Automatic attack analysis method and device based on multi-agent deep collaboration and storage medium

Abstract

The application discloses a kind of automatic attack analysis method, equipment and storage medium based on multi-agent deep collaboration, it is related to network security technical field, the method comprises the following steps: receiving attack analysis task submitted by user;Intention recognition is carried out to attack analysis task, generates task scheduling strategy to distribute attack analysis task to at least one vertical field agent;Attack behavior analysis is carried out to attack analysis task by each vertical field agent in corresponding dimension respectively, and the analysis result of each vertical field agent is output;Multi-source data fusion and correlation analysis are carried out to each analysis result, attack correlation graph is constructed, and attack causal evidence chain is deduced based on attack correlation graph;Attack analysis report is generated according to attack causal evidence chain.The application carries out intention recognition and intelligent scheduling to attack analysis task by multi-agent deep collaboration, realizes the automation and high efficiency of attack analysis, significantly improves the analysis efficiency and accuracy of security event.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an automated attack analysis method, device and storage medium based on deep multi-agent collaboration. Background Technology

[0002] In cybersecurity incident analysis, security logs in production environments are scattered across independent components such as firewalls, web servers, application containers, and database auditing, with inconsistent timestamps, session identifiers, and field naming rules across these data sources. Attacks often involve multi-layered component interactions, requiring analysts to manually extract logs across systems and perform manual time-series alignment and field matching to reconstruct attack paths. Because logs from different components lack a unified association identifier, manual processing makes it difficult to automatically merge and sort multi-source alerts and audit data within the emergency response window, resulting in a lack of automated correlation analysis capabilities for cross-data source security incidents.

[0003] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0004] The main purpose of this application is to provide an automated attack analysis method, device and storage medium based on deep multi-agent collaboration, which aims to solve the technical problems of attack analysis relying on manual cross-source log correlation, resulting in low response efficiency and difficulty in dealing with complex attacks.

[0005] To achieve the above objectives, embodiments of this application provide an automated attack analysis method based on deep multi-agent collaboration, the automated attack analysis method based on deep multi-agent collaboration comprising: Receive attack analysis tasks submitted by users; The attack analysis task is subjected to intent identification, a task scheduling policy is generated, and the attack analysis task is distributed to at least one vertical domain Agent according to the task scheduling policy. Each of the vertical domain agents performs attack behavior analysis on the attack analysis task in its respective dimension, and outputs the analysis results of each vertical domain agent. The analysis results of each vertical domain agent are subjected to multi-source data fusion and correlation analysis to construct an attack correlation graph, and the attack causal evidence chain is deduced based on the attack correlation graph. An attack analysis report is generated based on the aforementioned causal evidence chain of the attack.

[0006] In one embodiment, the step of performing intent identification on the attack analysis task, generating a task scheduling policy, and distributing the attack analysis task to at least one vertical domain Agent according to the task scheduling policy includes: The attack analysis task is semantically parsed by the central control agent to extract entity information and contextual features from the attack analysis task; The entity information and the context features are input into a large language model for semantic reasoning to generate a preliminary scheduling scheme. The preliminary scheduling scheme includes a combination of candidate vertical domain agents and a priority ranking of each candidate vertical domain agent in the combination of candidate vertical domain agents. The preliminary scheduling scheme is double-verified by a rules engine. The double verification includes: static constraint verification based on the current availability status and task dependency relationship of each candidate vertical domain Agent, and dynamic risk verification based on the risk level of the entity information. The preliminary scheduling scheme is compared with the verification result of the dual verification: If the comparison results are consistent, the candidate vertical domain agent combination is determined as the target vertical domain agent combination, and the task scheduling strategy is generated according to the preliminary scheduling scheme. The task scheduling strategy includes the target vertical domain agent combination and the priority order of each vertical domain agent in the target vertical domain agent combination. If the comparison results are inconsistent, the preliminary scheduling scheme will be modified according to the hard constraints of the rule engine, or a manual review process will be triggered. According to the task scheduling strategy, the attack analysis task is distributed to each vertical agent in the target vertical agent combination, and corresponding entity information is injected into each vertical agent as analysis parameters.

[0007] In one embodiment, the step of modifying the initial scheduling scheme based on the hard constraints of the rule engine includes: Remove candidate vertical domain agents that fail the static constraint verification from the preliminary scheduling scheme; Based on the list of available vertical domain agents output by the rule engine, determine the available vertical domain agents that match the functions of the deleted candidate vertical domain agents, and add the available vertical domain agents to the sorting position of the deleted candidate vertical domain agents in the candidate vertical domain agent combination to generate a corrected scheduling scheme. The double verification is performed again on the revised scheduling scheme until all candidate vertical domain agents in the revised scheduling scheme pass the double verification, or the number of retries reaches a preset threshold. If, after the number of retries reaches the preset threshold, there are still candidate vertical domain agents in the corrected scheduling scheme that have failed the dual verification, then a manual review process is triggered.

[0008] In one embodiment, the step of performing attack behavior analysis on the attack analysis task according to corresponding dimensions using each of the vertical domain agents and outputting the analysis results of each of the vertical domain agents includes: During the attack behavior analysis of the corresponding dimension, each vertical domain agent outputs intermediate state data in real time. The intermediate state data includes risk feature vectors, behavior sequence fragments, and confidence scores. The intermediate state data output by each of the vertical domain agents are exchanged and shared in real time. When any of the vertical domain agents identifies a potential risk feature based on the intermediate state data, the potential risk feature is converted into a dynamic constraint condition in a preset format, and the dynamic constraint condition is injected into the input context of other vertical domain agents associated with the potential risk feature. Upon receiving the dynamic constraints, the vertical domain agent adjusts the detection threshold or expands the analysis dimensions according to the dynamic constraints, and outputs the analysis results after completing the attack behavior analysis of the corresponding dimensions.

[0009] In one embodiment, the step of performing multi-source data fusion and correlation analysis on the analysis results of each of the vertical domain agents to construct an attack correlation graph includes: By comprehensively analyzing the Agent, we obtain the analysis results output by each of the vertical domain Agents and the intermediate state data shared in real time by each of the vertical domain Agents during the analysis process. Extract the risk entities and associated attributes from the analysis results and the intermediate state data, using the attack IP, user ID and session ID as the core entity keys, and map each extracted risk entity to the corresponding entity node to generate an initial attack association graph. According to the dynamic weighting rules of entity relationships, the weights of the association edges between each entity node in the initial attack association graph are adjusted to obtain the weighted attack association graph, wherein the weights are calculated based on the historical violation frequency, attack intensity and time decay factor of the corresponding risk entity. When there are link breaks in the weighted attack association graph, matching association information is retrieved from the security knowledge base based on the context information of the link breaks, and missing entity nodes and corresponding association edges are generated based on the retrieval results. The missing entity node and its corresponding associated edge are injected into the weighted attack association graph to obtain the attack association graph.

[0010] In one embodiment, the step of deducing the causal evidence chain of the attack based on the attack correlation graph includes: The attack behavior sequence of each entity node in the attack association graph and the connection relationship of each associated edge are obtained. Based on the attack behavior sequence and the connection relationship, the historical attack pattern library is matched to locate the attack entry entity node, intermediate stepping entity node and business impact entity node, and generate candidate attack causal chain. Based on the type of each attack behavior and the attribute information of the entity nodes in the candidate attack causal chain, matching reference cases and verification rules are retrieved from the security knowledge base. Based on the reference cases and the verification rules, the association relationship of each hop in the candidate attack causal chain is verified, entity nodes and associated edges that fail the verification are deleted, and the candidate attack causal chain is updated. Based on the weights of each entity node and associated edge in the attack association graph, the confidence level of each attack path in the updated candidate attack causal chain is calculated, and attack paths with confidence levels lower than a preset confidence threshold are deleted to obtain the target attack causal chain. For each hop in the target attack causal chain, the analysis results output by the corresponding vertical domain agent and the retrieved reference cases are bound together to generate a verifiable chain of attack causal evidence.

