Safe intelligent agent skill gateway invocation execution method and system

Abstract

This application provides a method and system for executing a secure intelligent agent skill gateway, belonging to the field of network security protection technology. The method includes: acquiring natural language instructions and parsing them to obtain the target operation type and operation object; extracting candidate execution devices from the skill registry based on the target operation object and operation type; acquiring an initial network topology map; sensing the current network state and dynamically correcting the weights of nodes or edges in the graph to obtain the target network topology map; using a shortest path algorithm to determine the minimum cost path from the secure intelligent agent to each candidate device, selecting the optimal forwarding path and the corresponding target execution device; generating machine instructions based on the target execution device, operation type, and operation object, and transmitting and executing them through the optimal path. This application reduces the user's operational burden and improves usability through natural language parsing; on the other hand, it significantly improves system reliability by dynamically sensing the network state and correcting path weights to bypass faulty or congested links.

Description

Technical Field

[0001] This application belongs to the field of network security protection technology, specifically a method and system for calling and executing a security intelligent agent skill gateway. Background Technology

[0002] With the rapid development of artificial intelligence (AI) technology, the application of secure intelligent agents in IoT security is becoming increasingly widespread. A secure intelligent agent is an AI system that uses a large model as its decision-making core to analyze instructions and invoke external security devices to execute security tasks. The skill gateway is the built-in middleware system of the secure intelligent agent. As the sole trusted entry point for invoking external skills, it is responsible for skill registration, authentication, routing, and auditing. It provides unified access to external devices, including IoT devices, isolating the secure intelligent agent from backend resources and preventing key leakage and unauthorized execution. The secure intelligent agent translates security requirements into specific machine instructions by invoking the skill gateway.

[0003] In existing technologies, after the security intelligent agent completes instruction parsing, the execution of its skill gateway is usually carried out using a static pre-configuration method. Specifically, the system predefines a fixed forwarding path. When the parsing result is received, the skill gateway forwards the machine instruction to the designated execution device for security protection according to the pre-configured static forwarding path.

[0004] However, in the above static pre-configuration method, since the forwarding path is pre-set statically, there is a lack of awareness of the real-time network context. When a node in the forwarding path (such as an IoT gateway or edge router) fails or becomes congested, the system cannot dynamically adjust the forwarding path, resulting in interruption or timeout of instruction transmission, making it difficult to achieve normal security interception operations, and the system reliability is poor. Summary of the Invention

[0005] In view of this, this application provides a secure intelligent agent skill gateway invocation execution method and system to solve the technical problems existing in the prior art, which are that the forwarding path is pre-statically set and lacks real-time network context awareness, resulting in the inability to dynamically adjust when nodes in the path fail or become congested, thus making it difficult to achieve normal secure interception and resulting in poor system reliability.

[0006] To address the aforementioned issues, this application provides a secure intelligent agent skill gateway invocation and execution method, comprising:

[0007] The system acquires input natural language instruction data, performs intent analysis on the natural language instruction data, and obtains the target operation type and target operation object. Obtain a skill registry; based on the target operation object and the target operation type, extract at least one candidate execution device from the skill registry; the skill registry includes at least several operation objects, execution devices associated with each operation object, and operation types supported by each execution device. Obtain an initial network topology graph, which includes several nodes and edges between adjacent nodes, wherein the several nodes include at least a security agent and the candidate execution device; Obtain the current network state, and based on the current network state, modify the weights of nodes or edges in the initial network topology graph to determine the target network topology graph; Based on the shortest path algorithm, candidate shortest paths from the security agent to each candidate execution device are determined in the target network topology. The candidate shortest path with the lowest cost is selected to obtain the optimal forwarding path. The candidate execution device corresponding to the optimal forwarding path is determined as the target execution device. Based on the target execution device, the target operation object, and the target operation type, machine instructions are determined, and the machine instructions are transmitted to the target execution device for execution through the optimal forwarding path to provide security protection for the target operation object.

[0008] In one implementation, intent analysis is performed on the natural language instruction data to obtain the target operation type and the target operation object, including: A word segmenter is used to segment the natural language instruction data to obtain segmented data. The segmented data is matched with a preset operation type library to obtain the target operation type, and the segmented data is matched with a preset operation object library to obtain the target operation object.

[0009] In one embodiment, the word segmentation data includes words and their corresponding part-of-speech tags, the part-of-speech tags include at least verbs and nouns, the operation type library includes several standard operation types and a first set of keywords associated with each standard operation type, and the operation object library includes several standard operation objects and a second set of keywords associated with each standard operation object. The segmented data is matched with a preset operation type library to obtain the target operation type, and the segmented data is matched with a preset operation object library to obtain the target operation object, including: Each word in the segmented data and its corresponding part-of-speech tag are sequentially traversed. Words tagged as verbs are matched with the first keyword set. The standard operation type corresponding to the first keyword set that is successfully matched is determined as the target operation type. Words tagged as nouns are matched with the second keyword set. The standard operation object corresponding to the second keyword set that is successfully matched is determined as the target operation object.

