proxies, the module adopts the concept of memory address redirection and maintains an active context pointer for each context block. When packets from different proxy sessions arrive alternately, the session switching can be completed simply by redirecting the active context pointer to the memory address of the corresponding context block. There is no need to repeatedly read, write, and move data, thereby reducing the overhead of high-frequency session switching from data I / O to pointer redirection. This ensures that the router can still maintain the state of each session in real time under tens of thousands of concurrent proxy sessions and provides support for appending the identified current intent to the historical intent sequence of the corresponding context block in real time.

[0017] S103, a lightweight intent classification model is used to classify the communication content of the target traffic (or the communication content after compliant decryption by the network edge router) to obtain the current intent, and the current intent is appended to the historical intent sequence of the proxy session context block; In this embodiment, the dynamic intent graph generation engine acquires content from the identified target traffic. Plaintext traffic is read directly, and decrypted content is read from traffic that has been legally decrypted at the router side. This yields the text content of inter-agent communication, which is then used as input for classification. The engine deploys a distillation-optimized lightweight Transformer model (such as DistilBERT, TinyBERT, or MobileBERT) as the intent classification model, whose encoder extracts feature vectors from the input content. Then, the probability of the content belonging to each intent category is calculated through a classification layer and softmax operation:

[0018] The category with the highest probability is taken as the current intent, where the set of intent categories is... Specifically designed for AI agent communication, including data querying, tool invocation, task allocation, state synchronization, result aggregation, error handling, authorization requests, and resource discovery. The numerator in the above formula represents the target category. Corresponding trainable parameters , and The exponential term and denominator are the set of intent categories. All categories Corresponding parameters , The normalization term of the summation normalizes the classification result into a probability distribution. When the current intent is a tool invocation, the engine further uses the tool invocation intent recognizer to parse the tool name from the communication content. Parameter list Target endpoint and the caller's permission level and will With the default list of allowed tools Compare, and The minimum privilege level required by the tool Compare and calculate the out-of-bounds amount using the following formula: , where the indicator function The value is 1 if the condition within the parentheses is true, and 0 otherwise. If the value is greater than 0, the tool call is considered a violation of authorization or an unauthorized tool call. Finally, the engine appends the identified current intent along with the tool call parsing results to the historical intent sequence of the allocated agent session context block for subsequent graph construction and anomaly scoring.

[0019] S104, using the AI ​​agent corresponding to each of the agent session context blocks as nodes, the target traffic between the AI ​​agents as directed edges, and information including at least intent type and confidence as edge weights, construct and update a dynamic intent graph within a sliding time window. In this embodiment, since S102 allocates an independent agent session context block for each AI agent session, multiple agent session context blocks initiated by the same AI agent at different times and in different transport layer connections (including but not limited to TCP connections, QUIC connections carried by UDP, and multiple HTTP / 2 streams multiplexed for the same TCP connection) are all merged into the same graph node with the AI ​​agent's identity identifier as the key. Thus, the dynamic intent graph uses AI agents rather than sessions as the node granularity, and aggregates the communication behaviors corresponding to multiple agent sessions that were originally isolated from each other in the traditional single session perspective into a global view centered on agents, thereby supporting the subsequent correlation analysis of multi-agent collaborative behaviors. Furthermore, a weighted directed graph is maintained in the router's graph database as a global intent graph:

[0020] For each processed agent session, the engine adds the AI ​​agent corresponding to its agent session context block as a node in the graph to the node set. When a certain AI agent To another AI agent When initiating target traffic communication, a link is established between the two. point to Directed edge And add to the set of directed edges Simultaneously, by the edge weight function Assign a quadruple to this edge:

[0021] in Taken from the type of the current intent identified. The confidence level for classifying this intent. This is the timestamp for this communication. This represents the cumulative frequency of the communication flow corresponding to the edge within the statistical period. When the same pair of agents communicate again, the engine does not add redundant edges, but instead updates the intent type, confidence level, and timestamp in the edge's four-tuple and accumulates the communication frequency. This connects the originally isolated agent sessions into a global view that reflects the collaborative situation of multiple agents. To avoid the graph from expanding indefinitely and to ensure real-time performance, the engine uses a sliding time window mechanism to dynamically update the graph, retaining only the most recent time window. Internal proxy interaction records:

[0022] in for The subgraph formed by constantly added agent interaction records exceeds the window. The nodes and edges are automatically aged and replaced; the constructed and updated intent graph is stored in the graph database in adjacency list or CSR format to optimize query efficiency, and is output to the subsequent graph analysis and anomaly detection stages.