[0011] In one embodiment, the step of generating an attack analysis report based on the attack causal evidence chain includes: The report generates an agent that retrieves matching defense solutions from a security knowledge base based on the attack causal evidence chain. Obtain the current business context information, and adjust the execution strength level of the defense scheme according to the business context information; Based on the adjusted defense scheme, generate defense strategy code; The attack analysis report is generated based on the attack causal evidence chain and the defense strategy code. The attack analysis report includes attack analysis conclusions, defense recommendations, implementation steps, verification methods, and rollback schemes.

[0012] In one embodiment, the vertical domain agent includes a high-frequency analysis agent, a credential stuffing analysis agent, an abnormal user analysis agent, a user journey analysis agent, and a user rights analysis agent.

[0013] This application embodiment also provides an automated attack analysis device based on multi-agent deep collaboration. The automated attack analysis device based on multi-agent deep collaboration includes: a memory, a processor, and a computer program stored in the memory and executable on the processor. The computer program is configured to implement the steps of the automated attack analysis method based on multi-agent deep collaboration as described above.

[0014] This application embodiment also provides a storage medium, which is a computer-readable storage medium, and stores a computer program on the storage medium. When the computer program is executed by a processor, it implements the steps of the automatic attack analysis method based on multi-agent deep collaboration as described above.

[0015] One or more technical solutions proposed in this application have at least the following technical effects: This application, upon receiving user-submitted attack analysis tasks, automatically triggers a complete process of intent recognition, task distribution, multi-agent parallel analysis, and report generation. This changes the traditional passive response mode of manually viewing logs and switching between multiple tools, allowing the attack analysis process to proceed automatically without human intervention. Specifically, by performing intent recognition on the received tasks to generate a task scheduling strategy, and distributing the attack analysis tasks to at least one vertical domain agent according to this strategy, different types of attack analysis tasks can be accurately assigned to agents with corresponding analysis capabilities. This avoids the problems of insufficient analysis accuracy and low processing efficiency caused by having a single analysis module handle all analysis tasks. Each vertical domain agent performs attack behavior analysis on the corresponding dimensions of the attack analysis tasks and outputs analysis results, allowing different types of attack behaviors to be analyzed in parallel by their respective vertical domain agents. This avoids the deficiency of a single analysis module being unable to cover multi-dimensional attack characteristics due to its limited analytical perspective. Furthermore, by performing multi-source data fusion and correlation analysis on the analysis results output by each vertical domain agent... By constructing an attack correlation graph and deducing the causal evidence chain of the attack based on this graph, fragmented analysis evidence originally scattered across agents in different vertical domains can be automatically correlated and aggregated. This fills the blind spots in correlation that are difficult to cover when each agent in a vertical domain analyzes independently, thereby reconstructing the complete attack path and attack logic. By automatically generating attack analysis reports based on the causal evidence chain of the attack, the entire process from task submission to report output does not require manual writing of analysis documents. This completely eliminates the dependence of attack analysis on the experience of professional personnel and the problems of inconsistent analysis quality and excessive time consumption caused by manual report writing. Ultimately, it achieves end-to-end automated attack analysis from user submission of attack analysis tasks to automatic output of attack analysis reports, significantly improving the response speed of security incidents and the accuracy and standardization of attack analysis. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating an embodiment of the automated attack analysis method based on deep multi-agent collaboration in this application. Figure 2 This is a schematic diagram of the implementation process of the master control agent provided in Embodiment 1 of the automated attack analysis method based on deep multi-agent collaboration in this application; Figure 3 This is a schematic diagram of the implementation process of the high-frequency analysis agent provided in Embodiment 1 of the automatic attack analysis method based on deep multi-agent collaboration of this application; Figure 4 This is a schematic diagram illustrating the implementation process of the credential stuffing analysis agent provided in Embodiment 1 of the automated attack analysis method based on deep multi-agent collaboration of this application; Figure 5 This is a schematic diagram of the implementation process of the abnormal user analysis agent provided in Embodiment 1 of the automatic attack analysis method based on deep multi-agent collaboration of this application; Figure 6 This is a schematic diagram of the implementation process of the user journey analysis agent provided in Embodiment 1 of the automated attack analysis method based on deep multi-agent collaboration of this application; Figure 7 This is a schematic diagram of the implementation process of the user rights analysis agent provided in Embodiment 1 of the automated attack analysis method based on deep multi-agent collaboration in this application; Figure 8 This is a schematic diagram of the system architecture provided in Embodiment 2 of the automated attack analysis method based on deep multi-agent collaboration in this application; Figure 9 This is a schematic diagram of the hardware operating environment of the automated attack analysis device based on multi-agent deep collaboration, which is involved in the automated attack analysis method based on multi-agent deep collaboration in the embodiments of this application.

[0017] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0018] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0019] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0020] In real-world production environments for cybersecurity incident analysis, security logs are typically stored across independent components such as firewalls, web servers, application containers, database auditing systems, and business systems. These data sources are not only isolated in their storage locations, but also lack uniformity in timestamp formats, session identifier generation rules, and field naming conventions. Attacks often involve coordinated operations across multiple layers of components. When encountering a security incident, analysts need to manually extract log data from these components across systems and perform time-series alignment and field matching manually to reconstruct a relatively complete attack path. However, due to the lack of unified correlation identifiers between logs from different components, alert data, access records, and audit information generated by attack behavior are fragmented in terms of their source, resulting in a long-standing lack of automated correlation analysis capabilities for cross-data source security incidents.

[0021] Specifically, current attack analysis in production environments suffers from the following main shortcomings: First, the analysis process is cumbersome and inefficient. When faced with attack alerts, developers typically need to switch back and forth between different monitoring platforms, log systems, and operation and maintenance tools, and may even need to enter the data center to directly examine the original log files. This entire process not only consumes a lot of manpower but also seriously affects the timeliness of security incident response. In the face of sudden security incidents, manual analysis often takes several hours or even days to complete the initial attribution, which is difficult to meet the basic requirement of rapid response in emergency handling.

[0022] Second, the data correlation complexity is high. The siloed distribution of data among various security platforms and log systems makes the correlation logic extremely complex. Developers need to manually correlate heterogeneous data from multiple dimensions, such as the network layer, application layer, and business layer, across platforms. This operation is lengthy and prone to errors. When manually performing cross-source correlation, it is not only necessary to deal with time deviations and field mapping issues between different data sources, but also often misses key evidence due to the large amount of data, making it difficult to comprehensively cover all dimensions involved in the attack event.

[0023] Third, attack analysis heavily relies on expert experience. As attack technologies evolve rapidly and intelligently, AI-driven attack methods are constantly emerging, and the speed at which attack patterns change is significantly faster than the speed at which R&D personnel update their professional knowledge. Traditional rule-based analysis methods often have blind spots when facing new attack methods, while analysts need a long learning period to understand and accumulate knowledge of new attack patterns. This results in a lag between attack analysis capabilities and the evolution of attack technologies.

[0024] Fourth, generating analysis reports is difficult. After the attack analysis is completed manually, the analysis process and conclusions need to be compiled into a professional analysis report. This step is time-consuming and of inconsistent quality. Reports written by different analysts vary greatly in structure, level of detail, and expression of conclusions, making it difficult to form standardized analysis outputs. This also makes it difficult to accumulate experience and reuse cases.

