Security auditing method and system for constructing cross-session agent tool invocation execution graph based on bypass network traffic

Abstract

The application relates to a security auditing method and system for constructing a cross-session Agent tool call execution graph based on bypass network traffic, which comprises the following steps: according to the bypass collected network traffic, identifying the derived call event, the derived confirmation event and the sub-Agent completion event corresponding to the derived tool call of the main Agent session, the derived tool call being used for deriving the sub-Agent session; according to the session identifier carried by the derived confirmation event and the main Agent session information, establishing the cross-session association between the sub-Agent session and the main Agent session; and constructing the cross-session Agent tool call execution graph according to the three types of events and the cross-session association and performing security auditing. The application solves the problem that the existing scheme cannot cross-session associate the main Agent and the sub-Agent tool call chain under the non-invasive condition, and the sub-Agent is in the auditing blind area.

Description

Technical Field

[0001] This application relates to the field of security auditing technology, and in particular to a security auditing method and system for constructing a cross-session agent tool call execution graph based on bypass network traffic. Background Technology

[0002] With the widespread deployment of large language model-driven intelligent software systems (AI Agents, or Agents for short) in business systems, Agents autonomously perform tool calls such as file reading and writing, command execution, network requests, and sub-Agent derivation during task execution, forming complex tool call chains. These tool calls involve system-level operations and may pose security risks. Therefore, without intruding on the business system framework, security auditing of Agent tool call behavior is crucial for ensuring system security.

[0003] Existing technologies collect system call logs generated by the Agent during Agent runtime through a system audit service on the host side, while also collecting the Agent's session records. The system call logs and session records are correlated using timestamps, and a large language model is used to determine the semantic correlation between the two to identify abnormal behavior. However, this approach limits its audit scope to within a single Agent session. When an Agent creates a child Agent through a derivation operation, the child Agent runs in an independent session. This approach cannot correlate the tool call chains of the main Agent session and the child Agent session across sessions, resulting in the child Agent's tool call behavior being in an audit blind spot. A complete execution graph cannot be reconstructed, and therefore, security auditing of cross-session tasks is impossible.

[0004] There is currently no effective solution to the problem that existing technologies cannot link the tool call chains of the main agent and sub-agent across sessions under non-intrusive conditions, resulting in the sub-agent's tool call behavior being in an audit blind spot and making it impossible to complete the security audit of cross-dialogue tasks. Summary of the Invention

[0005] This application provides a security auditing method and system for constructing a cross-session Agent tool call execution graph based on bypass network traffic. This addresses the technical problem that existing related technologies cannot associate the main Agent and sub-Agent tool call chains across sessions under non-intrusive conditions, resulting in the sub-Agent's tool call behavior being in an audit blind spot and making it impossible to complete the security audit of cross-dialogue tasks.

[0006] Firstly, this application provides a security auditing method for constructing a cross-session agent tool call execution graph based on bypass network traffic, comprising:

[0007] Based on the network traffic collected by the bypass, the derivation tool call of the main agent session is identified to obtain the corresponding derivation call event, derivation confirmation event, and sub-agent completion event; wherein, the derivation tool call is used to derive the sub-agent session;

[0008] Based on the session identifier of the sub-Agent session and the information of the main agent session carried in the derived confirmation event, a cross-session association is established between the sub-Agent session and the main agent session;

[0009] Based on the derived call event, the derived confirmation event, the sub-Agent completion event, and the cross-session association, construct a cross-session agent tool call execution graph;

[0010] Security audits are performed based on the cross-session agent tool call execution graph.

[0011] In some embodiments, the step of identifying the derived tool call execution of the main Agent session based on the network traffic collected via bypass, and obtaining the corresponding derived call event, derived confirmation event, and sub-Agent completion event, includes:

[0012] Based on the network traffic collected by the bypass, obtain the call information and return results corresponding to the derived tool calls of the main Agent session;

[0013] Based on the call information, extract the call identifier and call parameters corresponding to the derived tool call;

[0014] Based on the call identifier and the call parameters, the derived call event is generated; wherein, the derived call event represents the main Agent requesting a derived sub-Agent session;

[0015] Based on the returned results, the corresponding derived confirmation event and sub-Agent completion event are obtained.

