An asset physical examination method and system based on multi-agent cooperation

Abstract

A kind of asset physical examination method and system based on multi-agent cooperation, the method mainly includes: obtaining asset information;The assets are divided into different groups, and a customized physical examination strategy is generated for each group, and for each asset physical examination subtask in the asset group, the subtasks are sorted or executed in parallel according to the dependency relationship;According to the physical examination strategy, determine the agent combination required to schedule each physical examination subtask, and distribute the physical examination task to the corresponding agent;Multiple agents cooperatively execute the detection task;In the case of multiple agent detection results conflict, conflict processing is carried out;For each asset, collect all agent detection results and perform risk comprehensive evaluation.The method and system can improve the physical examination efficiency in large-scale asset environment, realize multi-dimensional, full-coverage safety detection, improve detection accuracy, reduce false alarm rate, and perform differentiated physical examination according to asset characteristics, and realize adaptive optimization of physical examination strategy.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an asset health check system and method based on multi-agent collaboration for use in network security situation awareness systems. Background Technology

[0002] In a network security situation awareness system, conducting regular security checks on the network assets of enterprises and institutions is an important means of ensuring network security.

[0003] The main problems with traditional asset examination techniques are:

[0004] (1) Inefficient, serial scanning is performed based on a single detection engine, and the large-scale asset health check cycle can take several days, making it impossible to detect new threats in a timely manner;

[0005] (2) Limited coverage: A single tool can only detect specific security issues, and the security status assessment is not comprehensive;

[0006] (3) High false alarm rate, lack of intelligent correlation analysis and multi-dimensional verification, requiring a lot of manual confirmation, and high operation and maintenance costs;

[0007] (4) Unreasonable resource allocation: The "one-size-fits-all" strategy is adopted, which fails to differentiate treatment, resulting in insufficient protection of important assets and waste of resources;

[0008] (5) Static policy configuration cannot be dynamically adjusted and is difficult to cope with evolving security threats. Summary of the Invention

[0009] To address the aforementioned issues, this disclosure provides an asset health check method and system based on multi-agent collaboration, which achieves efficient, comprehensive, and intelligent health checks on network assets through the collaborative work of multiple specialized intelligent agents.

[0010] The multi-agent collaborative asset health check method disclosed herein mainly includes the following steps:

[0011] S0, acquire asset information and construct asset feature vectors;

[0012] S1, Agent Configuration: Configure several specialized agents, set up detection rule base and cooperation rules, and configure communication protocol and security authentication;

[0013] S2, Task decomposition: Divide assets into different groups based on asset feature vectors, generate customized health check strategies for each group, and sort or execute health check sub-tasks for each asset within the asset group according to dependencies.

[0014] S3, Agent Scheduling: Determine the combination of agents that need to be scheduled for each physical examination sub-task according to the physical examination strategy, and distribute the physical examination tasks to the corresponding agents.

[0015] S4, Cooperative Execution: Multiple agents cooperate to execute detection tasks. The agents execute in parallel, serial, or cross-cooperative modes and communicate in real time through a cooperative communication protocol to share detection results and collaborate on tasks.

[0016] S5 handles conflicts when multiple agents produce contradictory detection results.

[0017] S6 collects the detection results of all agents for each asset to be examined, performs deduplication, association analysis, and confidence fusion based on DS evidence theory, and calculates the asset risk score; after completing the asset risk score, it performs summary analysis on the asset group or the global asset set.

[0018] Furthermore, in step S0, the asset feature vector includes one or more dimensions from the following: asset type, asset importance, historical risk level, environmental sensitivity, and frequency of change.

[0019] Furthermore, in step S1, the configured professional intelligent agents include: vulnerability scanning intelligent agent, configuration audit intelligent agent, threat intelligence intelligent agent, behavior analysis intelligent agent, weak password detection intelligent agent, port service intelligent agent, web application intelligent agent, patch management intelligent agent, and compliance check intelligent agent.

[0020] Furthermore, step S2 specifically includes:

[0021] S21, calculate the similarity between assets based on asset feature vectors, and classify similar assets into the same group;

[0022] S22, determine the customized health check strategy for each group, including: the required testing dimensions, testing depth, and testing cycle;

[0023] S23. For each asset within each asset group, generate multiple health check sub-tasks at the granularity of detection dimensions according to the health check strategy, and calculate the priority of each detection dimension; parse the dependencies between each detection dimension and construct a detection dimension dependency graph; perform topological sorting according to the detection dimension dependency graph to determine the execution order of the health check sub-tasks; wherein, health check sub-tasks with dependencies are executed in the topological sorting order, and health check sub-tasks without dependencies are executed in parallel.

[0024] Furthermore, step S22 specifically includes:

[0025] The physical examination strategy is expressed as follows:

[0026]

[0027] In the formula, This represents the set of detection dimensions required to be performed for the i-th asset group. The detection dimensions include one or more of the following: vulnerability scanning, configuration auditing, port service detection, web application detection, threat intelligence detection, behavioral analysis, weak password detection, patch status detection, and compliance checks. Indicates the detection depth. Indicates the testing cycle. Indicates the detection time window;

[0028] The method for determining the detection depth includes:

[0029]

[0030] In the formula, Based on the depth coefficient, As importance weight, Risk weighting Threat weight;

[0031] The decision-making method for the detection cycle includes:

[0032]

[0033] In the formula, As the base period, For the frequency coefficient, This represents the threat change coefficient.

[0034] Furthermore, in step S23, the method for constructing the detection dimension dependency graph includes: determining the topological relationship of the detection dimension based on the preceding detections that each detection dimension needs to depend on.