[0023] S105, based on the historical intent sequence of each node in the dynamic intent graph and the set of communication peers, the intent distribution offset, communication peer change degree and tool call boundary violation degree are integrated to calculate the comprehensive anomaly score of each AI agent; In this embodiment, anomaly analysis is performed node-by-node on the output dynamic intent graph. First, a normal behavior baseline is established for each AI agent, including the baseline intent distribution. Baseline communication peer set The baseline intent distribution is not statically set, but rather is statistically analyzed and updated online based on the historical intent sequences recorded in the agent session context block. This is done whenever a new observed intent distribution is obtained. At that time, the baseline is smoothed by performing an exponentially weighted moving average recursion using the following formula:

[0024] Income As the next moment to participate in anomaly scoring Smoothing coefficient The baseline is set between 0 and 1, ensuring it retains historical behavioral characteristics while adaptively shifting with the normal evolution of agent behavior. Subsequently, the anomaly detection unit analyzes each agent... exist Calculate the comprehensive anomaly score at any time:

[0025] The first item is distributed according to the current intent. Compared with baseline distribution The KL divergence measure is the intention distribution shift, used to capture sudden changes in intention. The second term measures the change in communication peers as the proportion of newly added communication peers to the total number of current peers, used to capture the increase in communication entropy. This represents the set of counterparts that belong to the current counterpart set but not to the baseline counterpart set. The third term, representing the number of elements in the set, is obtained from S3 by the tool call outbound indicator function to measure tool overreach. The fourth term is obtained from the intent loop detection function. Determine if there are recurring intent subsequences in the historical intent sequence to identify anomalous repetitions that are trapped in an infinite loop. , , , These are the non-negative weight coefficients corresponding to the aforementioned intent distribution offset, communication peer variation, tool call out-of-bounds, and intent loop anomaly, and they satisfy the following conditions: The proportions of each dimension can be adjusted according to the characteristics of the deployed network environment. The comprehensive anomaly score is used to compare with preset thresholds and trigger corresponding graded responses.

[0026] S106. Based on the comparison result between the comprehensive anomaly score and the preset threshold, a graded response strategy including allowing, limiting, and blocking is implemented on the target traffic. In this embodiment, the comprehensive anomaly score will be used. With the first threshold Second threshold Comparisons are made to trigger a graded response, where , It is not a fixed value, but is adaptively determined by the following formula:

[0027] That is, based on the recent historical comprehensive anomaly score set mean with standard deviation As a benchmark, supplemented by sensitivity coefficient Dynamic calculation allows the threshold to automatically adjust with overall network traffic fluctuations and meet the requirements. When the overall anomaly score is less than If the risk level is low, the target traffic is allowed to proceed and logged for future analysis; if the score is not less than [a certain value], the traffic is considered low-risk. and not greater than If the score is deemed medium risk, the target traffic will be rate-limited, and the corresponding AI proxy session will be isolated in a sandbox environment. If necessary, an obfuscated response will be returned to disrupt potential attacks. When a high-risk scenario is identified, the target traffic is directly blocked, the corresponding proxy identity is added to a dynamic blacklist, and an administrator alert is triggered. Considering the uncertainty of determining the medium-risk range due to a single-point observation perspective, when the score falls into... and When the interval is ambiguous, a distributed consensus query is initiated to the adjacent network edge routers. Each adjacent router returns a vote value of 1 (abnormal) or 0 (normal) to indicate whether the proxy is abnormal. This node is based on the historical detection accuracy of each neighboring router. The final confidence level is calculated by weighting the votes and using the following formula:

[0028] By combining observation results from multiple nodes, a more accurate determination is made of the behavior in fuzzy regions, and a corresponding level of response strategy is executed accordingly, thereby achieving pre-interception of abnormal behavior of multi-agent collaboration at the network edge.