[0016] In some further embodiments, obtaining the corresponding derived confirmation event and sub-Agent completion event based on the returned result includes:

[0017] Based on the returned results, extract the execution status corresponding to the derived tool call and the session identifier of the sub-Agent session;

[0018] Based on the execution status and the session identifier, the derived confirmation event is generated; wherein, the derived confirmation event indicates that the derived tool call has been executed and the sub-Agent session has been created;

[0019] Based on the session identifier, obtain the session traffic of the sub-Agent session, and identify the sub-Agent completion event from the session traffic; wherein, the sub-Agent completion event indicates that the sub-Agent session has been completed.

[0020] In some embodiments, establishing a cross-session association between the sub-agent session and the main agent session based on the session identifier of the sub-agent session carried in the derived confirmation event and the information of the main agent session includes:

[0021] Obtain the task identifier of the task corresponding to the main Agent session;

[0022] Generate a cross-session mapping record based on the session identifier and the task identifier;

[0023] Store the cross-session mapping record in a mapping table; use the mapping table as the cross-session association;

[0024] The mapping table is used to query the task corresponding to the main agent session when network traffic carrying the session identifier is received.

[0025] In some embodiments, constructing a cross-session agent tool call execution graph based on the derived call event, the derived confirmation event, the sub-Agent completion event, and the cross-session association includes:

[0026] Create the main agent node corresponding to the main agent and the sub-agent node corresponding to the sub-agent;

[0027] The derived call event, the derived confirmation event, and the sub-Agent completion event are combined with the main agent node and the sub-agent node respectively to construct corresponding event edges;

[0028] Based on the cross-session association, construct a cross-session association edge from the task to which the main Agent node belongs to the sub-Agent node;

[0029] Perform corresponding combinations on the main Agent node, the sub-Agent, the event edge, and the cross-session association edge to construct the cross-session Agent tool call execution graph.

[0030] In further embodiments, the step of combining the derived call event, the derived confirmation event, and the sub-Agent completion event with the main agent node and the sub-Agent node, respectively, to construct corresponding event edges includes:

[0031] Based on the derived call event, construct a derived call edge from the main Agent node to the derived tool call;

[0032] Based on the derived confirmation event, construct a derived confirmation edge pointing from the derived tool call to the child Agent node;

[0033] Based on the sub-Agent completion event, construct a sub-Agent completion edge pointing from the sub-Agent node to the task completion status.

[0034] In some embodiments, performing security auditing based on the cross-session Agent tool call execution graph includes:

[0035] The cross-session Agent tool is invoked to perform an integrity check on the execution graph, and the check result is obtained.

[0036] When the judgment result indicates that the cross-session Agent tool call execution graph is complete, the tool call trajectory of the main Agent session and the tool call trajectory of the sub-Agent session are obtained according to the cross-session Agent tool call execution graph;

[0037] The tool call trajectory of the main agent session and the tool call trajectory of the sub-agent session are merged into a complete tool call trajectory;

[0038] Perform a security audit on the complete tool call trajectory to obtain the security audit results;

[0039] Based on the security audit results, a task-level alarm is generated for the task corresponding to the main Agent session, and deduplication is performed on the task-level alarms for the same task.

[0040] In some further embodiments, the step of performing integrity checks on the cross-session Agent tool call execution graph and obtaining the check result includes:

[0041] When the cross-session agent tool call execution graph contains the derived call event, the derived confirmation event, and the sub-agent completion event, the cross-session agent tool call execution graph is determined to be complete.

[0042] If at least one of the following events is missing in the cross-session Agent tool call execution graph: the derived call event, the derived confirmation event, and the sub-Agent completion event, the cross-session Agent tool call execution graph is determined to be incomplete.

[0043] In some further embodiments, the method further includes:

[0044] When the judgment result indicates that the cross-session Agent tool call execution graph is incomplete, bypass processing is performed on the incremental tool call of the main Agent session, and the missing events in the derived call event, the derived confirmation event, and the sub-Agent completion event are waited for to arrive.