[0035] Furthermore, step S3 specifically includes:

[0036] For each detection subtask, a multi-objective optimization scheduling algorithm is used for agent scheduling, taking into account the following factors:

[0037]

[0038] In the formula, Skill matching degree: Task type, representing the degree of matching between the detection dimension corresponding to the current detection subtask and the detection capability of the candidate agent;

[0039] Historical completion rate: the quality of tasks completed by the agent in the past;

[0040] Current load: The current task load of the agent;

[0041] For collaborative efficiency: the ease of collaboration with assigned tasks;

[0042] These are the weighting coefficients;

[0043] The determination of the collaborative efficiency value takes into account the following factors: when other tasks with the same asset have been assigned to an agent, the collaborative efficiency of that agent will increase; historical collaborative success rate will be considered; communication latency and the convenience of result sharing will be considered.

[0044] For each agent configured in the system, calculate its... The agent with the highest score is selected as the agent for the current detection subtask scheduling.

[0045] Furthermore, in step S4, the cooperative execution modes include:

[0046] Parallel collaboration: Multiple agents simultaneously perform different dimensions of detection on the same asset;

[0047] Serial collaboration: The output of agent A serves as the input of agent B;

[0048] Cross-collaboration: Agent A discovers a suspicious point and requests agent B to verify it.

[0049] Furthermore, in step S5, the conflict handling employs a three-tiered mechanism: historical state verification, re-probe verification, and manual confirmation; wherein:

[0050] The first level is historical status verification: query historical test data, and if the historical data shows a stable status, the historical data shall be used as the standard.

[0051] The second level is re-probe verification: triggers additional detection verification. If the confidence level of the re-verification result is greater than the set threshold, the new verification result is adopted.

[0052] The third level is manual confirmation: when the problem cannot be resolved automatically, it is marked as requiring manual confirmation, and the scenario is recorded for future learning.

[0053] Furthermore, step S6 specifically includes:

[0054] S61, standardize the data into a unified format and extract key fields;

[0055] S62, based on the detected problem type, asset, and location, deduplicates the results and retains the results with the highest confidence.

[0056] S63, Identify causal relationships and combined risks among problems;

[0057] S64 uses an improved DS evidence theory to fuse the confidence values ​​of multiple agents to obtain a comprehensive confidence score.

[0058] S65, calculates a risk score by considering the severity of the problem, the importance of the asset, and the confidence level;

[0059] The DS evidence theory fusion formula is as follows:

[0060]

[0061] The target proposition after fusion has the following value range: risky, risk-free, and uncertain;

[0062] The basic probability assignment function for the two agents;

[0063] Let X be the confidence score of agent 1 on proposition X;

[0064] Let Y be the confidence score of agent 2 on proposition Y;

[0065] The fusion condition is that the intersection of X and Y equals the target proposition C;

[0066] Overall confidence level calculation:

[0067]

[0068] In the formula, Based on the baseline confidence level, derived from the detection agent's report. The weighted confidence level represents the confidence value of the target proposition obtained after fusion based on the DS evidence theory. When the target proposition is "at risk", = .

[0069] Furthermore, the basic confidence level in step S6 The dynamic adjustment method is adopted, specifically including: for each test result of each asset to be tested in each round of physical examination, the initial confidence level output by the detection agent is used as the basic confidence level, and the basic confidence level is adjusted by weighted decay or enhancement according to the multi-dimensional verification factors corresponding to the test result. The multi-dimensional verification factors include: defense measure coefficient, measured verification coefficient, and historical data coefficient.

[0070] Specifically, it includes:

[0071] Confidence adjustment formula:

[0072]

[0073] In the formula, The initial confidence level is derived from the report of the detection agent.

[0074] Let be the adjustment coefficient for the i-th validation factor;

[0075] The number of validation factors;

[0076] To verify the credibility weights of the intelligent agent;

[0077] The adjusted confidence level;

[0078] The verification factor types include: effective defense measures, failed actual verification, successful actual verification, no historical risk, historical risk, compliant configuration, non-compliant configuration, matching threat intelligence, and unmatched threat intelligence.

[0079] Confidence threshold determination:

[0080]

[0081] Confidence saturation processing:

[0082] .

[0083] Furthermore, the method also includes the following steps:

[0084] The quality of the physical examination strategy is evaluated based on the results of the physical examination, and the physical examination strategy generation model is optimized to achieve adaptive optimization.

[0085] Specific methods include: employing a reinforcement learning framework, wherein:

[0086] State space S:

[0087]

[0088] Action Space A:

[0089]

[0090] Reward function R:

[0091]

[0092] In the formula, To ensure detection efficiency, To cover the cost of false reporting, For time cost.

[0093] An asset health check system based on multi-agent collaboration applying the above method mainly includes:

[0094] The collaborative management layer is used to intelligently decompose physical examination tasks based on asset characteristics, dynamically allocate detection tasks based on task characteristics, monitor the working status and load of each agent in real time, and handle conflicts in the detection results of multiple agents.

[0095] The coordination and control layer is used to generate and optimize health check strategies, perform fusion analysis of multi-agent detection results, and manage communication between agents.

[0096] The specialized intelligent agent layer consists of several specialized intelligent agents, each responsible for setting up security detection dimensions;

[0097] The data sharing layer is used to provide support for shared data.