[0029] Please see Figure 2 The second embodiment of the present invention provides an AI agent abnormal behavior detection device based on network layer intent graph, comprising: The proxy traffic identification unit 201 is used to extract protocol layer features and statistical features of encrypted payloads from the network traffic captured by the network edge router, and determine the target traffic belonging to AI proxy communication traffic in the network traffic based on the matching of the AI ​​proxy behavior pattern library. The session state management unit 202 is used to allocate a proxy session context block in the cache of the network edge router for the AI ​​proxy session to which the target traffic belongs. The proxy session context block is used to record the proxy identity, communication peer set and historical intent sequence corresponding to the AI ​​proxy session. The intent classification unit 203 is used to classify the communication content of the target traffic using a lightweight intent classification model to obtain the current intent, and append the current intent to the historical intent sequence of the proxy session context block; The graph update unit 204 is used to construct and update a dynamic intent graph within a sliding time window, using the AI ​​agent corresponding to each of the agent session context blocks as nodes, the target traffic between the AI ​​agents as directed edges, and information including at least intent type and confidence as edge weights. The intent graph analysis unit 205 is used to calculate the comprehensive anomaly score of each AI agent based on the historical intent sequence of each node in the dynamic intent graph and the set of communication peers, by fusing intent distribution offset, communication peer change degree and tool call out-of-bounds degree. Arbitration unit 206 is used to execute a graded response strategy, including allowing, limiting, and blocking, on the target traffic based on the comparison result of the comprehensive anomaly score and the preset threshold.

[0030] The third embodiment of the present invention provides an AI agent abnormal behavior detection device based on network layer intent graph, including a memory and a processor. The memory stores a computer program, which can be executed by the processor to implement the AI ​​agent abnormal behavior detection method based on network layer intent graph as described in any of the above embodiments.

[0031] The fourth embodiment of the present invention provides a computer-readable storage medium, characterized in that it stores a computer program, which can be executed by the processor of the device where the computer-readable storage medium is located, to implement the AI ​​agent abnormal behavior detection method based on network layer intent graph as described in any of the above claims.

[0032] Based on the AI ​​agent abnormal behavior detection method and device based on network layer intent graph provided by this invention, protocol layer features and encrypted payload statistical features are extracted from captured traffic on the network edge router. These features are then matched with an AI agent behavior pattern library to identify AI agent communication traffic, thus completing the identification at the network edge before the traffic reaches the server. Furthermore, a context block is allocated to each agent session to record its identity, peer, and historical intent sequence. The current intent is then classified in real time using a lightweight model and written back to the sequence. A dynamic intent graph is constructed within a sliding time window, with each agent as a node, inter-agent traffic as edges, and intent type and confidence level as edge weights, linking multiple previously isolated sessions into a global view. Finally, a comprehensive anomaly score is calculated based on the graph, considering multiple dimensions such as intent distribution offset, peer changes, and tool boundary violations. A graded response is then implemented to detect multi-agent collaborative abnormal behaviors that cannot be detected from a single session perspective.

[0033] Exemplary examples show that the computer program described in the third and fourth embodiments of the present invention can be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in implementing an AI agent abnormal behavior detection device based on network layer intent graphs. For example, the apparatus described in the second embodiment of the present invention.

[0034] The processor referred to can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. This processor is the control center of the aforementioned AI agent abnormal behavior detection method based on network layer intent graphs, connecting various parts of the method through various interfaces and lines.