[0025] In view of the above problems, this application proposes an automated attack analysis method based on deep multi-agent collaboration. The method includes: receiving an attack analysis task submitted by a user; performing intent identification on the attack analysis task, generating a task scheduling policy, and distributing the attack analysis task to at least one vertical domain agent according to the task scheduling policy; performing attack behavior analysis on the attack analysis task in a corresponding dimension through each vertical domain agent, and outputting the analysis results of each vertical domain agent; performing multi-source data fusion and correlation analysis on the analysis results of each vertical domain agent, constructing an attack correlation graph, and inferring the attack causal evidence chain based on the attack correlation graph; and generating an attack analysis report based on the attack causal evidence chain.

[0026] This application provides a solution that, upon receiving user-submitted attack analysis tasks, automatically triggers a complete process of intent recognition, task distribution, multi-agent parallel analysis, and report generation. This changes the traditional passive response mode of manually viewing logs and switching between multiple tools, allowing the attack analysis process to proceed automatically without human intervention. Specifically, by performing intent recognition on the received tasks to be analyzed to generate a task scheduling strategy, and distributing the attack analysis tasks to at least one vertical domain agent according to this strategy, different types of attack analysis tasks can be accurately assigned to agents with corresponding analysis capabilities for processing. This avoids the problems of insufficient analysis accuracy and low processing efficiency caused by having a single analysis module handle all analysis tasks. Each vertical domain agent performs attack behavior analysis on the attack analysis tasks according to their respective dimensions and outputs analysis results, allowing different types of attack behaviors to be analyzed in parallel by their corresponding vertical domain agents. This avoids the deficiency of a single analysis module being unable to cover multi-dimensional attack characteristics due to its limited analytical perspective. Furthermore, by performing multi-source data fusion and correlation analysis on the analysis results output by each vertical domain agent... By constructing an attack correlation graph and deducing the causal evidence chain of the attack based on this graph, fragmented analysis evidence originally scattered across agents in different vertical domains can be automatically correlated and aggregated. This fills the blind spots in correlation that are difficult to cover when each agent in a vertical domain analyzes independently, thereby reconstructing the complete attack path and attack logic. By automatically generating attack analysis reports based on the causal evidence chain of the attack, the entire process from task submission to report output does not require manual writing of analysis documents. This completely eliminates the dependence of attack analysis on the experience of professional personnel and the problems of inconsistent analysis quality and excessive time consumption caused by manual report writing. Ultimately, it achieves end-to-end automated attack analysis from user submission of attack analysis tasks to automatic output of attack analysis reports, significantly improving the response speed of security incidents and the accuracy and standardization of attack analysis.

[0027] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a personal computer, server, or distributed computing platform, or an electronic device capable of performing the above functions, an automated attack analysis device or system based on deep multi-agent collaboration, etc. The following description uses an automated attack analysis system based on deep multi-agent collaboration as an example to illustrate this embodiment and the subsequent embodiments.

[0028] The first embodiment of the automated attack analysis method based on deep multi-agent collaboration proposed in this application is described in reference to... Figure 1 The method includes steps S10 to S50: Step S10: Receive the attack analysis task submitted by the user.

[0029] In this embodiment, the attack analysis task is an analysis request submitted by the user in a security operation scenario for a specific network security event or suspicious behavior. It is the core trigger carrier that drives subsequent multi-agent collaborative analysis. It usually includes basic attributes such as attack IP, timestamp, affected assets, alarm source identifier and initial risk level. The above attributes will serve as the core reference for the subsequent scheduling of vertical domain agents by the central control agent.

[0030] Attack analysis tasks are triggered in two ways: manual submission and automatic triggering by the monitoring system. In the manual submission scenario, users can directly paste the description text of the attack alert or log fragments. The system will automatically extract key entities such as the source IP, request path, and abnormal status code through the log parsing engine and align them with the system's standard timestamp. Users can also directly select preset analysis templates to initiate tasks. Templates include high-frequency attack analysis templates, credential stuffing attack analysis templates, and abnormal user analysis templates. Each template has pre-configured corresponding analysis dimensions and Agent scheduling rules.

[0031] In addition, the system can perform pre-verification on submitted attack analysis tasks, verifying core required fields such as attack IP, time window, and alarm source. If any item is missing, the user will be prompted to complete it. After the verification is passed, the attack analysis task will be pushed to the processing queue of the central control agent.

[0032] In automatically triggered scenarios, the system pre-connects to external monitoring systems such as Web Application Firewall (WAF), Intrusion Detection System (IDS), and business risk control engine via API interfaces. The built-in alarm module serves as a unified access middleware for these systems, pre-aligning the log formats and alarm field specifications of each system. This allows it to convert heterogeneous alarms from different sources into a standardized task format that the system can recognize. When the detection metrics of the external monitoring system or alarm module reach a preset alarm threshold, a standardized attack analysis task containing core attributes is automatically generated and pushed to the system without manual intervention.

[0033] As an example, when the connected WAF detects that an IP address has failed to access the login interface 50 times within 5 minutes, exceeding the preset threshold of 10 times / minute for credential stuffing attacks, the alarm module automatically generates an attack analysis task and pushes it to this system. The task includes the IP address, abnormal time window, trigger rule ID, number of failures, initial medium-risk level, and alarm type identifier. After receiving the task, the central control agent automatically tags it with "credential stuffing attack - pending scheduling," triggering the subsequent analysis process.

[0034] Step S20: Perform intent identification on the attack analysis task, generate a task scheduling policy, and distribute the attack analysis task to at least one vertical domain Agent according to the task scheduling policy.

[0035] User-submitted attack analysis tasks typically exist in the form of natural language descriptions or structured alerts. Before executing specific attack behavior analysis, the system needs to understand the semantic meaning of the task, extract the analysis objectives and dimensions that the user is concerned with, and then decide which domain agents to call to collaboratively complete the analysis based on the understanding results. This step is executed by the central control agent, whose core function is to transform unstructured attack analysis tasks into structured, executable task scheduling strategies.

[0036] In this embodiment, after receiving the attack analysis task, the central control agent first performs semantic parsing on the task to extract entity information and contextual features. Entity information refers to the object identifiers explicitly mentioned in the task that are directly related to the attack event, such as the attacking IP address, the attacked user ID, session identifier, or device fingerprint. This information will serve as the core retrieval conditions for subsequent analysis by each domain agent. Contextual features refer to auxiliary information describing the attributes and environment of the attack event, such as the time range of the attack, request frequency, involved interface paths, or error code distribution. This information helps each agent determine the time boundaries and focus of data queries during analysis.

[0037] The master control agent inputs the extracted entity information and contextual features into the Large Language Model (LLM) for semantic reasoning. Based on its understanding of the task text, the LLM generates a preliminary scheduling plan. This preliminary scheduling plan includes the candidate vertical domain agent combinations to be scheduled and the priority ranking of each candidate vertical domain agent within the combination. The candidate vertical domain agent combination is a set of agents that the LLM infers based on attack type keywords (such as "login anomaly," "high-frequency access," and "coupon hunting") and entity attributes in the task, and that may participate in this analysis; the priority ranking indicates the importance of each candidate vertical domain agent in this analysis or the suggested execution order.