[0098] Compared with existing technologies, the beneficial effects of this disclosure are: ① improving the efficiency of security checks in large-scale asset environments, achieving multi-dimensional and comprehensive security detection, reducing false alarm rates and improving detection accuracy; ② achieving differentiated security checks based on asset characteristics; ③ achieving adaptive optimization of security check strategies; ④ automated intelligent agent collaboration, significantly reducing manual intervention. Attached Figure Description

[0099] The above and other objects, features and advantages of this disclosure will become more apparent from the more detailed description of exemplary embodiments of this disclosure taken in conjunction with the accompanying drawings, in which the same reference numerals generally represent the same components.

[0100] Figure 1 This is an exemplary system architecture diagram based on this disclosure;

[0101] Figure 2 Here is an exemplary multi-agent collaborative workflow diagram according to this disclosure;

[0102] Figure 3 This is a schematic diagram of an exemplary intelligent agent collaborative communication protocol;

[0103] Figure 4 Flowchart of the task decomposition and agent scheduling algorithm;

[0104] Figure 5 Flowchart of the multi-dimensional result fusion algorithm;

[0105] Figure 6 Flowchart for the adaptive physical examination strategy generation and optimization method. Detailed Implementation

[0106] Preferred embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While preferred embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.

[0107] This disclosure provides an asset health check system and method based on multi-agent collaboration, which achieves efficient, comprehensive and intelligent health check of network assets through the collaborative work of multiple professional intelligent agents.

[0108] In one exemplary implementation:

[0109] An asset health check system based on multi-agent collaboration according to this disclosure is attached. Figure 1 As shown, it mainly includes:

[0110] The collaborative management layer includes a task decomposer, an agent scheduler, a state monitor, and a conflict resolver.

[0111] The coordination and control layer includes a policy manager, a result fusion unit, and a communication manager;

[0112] The specialized intelligent agent layer includes multiple specialized intelligent agents, each responsible for a specific security detection dimension;

[0113] The data sharing layer includes a shared knowledge base, a detection result database, an asset status database, and a threat intelligence database;

[0114] The system includes a task decomposer that intelligently decomposes the physical examination task into multiple sub-tasks based on the characteristics of the assets to be inspected; an agent scheduler that dynamically allocates inspection tasks based on task characteristics and agent status; a status monitor that monitors the working status and load of each agent in real time; a conflict resolver that handles conflicting inspection results from multiple agents; and professional agents that communicate with each other in real time via a collaborative communication protocol to achieve result sharing and task collaboration.

[0115] The specialized intelligent agents include: vulnerability scanning intelligent agent, configuration auditing intelligent agent, threat intelligence intelligent agent, behavior analysis intelligent agent, weak password detection intelligent agent, port service intelligent agent, web application intelligent agent, patch management intelligent agent, and compliance inspection intelligent agent; the detection dimensions and detection content of each intelligent agent are shown in Table 1.

[0116] Table 1. Description of Professional Intelligent Agents

[0117] Vulnerability Scanning Agent Known vulnerabilities Vulnerability detection such as CVE and CNVD Configure auditing agent Configuration Compliance System configuration security compliance check Threat Intelligence Agent Malicious indicators Threat intelligence-based IoC detection Behavioral analysis intelligent agent Abnormal behavior Analysis of Abnormal Asset Behavior Patterns Weak password detection agent Password security Weak password and default password detection Port Service Intelligent Agent Port service Open ports and running service identification Web Application Intelligent Agent Web security Web application security issue detection Patch Management Agent Patch status System patch status assessment Compliance inspection intelligent agent Legal compliance Compliance checks with laws, regulations and standards

[0118] According to the asset health check method based on multi-agent collaboration disclosed herein, the process is as follows: Figure 2 As shown, the main steps include:

[0119] Step 1: Discover network assets by combining active scanning and passive listening, collect asset information and construct asset feature vectors;

[0120] Step 2: Divide the assets into different groups based on the asset feature vectors, generate customized health check strategies for each group, and sort or execute the health check sub-tasks for each asset in the asset group according to the dependency relationship.

[0121] Step 3: Determine the combination of intelligent agents that need to be scheduled for each physical examination sub-task based on the physical examination strategy, and the intelligent agent scheduler distributes the physical examination tasks to the corresponding intelligent agents;

[0122] Step 4: Multiple agents execute detection tasks in parallel. The agents cooperate with each other in a cooperative mode (parallel cooperation, serial cooperation, or cross cooperation) and transmit messages in real time through a cooperative communication protocol to achieve the sharing of detection results and task collaboration.

[0123] Step 5: Conflict resolution for contradictory detection results from multiple agents: The conflict resolver handles contradictory detection results from multiple agents using a three-level mechanism of historical state verification, re-probe verification, and manual confirmation.

[0124] Step 6: For each asset to be examined, the result fusion unit collects the detection results of all agents, performs deduplication, association analysis, and confidence fusion based on DS evidence theory, and calculates the asset risk score; after completing the asset risk score, it performs summary analysis on the asset group or the global asset set.

[0125] As a preferred option, step 7 is also included: evaluating the quality of the health checkup strategy based on the health checkup results, optimizing the health checkup strategy generation model, and achieving adaptive optimization.

[0126] Each step is further explained below:

[0127] 1. Asset discovery and feature vector construction

[0128] By combining active scanning and passive listening, network assets are discovered, basic asset information (IP, operating system, open ports, etc.) is collected, and asset characteristics are enriched by combining data sources such as CMDB and threat intelligence to construct asset feature vectors.

[0129] The asset feature vector includes one or more dimensions from the following: asset type, asset importance, historical risk level, environmental sensitivity, and frequency of change.

[0130] In this embodiment, it is constructed as follows:

[0131]

[0132] in, Asset types, such as: core servers, general servers, network equipment, security equipment, etc.