[0045] Secondly, this application provides a security auditing system for constructing a cross-session agent tool call execution graph based on bypass network traffic, comprising:

[0046] The graph event extraction module is used to identify the derived tool calls of the main agent session based on the network traffic collected by the bypass, and obtain the corresponding derived call events, derived confirmation events and sub-agent completion events; wherein, the derived tool call is used to derive the sub-agent session;

[0047] The Agent context identification module is used to establish a cross-session association between the sub-Agent session and the main Agent session based on the session identifier of the sub-Agent session carried in the derived confirmation event;

[0048] The graph state storage module is used to construct a cross-session agent tool call execution graph based on the derived call event, the derived confirmation event, the sub-Agent completion event, and the cross-session association.

[0049] The graph-aware auditing module is used to perform security audits on graphs based on the cross-session Agent tool call.

[0050] Compared with existing related technologies, the embodiments of this application have the following beneficial effects:

[0051] This application embodiment collects network traffic via a bypass to identify derived call events, derived confirmation events, and sub-agent completion events corresponding to derived tool calls in the main agent session. The derived tool calls are used to derive sub-agent sessions. Based on the session identifier of the sub-agent session and the information of the main agent session carried in the derived confirmation event, a cross-session association is established between the sub-agent session and the main agent session. A cross-session agent tool call execution graph is constructed based on the derived call events, derived confirmation events, sub-agent completion events, and the cross-session association, and security auditing is performed based on this graph. By identifying three types of graph events from network traffic and establishing cross-session associations under purely bypass and non-intrusive conditions, the sub-agent tool call behavior, which was originally in an audit blind spot, is associated with the task to which the main agent session belongs. This constructs a complete tool call execution graph including the main agent and sub-agents, enabling cross-session security auditing. Therefore, this application embodiment can solve the problem that existing technologies cannot perform complete security auditing by associating the main agent and sub-agent tool call chains across sessions under non-intrusive conditions.

[0052] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0053] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0054] Figure 1 This is a flowchart of a security auditing method for constructing a cross-session agent tool call execution graph based on bypass network traffic, according to an embodiment of this application.

[0055] Figure 2 This is a flowchart illustrating the acquisition of three types of events according to an embodiment of this application;

[0056] Figure 3 This is a flowchart of obtaining the derived confirmation event and the sub-Agent completion event provided in an embodiment of this application;

[0057] Figure 4 This is a flowchart illustrating the establishment of a cross-session association between a sub-Agent session and a master agent session, provided in one embodiment of this application.

[0058] Figure 5 This is a flowchart illustrating the construction of a cross-session agent tool call execution graph according to an embodiment of this application;

[0059] Figure 6 This is a flowchart of constructing event edges based on three types of events and Agent nodes, provided in one embodiment of this application;

[0060] Figure 7 This is a flowchart of a method for performing security audits based on a cross-session agent tool call execution graph, provided in one embodiment of this application.

[0061] Figure 8 This is a flowchart of the execution integrity judgment of cross-session Agent tool call execution graph provided in an embodiment of this application;

[0062] Figure 9 This is a flowchart illustrating the processing of cross-session Agent tool call execution graphs according to an embodiment of this application;

[0063] Figure 10 This is a hardware structure block diagram of the terminal for a security auditing method based on bypass network traffic to construct a cross-session agent tool call execution graph, as provided in an embodiment of this application.

[0064] In the diagram: 102, processor; 104, memory; 106, transmission device; 108, input / output device. Detailed Implementation

[0065] To better understand the purpose, technical solution, and advantages of this application, the application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0066] Unless otherwise defined, the technical or scientific terms used in this application shall have the general meaning understood by one of ordinary skill in the art to which this application pertains. Words such as “a,” “an,” “an,” “the,” “the,” and “these” used in this application do not indicate quantitative limitation and may be singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps or modules (units) is not limited to the listed steps or modules (units) but may include steps or modules (units) not listed, or may include other steps or modules (units) inherent to these processes, methods, products, or devices. Words such as “connected,” “linked,” and “coupled” used in this application are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. “Multiple” used in this application refers to two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. Normally, the character " / " indicates that the objects before and after it are in an "or" relationship. The terms "first," "second," and "third," etc., used in this application are merely to distinguish similar objects and do not represent a specific order.

