A swarm intelligence driven distributed network security risk assessment method and system

Abstract

The application discloses a kind of swarm intelligence driven distributed network security risk assessment method and system, it is related to network security technical field.The application is dynamically distributed security capability for distributed probe based on multidimensional strategy matching algorithm by central coordinator, realizes the distributed distribution and time window aggregation batch triggering of security event based on the release-subscription mode by memory event bus, constructs CVSS weighted directed attack graph in memory to complete attack path reasoning and risk quantification, realizes dynamic tool arrangement and risk closed loop disposal based on large language model construction tool call loop engine.The application realizes the swarm intelligence cooperation of distributed security node, solves the problems of probe capability solidification, tool arrangement static, risk cognition fragmentation and easy event storm in the prior art, greatly improves the dynamics, accuracy and disposal efficiency of network security risk assessment, reduces system operation cost and resource consumption.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a distributed network security risk assessment method and system. Background Technology

[0002] As enterprise network architectures become more complex, assets are increasingly distributed across multiple isolated network segments, such as intranets, DMZs, cloud environments, and branch offices. Network security risk assessments face challenges in terms of coverage, dynamic adaptation, and risk awareness.

[0003] Current cybersecurity assessment technologies have mainly gone through three stages of development: The first stage is the era of single-machine scanners, represented by tools such as Nessus and OpenVAS. Port scanning and vulnerability detection are completed through a single node, but they cannot penetrate network isolation, and the scanning range is limited by the network reachability of a single machine. The second stage is the era of distributed scanning, which adopts a management terminal + multi-probe architecture. Scanning agents are deployed in various network segments, and the management terminal issues tasks and the probes return the results. This solves the network reachability problem, but the scanning capabilities of the probes are fixed at the time of deployment and cannot be dynamically adapted according to asset characteristics. The toolchain is statically pre-configured and lacks flexibility. The third stage is the AI-assisted security operation stage, which introduces large language models into the security field for vulnerability analysis, alarm judgment and other scenarios. However, in existing solutions, AI is mostly used for post-event data summarization and does not directly participate in the dynamic decision-making and process orchestration of the assessment process.

[0004] Existing distributed security assessment and automated response solutions mainly suffer from the following technical shortcomings: First, probe capabilities are statically fixed and cannot be allocated on demand. The scanning tools for probes are pre-installed during deployment, and subsequent capability changes require manual operation on a per-machine basis. In large-scale deployment scenarios, maintenance costs are extremely high. Probes cannot dynamically adapt to the optimal tool combination based on the operating system, service type, and other characteristics of the scanned assets. Related technologies, such as the distributed vulnerability scanning system disclosed in Chinese patent CN114422253A (publication date: April 29, 2022), use a concentrator and task scheduler to uniformly distribute scanning tasks, but the scanner capabilities are still statically configured, lacking a mechanism to dynamically adjust probe capabilities based on asset characteristics.

[0005] Secondly, the tool orchestration chain is fixed and lacks dynamic decision-making capabilities. The script execution flow of existing SOAR platforms is based on predefined conditional branching logic, which cannot autonomously adjust the execution strategy according to intermediate execution results, making it difficult to cope with uncertain scenarios in the security assessment process. Related technologies, such as the SOAR platform component execution method based on distributed task scheduling disclosed in Chinese patent CN116450305A (publication date: July 17, 2023), improve the platform's throughput by encapsulating component code into execution objects and distributing them to execution work units. However, its execution flow still relies on predefined component orchestration logic and cannot dynamically adjust subsequent strategies based on feedback during the execution process.

[0006] Third, multi-source security data cannot form a coherent risk perception. Existing solutions store asset, vulnerability, and network topology data in a scattered manner, lacking a real-time correlation mechanism. This makes it impossible to automatically infer attack paths and quantify risks, and it is difficult to support scientific decision-making on vulnerability remediation priorities. In recent years, attack graph technology has been used for network risk assessment. As described in the paper "Behind the scenes of attack graphs: Vulnerable network generator for in-depth experimental evaluation of attack graph scalability" (Computers & Security, Vol. 157, October 2025), existing attack graph generation algorithms mostly adopt offline batch processing mode, which faces challenges in combinatorial complexity and scalability, making it difficult to meet the needs of real-time risk assessment.