[0133] Assign importance to assets, for example: a rating of 1-5, high / medium / low;

[0134] This refers to historical risk levels, such as the number of risk events in the last 30 days.

[0135] For environmental sensitivity, such as for production, testing, and development environments;

[0136] The frequency of change of the asset model (including common asset information, open ports, running services, deployment environment, etc.), such as high-frequency change, medium-frequency change, low-frequency change, etc.

[0137] 2. Agent grouping, health check strategy generation, task decomposition and ranking

[0138] 2.1 Calculate the similarity between assets based on asset feature vectors. In this embodiment, a clustering algorithm is used to group similar assets into the same group.

[0139] 2.2 Generate customized health check strategies for each group of assets, including: detection dimensions, detection depth, detection cycle, etc.;

[0140] 2.3 For each asset within each asset group, generate multiple health check sub-tasks at the detection dimension granularity according to the health check strategy, and calculate the priority of each detection dimension; parse the dependencies between each detection dimension and construct a detection dimension dependency graph; perform topological sorting according to the detection dimension dependency graph to determine the execution order of the health check sub-tasks; wherein, health check sub-tasks with dependencies are executed in the topological sorting order, and health check sub-tasks without dependencies are executed in parallel.

[0141] In this embodiment, the detection dimensions include one or more of the following: vulnerability scanning, configuration auditing, port service detection, web application detection, threat intelligence detection, behavioral analysis, weak password detection, patch status detection, and compliance checks.

[0142] In this embodiment, health check sub-tasks are generated with "asset + detection dimension" as the basic granularity. For example: asset A + port service detection = one health check sub-task; asset A + vulnerability scanning = one health check sub-task.

[0143] 2.4 Optimize task allocation to avoid redundancy.

[0144] The specific steps are as follows:

[0145] 2.2 Physical Examination Strategy Generation

[0146] In this embodiment, the detection strategy generation model is as follows:

[0147]

[0148] In the formula, This represents the set of detection dimensions required for the i-th asset group. Indicates the detection depth. Indicates the testing cycle. Indicates the detection time window.

[0149] Detection deep decision algorithm

[0150]

[0151] In the formula, The base depth coefficient is set to 1.0. Importance weights: High = 1.5, Medium = 1.0, Low = 0.7; Risk weights are assigned as follows: high-risk history = 1.3, medium-risk = 1.0, and low-risk = 0.8. Threat weights are calculated as follows: 1.2 for relevant threats, 1.0 for none.

[0152] Detection depth level comparison:

[0153] ≥1.5 (depth) Full rule set + custom rules 5000+ 30-60 minutes 1.0-1.5 (Standard) Core rule set 2000+ 15-30 minutes <1.0 (Fast) Basic rule set 500+ 5-15 minutes

[0154] Detection cycle decision algorithm:

[0155]

[0156] In the formula, The base period is 24 hours. The frequency coefficients are: high frequency = 0.5, mid frequency = 1.0, low frequency = 2.0; Threat change coefficient: New threat = 0.5, Normal = 1.0.

[0157] 2.3 Task Decomposition

[0158] Based on the pre-detection data that the detection dimensions depend on, the dependencies between detection dimensions are determined, and a dependency graph is constructed.

[0159] In this embodiment, the pre-detection that depends on the detection dimension is as follows:

[0160] Vulnerability Scanning Port service You need to know the open ports first. Web Application Detection Port service You need to know about HTTP services first. Configuration audit Vulnerability scanning, port services It is necessary to understand the asset exposure. Threat Intelligence Vulnerability scanning and behavioral analysis It is necessary to understand the risk profile of assets. Behavioral Analysis Configuration auditing, port services Need to understand configuration and port baseline Weak password detection Port service You need to know the open services first.

[0161] The execution order of detection subtasks is determined according to the topological sorting of the dependency graph: subtasks with dependencies are executed in the topological sorting order, and subtasks without dependencies are executed in parallel.

[0162] 3. Based on the strategy, determine the combination of agents that need to be scheduled, and the scheduler will distribute the physical examination tasks to the corresponding agents.

[0163] The agent scheduling in this embodiment adopts a multi-objective optimization scheduling algorithm, which comprehensively considers factors such as skill matching degree, historical completion rate, current load and collaborative efficiency.

[0164]

[0165] In the formula, Skill matching degree: represents the degree of matching between the detection dimension corresponding to the current detection subtask and the detection capability of the candidate agent; one detection subtask corresponds to "one detection dimension of an asset to be examined";

[0166] Historical completion rate: the quality of tasks completed by the agent in the past;

[0167] Current load: The current task load of the agent;

[0168] For collaborative efficiency: the ease of collaboration with assigned tasks;

[0169] The determination of the collaborative efficiency value takes into account the following factors: when other tasks with the same asset are assigned to an agent, the collaborative efficiency of that agent is improved; the historical collaborative success rate is taken into account; and communication latency and the convenience of result sharing are taken into account.

[0170] For each agent configured in the system, calculate its... The agent with the highest score is selected as the agent for the current detection subtask scheduling.

[0171] The agent combination selection rule in this embodiment is as follows:

[0172] Core Web Server Vulnerability scanning, configuration auditing, web applications, threat intelligence Behavioral analysis, weak passwords Database server Vulnerability scanning, configuration auditing, weak passwords, compliance checks Patch Management Network equipment Port services, configuration auditing, vulnerability scanning - Safety equipment Configuration audit, vulnerability scanning, compliance checks Patch Management

[0173] 4. Multi-agent collaborative execution

[0174] Each agent executes detection tasks in parallel, and the agents share detection results through a collaborative communication protocol to adjust detection strategies in real time and avoid duplicate detection.