[0038] As an example, see reference Figure 2 , Figure 2A schematic diagram of the implementation process of the central control agent is provided. The central control agent maintains task data in the task management module and continuously monitors the running status of each vertical domain agent. When an attack analysis task is received, the central control agent executes the main process: first, it performs intent recognition and semantic understanding on the attack analysis task to generate a preliminary scheduling plan; then, it triggers the corresponding vertical domain agent to execute the analysis task according to the scheduling plan. During the execution of each vertical domain agent, the central control agent continuously receives the status data returned by each agent through the status monitoring module and updates the task status until all distributed analysis tasks are completed.

[0039] Because the scheduling scheme generated by the large language model may contain illusions or deviate from the actual system state—for example, scheduling an Agent whose current service is unavailable, or scheduling a combination of Agents with conflicting data dependencies—the control Agent needs to perform double verification on the initial scheduling scheme through the rule engine. The rule engine pre-configures two types of verification logic: static constraint verification checks the current availability of each candidate vertical domain Agent and whether the task dependencies between Agents are satisfied. For example, if the analysis input of one Agent depends on the output of another Agent, both must be scheduled simultaneously and their execution order must be guaranteed. Dynamic risk verification determines whether the current scheduling scheme matches the risk profile based on the risk level of the entity information extracted from the attack analysis task. For example, when an attacking IP hits a historical blacklist, dynamic risk verification tends to increase the priority of the analysis Agents associated with that IP.

[0040] The central control agent compares the preliminary scheduling plan with the results of the dual verification: if the comparison results are consistent, it indicates that the scheduling plan of the large language model satisfies the static constraints, and the priority order of each agent matches the dynamic risk verification results, indicating that the plan is feasible at the system level. At this point, the candidate vertical domain agent combination is determined as the target vertical domain agent combination, and the central control agent generates the final task scheduling strategy based on the preliminary scheduling plan. This task scheduling strategy includes the target vertical domain agent combination and the priority order of each vertical domain agent in the combination. If the comparison results are inconsistent, it indicates that the scheduling plan generated by the large language model has infeasible items. The central control agent modifies the preliminary scheduling plan according to the hard constraints of the rule engine, or triggers a manual review process.

[0041] It's important to note that the hard constraints of the rule engine primarily stem from static constraint validation and security compliance requirements. Static constraint validation checks the availability and task dependencies of candidate vertical domain agents, while security compliance requirements cover security red lines such as data residency policies, access control for sensitive information, and execution permissions for high-risk operations. If any of these hard constraints is not met, that constraint has veto power; regardless of the large language model's recommendation, the relevant agent cannot be included in the scheduling scheme. The results of dynamic risk validation, on the other hand, participate in the decision-making process as soft constraints, adjusting the priority ranking of each agent without affecting the feasibility of the scheduling scheme. Furthermore, for scenarios where the comparison results are consistent but the large language model's own judgment requires expert intervention—for example, when the large language model has low confidence in the task's semantic understanding, or when the task involves novel attack patterns and there are insufficient reference cases—the system automatically escalates to a manual review process to ensure the reliability of analysis in high-risk or low-confidence scenarios.

[0042] After the task scheduling strategy is generated, the central control agent distributes the attack analysis task to each vertical agent in the target vertical agent combination according to the strategy, and injects the corresponding entity information into each vertical agent as analysis parameters, so that each agent can directly use these parameters to perform targeted data queries and feature extraction when performing analysis, without having to repeatedly parse the original task text.

[0043] As an optional implementation, the central control agent can also check the load status of each candidate vertical domain agent during static constraint verification. If the number of tasks in the processing queue of a certain agent exceeds the preset concurrency limit, the rule engine can mark it as temporarily unschedulable even if the agent is alive and the dependencies are satisfied. The engine will also suggest in the verification results that the large language model regenerate a scheduling scheme that excludes the agent to avoid affecting the overall analysis efficiency due to single-point overload.

[0044] As an alternative implementation, when the comparison results are inconsistent and a correction process is triggered, the central control agent adopts a progressive correction strategy: First, candidate vertical domain agents that failed the static constraint verification in the initial scheduling plan are deleted. Based on the list of available vertical domain agents output by the rule engine, available vertical domain agents with functions matching the deleted candidate vertical domain agents are determined. Then, the available vertical domain agents with similar functions are added to the original sorting position of the deleted candidate vertical domain agents in the candidate vertical domain agent combination. At the same time, the priority ranking of the corresponding candidate vertical domain agents in the initial scheduling plan is adjusted according to the entity risk level of the candidate vertical domain agents that failed the dynamic risk verification. Based on the above deletion and priority adjustment results, a corrected scheduling plan is generated, and the corrected scheduling plan is double-verified again until the verification passes or the number of retries reaches a preset threshold. If the verification still fails after the number of retries reaches the preset threshold, a manual review process is triggered. Through the above progressive correction and retry closed loop, the system can automatically complete the correction of the scheduling plan as much as possible without introducing manual intervention while avoiding infinite loops.

[0045] Step S30: Analyze the attack behavior of the attack analysis task in the corresponding dimension through each of the vertical domain agents, and output the analysis results of each vertical domain agent.

[0046] Once the attack analysis task is distributed, each vertical domain agent immediately initiates its own analysis process. At the architectural level, each vertical domain agent is an independent analysis unit; each agent focuses only on the attack dimension corresponding to its function and can begin execution without waiting for the analysis results of other agents. This parallel architecture enables the system to simultaneously profile security events from multiple dimensions, including high-frequency attacks, credential stuffing attacks, abnormal users, user journey analysis, and user rights analysis, significantly reducing the overall analysis time.

[0047] In this embodiment, after receiving the analysis parameters injected by the central control agent, each vertical domain agent queries and aggregates relevant data from its corresponding data source and executes its own analysis logic. The vertical domain agents include high-frequency analysis agents, credential stuffing analysis agents, abnormal user analysis agents, user journey analysis agents, and user rights analysis agents.

[0048] Among them, the high-frequency analysis agent is responsible for identifying high-frequency attack behaviors such as API brute-force calls and large-scale scanning. Through a sliding window mechanism, it counts the access frequency of target URLs from dimensions such as IP, user, and device fingerprints, and combines the statistical data with the model to comprehensively evaluate the statistical data to determine whether a high-frequency attack exists.

[0049] As an example, see reference Figure 3 , Figure 3 A schematic diagram of the implementation process of the high-frequency analysis agent is provided. After receiving the analysis parameters injected by the central control agent, the high-frequency analysis agent obtains log data within a specified time range from the full access log data source. The feature extraction engine extracts key fields such as IP, user identifier, and device fingerprint from the logs as analysis dimensions. Then, through the multi-dimensional sliding window frequency analysis module, the access frequency under each dimension is statistically analyzed. Next, the high-frequency analysis engine inputs the frequency statistics of each dimension into the large model evaluation module. The large model combines preset trigger thresholds to comprehensively evaluate the anomaly degree of each dimension. When the evaluation result determines that high-frequency access behavior exists, a high-frequency attack event report is output, and the high-frequency attack list database is updated synchronously.

[0050] The credential stuffing analysis agent is a core component of the system focused on identity security. It is mainly used to analyze bulk login behavior targeting the system and identify black and gray market attacks. It uses three indicators—login failure rate, account traversal rate, and the clustering degree of IP, account, and device fingerprints—combined with a weighted risk scoring model to comprehensively determine whether it is a credential stuffing attack.

[0051] As an example, see reference Figure 4 , Figure 4 A schematic diagram of the implementation process of the credential stuffing attack analysis agent is provided. After receiving the analysis parameters injected by the central control agent, the credential stuffing attack analysis agent retrieves login logs within a specified time range from the login interface log data source, extracting key fields such as IP, account, device fingerprint, and login result from the logs. Then, the multi-dimensional indicator calculation module of the credential stuffing attack analysis engine calculates the login failure rate, account traversal rate, and the clustering degree of IP, account, and device fingerprint respectively. Next, the above three indicators are input into the weighted risk scoring model, and a risk score is calculated comprehensively according to the preset weights of each indicator. When the comprehensive risk score reaches the judgment threshold, a credential stuffing attack event report is output, and the credential stuffing attack list is updated synchronously.