[0067] This application can be applied to AI Agent security auditing scenarios. In this scenario, during task execution, the Agent autonomously performs tool calls such as file reading and writing, command execution, network requests, and sub-Agent derivation, forming a complex tool call chain. When the main Agent creates a sub-Agent through tool calls, the sub-Agent runs in an independent session to execute tasks, and its tool call behavior lacks correlation with the main Agent session, making it difficult for security auditing to cover the sub-Agent session. The aforementioned tool calls involve system-level operations, and using intrusive methods for cross-session security auditing may introduce security risks to business systems. Existing solutions currently cannot perform cross-session security auditing by associating the tool call chains of the main Agent and sub-Agents without intruding on business scenarios.

[0068] This embodiment provides a security auditing method for constructing a cross-session agent tool call execution graph based on bypass network traffic. Figure 1 This is a flowchart of the security auditing method for constructing a cross-session agent tool call execution graph based on bypass network traffic in this embodiment, as shown below. Figure 1 As shown, the process includes the following steps:

[0069] Step S110: Based on the network traffic collected by the bypass, identify the derived tool call execution of the main Agent session to obtain the corresponding derived call event, derived confirmation event and sub-Agent completion event;

[0070] Specifically, derived tool calls are used to derive child agent sessions.

[0071] For example: Bypass acquisition can refer to collecting network traffic from network packets during Agent interaction at a network bypass location, without intruding on the business system framework; correspondingly, network traffic can refer to network packets containing request and response data corresponding to an Agent session. A derived call event can represent the event where a derived tool call is initiated. A derived confirmation event can represent the event where a derived tool call has been executed and a sub-Agent session has been created; the derived confirmation event includes the session identifier of the sub-Agent session. A sub-Agent completion event can represent the event where the sub-Agent session has completed execution.

[0072] This step identifies the three types of events mentioned above from the collected network traffic in a non-intrusive manner, thereby enabling a structured description of the behavior of deriving child agent sessions from the main agent session.

[0073] Step S120: Based on the session identifier of the sub-Agent session and the information of the main Agent session carried in the derived confirmation event, establish a cross-session association between the sub-Agent session and the main Agent session.

[0074] For example: a session identifier, used as a unique identifier for the sub-Agent session; the session identifier is carried by the derived acknowledgment event. Cross-session association can refer to the correspondence between the sub-Agent session and the main Agent session.

[0075] This step associates the originally independent sub-Agent session with the main Agent session by combining the session identifier carried in the derived confirmation event with relevant information of the main Agent session.

[0076] Step S130: Construct a cross-session agent tool call execution graph based on derived call events, derived confirmation events, sub-Agent completion events, and cross-session associations.

[0077] For example, a cross-session agent tool call execution graph can refer to a graph data structure that integrates agent nodes, event edges, and node relationships. Agent nodes may include: main agent nodes and child agent nodes; event edges may include: edges formed by derived call events, derived confirmation events, and child agent completion events; node relationship edges may include: edges formed by cross-session relationships. Therefore, a cross-session agent tool call execution graph can represent the complete execution path of a cross-session agent tool call chain.

[0078] Step S140: Perform security audit based on the cross-session Agent tool call execution graph.

[0079] Specifically, the security audit here refers to the process of conducting a security assessment of the tool call behavior of the main agent session and the sub-agent session based on the cross-session agent tool call execution graph.

[0080] Unlike existing technologies, this implementation collects network traffic non-intrusively and identifies derived call events, derived confirmation events, and sub-Agent completion events. It then establishes cross-session associations based on the session identifiers carried in the derived confirmation events, and combines these three types of events with the cross-session associations to construct a cross-session agent tool call execution graph. Through these methods, this embodiment can associate sub-Agent tool call behaviors, which were previously in an audit blind spot, with the tasks corresponding to the main agent session. This allows for complete reconstruction and security auditing of the cross-session main agent and sub-agent tool call chains under purely bypass and non-intrusive conditions.

[0081] In some feasible embodiments, before performing identification on derived tool calls of the main agent session, the sequence of tool calls and return results starting from the user task is identified from the network traffic collected from the side channel; based on the sequence of tool calls and return results, it is detected whether a single agent tool call closed loop is formed in the main agent session; after confirming that the single agent tool call closed loop is completed, the identification on derived tool calls of the main agent session is triggered.