[0010] In one implementation, based on the target operation object and the target operation type, at least one candidate execution device is extracted from the skill registry, including: Obtain the skill registry and extract the list of initial execution devices associated with the target operation object from the skill registry; Extract at least one candidate execution device that supports the target operation type from the initial execution device list.

[0011] In one implementation, the current network state includes the fault state of a node; Based on the current network state, the weights of nodes or edges in the initial network topology are adjusted to determine the target network topology, including: Delete the nodes in the faulty state in the initial network topology graph to determine the target network topology graph.

[0012] In one implementation, the current network state includes the permission status of the nodes; Based on the current network state, the weights of nodes or edges in the initial network topology are adjusted to determine the target network topology, including: Delete the nodes in the initial network topology diagram that indicate the security agent has no permission to access, and determine the target network topology diagram.

[0013] In one implementation, the current network state includes the bandwidth load rate between adjacent nodes; Based on the current network state, the weights of nodes or edges in the initial network topology are adjusted to determine the target network topology, including: The weights of edges between adjacent nodes are determined based on the bandwidth load rate between adjacent nodes, and the target network topology is determined based on the weights of the edges between adjacent nodes. The bandwidth load rate is positively correlated with the weights.

[0014] In one implementation, the current network state also includes the transmission distance between adjacent nodes; The weights of edges between adjacent nodes are determined based on the bandwidth load rate between adjacent nodes, including: The weights of edges between adjacent nodes are determined based on the bandwidth load rate and transmission distance between adjacent nodes, wherein the transmission distance is positively correlated with the weights.

[0015] In one implementation, the skill registry also includes interface information for the types of operations supported by the execution device; Based on the target execution device, the target operation object, and the target operation type, machine instructions are determined, including: The target interface information corresponding to the target execution device is extracted from the skill registry. Based on the target interface information, the target operation object, and the target operation type, machine instructions are determined.

[0016] On the other hand, this application also provides a secure intelligent agent skill gateway invocation and execution system, including: The intent analysis unit is used to acquire input natural language instruction data, perform intent analysis on the natural language instruction data, and obtain the target operation type and target operation object. An execution device determination unit is configured to acquire a skill registry and extract at least one candidate execution device from the skill registry based on the target operation object and the target operation type. The skill registry includes at least several operation objects, execution devices associated with each operation object, and operation types supported by each execution device. A network topology construction unit is used to obtain an initial network topology graph, which includes several nodes and edges between adjacent nodes. The several nodes include at least a security agent and the candidate execution device. The unit obtains the current network state, corrects the weights of nodes or edges in the initial network topology graph based on the current network state, and determines the target network topology graph. The path optimization unit is used to determine the candidate shortest paths from the security agent to each candidate execution device in the target network topology based on the shortest path algorithm, select the candidate shortest path with the lowest cost to obtain the optimal forwarding path, and determine the candidate execution device corresponding to the optimal forwarding path as the target execution device. The instruction transmission and execution unit is used to determine machine instructions based on the target execution device, the target operation object, and the target operation type, and transmit the machine instructions to the target execution device for execution through the optimal forwarding path, so as to provide security protection for the target operation object.

[0017] The beneficial effects of this application are as follows: The secure intelligent agent skill gateway invocation execution method provided by this application automatically performs intent analysis after the user inputs a natural language command, parses out the target operation type and target operation object, obtains the corresponding initial network topology map, and perceives the current network status in real time (such as node failure, bandwidth load rate, etc.). When network devices on the original path fail or links are congested, the weights of nodes or edges in the graph can be dynamically adjusted to obtain the target network topology map. The shortest path algorithm is then guided to automatically bypass unavailable or congested links and select other reachable and smooth paths, ensuring that machine commands can be reliably transmitted to the target execution device for execution. This effectively overcomes the problems of command transmission interruption or timeout caused by static pre-configuration of forwarding paths in the prior art, which cannot adapt to dynamic network changes, and significantly improves the reliability of the system. Attached Figure Description

[0018] Figure 1 A flowchart illustrating the execution method of the security intelligent agent skill gateway provided in this application embodiment; Figure 2 This is a flowchart illustrating step S11 of an embodiment of this application; Figure 3 This is a flowchart illustrating step S12 in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of the secure intelligent agent skill gateway call execution system provided in the embodiments of this application. Detailed Implementation

[0019] To enable those skilled in the art to better understand the technical solution, the present application will be described in detail below with reference to the embodiments. The description in this section is only exemplary and explanatory, and should not be used to limit the scope of protection of the present application in any way.

[0020] This application provides a method and system for calling and executing secure intelligent agent skill gateways, which will be described below.