[0175] This embodiment supports three collaborative modes:

[0176] Parallel collaboration Multiple agents simultaneously perform different dimensions of detection on the same asset. No direct dependencies, parallel execution Comprehensive physical examination Serial Collaboration The output of agent A is used as the input of agent B. A→B→C chain dependency In-depth analysis Cross-coordination Agent A detects something suspicious and requests agent B to verify it. A↔B Two-way interaction Threat confirmation, false alarm verification

[0177] The cooperative communication protocol supports the three cooperative modes mentioned above. The message format includes: message type field, sender information field, receiver information field, payload field, priority field, and context field.

[0178] Message types include:

[0179] TASK_REQUEST is used by the scheduler to assign detection tasks to agents;

[0180] TASK_RESULT is used by the agent to report the detection results to the scheduler;

[0181] QUERY is used by an agent to query the detection results of other agents;

[0182] HELP is used by an agent to request assistance from other agents in verification.

[0183] RESULT_SHARE is used for agents to proactively share detection and discovery.

[0184] ALERT is used for emergency notification when high-risk situations are detected.

[0185] ACK is used to acknowledge receipt of a message.

[0186] 5. Conflict resolution

[0187] In this embodiment, when the detection results of multiple agents conflict, a three-level resolution mechanism is adopted:

[0188] Level 1, Historical Status Verification: Query historical test data. If the historical data shows a stable status, the historical data shall prevail.

[0189] Level 2, New Detection Validation: Triggers additional detection validation. If the confidence level of the revalidation result is >0.8, the new result is adopted.

[0190] Level 3, manual confirmation: When the problem cannot be resolved automatically, it is marked as requiring manual confirmation, and the scenario is recorded for future learning.

[0191] 6. Results Integration and Risk Analysis

[0192] The result fusion unit collects the detection results of all agents, performs deduplication, correlation analysis and confidence fusion, calculates the comprehensive risk score of each asset, and then generates an asset health check report and improvement suggestions.

[0193] The multi-dimensional result fusion algorithm flow in this embodiment is shown in the appendix. Figure 5 As shown.

[0194] Algorithm flow:

[0195] Input: Detection results from multiple agents; Output: Integrated detection results after fusion.

[0196] Step 1: Standardize the data, convert it to a uniform format, and extract key fields;

[0197] Step 2, Deduplication: Based on the detected problem type (e.g., weak password, host vulnerability, configuration defect, compliance risk, etc.) + asset + location, deduplication is performed, retaining the result with the highest confidence.

[0198] Step 3, Correlation Analysis: Identify causal relationships and combined risks among the issues;

[0199] Step 4, Confidence Fusion: Fusion using an improved DS evidence theory;

[0200] Step 5, Risk Rating: Calculate a risk score based on the severity of the problem, the importance of the asset, and the confidence level.

[0201] The DS evidence theory fusion formula is as follows:

[0202]

[0203] The target proposition after fusion has the following value range: risky, risk-free, and uncertain;

[0204] The basic probability assignment function for the two agents;

[0205] Let X be the confidence score of agent 1 for proposition X; [0, 1]

[0206] Let [0, 1] be the confidence score of agent 2 on proposition Y;

[0207] The condition for fusion is that the intersection of X and Y equals the target proposition C.

[0208] Among the proposition types,

[0209] The phrase "{risky}" indicates a clear judgment that there is risk, and is a single-element proposition.

[0210] {No risk} indicates a clear judgment that there is no risk; it is a single-element proposition.

[0211] {Risk-free} indicates uncertainty; this is a universal proposition.

[0212] Then, the overall confidence level is calculated as follows:

[0213]

[0214] In the formula, The base confidence level is derived from the detection agent's report. The weighted confidence level represents the confidence value of the target proposition obtained after fusion based on the DS evidence theory; when the target proposition is "at risk", = .

[0215] In this embodiment, the basic confidence level The dynamic adjustment method is adopted, specifically including: for each test result of each asset to be tested in each round of physical examination, the initial confidence level output by the detection agent is used as the basic confidence level, and the majority of basic confidence levels are adjusted by weighted attenuation or enhancement according to the multi-dimensional verification factors corresponding to the test result. The multi-dimensional verification factors include: defense measure coefficient, measured verification coefficient, and historical data coefficient.

[0216] Specifically, it includes:

[0217] Confidence adjustment formula:

[0218]

[0219] In the formula, This represents the initial confidence level (reported by the detection agent), with a value range of [0, 1].

[0220] is the adjustment coefficient for the i-th validation factor, with a value range of [0, 2].

[0221] The number of validation factors is n≥1;

[0222] To verify the credibility weight of the agent, the value range is [0.5, 1.5].

[0223] The adjusted confidence level, with a value range of [0, 1].

[0224] Confidence threshold determination:

[0225]

[0226] Confidence saturation processing:

[0227]

[0228] The lower limit protection is a confidence level of no less than 0.01 to avoid completely rejecting the original test; the upper limit protection is a confidence level of no more than 1.0 to maintain a reasonable risk rating margin.