[0082] In some of these embodiments, Figure 2 This is a flowchart of the process for obtaining three types of events provided in this embodiment. Please refer to it. Figure 2 Step S110, which involves identifying the derived tool call execution of the main Agent session based on the network traffic collected via the bypass, and obtaining the corresponding derived call event, derived confirmation event, and sub-Agent completion event, specifically includes the following steps:

[0083] Step S111: Based on the network traffic collected by the bypass, obtain the call information and return results corresponding to the derived tool calls of the main Agent session;

[0084] Step S112: Extract the call identifier and call parameters corresponding to the derived tool call based on the call information;

[0085] Step S113: Generate a derived call event based on the call identifier and call parameters; wherein, the derived call event represents the main Agent requesting a derived sub-Agent session;

[0086] Step S114: Based on the returned results, obtain the corresponding derived confirmation event and sub-Agent completion event.

[0087] For example: The call information can refer to the request content of a derived tool call within the main Agent session; the return result can refer to the response content returned after the derived tool call is executed. Correspondingly, the call identifier can refer to the unique identifier of the derived tool call; the call parameters can refer to the parameters carried in the derived tool call to specify the method of creating the sub-Agent session. In practice, when the above steps are executed, the HTTP request and response content of the main Agent session is parsed from the network traffic collected via a bypass, the request content is extracted as the call information, and the response content is extracted as the return result.

[0088] This embodiment uses the above methods to transform discrete network traffic data into three types of structured events with clear semantics, providing a foundation for subsequent graph construction and cross-session association building.

[0089] In some feasible embodiments, the three types of events in step S110 can be understood with reference to the following examples:

[0090] In real-world scenarios, a spawn call event corresponds to the `spawn_call` event, a spawn confirmation event corresponds to the `spawn_accepted` event, and a child agent completion event corresponds to the `child_completed` event. In step S110, the `spawn_call` event is extracted from the call information of the spawn tool call in the main agent session, the `spawn_accepted` event is extracted from the return result of the spawn tool call, and the `child_completed` event is extracted from the session traffic of the child agent session.

[0091] In some further embodiments, Figure 3 This is a flowchart of the process for obtaining the derived confirmation event and the sub-Agent completion event provided in this embodiment. Please refer to it. Figure 3 Step S114 specifically includes the following steps:

[0092] Step S114.1: Based on the returned results, extract the execution status of the derived tool call and the session identifier of the sub-Agent session;

[0093] Step S114.2: Generate a derived confirmation event based on the execution status and session identifier; wherein, the derived confirmation event indicates that the derived tool call has been executed and the sub-Agent session has been created;

[0094] Step S114.3: Based on the session identifier, obtain the session traffic of the sub-Agent session, and identify the sub-Agent completion event from the session traffic; wherein, the sub-Agent completion event indicates that the sub-Agent session has been completed.

[0095] For example: Execution status can refer to the indicator field of the execution result of the derived tool call, indicating whether the derived tool call was executed successfully; the session identifier corresponds to the sub-Agent session and is unique. Correspondingly, session traffic can refer to the network traffic data corresponding to the sub-Agent session. In a real-world scenario, when the above steps are executed, the execution status field and the session identifier field of the sub-Agent session are parsed from the return result of the derived tool call. Based on the execution status, it is determined that the derived tool call has been successfully executed; based on the session identifier, it is determined that the sub-Agent session has been created, and a derived confirmation event containing the execution status and session identifier is generated. Based on the session identifier, the network traffic data corresponding to the sub-Agent session is located from the network traffic collected from the bypass, and the task completion message of the sub-Agent session is extracted from the session traffic of the sub-Agent session, generating a sub-Agent completion event.

[0096] This embodiment clarifies the generation process of derived confirmation events and sub-Agent completion events through the above methods, providing a reliable data source for subsequent steps.

[0097] In some feasible embodiments, step S114 further includes the following steps:

[0098] The security audit results are output using a two-layer JSON structure. The outer layer is in fileinfo event format for compatibility with security monitoring platforms; the inner layer is in chat.completion format, containing detailed information about the complete tool call history. The security audit results also include the task identifier of the task to which the main agent session belongs, used to deduplicate alerts for the same task.