[0021] Figure 1 A flowchart illustrating the secure intelligent agent skill gateway invocation execution method provided in this application embodiment is shown below. Figure 1 As shown, the secure intelligent agent skill gateway calls and executes the following methods: S11. Obtain natural language instruction data, perform intent analysis on the natural language instruction data, and obtain the target operation type and target operation object; It's important to note that natural language (NLP) commands refer to security operations and maintenance (O&M) instructions expressed by O&M personnel in unstructured, free-text form. These instructions require semantic parsing to be converted into machine-understandable commands. For example, the obtained NLP command data might be "Block the core database server that is abnormally connecting to external networks." Compared to structured commands, such as JSON (JavaScript Object Notation) and XML (Extensible Markup Language) parameters in APIs (Application Programming Interfaces), NLP commands do not require O&M personnel to know the specific interface format or parameters of the target execution device beforehand, offering greater ease of use and flexibility. There are various ways to obtain input NLP command data, and the appropriate method can be chosen based on the specific O&M scenario during deployment. For instance, O&M personnel can directly input text commands into a browser through a web (World Wide Web) interactive interface provided by the security agent; alternatively, they can receive commands through a voice interaction interface, converting their voice commands into text via automatic speech recognition before inputting them into the security agent for intent analysis.

[0022] It should also be noted that intent analysis refers to the semantic parsing of natural language commands to extract the category of security actions (i.e., operation type) that operations personnel expect to perform and the specific target (i.e., operation object) that the action affects. This converts unstructured natural language expressions into structured operation intents for subsequent device matching and command generation. Operation types typically appear as verbs or verb-object phrases, such as "block" or "isolate." Operation objects typically appear as nouns or noun phrases, such as core database servers, Web (World Wide Web) servers, and terminal hosts. Different combinations of operation types and operation objects correspond to different security execution devices and machine commands. For example, when the natural language command is "block the core database server that is abnormally connecting," the parsed operation type is "block" and the operation object is "core database server." In this case, the firewall is used as the execution device to execute the traffic blocking command, blocking specific traffic from that server. When the operation type is "isolate" and the operation object is a terminal host, the switch or terminal response system is used as the execution device to execute the port disable or network disconnect command, isolating the terminal from the network.

[0023] Considering that the network security protection application scenario in this application has high requirements for real-time response and processing latency, and that the natural language commands input by maintenance personnel are usually characterized by relatively fixed sentence structures and limited vocabulary, common solutions for intention analysis of natural language in the prior art include rule-template-based models and large language models. While large language models possess strong semantic understanding capabilities, they consume high computational resources and have large inference latency, making it difficult to meet the requirements of low latency and lightweight deployment in this scenario. In contrast, rule-template-based models have advantages such as high real-time performance, low resource consumption, strong deterministic inference results, and deployment without training, effectively adapting to the application scenario of this application. Therefore, in some embodiments of this application, a rule-template-based model is used for intention analysis of natural language to adapt to the application scenario of this application, which has high requirements for response timeliness, limited deployment environment resources, and relatively fixed and closed natural language commands. Specifically, for example... Figure 2 As shown, step S11 includes: S111. Use a word segmenter to segment the natural language instruction data to obtain segmented data; It should be noted that the word segmenter can be a lightweight word segmentation tool commonly used in this field, such as jieba or SnowNLP (Snow Natural Language Processing). These tools have built-in part-of-speech tagging capabilities, enabling them to tag the part of speech (e.g., verb, noun, adjective, adverb, particle, etc.) of each word while segmenting natural language instruction data. Part-of-speech tagging helps identify the operation type (usually verbs) and the operation object (usually nouns) in subsequent steps.

[0024] For example, when the natural language instruction data is "block the core database server that is abnormally connecting", the word segmentation data obtained after word segmentation and part-of-speech tagging is: block (verb), is (adverb), abnormal (adjective), connect (verb), of (particle), core database server (noun); among them, "block" is a verb and is the operation type; "core database server" is a noun phrase and is the operation object.

[0025] S112. Match the segmented data with the preset operation type library to obtain the target operation type, and match the segmented data with the preset operation object library to obtain the target operation object; It should be noted that the operation type library is a predefined mapping structure used to map verbs in natural language instructions to standardized operation types. It includes several standard operation types and a set of first keywords associated with each standard operation type (including main keywords and synonyms). For example, the standard operation types include "block" and "isolate". The set of first keywords corresponding to the standard operation type "block" includes "block", "intercept", and "prevent". The set of first keywords corresponding to the standard operation type "isolate" includes "isolate", "disconnect", "remove from network", and so on.

[0026] The operation object library is also a predefined mapping structure used to map nouns in natural language instructions to standardized operation objects. It includes several standard operation objects and a set of second keywords associated with each standard operation object (including standard names and common variations). For example, the standard operation objects include "core database server", "web server", "terminal host", etc.; the set of second keywords corresponding to the standard operation object "core database server" includes "core database server", "core database", "database server"; the set of second keywords corresponding to the standard operation object "web server" includes "web server", "website server", "front-end server"; the set of second keywords corresponding to the standard operation object "terminal host" includes "terminal", "host", "computer", etc.