[0229] In this embodiment, the verification factor types include:

[0230] Effective defensive measures 0.3~0.6 There are WAF, firewall and other defenses. Actual test verification failed. 0.4~0.5 The actual attack test failed. The actual test was successful. 1.2~1.5 The actual attack test was successfully executed. History is risk-free 0.5~0.7 Historical data indicates long-term security History is risky 1.3~1.5 Similar security incidents have occurred in the past. Configuration Compliance 0.6~0.8 Security configuration conforms to best practices non-compliant configuration 1.2~1.4 Configuration defects exist Threat intelligence matching 1.3~1.8 Matching with known threat indicators Threat intelligence mismatch 0.7~0.9 No threat intelligence association found

[0231] The precise formula for calculating the adjustment coefficient corresponding to the validation factor is as follows:

[0232] (1) Defense measures coefficient :

[0233]

[0234] The base coefficients for defense measures are set as follows: WAF = 0.60, Firewall = 0.65, IDS = 0.70;

[0235] This is the defense status coefficient, with values ​​as follows: Fully Activated = 0.95, Basic Activated = 0.85, Not Activated = 1.00;

[0236] Attack type specific coefficient, with values ​​as follows: core protection = 1.00, secondary core = 0.95, edge = 0.90, periphery = 0.85.

[0237] (2) Measured verification coefficient :

[0238]

[0239] The baseline coefficient for actual failure is set to a fixed value of 0.50.

[0240] To verify the confirmation coefficients, the defense interception was set to 1.00, natural failure to 0.60, and partial interception to 0.80.

[0241] (3) Historical data coefficients :

[0242]

[0243] The historical risk-free baseline coefficient is set to a fixed value of 0.60.

[0244] This is the time span coefficient, with values ​​as follows: long-term > 180 days = 0.80, medium-term 30-180 days = 0.90, short-term < 30 days = 1.00;

[0245] This is the event frequency coefficient, with values ​​as follows: no event = 0.85, low frequency = 0.95, high frequency = 1.20.

[0246] This is the verification coefficient for the intelligence database, with values ​​as follows: multi-source no-match = 1.225, single-source verification = 1.10, no verification = 1.00.

[0247] (4) Intelligent Agent Credibility weight:

[0248] Vulnerability Scanning Agent 1.0 Benchmark weight Configure Audit Agent 0.9 Configuration verification has high credibility. Web Application Agent 1.1 The actual test verification is highly authoritative. Threat Intelligence Agent 1.2 Intelligence data is forward-looking Behavioral Analysis Agent 0.85 There is uncertainty in judging behavioral patterns.

[0249] 7. Adaptive optimization of physical examination strategy

[0250] Collect data on various indicators during the physical examination process, analyze the effectiveness of the physical examination strategy, optimize the strategy generation model based on the analysis results, and update the collaboration rules and detection rules of the intelligent agent.

[0251] This embodiment employs a reinforcement learning optimization framework, wherein:

[0252] State space S:

[0253]

[0254] Action Space A:

[0255]

[0256] Reward function R:

[0257]

[0258] In the formula, Weighting is used to determine the detection effectiveness rate (number of problems found / total number of detections). ;

[0259] The cost of false alarms (number of false alarms × cost of manual verification), weighted ; For time cost (detection time × resource consumption), weight .

[0260] Q-learning update formula:

[0261]

[0262] Learning rate Set to 0.1, discount factor It is set to 0.9.

[0263] In addition, this embodiment also employs a dynamic load balancing mechanism: real-time monitoring of the load indicators of each agent, and dynamic adjustment of the task allocation strategy when load imbalance is detected.

[0264] Monitoring metrics include: current number of tasks, CPU / memory usage, task queue length, average task completion time, etc.

[0265] The adjustment strategies include: triggering rebalancing when the load variance exceeds a threshold, transferring tasks from high-load agents to low-load agents, and prioritizing the transfer of low-priority, interruptible tasks.

[0266] In addition, this embodiment also employs a fault recovery mechanism: when a certain agent fails, the task to be executed is automatically reassigned to other available agents, and critical tasks undergo compensatory detection.

[0267] When an agent fails: identify the affected tasks to be executed, reassign the tasks to other available agents, perform compensatory checks on critical tasks, and record fault logs for analysis.

[0268] Application Examples

[0269] 1. Parallel Collaboration - Comprehensive Asset Checkup

[0270] Scenario Description: Perform a comprehensive security check on 10,000 servers.

[0271] Collaborative process:

[0272] (1) Phase 1: Task decomposition

[0273] Asset grouping: 10,000 units → 100 groups × 100 units

[0274] Strategy Generation: Generate customized health check strategies for each group.

[0275] • Core Server → Full-Dimensional Detection (9 Agents)

[0276] • Standard Server → Basic Detection (5 agents)

[0277] • Network equipment → Network security detection (3 agents)

[0278] Task breakdown: Each asset → N sub-tasks

[0279] (2) Phase 2: Parallel execution

[0280] Intra-group collaboration: Multiple agents working in parallel

[0281] Asset 1: Vulnerability scan revealed 3 vulnerabilities.

[0282] Configuration audit revealed 5 configuration issues.

[0283] Threat intelligence, matching 2 IoCs

[0284] Behavioral analysis revealed one abnormal behavior.

[0285] The results were merged to obtain the asset 1 health check report.

[0286] Inter-group collaboration: 100 groups execute in parallel

[0287] (3) Phase 3: Global Integration

[0288] Each group's physical examination report → Overall risk analysis → Overall security situation report.

[0289] 2. Serial Collaboration - Deep Threat Analysis

[0290] Scenario Description: Conduct in-depth analysis after detecting suspicious behavior.

[0291] Collaborative process:

[0292] Step 1: Behavioral Analysis Agent

[0293] An anomaly was detected: User A logged in from an unusual IP address at 3:00 AM.

[0294] Anomaly score: 0.85 (High)

[0295] Output: List of suspicious sessions + anomaly characteristics

[0296] Step 2: Threat Intelligence Agent

[0297] Threat intelligence database query: IP belongs to a known malicious IP range.