[0099] This embodiment outputs security audit results through a two-layer JSON structure, which ensures compatibility with the format of existing security monitoring platforms and fully carries the details of cross-session tool call traces, making it easy for security operations and maintenance personnel to view and analyze.

[0100] In some feasible embodiments, the session identifier can be mapped to the child_session_key field, which is extracted from the child Agent session creation confirmation information in the return result of the derived tool call.

[0101] In some of these embodiments, Figure 4 This is a flowchart illustrating the process of establishing a cross-session association between a child agent session and a primary agent session, as provided in this embodiment. Please refer to it. Figure 4 Step S120, which is the step of establishing a cross-session association between the sub-Agent session and the main agent session based on the session identifier of the sub-Agent session and the information of the main agent session carried in the derived confirmation event, specifically includes the following steps:

[0102] Step S121: Obtain the task identifier of the task corresponding to the main Agent session;

[0103] Step S122: Generate a cross-session mapping record based on the session identifier and the task identifier;

[0104] Step S123: Store the cross-session mapping records into the mapping table; use the mapping table as a cross-session association;

[0105] Specifically, the mapping table is used to query the task corresponding to the main agent session when network traffic carrying a session identifier is received.

[0106] For example: a task identifier refers to a unique identifier of the task to which the main agent session belongs; a cross-session mapping record refers to a record of the correspondence between the session identifier of a sub-agent session and the task identifier of the task to which the main agent session belongs. Correspondingly, a mapping table refers to a data structure used to store cross-session mapping records. In a real-world scenario, when the above steps are executed, the task identifier of the task to which the main agent session belongs is obtained from the context of the main agent session, the session identifier and the task identifier are combined into a cross-session mapping record, and the cross-session mapping record is written into the mapping table. Subsequently, when network traffic carrying the session identifier of a sub-agent session is received, the task to which the main agent session to which the sub-agent session belongs can be determined by querying the mapping table.

[0107] In this embodiment, the session identifier in the derived confirmation event and the task identifier of the main agent session are used to generate a cross-session mapping record and store it in a mapping table. The mapping table is used as the carrier for cross-session association, and the subsequent network traffic of the sub-agent session is dynamically associated with the task to which the main agent session belongs.

[0108] In some feasible embodiments, in step S121, the information of the main agent session includes the main agent session identifier, and the task identifier is generated based on the hash value of the main agent session identifier and the user task text. Specifically, the main agent session identifier corresponding to the main agent session is obtained, the user task text is hashed to obtain the task hash value, and the task identifier is generated based on the main agent session identifier and the task hash value.

[0109] In some feasible embodiments, the cross-session mapping record in step S122 can be understood with reference to the following example:

[0110] The cross-session mapping record contains the session identifier of the sub-Agent session, the task identifier of the task to which the main Agent session belongs, and the derived confirmation event identifier of the derived confirmation event. In step S123, the mapping table uses the session identifier as the index key and the task identifier and derived confirmation event identifier as the mapping values. When network traffic carrying the session identifier is received, the corresponding task to which the main Agent session belongs is obtained by querying the mapping table.

[0111] In some of these embodiments, Figure 5 This is a flowchart of the cross-session agent tool call execution graph provided in this embodiment. Please refer to it. Figure 5 Step S130, which is the step of constructing the cross-session agent tool call execution graph based on the derived call event, derived confirmation event, sub-Agent completion event, and cross-session association, specifically includes the following steps:

[0112] Step S131: Create the main agent node corresponding to the main agent and the child agent node corresponding to the child agent;

[0113] Step S132: Combine the derived call event, the derived confirmation event, and the sub-Agent completion event with the main Agent node and the sub-Agent node respectively to construct the corresponding event edges;

[0114] Step S133: Based on the cross-session association, construct a cross-session association edge from the task to which the main Agent node belongs to the child Agent node;

[0115] Step S134: Perform corresponding combinations on the main Agent node, sub-Agent, event edge, and cross-session association edge to construct the cross-session Agent tool call execution graph.