[0007] Fourth, there is a risk of storming in incident response. After a large-scale scan is completed, a large number of vulnerability events generated in a short period of time will trigger multiple workflow executions, which can easily exhaust system resources and cause cascading failures. There is a lack of effective event aggregation and batch processing mechanisms. Summary of the Invention

[0008] The purpose of this invention is to address the aforementioned deficiencies in existing technologies by providing a distributed cybersecurity risk assessment method and system driven by swarm intelligence. This system integrates distributed probes, AI decision engines, and heterogeneous security tools into a self-organizing and adaptive swarm intelligence system, enabling full-process management from distributed risk perception and associated risk assessment to automated closed-loop handling. This solves the technical problems in existing technologies, such as fixed probe capabilities, static tool orchestration, fragmented risk perception, and susceptibility to event storms.

[0009] To achieve the above objectives, the present invention adopts the following technical solution: On the one hand, this invention provides a swarm intelligence-driven distributed network security risk assessment method, comprising the following steps: S1: Dynamic allocation of distributed probe capabilities: The registration, authentication and online status management of multi-segment distributed probes are completed through the central coordinator. Based on the multi-dimensional policy matching algorithm, each probe is automatically matched and issued with a combination of security capabilities that are compatible with its device attributes and business affiliation. The probe performs local asset scanning and vulnerability detection security awareness tasks based on the received security capabilities. S2: Event-driven collaborative data flow: Each probe generates standardized security events from the security perception results and publishes them to the memory event bus. The event bus distributes the security events to the corresponding modules based on the publish-subscribe model. S3: Security event aggregation batch trigger: Group and accumulate security events of the same type in the event bus according to a preset time window. At the time window alignment, send the batch event set accumulated in the window as input parameters to the workflow engine. S4: Attack Path Reasoning and Risk Quantification: Based on asset, vulnerability, and network topology data distributed by the event bus, a CVSS-weighted directed attack graph is constructed in memory in real time. Based on the improved Dijkstra algorithm, multiple attack paths from the attack entry point to the critical assets are calculated, and risk quantification scores for the corresponding paths are generated. S5: AI-driven dynamic closed-loop handling: Based on a large language model, a tool call loop engine is built. The aggregated security event set and attack path reasoning results are used as engine inputs. Through multiple rounds of iterative reasoning, tool call instructions are generated, the corresponding security tool calls are executed and the results are fed back. The subsequent evaluation and handling execution process is dynamically adjusted based on the tool return results until the final handling result is generated.

[0010] On the other hand, the present invention provides a distributed network security risk assessment system driven by swarm intelligence, including a distributed perception layer, an event bus layer, a security analysis layer, an AI decision orchestration layer, and a user interaction layer, wherein each layer communicates through the event bus; The distributed perception layer includes multiple distributed probes deployed in different network segments and a central coordinator. The central coordinator is used to complete the registration and authentication of probes, online management and dynamic allocation of security capabilities. The probes are used to perform local security perception tasks and report standardized events. The event bus layer is a memory event bus used to implement publish-subscribe distribution of security events, as well as time window aggregation and batch triggering of similar security events; The security analysis layer includes an attack path engine, a vulnerability association engine, and a risk assessment engine, which are used to construct a weighted attack graph, infer attack paths, and complete risk quantification calculations. The AI ​​decision orchestration layer includes a tool call loop engine based on a large language model, an MCP protocol tool integration module, and a workflow engine, which are used to execute dynamic tool orchestration and risk management processes. The user interaction layer is used to enable task configuration, risk visualization, AI interaction, and report generation.

[0011] Compared with the prior art, the present invention has the following beneficial effects: This invention achieves dynamic on-demand allocation of distributed probe security capabilities through a multi-dimensional strategy matching algorithm. Newly registered probes can automatically acquire suitable security capabilities without the need for manual deployment and configuration on a per-device basis, which significantly reduces the operation and maintenance costs in large-scale distributed deployment scenarios. At the same time, probe capabilities can be dynamically adjusted according to asset characteristics, improving the targeting of security awareness.

[0012] This invention uses a time-window event aggregation and batch triggering mechanism to accumulate similar security events and trigger workflow execution in batches, which greatly reduces the number of workflow executions, avoids the problem of system resource exhaustion in sudden event scenarios, and improves the stability of system operation.