[0052] The abnormal user analysis agent identifies abnormal users through feature engineering and a three-order progressive detection pipeline. Specifically, it includes real-time processing of log streams, encoding user discrete behaviors and contexts into structured feature vectors after cleaning, window aggregation, and feature calculation. Then, it uses K-means clustering to quickly group all users to screen potential abnormal groups, the Isolation Forest algorithm to accurately locate statistical outliers within the candidate groups, and a large language model to perform high-level semantic analysis and context judgment on suspicious entities, achieving a deep perception of abnormal users from numerical anomalies to behavioral intent anomalies.

[0053] As an example, see reference Figure 5 , Figure 5A schematic diagram of the implementation process of the anomaly user analysis agent is provided. After receiving the analysis parameters injected by the central control agent, the anomaly user analysis agent uses user log traffic as input data in real time. The data processing and feature engineering module sequentially performs log consumption and cleaning, window aggregation calculation, and feature vector encoding to convert discrete user behaviors and contexts into structured feature vectors. Then, it enters a three-stage progressive detection pipeline: the first stage uses K-means clustering to quickly group all users and filter out potential anomaly groups that differ significantly from the mainstream group; the second stage uses the isolated forest algorithm to accurately locate statistical outliers within the candidate anomaly groups; the third stage inputs the feature vectors of outliers into a large language model for semantic enhancement decoding and deep analysis to evaluate the anomaly nature from the behavioral intent level, and finally outputs a list of anomaly users.

[0054] The User Journey Analysis Agent analyzes user behavior and access records, combining user identification and association, operation path reconstruction, success rate statistics, and abnormal access detection to comprehensively analyze user behavior and output analysis results.

[0055] As an example, see reference Figure 6 , Figure 6 A schematic diagram of the implementation process of the User Journey Analysis Agent is provided. After receiving the analysis parameters injected by the central control Agent, the User Journey Analysis Agent retrieves access logs within a specified time range from the full access log data source. The data preprocessing module sequentially performs access log cleaning and data standardization operations. Then, the User Journey Analysis Engine sequentially performs user identification and association, operation path reconstruction, success rate statistics, and abnormal access detection. Finally, the analysis results of the above steps are input into the large language model for comprehensive analysis and evaluation, and the journey visualization charts and analysis reports are output.

[0056] The user rights analysis agent identifies and associates users to obtain records of user activity participation and coupon redemption. It then combines this with a large language model to analyze whether users are engaging in "coupon-grabbing" behavior, and finally outputs a visualized record of rights redemption and an analysis report.

[0057] As an example, see reference Figure 7 , Figure 7A flowchart illustrating the implementation process of the User Rights Analysis Agent is provided. After receiving the analysis parameters injected by the central control Agent, the User Rights Analysis Agent uses the user ID as input and retrieves the user's activity participation records and coupon redemption records through user identification and association. Then, the User Rights Analysis Engine inputs these records into a large language model for analysis. The large language model identifies characteristics of "coupon-grabbing" behavior, such as abnormal participation frequency, excessively concentrated redemption times, or multiple accounts associated with the same device. Finally, it outputs a visual chart of user rights redemption records and a coupon-grabbing behavior analysis report.

[0058] During the attack behavior analysis of their respective dimensions, each vertical domain agent outputs intermediate state data in real time. Intermediate state data refers to the phased analysis results or characteristic signals generated by each vertical domain agent during the analysis process, before reaching a final conclusion. Specifically, it includes risk feature vectors, behavioral sequence fragments, and confidence scores. Risk feature vectors are a set of numerical features extracted by the vertical domain agent from the raw data to characterize attack indications, such as the IP access frequency sequence statistically analyzed by a high-frequency agent; behavioral sequence fragments are segments of user or IP operation trajectories reconstructed by the agent, such as consecutive login failure records identified by a credential stuffing agent; and confidence scores are the agent's quantitative assessment of the reliability of the currently identified risk signals.

[0059] After each vertical domain agent completes the attack behavior analysis for its corresponding dimension, it outputs its own analysis results, which will serve as input for subsequent multi-source data fusion and correlation analysis.

[0060] Furthermore, in addition to reporting the final analysis results, each vertical domain agent will also exchange and share intermediate state data output during the analysis process in real time. This sharing mechanism can be implemented through a shared memory queue or message bus, enabling potential risk characteristics identified by any agent to be perceived by other agents performing analysis.

[0061] As an optional implementation, when any vertical domain agent identifies a potential risk feature based on its corresponding intermediate state data, the agent converts the potential risk feature into a dynamic constraint in a preset format and injects this dynamic constraint into the input context of other vertical domain agents associated with the potential risk feature. Other vertical domain agents receiving the dynamic constraint adjust their detection thresholds or expand their analysis dimensions according to the constraint, and output the final analysis result after completing the attack behavior analysis for the corresponding dimension.

[0062] As an example, when the abnormal user analysis agent identifies potential risk characteristics such as abnormal fingerprint entropy values ​​or high-frequency abnormal operation patterns of a device, the system converts these characteristics into dynamic constraints according to predefined mapping rules and injects them into the input context of the high-frequency analysis agent, the credential stuffing analysis agent, and the rights analysis agent. Upon receiving these dynamic constraints, the vertical domain agents adjust their detection thresholds or expand their analysis dimensions accordingly. For example, after receiving the constraint, the high-frequency analysis agent lowers the frequency threshold for requests to that device from 10 times per minute to 5 times per minute, while the credential stuffing analysis agent expands its analysis dimensions, adding a check of login records for all accounts associated with that device. This risk linkage and perception mechanism enables risk signals discovered by a single vertical domain agent to spread rapidly throughout the entire vertical domain agent cluster, achieving cross-agent collaborative response.

[0063] Step S40: Perform multi-source data fusion and correlation analysis on the analysis results of each vertical domain Agent to construct an attack correlation graph, and deduce the attack causal evidence chain based on the attack correlation graph.

[0064] The analysis results output by agents from different vertical domains come from different data sources and analytical dimensions. While each of these results possesses a certain attack detection capability, they are fragmented and isolated pieces of evidence when viewed individually. For example, a high-frequency analysis agent might output that an IP address accessed a certain interface 1,000 times within 10 minutes, while an abnormal user analysis agent might output that a user's login location changed across regions within a short period. These two pieces of information, presented separately, are insufficient to determine a complete attack event. However, if they are correlated, they may reveal a complete attack scenario: the IP address is conducting a high-frequency credential stuffing attack on the user's account. Therefore, the system needs to fuse and correlate the discrete analysis results from agents across different vertical domains to reconstruct the full picture of the attack event.

[0065] In this embodiment, the comprehensive analysis agent is responsible for performing multi-source data fusion and correlation analysis. The comprehensive analysis agent first obtains the final analysis results output by each vertical domain agent and the intermediate state data shared in real time by each vertical domain agent during the analysis process. This data is then used as a set of evidence to be correlated. The comprehensive analysis agent extracts risk entities and related attributes from the evidence set, using attack IP, user ID, and session ID as core entity keys. It maps each extracted risk entity to its corresponding entity node, generating an initial attack correlation graph. Entity nodes represent various objects involved in the attack event, including attack IP nodes, user ID nodes, session ID nodes, and device fingerprint nodes. The correlation edges between entity nodes represent the connection relationships between nodes. For example, if an IP initiates a login request at a certain time, a correlation edge with a time attribute can be established between the IP node and the user node.