[0027] In some embodiments of this application, the word segmentation data includes words and their corresponding part-of-speech tags. The part-of-speech tags include at least verbs and nouns. The operation type library includes several standard operation types and a first keyword set associated with each standard operation type. The operation object library includes several standard operation objects and a second keyword set associated with each standard operation object. Correspondingly, step S112 includes: sequentially traversing each word in the word segmentation data and its corresponding part-of-speech tag, matching words tagged as verbs with the first keyword set, determining the standard operation type corresponding to the successfully matched first keyword set as the target operation type, matching words tagged as nouns with the second keyword set, and determining the standard operation object corresponding to the successfully matched second keyword set as the target operation object.

[0028] It should be noted that a successful match means that a word in the segmented data is exactly the same as a keyword in either the first or second keyword set (i.e., an exact match). Since each keyword set pre-contains the main keyword and its common synonyms, exact matching can cover most operational commands. If a word in the segmented data fails to match an exact keyword set (i.e., it does not belong to any standard operation type or standard operation object keyword set), the word is considered unmatchable. A match failure log can be recorded and manually processed, or the system administrator can expand the keyword set according to actual needs.

[0029] For example, for the natural language command "Block the core database server that is abnormally connecting," the segmented data contains the verb "block" and the noun "core database server." Through the aforementioned matching process, the unique standard operation type that matches successfully is located from multiple standard operation types and is determined as the target operation type; similarly, the unique standard operation object that matches successfully is located from multiple standard operation objects and is determined as the target operation object. For example, when matching the operation type library, "block" belongs to the first keyword set of the standard operation type "block," so the target operation type is "block"; when matching the operation object library, "core database server" belongs to the second keyword set of the standard operation object "core database server," so the target operation object is "core database server."

[0030] S12, Obtain the skill registry. Based on the target operation object and the target operation type, extract at least one candidate execution device from the skill registry. The skill registry includes at least several operation objects, execution devices associated with each operation object, and operation types supported by each execution device. It should be noted that the skill gateway built into the security agent maintains a skill registry. The function of the skill registry is to establish a mapping relationship between operation objects and execution devices, so that after determining the target operation object and the target operation type, it can quickly locate candidate execution devices capable of performing the operation. The skill registry records one or more execution devices associated with each operation object, as well as the set of operation types and interface information supported by each execution device. Here, execution devices refer to specific hardware or software entities capable of performing security protection operations, such as firewalls, switches, and endpoint response systems. The execution devices receive and execute machine instructions issued by the security agent to implement security policies on the target operation object. Interface information refers to the set of technical parameters required for a secure intelligent agent to call and execute a device. It is used for communication between the secure intelligent agent and the execution device. For example, it includes network address, protocol type, access authentication method, and data format to be followed when calling. Among them, network address includes IP (Internet Protocol) address and port number, protocol type includes HTTP (Hypertext Transfer Protocol) and HTTPS (Hypertext Transfer Protocol Secure), and access authentication method includes API (Application Programming Interface) key, token, etc.

[0031] The skill registry can be maintained using either static configuration or dynamic registration. In static configuration, the system administrator pre-enters the operation object, execution device, and its supported operation types and interface information into the registry. In dynamic registration, when the execution device comes online, it proactively reports its identifier, capability information (supported operation types), and associated operation object to the skill gateway through the registration interface. The skill gateway then dynamically updates the skill registry accordingly. Both methods can be used in combination to ensure the accuracy and timeliness of the registry information.

[0032] In some embodiments of this application, such as Figure 3 As shown, step S12 includes: S121, Obtain the skill registry and extract the list of initial execution devices associated with the target operation object from the skill registry; It should be noted that the skill registry includes at least the relationships between the operation object, the execution device, and the operation types supported by the execution device. Specifically, it uses the operation object as an index to record one or more execution devices associated with each operation object, and each execution device is associated with its set of supported operation types. The specific method for extracting the initial execution device list is as follows: using the target operation object as the query key, a matching search is performed in the skill registry. If a record exists in the skill registry that completely matches the target operation object, all execution devices recorded in that record, along with the set of supported operation types associated with each execution device, are extracted to form the initial execution device list. If no matching record exists, it is determined that there are currently no available execution devices, and a prompt message may be returned to the user or an exception log may be recorded.

[0033] For example, the target operation object is the "core database server", and the skill registry records the list of initial execution devices associated with it as "firewall 01" and "alternate firewall 02".

[0034] S122, extract at least one candidate execution device that supports the target operation type from the initial execution device list.

[0035] It should be noted that candidate execution devices refer to devices selected from the initial execution device list that possess the capability to execute the target operation type. These devices have the execution capability but have not yet undergone path cost evaluation, hence the term "candidate." The final target execution device will be determined from these candidates. The specific method for determining whether a device supports the target operation type is as follows: using the target operation type as the query condition, iterate through the set of operation types supported by each execution device in the initial execution device list, and check whether the set contains the target operation type. If it does, the device is determined to support the operation type and is retained as a candidate execution device; if it does not, the device is determined to not support the operation type and is removed from the list.