[0013] This invention achieves automated reasoning from isolated vulnerability data to associated attack paths by constructing a CVSS weighted attack graph in memory in real time. At the same time, it quantifies the degree of risk reduction of different vulnerability remediation actions through hypothesis analysis, providing a precise quantitative basis for prioritizing vulnerability remediation and filling the gap in the existing technology from vulnerability discovery to risk perception.

[0014] This invention is based on a tool call loop engine built on a large language model, which realizes dynamic tool orchestration in the security assessment process. It can autonomously adjust subsequent execution strategies according to the execution results of each step, breaking through the limitations of existing static script orchestration. It can adapt to uncertain scenarios in the security assessment process and improve the flexibility of assessment and handling.

[0015] This invention adopts a five-layer loosely coupled system architecture, realizes collaborative communication among modules through an event bus, and integrates distributed perception, correlation analysis, AI decision-making and automated handling into a unified swarm intelligence system, forming a complete process from risk perception to closed-loop handling, which greatly improves the efficiency and accuracy of network security risk assessment. Attached Figure Description

[0016] Figure 1 This is an overall architecture diagram of the swarm intelligence-driven distributed network security risk assessment system described in this invention; Figure 2 This is an overall flowchart of the distributed network security risk assessment method driven by swarm intelligence as described in this invention; Figure 3 This is a flowchart illustrating the multi-dimensional strategy matching algorithm described in this invention. Figure 4 This is a schematic diagram of the loop execution process of the AI ​​tool based on a large language model as described in this invention; Figure 5 This is a schematic diagram of the CVSS weighted attack graph construction and attack path reasoning described in this invention. Detailed Implementation

[0017] The specific embodiments of the present invention will be further described below with reference to the accompanying drawings. It should be noted that these descriptions are for the purpose of aiding understanding the present invention, but do not constitute a limitation thereof. Furthermore, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0018] To clearly illustrate this invention, the core terms involved are defined as follows: Swarm intelligence: a distributed computing paradigm in which multiple autonomous intelligent probes, through local perception and global cooperation, exhibit collective intelligent behaviors that surpass individual capabilities. Smart probes: Autonomous security assessment units deployed in different network segments of the target network, with local asset scanning, vulnerability discovery, and remote collaboration capabilities; Model Context Protocol: A standardized tool integration protocol used to enable unified interface calls between artificial intelligence models and external security tools; General vulnerability scoring system: A universal standard used to quantify the severity of vulnerabilities, with a scoring range of 0.0-10.0; Attack path: The chain of exploitable vulnerabilities from the attack entry point to critical assets, determined by the network connectivity between assets and the severity of the vulnerabilities.

[0019] Example 1: A Swarm Intelligence-Driven Distributed Network Security Risk Assessment Method This embodiment provides a swarm intelligence-driven distributed network security risk assessment method. This method consists of five core steps linked together to form a complete chain from distributed risk perception and associated risk assessment to automated closed-loop handling. The overall execution flowchart is as follows: Figure 2 As shown, it includes the following steps S1 to S5.

[0020] S1: Registration and dynamic allocation of capabilities for distributed probes.

[0021] In this step, the registration, authentication, and online status management of multiple distributed probes deployed in multiple network segments (such as intranet, DMZ, and cloud environment) are completed through a central coordinator.

[0022] Specifically, probe registration employs a token-device two-phase authentication model. The administrator first creates a registration token on the central coordinator. This token's data structure includes the token's hash value (generated based on the SHA-256 algorithm), the maximum registration quota, the associated project identifier, category tag, and expiration time. Upon startup, the probe initiates a registration request carrying this token, a unique hardware identifier, hostname, operating system type, and CPU architecture. After verifying the token's validity and quota, the central coordinator generates a device key and creates a registration device record, which records the probe's hardware identifier, operating system, architecture, type, and version. Subsequently, the probe establishes a long-lived WebSocket connection with the central coordinator and sends a heartbeat every 30 seconds to maintain online status. To prevent misjudgments due to brief network fluctuations, the probe retransmits its heartbeat within 5 seconds if the initial heartbeat transmission fails. The central coordinator manages the probe's status through the heartbeat mechanism. If no heartbeat is received for two consecutive minutes, a probe activation request is first sent. If no response is received within a set timeout, the probe is deemed offline, and an offline status event is generated and broadcast to the event bus.