[0066] After generating the initial attack association graph, the comprehensive analysis agent adjusts the weights of the association edges between entity nodes in the initial attack association graph according to preset dynamic weighting rules for entity relationships, resulting in a weighted attack association graph. These weights are calculated based on the historical violation frequency, attack intensity, and time decay factor of the corresponding risky entity. The historical violation frequency reflects the number of times the entity has been marked as malicious over a period of time; the attack intensity reflects the strength of the attack behavior initiated by the entity; and the time decay factor is used to give higher weight to more recent attacks. Through dynamic weighting, the system can cascade the risk of entity associations, meaning that when the risk confidence of one entity increases, the risk confidence of other entities with strong associations with it also increases.

[0067] When there are link breaks in the weighted attack association graph, the comprehensive analysis agent retrieves matching association information from the security knowledge base based on the context information of the link break, and generates missing entity nodes and corresponding association edges based on the retrieval results. Then, the generated missing entity nodes and corresponding association edges are injected into the weighted attack association graph to obtain a complete attack association graph.

[0068] Based on the completed attack correlation graph, the comprehensive analysis agent further deduces the causal evidence chain of the attack. Specifically, the comprehensive analysis agent obtains the attack behavior sequences of each entity node in the attack correlation graph and the connection relationships of each associated edge. Based on the attack behavior sequences and connection relationships, it matches them with a historical attack pattern library to locate the attack entry entity node, intermediate stepping entity node, and business-impacting entity node, generating candidate attack causal chains. Then, based on the type of attack behavior and attribute information of each entity node in the candidate attack causal chains, the comprehensive analysis agent retrieves matching reference cases and verification rules from the security knowledge base. Based on the reference cases and verification rules, it verifies the correlation of each hop in the candidate attack causal chains, deletes entity nodes and associated edges that fail the verification, and updates the candidate attack causal chains. Next, based on the weights of each entity node and associated edge in the attack correlation graph, the comprehensive analysis agent calculates the confidence level of each attack path in the updated candidate attack causal chains, deletes attack paths with confidence levels below a preset threshold, and obtains the target attack causal chain. Finally, by comprehensively analyzing the analysis results of the corresponding vertical domain agent output and the retrieved reference cases, a verifiable chain of attack causal evidence containing the attack entry point, attack path, scope of impact, and the basis for the relationships between each hop in the causal chain of the target attack is generated.

[0069] Step S50: Generate an attack analysis report based on the attack causal evidence chain.

[0070] The causal evidence chain of an attack exists in the form of a graph structure and relationships. Although it fully records the entry point, path, scope of impact, and basis for the relationships between each hop in the attack, directly viewing the graph for understanding still presents a certain barrier for security operations personnel. Furthermore, the value of security incident analysis lies not only in reconstructing the attack process but also in providing actionable recommendations for subsequent emergency response and defense hardening. Therefore, the system needs to transform the causal evidence chain of attacks into a structured, easy-to-understand attack analysis report, and provide actionable security policy recommendations within the report.

[0071] In this embodiment, the report generation agent is responsible for generating the attack analysis report. First, the agent retrieves matching defense solutions from the security knowledge base based on the attack behavior type recorded in the attack causal evidence chain, the attack methods of each hop in the attack path, and the final impact scope. The security knowledge base pre-stores defense solution templates for various attack patterns and their corresponding implementation conditions. The agent selects an applicable defense solution by matching attack characteristics with template characteristics. Next, the agent obtains current business context information, such as whether a major promotional event is underway and the distribution of affected user groups by risk level. Based on this context, the agent adjusts the enforcement level of the defense solution to avoid impacting the access experience of normal users due to overly strict security policies during peak business periods. After adjustment, the agent generates dynamic defense strategy code based on the adjusted defense solution, including but not limited to rate limiting rules and adaptive CAPTCHA triggering logic. For example, it sets tiered rate limiting thresholds for attacking IPs or dynamically pops up CAPTCHAs for human-machine verification for high-risk requests. Finally, the agent generates a complete attack analysis report based on the attack causal evidence chain and the generated defense strategy code. The report includes attack analysis conclusions, defense recommendations, implementation steps, verification methods, and rollback plans.

[0072] As an optional implementation, when generating defense recommendations, the report-generating agent can categorize the recommendations into multiple priority levels based on the confidence scores of each hop in the attack causal evidence chain. For example, for attack paths with a confidence level higher than 90%, it is recommended to immediately block and ban the relevant IPs; for attack paths with a confidence level between 60% and 90%, it is recommended to enable observation mode and increase monitoring frequency; for attack paths with a confidence level lower than 60%, only record the information without taking proactive action. Through this hierarchical strategy, the generated defense recommendations are both actionable and balance security protection with business stability.

[0073] As an optional implementation, when generating dynamic defense strategy code, the report generation agent can output the dynamic defense strategy code as a structured configuration script rather than a natural language description, so that it can be directly parsed and executed by automated deployment tools, thereby achieving a seamless connection from security analysis to automated handling.

[0074] This embodiment supports two sources for task reception: manual submission by users and automatic triggering by the monitoring system. Pre-processing verification ensures that all tasks entering the analysis process include core fields such as attack IP, time window, and alarm source, preventing ineffective computation due to incomplete task information. The initial scheduling scheme generated by the large language model is subjected to dual verification of static constraints and dynamic risks through a central control agent. Static constraint verification performs a hard check on the availability and task dependencies of candidate vertical domain agents to ensure the system feasibility of the scheme. Dynamic risk verification adjusts agent priorities based on entity risk levels to allocate analysis resources to high-risk entities. Hard constraints have veto power, while soft constraints serve as a reference, balancing the adaptability to complex task semantic understanding with the executability of the scheme under actual system conditions. By having multiple vertical domain agents execute attack behavior analysis in parallel across corresponding dimensions, and sharing the intermediate state data output during the execution process within the vertical domain agent cluster, the potential risk features identified by any vertical domain agent are injected into the input context of other vertical domain agents in the form of dynamic constraints. This triggers other vertical domain agents to adaptively adjust detection thresholds or expand analysis dimensions. While maintaining the independent parallel execution of their respective analysis dimensions by each vertical domain agent, cross-agent risk linkage perception and collaborative response are achieved. This covers multi-dimensional attack features in breadth and improves the sensitivity of a single agent in identifying related risks in depth. By comprehensively analyzing the Agent using attack IP, user ID, and session ID as core entity keys, fragmented evidence output by Agents from various vertical domains is mapped to a unified entity node to construct an attack correlation graph. The weights of correlation edges are dynamically adjusted based on historical violation frequency, attack intensity, and time decay factors to achieve cascading propagation of risk confidence. A security knowledge base is retrieved to complete the attack path by filling in gaps in the chain, and then the historical attack pattern library is matched to deduce the causal evidence chain of the attack. This effectively aggregates multi-source heterogeneous data that was previously uncorrelated due to data silos into a verifiable causal chain. The report generation Agent generates an attack analysis report based on the attack causal evidence chain, including attack analysis conclusions, defense recommendations, implementation steps, verification methods, and rollback schemes, eliminating the need for manual intervention from task submission to report output.

[0075] The above features work together to solve the problems of cumbersome and inefficient manual analysis processes, difficulty in correlating multi-source data, reliance on expert experience for analysis quality, and difficulty in report generation. They enable end-to-end automated security incident analysis, from task submission to automatic output of analysis reports containing actionable defense recommendations, significantly improving the speed of security incident response and the accuracy, standardization, and operability of attack analysis.