[0036] For example, if the target operation type is "blocking", check whether the operation type set supported by firewall 01 and backup firewall 02 includes "blocking" and retain the supported ones as candidate execution devices.

[0037] S13, Obtain the initial network topology graph, which includes several nodes and edges between adjacent nodes. The several nodes include at least a security agent and a candidate execution device. It should be noted that the skill gateway built into the security agent maintains an initial network topology map, which describes the network connections between the security agent and each candidate execution device. The initial network topology map consists of nodes and edges. Nodes represent communication entities in the network, typically including the node where the security agent resides, candidate execution device nodes, and intermediate device nodes (such as routers, switches, and gateways) involved in routing and forwarding. Each node has a unique identifier and can have attributes attached (such as device type, IP address, and security domain). Edges represent direct communication links between two adjacent nodes. The initial network topology map can be established in several ways: the skill gateway actively probes the interconnection relationships of network devices using the Link Layer Discovery Protocol (LLDP), or reads the routing tables and address forwarding tables of network devices using the Simple Network Management Protocol (SNMP). Alternatively, it can be statically configured by the administrator to predefine nodes and links. The skill gateway updates the initial network topology map periodically or based on events (such as device online / offline triggers) to ensure it reflects the current network structure.

[0038] S14, Obtain the current network state, and adjust the weights of nodes or edges in the initial network topology graph based on the current network state to determine the target network topology graph; It should be noted that in order to select the optimal forwarding path in a dynamic network environment, the weights of nodes or edges in the initial network topology graph need to be dynamically adjusted according to the current network state. The weight reflects the cost of data transmission through that edge. The higher the weight, the less optimal the edge is. The network topology graph obtained after adjustment is the target network topology graph. The target network topology graph is the basic graph data on which the subsequent shortest path algorithm is based. The weights of each edge in it have incorporated real-time network state information (such as link load, node failures, etc.), which can guide path planning to avoid unavailable or congested links.

[0039] Considering the possibility of node failures, in some embodiments of this application, the current network state includes the failure state of nodes. Step S14 includes: deleting nodes in the failure state from the initial network topology map and determining the target network topology map.

[0040] It's important to note that a fault state refers to the condition where a node (such as a router, switch, gateway, or execution device) is unable to forward data or respond to requests due to hardware damage, software crashes, power outages, network port failures, or other reasons. Fault state determination can be achieved by periodically sending probe packets or by using network management protocols to obtain device operating status. Once a node is marked as faulty, its corresponding node in the topology graph and all edges connected to it are considered unavailable. The node can be deleted, or the weights of its connected edges can be set to infinity to ensure that subsequent path planning does not traverse the faulty node.

[0041] Considering the possibility of nodes not having permission to access, in some embodiments of this application, the current network state includes the permission status of nodes. Step S14 includes: deleting nodes in the initial network topology diagram whose permission status indicates that the security agent does not have permission to access, and determining the target network topology diagram.

[0042] It's important to note that permission status refers to the attribute of a node (such as a router, switch, gateway, execution device, etc.) that determines which entities are allowed access based on its security domain or preset access control policies. Each node can be configured with one or more security labels (such as "core area," "isolation area," etc.), and the security agent itself has a specific access permission level. If a node's security label does not match the security agent's permissions, or if the node has set rules explicitly prohibiting the security agent's access, then the node's permission status is marked as "unauthorized access." Permission status can be determined by querying a pre-configured access control list or by calling a dynamic permission service. Once a node is determined to have unauthorized access, its corresponding node in the topology graph and all edges connected to it are considered unusable. The node can be deleted from the topology graph, or the weight of its associated edges can be set to infinity to ensure that subsequent path planning does not traverse the unauthorized node.

[0043] Considering that network link congestion can affect the real-time performance of command transmission, in some embodiments of this application, the current network state includes the bandwidth load rate between adjacent nodes. Step S14 includes: determining the weight of the edge between adjacent nodes based on the bandwidth load rate between adjacent nodes, and determining the target network topology based on the weight of the edge between adjacent nodes. The bandwidth load rate is positively correlated with the weight.

[0044] It should be noted that bandwidth load rate refers to the ratio of the currently used bandwidth to the total bandwidth on the link corresponding to the edge (which can be the larger value of the bandwidth load rate of the nodes at both ends of the link). The value ranges from 0 to 1 and can be calculated by collecting interface traffic data through the network management protocol. The higher the bandwidth load rate, the more congested the link is, and the greater the probability of packet transmission delay and packet loss. Therefore, the edge should be assigned a higher weight to guide subsequent path selection to avoid high-load edges.