[0035] The memory can be used to store the computer program and / or modules. The processor, by running or executing the computer program and / or modules stored in the memory, and by calling the data stored in the memory, implements various functions of an AI agent abnormal behavior detection method based on network layer intent graphs. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, text conversion function, etc.), etc.; the data storage area may store data created based on the use of the mobile phone (such as audio data, text message data, etc.). In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0036] If the implemented module is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0037] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0038] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A network layer intent graph-based AI agent abnormal behavior detection method, characterized in that, include: The protocol layer features and statistical features of the encrypted payload are extracted from the network traffic captured by the network edge router, and the target traffic belonging to the AI ​​agent communication traffic is determined based on the matching of the AI ​​agent behavior pattern library. In the cache of the network edge router, a proxy session context block is allocated for the AI ​​proxy session to which the target traffic belongs. The proxy session context block is used to record the proxy identity, communication peer set and historical intent sequence corresponding to the AI ​​proxy session. A lightweight intent classification model is used to classify the communication content of the target traffic to obtain the current intent, and the current intent is appended to the historical intent sequence of the proxy session context block; Using the AI ​​agent corresponding to each of the agent session context blocks as nodes, the target traffic between the AI ​​agents as directed edges, and information including at least intent type and confidence level as edge weights, a dynamic intent graph is constructed and updated within a sliding time window. Based on the historical intent sequence of each node in the dynamic intent graph and the set of communication peers, the intent distribution offset, communication peer change and tool call out-of-bounds degree are integrated to calculate the comprehensive anomaly score of each AI agent. Based on the comparison between the comprehensive anomaly score and the preset threshold, a tiered response strategy, including allowing, limiting, and blocking, is implemented on the target traffic.

2. The AI agent abnormal behavior detection method based on network layer intent graph according to claim 1, characterized in that, The protocol layer features include the SNI field and ALPN extension field in the transport layer security protocol handshake, as well as the SETTINGS frame features of HTTP / 2. The statistical characteristics of the encrypted payload include packet size distribution, packet arrival interval, stream duration, and uplink / downlink traffic ratio; the AI ​​agent behavior pattern library is constructed by reverse modeling known AI agent frameworks, pre-training on public datasets, and collecting feature vectors from simulation environments. 3.The network layer intent graph-based AI agent abnormal behavior detection method of claim 1, wherein, The agent identity identifier is composed of at least two of the following: API Key hash, digital certificate fingerprint, and User-Agent hash; The proxy session context block is allocated within the proxy session context heap defined in the tri-state content addressing memory or static random access memory of the network edge router, and multiple proxy session context blocks are switched to access by maintaining an active context pointer.

4. The AI agent abnormal behavior detection method based on network layer intent graph according to claim 1, characterized in that, The intent category set for intent classification includes data query, tool invocation, task allocation, state synchronization, result aggregation, error handling, authorization request, and resource discovery; the probability that the current intent belongs to category c is determined by the following formula: in, For the input communication content, Encoder for lightweight intent classification model The output feature vector, For the set of intent categories, for One of the intention categories, For traversal The summation index, and These are the intent categories corresponding to the lightweight intent classification model. The trainable weight matrix and bias terms, and These are the intent categories corresponding to the lightweight intent classification model. The trainable weight matrix and bias terms.

5. The network layer intent graph-based AI agent abnormal behavior detection method of claim 1, wherein, Also includes: When the current intent is a tool invocation, the tool name is extracted from the communication content. Parameter list Target endpoint and the caller's permission level And determine whether it constitutes an out-of-bounds tool call as follows: in, This is a pre-defined list of allowed tools. This refers to the minimum permission level required by the tool whose name corresponds to its function. This is an indicator function, which takes a value of 1 when the condition within the parentheses is true, and a value of 0 otherwise; when If the value is greater than 0, the tool call is considered to be out of bounds.