[0023] After successful registration, the central coordinator automatically matches and distributes a combination of security capabilities to each probe based on a multi-dimensional policy matching algorithm, ensuring the combination aligns with the probe's device attributes and service affiliation. The specific steps of this algorithm include: First, the probes are filtered in three levels according to endpoint type (such as scanning probes and terminal response probes), tags (such as critical business and Internet exposure surface), and project affiliation to obtain a suitable set of strategies.

[0024] Secondly, after sorting the strategies in descending order of priority, the capabilities in each strategy are traversed, and the capabilities are merged and deduplicated according to the principle of prioritizing higher priority, ensuring that each capability is assigned only once and is determined by the strategy with the highest priority.

[0025] Finally, based on the probe's operating system and CPU architecture, the tool library is queried to match tool packages compatible with the current platform, ultimately generating a capability distribution list containing information such as tool name, type, download address, checksum, and installation path.

[0026] The complete execution logic and process of the above multi-dimensional strategy matching algorithm are as follows: Figure 3 As shown, through three core steps—three-level filtering, priority sorting and capability deduplication, and platform adaptation—the probe security capabilities are accurately matched and dynamically distributed without the need for manual configuration on a per-device basis.

[0027] Once the probe receives the capability list, it can be used immediately to perform security awareness tasks such as local asset scanning and vulnerability detection. It should be noted that the distributed probe of this invention strictly adheres to the principles of legal authorization and minimum necessity before performing local asset scanning and data collection. All actions are based on explicit authorization from the user or administrator and comply with the Personal Information Protection Law and related regulations, and do not involve the illegal collection of personal privacy data.

[0028] S2: Security event distribution based on event bus.

[0029] Each probe generates standardized security events from its security awareness results (such as newly discovered ports, services, and vulnerabilities) and publishes them to the memory event bus. The event bus uses a publish-subscribe model and internally maintains a mapping table of event types and processing handles protected by concurrency security. In a preferred embodiment of this invention, read-write locks can be used to implement the aforementioned concurrency security protection. When an event is published, the event bus retrieves all processing handles corresponding to that event type from the mapping table and distributes these events to all modules that have subscribed to that event type (such as attack path engines and vulnerability association engines) through parallel coroutines, achieving loose coupling and high-concurrency communication between modules.

[0030] S3: Aggregated batch triggering of security events.

[0031] To prevent system resource exhaustion caused by event storms resulting from large-scale scanning or attacks, this step aggregates similar security events in the event bus. The event aggregation triggering mechanism specifically includes: grouping security events by associated project identifier and event type, and accumulating events in the same group into the corresponding pending event pool. The system aligns time windows according to a preset trigger interval (e.g., 5 minutes). Upon reaching the alignment time, the accumulated batch event set within that time window (e.g., a list containing 8 vulnerability discovery events) is passed as input parameters to the downstream workflow engine in one go, triggering workflow execution. After execution, the corresponding event pool is cleared. This mechanism aggregates the multiple workflow executions that might occur with traditional one-event-one-trigger executions into a small batch execution, significantly reducing system resource consumption.

[0032] S4: Real-time attack path discovery and hypothesis analysis.

[0033] Based on asset, vulnerability, and network topology data distributed via the event bus, a Common Vulnerability Scoring System (CVSS) weighted directed attack graph is constructed in memory in real time. The CVSS weighted directed attack graph construction logic, node and edge definition rules, and attack path reasoning process described in this step are all... Figure 5The attack graph is presented intuitively, with its data structure consisting of nodes and edges. Nodes store asset information, a vulnerability list, and the maximum CVSS score for that asset; edges represent access relationships between assets. The weights of directed edges are calculated using a reverse weighting function based on the severity of vulnerabilities in the target node, with weights ranging from 0.1 to 1.5. In a preferred embodiment of this invention, the formula for calculating the weight of a directed edge is: Weight of directed edge = 1.5 - (Maximum CVSS score of the target node / 101.4). The intention behind this formula is that nodes with higher CVSS scores have smaller incoming edge weights, indicating that the node is more attractive to attackers and more easily exploited.

[0034] Based on this weighted directed graph, the system uses an improved Dijkstra's shortest path algorithm to calculate K shortest attack paths (K defaults to 10) from the attack entry point to the critical assets, and generates a risk quantification score for each path. The score comprehensively considers the CVSS score of each node on the path and the path length factor; the longer the path, the lower the actual probability of it being exploited, and the lower its weight.