[0076] Based on the above embodiments of this application, in the second embodiment of this application, the content that is the same as or similar to that in the first embodiment can be referred to the above description, and will not be repeated hereafter. This embodiment will further supplement the description from the system architecture level based on the aforementioned automated attack analysis method based on multi-agent deep collaboration, to help understand a specific system architecture used to execute the above method. Based on this, please refer to... Figure 8 The system architecture mainly includes a user interaction layer, a central control agent, a vertical domain agent cluster, a comprehensive analysis agent, and a report generation agent.

[0077] The user interaction layer provides a task management interface for developers to submit attack analysis tasks and view the analysis results. The central control agent, acting as the system's scheduling hub, receives user-submitted attack analysis tasks, performs semantic understanding and intent recognition using a large language model, generates a preliminary scheduling plan, then performs condition verification and intelligent decision-making based on a rule engine to generate a task scheduling strategy, and distributes the attack analysis tasks to the corresponding vertical domain agents through dynamic task orchestration.

[0078] The vertical domain agent cluster includes high-frequency analysis agents, credential stuffing analysis agents, abnormal user analysis agents, user journey analysis agents, and user benefit analysis agents. Among them, the high-frequency analysis agent is used to identify abnormal traffic characteristics and detect high-frequency attack behaviors such as API brute-force calls and large-scale scanning; the credential stuffing analysis agent is used to identify anomalies in the identity authentication process and detect batch logins and credential stuffing attacks; the abnormal user analysis agent is used to identify abnormal user behavior by using feature engineering and outlier detection algorithms to discover abnormal users; the user journey analysis agent is used to analyze user behavior trajectories, reconstruct user operation paths, and identify abnormal links in the user journey; and the user benefit analysis agent is used to identify "coupon-grabbing" behavior in benefit activities by analyzing user activity participation records and coupon redemption records.

[0079] The comprehensive analysis agent is used to perform multi-source data fusion and correlation analysis on the analysis results output by agents from various vertical domains. Specifically, the comprehensive analysis agent uses attack IP, user ID, and session ID as core entity keys to map fragmented evidence output by agents from various vertical domains to a unified entity node, generating an initial attack correlation graph through cross-domain entity association and graph construction methods. During the graph generation process, the comprehensive analysis agent calls historical analysis reports and security knowledge bases for retrieval enhancement, including matching similar attack cases from historical analysis reports to assist in link completion, and retrieving vulnerability exploitation conditions and attack pattern characteristics from the security knowledge base to verify the rationality of the attack path. Finally, based on the complete attack correlation graph, the agent deduces the causal evidence chain of the attack.

[0080] The report generation agent integrates the analysis results of agents from various vertical domains and the output results of the comprehensive analysis agent. It conducts a risk situation assessment based on the attack causal evidence chain, generates defense suggestions based on the situation assessment results and combined with the current business context information, forms a global analysis overview, and finally outputs an executable attack analysis report containing an overview, details, evidence chain, and defense suggestions.

[0081] Through the aforementioned system architecture, the automated attack analysis system based on deep multi-agent collaboration provided in the second embodiment of this application achieves a complete automated analysis closed loop, from task reception, intent recognition and intelligent scheduling, multi-dimensional parallel analysis, multi-source data fusion and correlation analysis, to final report generation. The system ensures the accuracy of task distribution and system-level feasibility through intelligent scheduling and dual verification mechanisms of the central control agent. It achieves comprehensive coverage of multi-dimensional attack characteristics and cross-agent risk linkage perception through parallel analysis and intermediate state data sharing of vertical domain agent clusters. It overcomes the technical obstacle of automatically associating multi-source heterogeneous data by comprehensively analyzing cross-domain entity associations and graph construction of agents, as well as retrieval enhancement mechanisms. Finally, it achieves automated output from security analysis to executable defense strategies through risk posture assessment and defense suggestion generation of the report-generating agent, significantly improving the efficiency, accuracy, and operability of security incident analysis and defense suggestions.

[0082] This application provides an automated attack analysis device based on deep multi-agent collaboration. The automated attack analysis device based on deep multi-agent collaboration includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the automated attack analysis method based on deep multi-agent collaboration in the first embodiment described above.

[0083] The following is for reference. Figure 9 The diagram illustrates a structural schematic of an automated attack analysis device suitable for implementing the embodiments of this application based on multi-agent deep collaboration. The automated attack analysis device based on multi-agent deep collaboration in the embodiments of this application may include various hardware and software components for implementing the automated attack analysis method based on multi-agent deep collaboration. Figure 9 The automated attack analysis device based on deep multi-agent collaboration shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0084] like Figure 9As shown, an automated attack analysis device based on multi-agent deep collaboration may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the automated attack analysis device based on multi-agent deep collaboration. The processing unit 1001, the ROM 1002, and the RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the automated attack analysis device based on multi-agent deep collaboration to communicate wirelessly or wiredly with other devices to exchange data. While the figure shows automated attack analysis devices based on multi-agent deep collaboration with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0085] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0086] The automated attack analysis device based on deep multi-agent collaboration provided in this application, employing the automated attack analysis method based on deep multi-agent collaboration in the above embodiments, can solve the technical problems of attack analysis relying on manual cross-source log correlation, resulting in low response efficiency and difficulty in dealing with complex attacks. Compared with the prior art, the beneficial effects of the automated attack analysis device based on deep multi-agent collaboration provided in this application are the same as those of the automated attack analysis method based on deep multi-agent collaboration provided in the above embodiments, and other technical features in this automated attack analysis device based on deep multi-agent collaboration are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0087] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0088] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0089] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the automated attack analysis method based on multi-agent deep collaboration in the above embodiments.

[0090] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or apparatus. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, radio frequency (RF), etc., or any suitable combination thereof.

[0091] The aforementioned computer-readable storage medium may be included in an automated attack analysis device based on multi-agent deep collaboration; or it may exist independently and not assembled into an automated attack analysis device based on multi-agent deep collaboration.

[0092] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by an automated attack analysis device based on multi-agent deep collaboration, the automated attack analysis device based on multi-agent deep collaboration performs the following: receiving an attack analysis task submitted by a user; identifying the intent of the attack analysis task, generating a task scheduling policy, and distributing the attack analysis task to at least one vertical domain agent according to the task scheduling policy; performing attack behavior analysis on the attack analysis task in corresponding dimensions through each vertical domain agent, and outputting the analysis results of each vertical domain agent; performing multi-source data fusion and correlation analysis on the analysis results of each vertical domain agent, constructing an attack correlation graph, and deducing an attack causal evidence chain based on the attack correlation graph; and generating an attack analysis report based on the attack causal evidence chain.

[0093] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., using an internet connection from an internet service provider).

[0094] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation that may be implemented in systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0095] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0096] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the aforementioned automated attack analysis method based on multi-agent deep collaboration. This solves the technical problems of attack analysis relying on manual cross-source log correlation, resulting in low response efficiency and difficulty in handling complex attacks. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the automated attack analysis method based on multi-agent deep collaboration provided in the above embodiments, and will not be repeated here.

[0097] This application provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the above-described automated attack analysis method based on multi-agent deep collaboration.

[0098] The computer program product provided in this application can solve the technical problems of attack analysis relying on manual cross-source log correlation, resulting in low response efficiency and difficulty in dealing with complex attacks. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the automatic attack analysis method based on multi-agent deep collaboration provided in the above embodiments, and will not be repeated here.

[0099] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent scope of this application.