[0298] Associated APT group: APT29 (Highly Trusted)

[0299] Output: Threat intelligence report + correlation indicators

[0300] Step 3: Vulnerability Scanning Agent

[0301] Inspection of related assets revealed a privilege escalation vulnerability, CVE-2024-0001.

[0302] Output: Vulnerability exploitation path analysis

[0303] Step 4: Comprehensive Analysis Report + Handling Recommendations

[0304] 3. Cross-collaboration - False Alarm Verification

[0305] Scenario Description: Verify whether the SQL injection vulnerability reported by the vulnerability scanning agent is a false positive.

[0306] Initial state: The vulnerability scanning agent reports "SQL injection vulnerability exists" with a confidence level of 0.7.

[0307] Confidence adjustment process:

[0308] Step 1: Configure Audit Agent Authentication (WAF Configuration)

[0309] Validation factor: R_defense = 0.57 (Calculation process is shown in the table below)

[0310] Agent weights: W_agent = 0.9

[0311] Calculation: Conf_1 = 0.7 × 0.57 × 0.9 = 0.36 ≈ 0.4

[0312] Step 2: Real-world testing and verification of the Web application agent (injection test)

[0313] Validation factor: R_verify_fail = 0.5 (Injection intercepted by WAF)

[0314] Agent weights: W_agent = 1.1

[0315] Calculation: Conf_2 = 0.4 × 0.5 × 1.1 = 0.22 ≈ 0.2

[0316] Step 3: Threat Intelligence Agent Historical Query

[0317] Validation factor: R_history_safe = 0.5 (This IP has no history of successful attacks)

[0318] Agent weights: W_agent = 1.2

[0319] Calculation: Conf_final = 0.2 × 0.5 × 1.2 = 0.12 ≈ 0.1

[0320] Final judgment: 0.1 < 0.3 threshold → false alarm, no alarm generated.

[0321] 4. Enterprise intranet environment asset check

[0322] Application scenario: A large enterprise has approximately 10,000 network assets.

[0323] Implementation process:

[0324] (1) Asset discovery: Deploy probes to scan the internal network IP segment, collect device information through SNMP and SSH, and obtain the business importance level in combination with CMDB.

[0325] (2) Intelligent agent configuration: Configure 9 professional intelligent agents, set up detection rule base and cooperation rules, and configure communication protocol and security authentication.

[0326] (3) Strategy generation: Cluster 10,000 assets into 20 groups and generate customized strategies for each group: core assets undergo in-depth health checks every hour, and general assets undergo basic health checks every day.

[0327] (4) Collaborative physical examination: Multiple agents work in parallel, with 3-5 agents in each group starting up at the same time and sharing the test results in real time.

[0328] (5) Results processing: Perform deduplication and correlation analysis, calculate risk score (0-100 points), and generate physical examination report.

[0329] Effect:

[0330] The health check cycle was shortened from 7 days to 1.5 days; 127 high-risk vulnerabilities and 586 medium-risk vulnerabilities were discovered; the false alarm rate was only 2.8% (compared to 15% traditionally); and the incidence of security incidents involving important assets decreased by 65%.

[0331] 5. Synergistic effect verification experiment

[0332] Experimental design: Test assets consist of 1000 hybrid assets, with 50 known security vulnerabilities implanted.

[0333] Single agent working alone 28 / 50 (56%) 18% 12 hours Simple parallelism of multiple agents (without cooperation) 35 / 50 (70%) 22% 8 hours Multi-agent intelligent collaboration (this disclosure) 48 / 50 (96%) 3% 3 hours

[0334] The above technical solutions are merely exemplary embodiments of the present invention. For those skilled in the art, based on the application methods and principles disclosed in the present invention, it is easy to make various types of improvements or modifications, and not limited to the methods described in the specific embodiments of the present invention. Therefore, the methods described above are merely preferred and not restrictive.

Claims

1. An asset health check method based on multi-agent collaboration, characterized in that, Includes the following steps: S0, acquire asset information and construct asset feature vectors; S1, multi-agent configuration; S2, Task decomposition: Divide assets into different groups based on asset feature vectors, generate customized health check strategies for each group, and sort or execute the health check sub-tasks of each asset in the asset group according to the dependency relationship. S3, Agent Scheduling: Determine the combination of agents that need to be scheduled for each physical examination sub-task according to the physical examination strategy, and distribute the physical examination tasks to the corresponding agents. S4, Cooperative Execution: Multiple agents cooperate to execute detection tasks. The agents execute in parallel, serial, or cross-cooperative modes and communicate in real time through a cooperative communication protocol to share detection results and collaborate on tasks. S5 handles conflicts when multiple agents produce contradictory detection results. S6 collects the detection results of all intelligent agents for each asset to be examined, and conducts a comprehensive asset risk assessment.

2. The method according to claim 1, characterized in that, In step S1, the configured professional intelligent agents include one or more of the following: vulnerability scanning intelligent agent, configuration audit intelligent agent, threat intelligence intelligent agent, behavior analysis intelligent agent, weak password detection intelligent agent, port service intelligent agent, web application intelligent agent, patch management intelligent agent, and compliance check intelligent agent.