[0045] For example, the calculation steps for edge weights include: first, calculating the product of a preset first weight coefficient and the bandwidth load rate; then, adding 1 to this product to obtain the weight. The first weight coefficient, a positive real number, is used to adjust the influence of the load rate on the weight and can be set according to the network's sensitivity to congestion. By positively correlating edge weights with the load rate, each edge in the target network topology has a dynamic weight reflecting the real-time network congestion level, enabling the shortest path algorithm to prioritize links with lower loads, reducing instruction transmission latency and packet loss risk.

[0046] Considering that the physical distance or logical hop count between nodes in the network topology will affect the transmission delay, in some embodiments of this application, the weight of the edge between adjacent nodes is determined based on the bandwidth load rate between adjacent nodes, including: determining the weight of the edge between adjacent nodes based on the bandwidth load rate and transmission distance between adjacent nodes, wherein the transmission distance is positively correlated with the weight.

[0047] It should be noted that transmission distance refers to the normalized value of the physical distance between two adjacent nodes, ranging from 0 to 1. This value can be obtained statistically from network topology configuration information (such as device deployment locations and fiber optic cable lengths). A higher transmission distance indicates more physical time required for data transmission and greater latency; therefore, a higher weight should be assigned to this edge to guide subsequent path selection to avoid long-distance links.

[0048] For example, the calculation steps for edge weights include: first, calculating the first product of a preset first weight coefficient and the bandwidth load rate, and the second product of a preset second weight coefficient and the transmission distance; then, adding the first product and the second product to 1 to obtain the weight. The first weight coefficient is used to adjust the influence of the load rate on the weight, and the second weight coefficient is used to adjust the influence of the transmission distance on the weight. Both are positive real numbers and can be set according to the actual network's sensitivity to congestion and latency; the more sensitive the network, the higher the corresponding weight coefficient. By simultaneously positively correlated edge weights with both load rate and transmission distance, each edge in the target network topology has a dynamic weight reflecting the real-time congestion level and static transmission cost. This allows the shortest path algorithm to prioritize links with lower load and shorter distances, further reducing the latency and packet loss risk of command transmission.

[0049] S15. Based on the shortest path algorithm, determine the candidate shortest paths from the security agent to each candidate execution device in the target network topology graph, select the candidate shortest path with the lowest cost, obtain the optimal forwarding path, and determine the candidate execution device corresponding to the optimal forwarding path as the target execution device. It should be noted that the candidate shortest path refers to the shortest path from the node where the secure agent resides to each of the candidate execution device nodes. Since these paths correspond to different candidate execution devices, and the final selection has not yet been determined, they are called candidate shortest paths. The shortest path algorithm is a classic algorithm used to calculate the minimum cost path from the source node to the target node in a weighted graph. This application may employ Dijkstra's algorithm or A-star algorithm. Conventional algorithms, such as the Algorithm 1, are based on the principle of starting from the node where the secure agent is located and using a greedy strategy (such as Dijkstra's algorithm) or a heuristic search (such as A) to search for the agent. The algorithm progressively expands the node with the shortest current distance, recording the current minimum weight from the starting point to each node and its predecessor node, until all candidate execution device nodes have been visited or the shortest path has been determined. This algorithm utilizes dynamically adjusted edge weights in the target network topology (incorporating factors such as bandwidth load, transmission distance, fault conditions, and permissions) to accumulate the total weight from the node where the security agent resides to each candidate execution device node, thus obtaining the total cost. The path with the minimum total cost is then selected as the optimal forwarding path, and the candidate execution device corresponding to the optimal forwarding path is determined as the target execution device.

[0050] S16: Based on the target execution device, the target operation object, and the target operation type, determine the machine instruction, and transmit the machine instruction to the target execution device for execution through the optimal forwarding path, so as to provide security protection for the target operation object.

[0051] In some embodiments of this application, step S16, which determines machine instructions based on the target execution device, the target operation object, and the target operation type, includes: extracting target interface information corresponding to the target execution device from the skill registry, and determining machine instructions based on the target interface information, the target operation object, and the target operation type.

[0052] It should be noted that machine instructions refer to one or more specific commands generated by a security intelligent agent based on the target operation type, the target operation object, and the interface information of the target execution device. These commands can be directly parsed and executed by the target execution device. Machine instructions typically contain structured information such as opcodes (e.g., "block" or "isolate"), operation parameters (e.g., target IP address, port, asset identifier), and execution conditions (e.g., duration, priority). The skill registry also stores the interface information corresponding to the execution device. Interface information refers to the set of technical parameters required to call the target execution device, including at least the communication protocol type, network address, access authentication method, and data format specification (e.g., JSON, XML). Among these, the data format specification is used to determine the encoding structure of the machine instructions, while the communication protocol type, network address, and access authentication method are used for transmission addressing and authentication after instruction encapsulation.