6. The network layer intent graph-based AI agent abnormal behavior detection method of claim 1, wherein, The dynamic intent graph is represented as follows: in, for Momentary dynamic intent graph for A collection of constantly active AI agent nodes. Let be a set of directed edges. Let be the edge weight function, for AI agent Pointing to AI Agent Directed edge Its edge weights are: In the formula, , , , are edges corresponding to the intent type, intent confidence, timestamp, and communication frequency of the communication flow; The dynamic intent graph is updated using a sliding time window mechanism, retaining only the most recent time window. Internal proxy interaction records: in, The window length of the sliding time window. for The subgraph formed by the agent interaction records added at any time.

7. The network layer intent graph-based AI agent abnormal behavior detection method of claim 1, wherein, The comprehensive anomaly score is calculated using the following formula: in, AI Agent exist A comprehensive anomaly score at any given moment; AI Agent exist Distribution of current intent at any given moment AI Agent The baseline intention distribution, The KL divergence between the two is used to measure the offset of the intended distribution. AI Agent exist The set of communication peers at any given time. AI Agent The set of baseline communication counterparts, The newly added communication peer ratio is used to measure the degree of change of the communication peer. An indicator function for tool call out of bounds, used to measure the degree of tool call out of bounds; This is an intent loop detection function used to detect AI agents. If there is a recurring intention subsequence cycle in the historical intention sequence, the value is 1 if it exists, and 0 otherwise. , , , These are the weighting coefficients for intent distribution offset, communication peer change, tool call out-of-bounds, and intent loop anomaly, respectively.

8. The method for detecting abnormal behavior of AI agents based on network layer intent graphs according to claim 7, characterized in that, the baseline intent distribution The history of intents sequence recorded by the agent session context block is updated online by an exponentially weighted moving average: in, for The baseline intent distribution updated online at each time step is used as the basis for calculating the comprehensive anomaly score at the next time step. , According to The distribution of observed intentions obtained by statistical analysis of historical intention sequences at different times. for Baseline intention distribution at any given time; It is the smoothing coefficient for the exponentially weighted moving average.

9. The network layer intent graph-based AI agent abnormal behavior detection method of claim 1, wherein, The hierarchical response strategy is specifically as follows: when the composite anomaly score is less than a first threshold release the target traffic and log. When the comprehensive anomaly score is not less than the first threshold And not greater than the second threshold At that time, the target traffic is rate-limited and the corresponding AI agent session is isolated to a sandbox; When the comprehensive anomaly score is greater than the second threshold At that time, the target traffic is blocked and the corresponding proxy identity is added to the blacklist; wherein, And the first threshold With the second threshold Determined adaptively by the following formula: in, for The threshold is determined adaptively at any given time. This is a collection of historical comprehensive anomaly scores. and They are respectively The mean and standard deviation, This is the sensitivity coefficient.

10. An AI agent abnormal behavior detection device based on network layer intent graph, characterized in that, include: The proxy traffic identification unit is used to extract protocol layer features and statistical features of encrypted payloads from the network traffic captured by the network edge router, and to determine the target traffic belonging to AI proxy communication traffic in the network traffic based on the matching of the AI ​​proxy behavior pattern library. The session state management unit is used to allocate a proxy session context block in the cache of the network edge router for the AI ​​proxy session to which the target traffic belongs. The proxy session context block is used to record the proxy identity, communication peer set and historical intent sequence corresponding to the AI ​​proxy session. The intent classification unit is used to classify the communication content of the target traffic using a lightweight intent classification model, obtain the current intent, and append the current intent to the historical intent sequence of the proxy session context block. The graph update unit is used to construct and update a dynamic intent graph within a sliding time window, using the AI ​​agent corresponding to each of the agent session context blocks as nodes, the target traffic between the AI ​​agents as directed edges, and information including at least intent type and confidence as edge weights. The intent graph analysis unit is used to calculate the comprehensive anomaly score of each AI agent based on the historical intent sequence of each node in the dynamic intent graph and the set of communication peers, by integrating the intent distribution offset, the communication peer change degree and the tool call out-of-bounds degree. The arbitration unit is used to implement a graded response strategy, including allowing, limiting, and blocking, on the target traffic based on the comparison result between the comprehensive anomaly score and the preset threshold.

Images