[0035] In addition, the system includes a built-in hypothesis testing function. Security operations personnel can input hypothesis testing requests containing identifiers of vulnerabilities to be removed and / or assets to be isolated. The system will then construct two sets of attack graphs, one before removing the specified vulnerability and the other before isolating the specified asset, and calculate the differences in the number of attack paths and risk values ​​(highest risk, average risk) between the two sets of attack graphs. The final output includes a risk reduction percentage, identification of critical vulnerabilities, and a priority ranking of remediation results, such as prioritizing the remediation of a particular vulnerability to eliminate most attack paths, providing a quantitative basis for security decisions.

[0036] S5: Dynamic tool orchestration and processing based on large language models.

[0037] This step constructs a tool call loop engine based on a large language model, serving as the system's decision-making brain. The complete execution flow, dynamic skill activation mechanism, and concurrency and context management logic of the tool call loop engine described in this step are all within... Figure 4 The engine takes the aggregated security event set and attack path reasoning results as input, generates tool call instructions through multiple rounds of iterative reasoning, executes the corresponding security tool calls and results feedback, and dynamically adjusts the subsequent execution process based on the tool return results until the final disposal result is generated.

[0038] In the multi-round iterative inference process executed by the tool call loop engine based on the large language model, a dynamic skill activation mechanism is set up to realize the on-demand expansion of the toolset. Specifically, the system pre-defines a dedicated tool called "Activate Skill". During the inference process, if the large language model finds that the currently available tools are insufficient to complete the current task (for example, a work order needs to be created but the work order system tool has not yet been loaded), it can call the "Activate Skill" tool and pass in the skill group name parameter to dynamically add all tools under the specified tool group (such as work order system, report generation) to the available tool list of the current session. To prevent the model from accidentally calling or loading high-risk tools without authorization, this mechanism adds permission whitelist control: the central coordinator pre-configures a whitelist of activatable tool groups for each probe or session, and the large language model can only call tool groups within the whitelist. At the same time, a configurable call threshold is set, which the administrator can adjust in the central coordinator according to the business scenario (default 3 times, supports 1-10 times adjustment) to prevent the model from calling indefinitely and wasting resources. This mechanism enables the engine to dynamically adjust its capability boundaries according to task requirements during the iteration process, avoiding the problem of reduced decision accuracy of large language models due to loading too many tools at once, and achieving lightweight, high-precision on-demand loading.

[0039] Meanwhile, the engine controls the maximum concurrency of the workflow (e.g., 10) through a concurrency control module (such as a task queue or thread pool). Requests exceeding this limit will be queued to avoid system overload. To prevent large language model context overflow caused by large amounts of data returned by tool calls, safe truncation is performed on the returned results: a character length threshold is set (e.g., 8000 characters), and results exceeding the threshold are truncated to characters within the threshold, with truncation annotations added to ensure the stability of the processing.

[0040] Example 2: A Swarm Intelligence-Driven Distributed Network Security Risk Assessment System like Figure 1 As shown, this embodiment provides a distributed network security risk assessment system driven by swarm intelligence. The system adopts a five-layer loosely coupled modular architecture with clear functional boundaries at each layer. It achieves end-to-end data communication and collaborative scheduling through an event bus. The overall system architecture layout is as follows: Figure 1 As shown, this system includes a distributed perception layer, an event bus layer, a security analysis layer, an AI decision orchestration layer, and a user interaction layer. Each layer communicates with the other through the event bus.

[0041] The distributed awareness layer comprises multiple distributed probes deployed across different network segments and a central coordinator. The central coordinator has a built-in multi-dimensional policy matching module for performing three-level filtering based on endpoint type, label, and project affiliation, as well as policy priority sorting, capability deduplication, and platform adaptation, automatically generating a list of adapted security capabilities for the probes. The probes communicate with the central coordinator via a WebSocket long-lived connection, sending heartbeat packets at preset intervals. The central coordinator marks probes that do not send a heartbeat for an extended period as offline and generates an offline event, broadcasting it to the event bus. The probes receive combinations of security capabilities from the central coordinator, perform local security awareness tasks, and report standardized events.