[0053] Specifically, step S16 includes: using the device identifier of the target execution device as the query key, retrieving the target interface information record corresponding to the target execution device in the skill registry; after extracting the target interface information, mapping the target operation type to the opcode field in the machine instruction and mapping the target operation object to the operation parameter field in the machine instruction according to the data format specifications recorded in the target interface information, generating one or more machine instructions that meet the interface requirements of the target execution device and can be directly parsed and executed by it; subsequently, according to the communication protocol type and network address recorded in the target interface information, encapsulating the machine instructions into data packets that meet the protocol requirements, authenticating them using an access authentication method, and transmitting them to the target execution device for execution through the optimal forwarding path, so as to provide security protection for the target operation object.

[0054] Compared with existing technologies, this application, on the one hand, automatically performs intent analysis after the user inputs natural language commands, parsing out the target operation type and target operation object, without requiring the user to learn or fill in structured API parameters. This effectively reduces the operational burden of manually converting semantics into parameter items and significantly improves the ease of use of the system. On the other hand, by acquiring an initial network topology map and sensing the current network status in real time (such as node failures, bandwidth load, etc.), this application can dynamically adjust the weights of nodes or edges in the graph when network devices on the original path fail or links are congested, thereby obtaining the target network topology map and guiding the shortest path algorithm to automatically bypass unavailable or congested links and select other reachable and smooth paths. This ensures that machine commands can be reliably transmitted to the target execution device for execution, effectively overcoming the problems of command transmission interruption or timeout caused by static pre-configuration of forwarding paths in existing technologies and their inability to adapt to dynamic network changes, thus significantly improving the reliability of the system.

[0055] To better implement the secure intelligent agent skill gateway invocation and execution method in the embodiments of this application, based on the secure intelligent agent skill gateway invocation and execution method, correspondingly, as follows: Figure 4 As shown in the embodiment of this application, a secure intelligent agent skill gateway invocation and execution system 20 is also provided, including: The intent analysis unit 21 is used to acquire the input natural language instruction data, perform intent analysis on the natural language instruction data, and obtain the target operation type and target operation object; The execution device determination unit 22 is used to obtain a skill registry and extract at least one candidate execution device from the skill registry based on the target operation object and the target operation type. The skill registry includes at least several operation objects, execution devices associated with each operation object, and operation types supported by each execution device. The network topology construction unit 23 is used to obtain an initial network topology graph, which includes several nodes and edges between adjacent nodes. The several nodes include at least a security agent and a candidate execution device. The unit obtains the current network state, corrects the weights of the nodes or edges in the initial network topology graph based on the current network state, and determines the target network topology graph. The path optimization unit 24 is used to determine the candidate shortest paths from the security agent to each candidate execution device in the target network topology based on the shortest path algorithm, select the candidate shortest path with the lowest cost, obtain the optimal forwarding path, and determine the candidate execution device corresponding to the optimal forwarding path as the target execution device. The instruction transmission and execution unit 25 is used to determine the machine instruction based on the target execution device, the target operation object, and the target operation type, and transmit the machine instruction to the target execution device for execution through the optimal forwarding path, so as to provide security protection for the target operation object.

[0056] The secure intelligent agent skill gateway invocation and execution system 20 provided in the above embodiments can implement the technical solutions described in the above embodiments of the secure intelligent agent skill gateway invocation and execution method. The specific implementation principles of each of the above units can be found in the corresponding content in the above embodiments of the secure intelligent agent skill gateway invocation and execution method, which will not be repeated here.

[0057] It should be noted that, in this document, the terms "comprising," "including," and any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Specific examples have been used in this document to illustrate the principles and implementation methods of the technical solutions of this application. The above examples are only for the purpose of helping to understand the methods and core ideas of this application. The above descriptions are merely preferred embodiments of this application. It should be pointed out that, due to the limitations of written expression and the objective existence of infinite specific structures, those skilled in the art can make several improvements, modifications, or changes without departing from the principles of this application, and can also combine the above technical features in an appropriate manner; these improvements, modifications, changes, or combinations, or the direct application of the concept and technical solutions of this application to other situations without modification, should all be considered within the scope of protection of this application.

Claims

1. A method for invoking and executing a secure intelligent agent skill gateway, characterized in that, include: The system acquires input natural language instruction data, performs intent analysis on the natural language instruction data, and obtains the target operation type and target operation object. Obtain a skill registry; based on the target operation object and the target operation type, extract at least one candidate execution device from the skill registry; the skill registry includes at least several operation objects, execution devices associated with each operation object, and operation types supported by each execution device. Obtain an initial network topology graph, which includes several nodes and edges between adjacent nodes, wherein the several nodes include at least a security agent and the candidate execution device; Obtain the current network state, and based on the current network state, modify the weights of nodes or edges in the initial network topology graph to determine the target network topology graph; Based on the shortest path algorithm, candidate shortest paths from the security agent to each candidate execution device are determined in the target network topology. The candidate shortest path with the lowest cost is selected to obtain the optimal forwarding path. The candidate execution device corresponding to the optimal forwarding path is determined as the target execution device. Based on the target execution device, the target operation object, and the target operation type, machine instructions are determined, and the machine instructions are transmitted to the target execution device for execution through the optimal forwarding path to provide security protection for the target operation object.