[0100] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0101] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0102] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. An automated attack analysis method based on deep multi-agent collaboration, characterized in that, The automated attack analysis method based on deep multi-agent collaboration includes: Receive attack analysis tasks submitted by users; The attack analysis task is subjected to intent identification, a task scheduling policy is generated, and the attack analysis task is distributed to at least one vertical domain Agent according to the task scheduling policy. Each of the vertical domain agents performs attack behavior analysis on the attack analysis task in its respective dimension, and outputs the analysis results of each vertical domain agent. The analysis results of each vertical domain agent are subjected to multi-source data fusion and correlation analysis to construct an attack correlation graph, and the attack causal evidence chain is deduced based on the attack correlation graph. An attack analysis report is generated based on the aforementioned causal evidence chain of the attack.

2. The automated attack analysis method based on deep multi-agent collaboration as described in claim 1, characterized in that, The steps of performing intent identification on the attack analysis task, generating a task scheduling policy, and distributing the attack analysis task to at least one vertical domain Agent according to the task scheduling policy include: The attack analysis task is semantically parsed by the central control agent to extract entity information and contextual features from the attack analysis task; The entity information and the context features are input into a large language model for semantic reasoning to generate a preliminary scheduling scheme. The preliminary scheduling scheme includes a combination of candidate vertical domain agents and a priority ranking of each candidate vertical domain agent in the combination of candidate vertical domain agents. The preliminary scheduling scheme is double-verified by a rules engine. The double verification includes: static constraint verification based on the current availability status and task dependency relationship of each candidate vertical domain Agent, and dynamic risk verification based on the risk level of the entity information. The preliminary scheduling scheme is compared with the verification result of the dual verification: If the comparison results are consistent, the candidate vertical domain agent combination is determined as the target vertical domain agent combination, and the task scheduling strategy is generated according to the preliminary scheduling scheme. The task scheduling strategy includes the target vertical domain agent combination and the priority order of each vertical domain agent in the target vertical domain agent combination. If the comparison results are inconsistent, the preliminary scheduling scheme will be modified according to the hard constraints of the rule engine, or a manual review process will be triggered. According to the task scheduling strategy, the attack analysis task is distributed to each vertical agent in the target vertical agent combination, and corresponding entity information is injected into each vertical agent as analysis parameters.

3. The automated attack analysis method based on deep multi-agent collaboration as described in claim 2, characterized in that, The step of modifying the initial scheduling scheme based on the hard constraints of the rule engine includes: Remove candidate vertical domain agents that fail the static constraint verification from the preliminary scheduling scheme; Based on the list of available vertical domain agents output by the rule engine, determine the available vertical domain agents that match the functions of the deleted candidate vertical domain agents, and add the available vertical domain agents to the sorting position of the deleted candidate vertical domain agents in the candidate vertical domain agent combination to generate a corrected scheduling scheme. The double verification is performed again on the revised scheduling scheme until all candidate vertical domain agents in the revised scheduling scheme pass the double verification, or the number of retries reaches a preset threshold. If, after the number of retries reaches the preset threshold, there are still candidate vertical domain agents in the corrected scheduling scheme that have failed the dual verification, then a manual review process is triggered.

4. The automated attack analysis method based on deep multi-agent collaboration as described in claim 1, characterized in that, The step of performing attack behavior analysis on the attack analysis task according to the corresponding dimensions through each of the vertical domain agents, and outputting the analysis results of each of the vertical domain agents includes: During the attack behavior analysis of the corresponding dimension, each vertical domain agent outputs intermediate state data in real time. The intermediate state data includes risk feature vectors, behavior sequence fragments, and confidence scores. The intermediate state data output by each of the vertical domain agents are exchanged and shared in real time. When any of the vertical domain agents identifies a potential risk feature based on the intermediate state data, the potential risk feature is converted into a dynamic constraint in a preset format, and the dynamic constraint is injected into the input context of other vertical domain agents associated with the potential risk feature. Upon receiving the dynamic constraints, the vertical domain agent adjusts the detection threshold or expands the analysis dimensions according to the dynamic constraints, and outputs the analysis results after completing the attack behavior analysis of the corresponding dimensions.

5. The automated attack analysis method based on deep multi-agent collaboration as described in claim 1, characterized in that, The step of performing multi-source data fusion and correlation analysis on the analysis results of each of the vertical domain agents to construct an attack correlation map includes: By comprehensively analyzing the Agent, we obtain the analysis results output by each of the vertical domain Agents and the intermediate state data shared in real time by each of the vertical domain Agents during the analysis process. Extract the risk entities and associated attributes from the analysis results and the intermediate state data, using the attack IP, user ID and session ID as the core entity keys, and map each extracted risk entity to the corresponding entity node to generate an initial attack association graph. According to the dynamic weighting rules of entity relationships, the weights of the association edges between each entity node in the initial attack association graph are adjusted to obtain the weighted attack association graph, wherein the weights are calculated based on the historical violation frequency, attack intensity and time decay factor of the corresponding risk entity. When there are link breaks in the weighted attack association graph, matching association information is retrieved from the security knowledge base based on the context information of the link breaks, and missing entity nodes and corresponding association edges are generated based on the retrieval results. The missing entity node and its corresponding associated edge are injected into the weighted attack association graph to obtain the attack association graph.

6. The automated attack analysis method based on deep multi-agent collaboration as described in claim 5, characterized in that, The step of deducing the causal evidence chain of the attack based on the attack correlation graph includes: The attack behavior sequence of each entity node in the attack association graph and the connection relationship of each associated edge are obtained. Based on the attack behavior sequence and the connection relationship, the historical attack pattern library is matched to locate the attack entry entity node, intermediate stepping entity node and business impact entity node, and generate candidate attack causal chain. Based on the type of each attack behavior and the attribute information of the entity nodes in the candidate attack causal chain, matching reference cases and verification rules are retrieved from the security knowledge base. Based on the reference cases and the verification rules, the association relationship of each hop in the candidate attack causal chain is verified, entity nodes and associated edges that fail the verification are deleted, and the candidate attack causal chain is updated. Based on the weights of each entity node and associated edge in the attack association graph, the confidence level of each attack path in the updated candidate attack causal chain is calculated, and attack paths with confidence levels lower than a preset confidence threshold are deleted to obtain the target attack causal chain. For each hop in the target attack causal chain, the analysis results output by the corresponding vertical domain agent and the retrieved reference cases are bound together to generate a verifiable chain of attack causal evidence.

7. The automated attack analysis method based on deep multi-agent collaboration as described in claim 1, characterized in that, The step of generating an attack analysis report based on the attack causal evidence chain includes: The report generates an agent that retrieves matching defense solutions from a security knowledge base based on the attack causal evidence chain. Obtain the current business context information, and adjust the execution strength level of the defense scheme according to the business context information; Based on the adjusted defense scheme, generate defense strategy code; The attack analysis report is generated based on the attack causal evidence chain and the defense strategy code. The attack analysis report includes attack analysis conclusions, defense recommendations, implementation steps, verification methods, and rollback schemes.

8. The automated attack analysis method based on multi-agent deep collaboration as described in any one of claims 1 to 6, characterized in that, The vertical domain agents include high-frequency analysis agents, credential stuffing analysis agents, abnormal user analysis agents, user journey analysis agents, and user rights analysis agents.

9. An automated attack analysis device based on deep multi-agent collaboration, characterized in that, The automated attack analysis device based on multi-agent deep collaboration includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the automated attack analysis method based on multi-agent deep collaboration as described in any one of claims 1 to 8.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the automated attack analysis method based on multi-agent deep collaboration as described in any one of claims 1 to 8.

Images