[0042] The event bus layer is a memory event bus used to implement publish-subscribe distribution of security events. This layer has a built-in event aggregation triggering module, which is used to group and accumulate security events by event type and project identifier, and complete alignment triggering based on preset time windows. At the alignment time of each preset time window, the workflow execution is triggered only once for the same group of accumulated events.

[0043] The security analysis layer includes an attack path engine, a vulnerability correlation engine, and a risk assessment engine. The attack path engine has a built-in hypothesis analysis module used to construct two sets of attack graphs before and after removing a specified vulnerability or isolating a specified asset. It calculates the number of attack paths and the difference in risk values ​​between the two sets of attack graphs, generating a vulnerability remediation priority ranking result. This layer is used to construct weighted attack graphs, infer attack paths, and complete risk quantification calculations.

[0044] The AI ​​decision orchestration layer comprises a tool invocation loop engine based on a large language model, a Model Context Protocol (MCP) tool integration module, and a workflow engine. The tool invocation loop engine integrates a dynamic skill activation module, a permission verification module, and a concurrency control module. The dynamic skill activation module responds to skill activation requests from the large language model by adding the security tools of the specified tool group to the available tool list of the current session. The permission verification module performs user permission verification before tool invocation. The concurrency control module controls the maximum number of concurrent workflow executions through a task queue or thread pool. This layer is used to execute dynamic tool orchestration and risk handling processes.

[0045] The user interaction layer is used to implement task configuration, risk visualization (such as attack path diagrams), AI interactive dialogue, and report generation.

[0046] Example of a specific application scenario: Automated vulnerability assessment and response across network segments for an enterprise. To more clearly demonstrate how this invention organically combines various steps and system layers to form a closed loop of collective intelligence, from decentralized perception to collaborative assessment and then to automatic response, a specific enterprise network security risk assessment scenario is used as an example for detailed description below. The various stages in this scenario are similar to those described above. Figures 1-5 The technical solutions correspond one-to-one.

[0047] Initial stage (corresponding to step S1 and the distributed perception layer) A company has deployed smart probes in its DMZ (Dedicated Domain Name Zone), intranet office area, and cloud business area. Administrators generate registration tokens through a central coordinator, setting the maximum number of registrations, associated project identifiers, and category tags (e.g., DMZ-Web, Intranet-Database, Cloud-File Service). Upon startup, each probe carries the token to complete registration and authentication, establishes a persistent connection with the central coordinator, and periodically sends heartbeats. Based on each probe's endpoint type (scanning probe), tag, project affiliation, operating system, and CPU architecture, the central coordinator automatically assigns Web vulnerability scanning capabilities to DMZ probes, database security auditing capabilities to intranet probes, and configuration verification capabilities to cloud probes using a multi-dimensional policy matching algorithm. After loading the corresponding tools, the probes begin executing scheduled security scans.

[0048] Phase 1: Distributed sensing and event reporting (corresponding to step S2 and the event bus layer) The isolated zone probe scan discovered a high-risk vulnerability in a web server (e.g., CVE-2024-1234, CVSS score 9.8); the internal network probe discovered a critical vulnerability in the core database server (CVSS 7.5); and the cloud environment probe discovered a weak password configuration risk in the file server. Each probe generates standardized vulnerability discovery events from its findings and publishes them via an event bus. The event bus uses a publish-subscribe mechanism to distribute events in parallel to all modules that have subscribed to that event type (e.g., vulnerability association engine, attack path engine, etc.).

[0049] Phase Two: Attack Path Reasoning and Risk Quantification (corresponding to Step S4 and Security Analysis Layer) Once the attack path engine subscribes to the scan completion event, it immediately loads the latest asset information, vulnerability data, and network topology from memory, and reconstructs the CVSS-weighted directed attack graph. The attack graph construction and path reasoning logic can be found in [reference needed]. Figure 5 Using an improved Dijkstra algorithm, the engine infers a three-hop attack path: from the external network entry point, through an isolated web server (exploiting a high-risk vulnerability), to the internal database server. This path has a risk score of 9.2 (extremely high risk). The engine then generates an attack path analysis completion event and republishes it to the event bus.

[0050] Phase 3: Event Aggregation and Workflow Triggering (corresponding to step S3 and the event bus layer) Within a 5-minute time window, the event aggregation trigger module accumulates three vulnerability discovery events from three regions. When the time window alignment time arrives, the module merges these three events into a batch event set, which is then passed as input parameters to the workflow engine to initiate the high-risk vulnerability automatic response workflow. Compared to the traditional one-by-one triggering method, this step combines three executions into one, significantly reducing system overhead.