2. The secure intelligent agent skill gateway invocation and execution method according to claim 1, characterized in that, Intent analysis is performed on the natural language instruction data to obtain the target operation type and target operation object, including: A word segmenter is used to segment the natural language instruction data to obtain segmented data. The segmented data is matched with a preset operation type library to obtain the target operation type, and the segmented data is matched with a preset operation object library to obtain the target operation object.

3. The secure intelligent agent skill gateway invocation and execution method according to claim 2, characterized in that, The word segmentation data includes words and their corresponding part-of-speech tags. The part-of-speech tags include at least verbs and nouns. The operation type library includes several standard operation types and a first set of keywords associated with each standard operation type. The operation object library includes several standard operation objects and a second set of keywords associated with each standard operation object. The segmented data is matched with a preset operation type library to obtain the target operation type, and the segmented data is matched with a preset operation object library to obtain the target operation object, including: Each word in the segmented data and its corresponding part-of-speech tag are sequentially traversed. Words tagged as verbs are matched with the first keyword set. The standard operation type corresponding to the first keyword set that is successfully matched is determined as the target operation type. Words tagged as nouns are matched with the second keyword set. The standard operation object corresponding to the second keyword set that is successfully matched is determined as the target operation object.

4. The secure intelligent agent skill gateway invocation and execution method according to claim 1, characterized in that, Based on the target operation object and the target operation type, at least one candidate execution device is extracted from the skill registry, including: Obtain the skill registry and extract the list of initial execution devices associated with the target operation object from the skill registry; Extract at least one candidate execution device that supports the target operation type from the initial execution device list.

5. The secure intelligent agent skill gateway invocation and execution method according to claim 1, characterized in that, The current network status includes the fault status of nodes; Based on the current network state, the weights of nodes or edges in the initial network topology are adjusted to determine the target network topology, including: Delete the nodes in the faulty state in the initial network topology graph to determine the target network topology graph.

6. The secure intelligent agent skill gateway invocation and execution method according to claim 1, characterized in that, The current network status includes the permission status of the nodes; Based on the current network state, the weights of nodes or edges in the initial network topology are adjusted to determine the target network topology, including: Delete the nodes in the initial network topology diagram that indicate the security agent has no permission to access, and determine the target network topology diagram.

7. The secure intelligent agent skill gateway invocation and execution method according to claim 1, characterized in that, The current network status includes the bandwidth load rate between adjacent nodes; Based on the current network state, the weights of nodes or edges in the initial network topology are adjusted to determine the target network topology, including: Based on the bandwidth load rate between adjacent nodes, the weight of the edge between adjacent nodes is determined, and based on the weight of the edge between adjacent nodes, the target network topology is determined. The bandwidth load rate is positively correlated with the weight.

8. The secure intelligent agent skill gateway invocation and execution method according to claim 7, characterized in that, The current network status also includes the transmission distance between adjacent nodes; The weights of edges between adjacent nodes are determined based on the bandwidth load rate between adjacent nodes, including: The weights of edges between adjacent nodes are determined based on the bandwidth load rate and transmission distance between adjacent nodes, and the transmission distance is positively correlated with the weights.

9. The secure intelligent agent skill gateway invocation and execution method according to claim 1, characterized in that, The skill registry also includes interface information for the types of operations supported by the device. Based on the target execution device, the target operation object, and the target operation type, machine instructions are determined, including: The target interface information corresponding to the target execution device is extracted from the skill registry. Based on the target interface information, the target operation object, and the target operation type, machine instructions are determined.

10. A secure intelligent agent skill gateway invocation and execution system, characterized in that, include: The intent analysis unit is used to acquire input natural language instruction data, perform intent analysis on the natural language instruction data, and obtain the target operation type and target operation object. An execution device determination unit is configured to acquire a skill registry and extract at least one candidate execution device from the skill registry based on the target operation object and the target operation type. The skill registry includes at least several operation objects, execution devices associated with each operation object, and operation types supported by each execution device. A network topology construction unit is used to obtain an initial network topology graph, which includes several nodes and edges between adjacent nodes. The several nodes include at least a security agent and the candidate execution device. The unit obtains the current network state, corrects the weights of nodes or edges in the initial network topology graph based on the current network state, and determines the target network topology graph. The path optimization unit is used to determine the candidate shortest paths from the security agent to each candidate execution device in the target network topology based on the shortest path algorithm, select the candidate shortest path with the lowest cost to obtain the optimal forwarding path, and determine the candidate execution device corresponding to the optimal forwarding path as the target execution device. The instruction transmission and execution unit is used to determine machine instructions based on the target execution device, the target operation object, and the target operation type, and transmit the machine instructions to the target execution device for execution through the optimal forwarding path, so as to provide security protection for the target operation object.

Images