3. The method according to claim 1, characterized in that, Step S2 specifically includes: S21, calculate the similarity between assets based on asset feature vectors, and classify similar assets into the same group; S22, determine the customized health check strategy for each group, including: the required testing dimensions, testing depth, and testing cycle; S23. For each asset within each asset group, generate multiple health check sub-tasks at the granularity of detection dimensions according to the health check strategy, and calculate the priority of each detection dimension; parse the dependencies between each detection dimension and construct a detection dimension dependency graph; perform topological sorting according to the detection dimension dependency graph to determine the execution order of the health check sub-tasks; wherein, health check sub-tasks with dependencies are executed in the topological sorting order, and health check sub-tasks without dependencies are executed in parallel.

4. The method according to claim 3, characterized in that, Step S22 specifically includes: The physical examination strategy is expressed as follows: ； In the formula, This represents the set of detection dimensions required to be performed on the i-th asset group. The detection dimensions include one or more of the following: vulnerability scanning, configuration auditing, port service detection, web application detection, threat intelligence detection, behavioral analysis, weak password detection, patch status detection, and compliance checks. Indicates the detection depth. Indicates the testing cycle. Indicates the detection time window; The method for determining the detection depth includes: ； In the formula, Based on the depth coefficient, As importance weight, Risk weighting Threat weight; The decision-making method for the detection cycle includes: ； In the formula, As the base period, For the frequency coefficient, This represents the threat change coefficient.

5. The method according to claim 1, characterized in that, Step S3 specifically includes: For each detection subtask, a multi-objective optimization scheduling algorithm is used for agent scheduling, taking into account the following factors: ； In the formula, Skill matching degree: Task type, representing the degree of matching between the detection dimension corresponding to the current detection subtask and the detection capability of the candidate agent; Historical completion rate: the quality of tasks completed by the agent in the past; Current load: The current task load of the agent; For collaborative efficiency: the ease of collaboration with assigned tasks; These are the weighting coefficients; The determination of the collaborative efficiency value takes into account the following factors: when other tasks with the same asset have been assigned to an agent, the collaborative efficiency of that agent will increase; historical collaborative success rate will be considered; communication latency and the convenience of result sharing will be considered. For each agent configured in the system, calculate its... The agent with the highest score is selected as the agent for the current detection subtask scheduling.

6. The method according to claim 1, characterized in that, In step S5, the conflict handling employs a three-tiered mechanism: historical state verification, re-probe verification, and manual confirmation; wherein: The first level is historical status verification: query historical test data, and if the historical data shows a stable status, the historical data shall be used as the standard. The second level is re-probe verification: triggers additional detection verification. If the confidence level of the re-verification result is greater than the set threshold, the new verification result is adopted. The third level is manual confirmation: when the problem cannot be resolved automatically, it is marked as requiring manual confirmation, and the scenario is recorded for future learning.

7. The method according to claim 1, characterized in that, Step S6 specifically includes: S61, standardize the data into a unified format and extract key fields; S62, based on the detected problem type, asset, and location, deduplicates the results and retains the results with the highest confidence. S63, Identify causal relationships and combined risks among problems; S64 uses an improved DS evidence theory to fuse the confidence values ​​of multiple agents to obtain a comprehensive confidence score. S65, taking into account the severity of the problem, the importance of the asset, and the confidence level, to conduct a risk score; The DS evidence theory fusion formula is as follows: ； The target proposition after fusion has the following value range: risky, risk-free, and uncertain; The basic probability assignment function for the two agents; Let X be the confidence score of agent 1 on proposition X; Let Y be the confidence score of agent 2 on proposition Y; The fusion condition is that the intersection of X and Y equals the target proposition C; Overall confidence level calculation: ； In the formula, Based on the baseline confidence level, derived from the detection agent's report. The weighted confidence level represents the confidence value of the target proposition obtained after fusion based on the DS evidence theory. When the target proposition is "at risk", = .

8. The method according to claim 7, characterized in that, The basic confidence level in step S6 The dynamic adjustment method is adopted, specifically including: for each test result of each asset to be tested in each round of physical examination, the initial confidence level output by the detection agent is used as the basic confidence level, and the basic confidence level is adjusted by weighted decay or enhancement according to the multi-dimensional verification factors corresponding to the test result. The multi-dimensional verification factors include: defense measure coefficient, measured verification coefficient, and historical data coefficient. Specifically, it includes: Confidence adjustment formula: ； In the formula, The initial confidence level is derived from the report of the detection agent. Let be the adjustment coefficient for the i-th validation factor; The number of validation factors; To verify the credibility weights of the intelligent agent; The adjusted confidence level; The verification factor types include: effective defense measures, failed actual verification, successful actual verification, no historical risk, historical risk, compliant configuration, non-compliant configuration, matching threat intelligence, and unmatched threat intelligence. Confidence threshold determination: ； Confidence saturation processing: 。 9. The method according to any one of claims 1-8, characterized in that, It also includes the following steps: The quality of the physical examination strategy is evaluated based on the results of the physical examination, and the physical examination strategy generation model is optimized to achieve adaptive optimization. Specific methods include: employing a reinforcement learning framework, wherein: State space S: Action Space A: Reward function R: ； In the formula, To ensure detection efficiency, To cover the cost of false reporting, For time cost.

10. An asset health check system based on multi-agent collaboration applying the method of any one of claims 1-9, characterized in that, include: The collaborative management layer is used to intelligently decompose physical examination tasks based on asset characteristics, dynamically allocate detection tasks based on task characteristics, monitor the working status and load of each agent in real time, and handle conflicts in the detection results of multiple agents. The coordination and control layer is used to generate and optimize health check strategies, perform fusion analysis of multi-agent detection results, and manage communication between agents. The specialized intelligent agent layer consists of several specialized intelligent agents, each responsible for setting up security detection dimensions; The data sharing layer is used to provide support for shared data.

Images