[0051] Phase 4: AI Dynamic Orchestration and Automated Processing (corresponding to step S5 and the AI ​​Decision Orchestration Layer) The tool uses a loop engine to receive workflow input, and with the results of batch vulnerability events and attack path inferences as context, it initiates multiple rounds of iterative inference. For the complete execution flow, please refer to [reference needed]. Figure 4 : Round 1: The large language model calls the attack path details query tool to obtain complete information on the high-risk attack paths generated in step 2.

[0052] The second round: The model analyzes the current list of available tools and finds that only information query tools are available, while the subsequent operation of creating work orders is missing from the current toolset. Therefore, the model determines that the capability needs to be expanded, and then calls the preset activated skill tool, passing in the parameter "work order management", dynamically loading and appending tools such as creating work orders and querying work order status under the work order management tool group to the list of available tools for the current session.

[0053] In the third round: after the tool list is updated, the model calls the newly loaded ticket creation tool to automatically generate a ticket titled "Urgent: High-risk attack path across network segments needs immediate repair", which describes the vulnerability information, attack path and risk score in detail and is assigned to the security team.

[0054] Fourth round: After the work order is created, the model calls the activation skill tool again and loads the report generation toolkit.

[0055] Fifth round: The model calls the newly loaded report generation tool to automatically generate a structured security incident report based on vulnerability details, attack paths, risk scores, and other data.

[0056] Sixth round: The model outputs the final text summary.

[0057] Phase 5: Human-Machine Collaboration and Decision Support (corresponding to the user interaction layer) The user interaction layer pushes real-time alerts and handling results to security operations personnel via bidirectional real-time communication (WebSocket). Operations personnel can log in to the web console to intuitively view attack path topology visualizations, AI-generated summary reports, and work order details. To further validate remediation decisions, operations personnel used the hypothesis testing module to simulate remediating a high-risk vulnerability (CVE-2024-1234) on the web server. The system quickly built a remediated attack graph in memory and returned analysis results: the number of attack paths decreased by 75%, and the highest risk score dropped from 9.2 to 5.1. Based on this quantitative evidence, operations personnel confirmed that this vulnerability should be prioritized for remediation and followed up on work order handling, ultimately completing the risk assessment and response process in a closed loop.

[0058] The above scenario fully demonstrates how the present invention integrates distributed probes, event bus, attack path analysis, AI dynamic orchestration, and user interaction to form a closed loop of collective intelligence from decentralized perception to collaborative evaluation to automatic response and decision support, effectively solving the problems of coordination dilemma, tool fragmentation, and cognitive gap mentioned in the background technology.

[0059] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. For those skilled in the art, various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention, and these variations still fall within the protection scope of the present invention.

Claims

1. A distributed network security risk assessment method driven by swarm intelligence, characterized in that, Includes the following steps: S1: The central coordinator completes the registration, authentication and online status management of multi-segment distributed probes. Based on the multi-dimensional policy matching algorithm, it automatically matches and distributes a combination of security capabilities that are compatible with the device attributes and business affiliation of each probe. The probe performs local asset scanning and vulnerability detection security awareness tasks based on the received security capabilities. S2: Each probe generates standardized security events from the security perception results and publishes them to the memory event bus. The event bus distributes the security events to the corresponding modules based on the publish-subscribe model. S3: For security events of the same type in the event bus, group and accumulate them according to a preset time window. At the time window alignment, send the accumulated batch event set in the window as input parameters to the workflow engine. S4: Based on the asset, vulnerability, and network topology data distributed by the event bus, a CVSS-weighted directed attack graph is constructed in memory in real time. Based on the improved Dijkstra algorithm, multiple attack paths from the attack entry point to the critical assets are calculated, and a risk quantification score for the corresponding path is generated. S5: Based on a large language model, a tool call loop engine is built. The aggregated security event set and attack path reasoning results are used as engine inputs. Through multiple rounds of iterative reasoning, tool call instructions are generated, the corresponding security tool calls are executed and the results are fed back. The subsequent evaluation and handling process is dynamically adjusted based on the tool return results until the final handling result is generated.

2. The method according to claim 1, characterized in that, In step S2, the event bus maintains a processing handle mapping table with concurrent security protection. The corresponding subscribed processing handles are matched through the mapping table, and high-concurrency distribution of secure events is achieved through parallel coroutines.

3. The method according to claim 2, characterized in that, The multi-dimensional strategy matching algorithm in step S1 specifically includes: performing three-level filtering according to the probe's endpoint type, label, and project affiliation to obtain a suitable strategy set; sorting the strategies in descending order of priority, merging security capability items and removing duplicates according to the principle of prioritizing high priority; and finally matching toolkits that are compatible with the probe's operating system and CPU architecture to generate a capability distribution list containing download addresses and checksums.

4. The method according to claim 3, characterized in that, The security event aggregation batch triggering step S3 specifically includes: grouping security events according to the project identifier and event type associated with the event, accumulating events in the same group into the corresponding pending event pool; completing time window alignment according to the preset trigger interval, and after reaching the alignment time, batch transmitting the accumulated event set to the workflow engine, and clearing the corresponding event pool after the trigger is completed.

5. The method according to claim 4, characterized in that, In step S4, the directed edge weights of the attack graph are calculated based on the inverse weighting function of the vulnerability severity of the target node. The maximum CVSS score of the target node refers to the highest CVSS score of all vulnerabilities on that node, and the weight range is 0.1-1.

5. The hypothetical analysis request containing the vulnerability identifier to be removed and the asset identifier to be isolated is received. Attack graphs before and after removal are constructed respectively. The number of attack paths and the difference in risk value between the two attack graphs are calculated, and the vulnerability remediation priority ranking result is generated.

6. A distributed network security risk assessment system driven by swarm intelligence, characterized in that, It includes a distributed perception layer, an event bus layer, a security analysis layer, an AI decision orchestration layer, and a user interaction layer, with each layer communicating through the event bus; The distributed perception layer includes multiple distributed probes deployed in different network segments and a central coordinator. The central coordinator is used to complete the registration and authentication of probes, online management and dynamic allocation of security capabilities. The probes are used to perform local security perception tasks and report standardized events. The event bus layer is a memory event bus used to implement publish-subscribe distribution of security events, as well as time window aggregation and batch triggering of similar security events; The security analysis layer includes an attack path engine, a vulnerability association engine, and a risk assessment engine, which are used to construct a weighted attack graph, infer attack paths, and complete risk quantification calculations. The AI ​​decision orchestration layer includes a tool call loop engine based on a large language model, an MCP protocol tool integration module, and a workflow engine, which are used to execute dynamic tool orchestration and risk management processes. The user interaction layer is used to enable task configuration, risk visualization, AI interaction, and report generation.

7. The system according to claim 6, characterized in that, The central coordinator has a built-in multi-dimensional policy matching module, which is used to perform three-level filtering based on endpoint type, label, and project affiliation, as well as policy priority sorting, capability deduplication, and platform adaptation, and automatically generate a list of adapted security capabilities for probes. The probe communicates with the central coordinator via a WebSocket long connection and sends heartbeat packets at a preset period. If the probe fails to send a heartbeat packet, it will retransmit according to a preset retransmission strategy. If the central coordinator does not receive a heartbeat within a preset time, it first sends a probe request. If no response is received within the preset probe timeout, it marks the probe as offline and generates an offline event to broadcast to the event bus.

8. The system according to claim 7, characterized in that, The event bus layer has a built-in event aggregation triggering module, which is used to group and accumulate security events according to event type and project identifier, and complete alignment triggering based on a preset time window. At the alignment time of each preset time window, the workflow execution is triggered only once for the same group of accumulated events.

9. The system according to claim 8, characterized in that, The attack path engine has a built-in hypothesis analysis module, which is used to construct two sets of attack graphs before and after removing a specified vulnerability or isolating a specified asset, calculate the number of attack paths and the difference in risk values ​​between the two sets of attack graphs, and generate a priority ranking result for vulnerability remediation.

10. The system according to claim 9, characterized in that, The tool invokes a loop engine with a built-in dynamic skill activation module, a permission verification module, and a concurrency control module. The dynamic skill activation module responds to skill activation requests from the large language model by adding the security tools of the specified tool group to the available tool list of the current session. The permission verification module performs user permission verification before tool invocation. The concurrency control module controls the maximum number of concurrent executions of the workflow through a task queue or thread pool.

Images