[0116] For example: a main agent node can refer to the node representation of a main agent session in the graph; a child agent node can refer to the node representation of a child agent session in the graph. Correspondingly, an event edge can refer to an edge constructed based on derived call events, derived confirmation events, and child agent completion events; a cross-session association edge can refer to an edge constructed based on cross-session associations to connect the task to which the main agent node belongs with the child agent node. In a real-world scenario, when the above steps are executed, a main agent node and a child agent node are created in the graph respectively. An edge connecting the main agent node and the derived tool call is constructed based on the derived call event. An edge connecting the derived tool call and the child agent node is constructed based on the derived confirmation event. An edge connecting the child agent node and the task completion status is constructed based on the child agent completion event. An edge connecting the task to which the main agent node belongs and the child agent node is constructed based on the cross-session association. The above nodes and edges are combined into a cross-session agent tool call execution graph.

[0117] This embodiment uses the above methods to fully present the execution relationships of the main agent, sub-agent, cross-session association, and three types of events in the cross-session agent tool call execution graph, thereby establishing a complete execution path for the cross-session agent tool call chain.

[0118] In some further embodiments, Figure 6 This is a flowchart of the process for constructing event edges based on three types of events and Agent nodes, provided in this embodiment. Please refer to it. Figure 6 Step S132, which involves combining the derived call event, derived confirmation event, and sub-Agent completion event with the main Agent node and sub-Agent node respectively to construct the corresponding event edges, specifically includes the following steps:

[0119] Step S132.1: Based on the derived call event, construct a derived call edge from the main Agent node to the derived tool call;

[0120] Step S132.2: Based on the derived confirmation event, construct a derived confirmation edge from the derived tool call pointing to the child Agent node;

[0121] Step S132.3: Based on the sub-Agent completion event, construct a sub-Agent completion edge pointing from the sub-Agent node to the task completion status.

[0122] For example: A derived call edge represents an edge initiated by the main agent when a derived tool call is made, with its direction pointing from the main agent node to the derived tool call. A derived confirmation edge represents an edge that the derived tool call has been executed and a sub-agent session has been created, with its direction pointing from the derived tool call to the sub-agent node. A sub-agent completion edge represents an edge that the sub-agent session has been completed, with its direction pointing from the sub-agent node to the task completion status. In a real-world scenario, when the above steps are executed, based on the main agent node and sub-agent node already created in the cross-session agent tool call execution graph, derived call edges pointing from the main agent node to the derived tool call are added to the graph according to the derived call event; derived confirmation edges pointing from the derived tool call to the sub-agent node are added to the graph according to the derived confirmation event; and sub-agent completion edges pointing from the sub-agent node to the task completion status are added to the graph according to the sub-agent completion event, thus mapping the three types of events to directed edges in the graph.

[0123] In this embodiment, the derived call event, derived confirmation event, and sub-Agent completion event are constructed as derived call edge, derived confirmation edge, and sub-Agent completion edge, respectively, through the above-mentioned means, so as to clearly express the temporal and logical relationships of the three types of events in the graph.

[0124] In some of these embodiments, Figure 7 This is a flowchart of the security audit performed based on the cross-session Agent tool call execution graph provided in this embodiment. Please refer to it. Figure 7 Step S140 specifically includes the following steps:

[0125] Step S141: Perform an integrity check on the cross-session Agent tool call execution graph and obtain the check result;

[0126] Step S142: When the judgment result indicates that the cross-session Agent tool call execution graph is complete, obtain the tool call trajectory of the main Agent session and the tool call trajectory of the sub-Agent session according to the cross-session Agent tool call execution graph;

[0127] Step S143: Merge the tool call trace of the main Agent session and the tool call trace of the sub-Agent session into a complete tool call trace;

[0128] Step S144: Perform a security audit on the complete tool call trajectory to obtain the security audit results;

[0129] Step S145: Based on the security audit results, generate task-level alarms for the tasks corresponding to the main Agent session, and perform deduplication on task-level alarms for the same task.

[0130] For example: Integrity assessment can refer to the process of detecting the integrity of events in the cross-session Agent tool call execution graph. Tool call trajectory can refer to the sequence record of tool calls and return results within an Agent session; complete tool call trajectory can refer to the complete sequence obtained by merging the tool call trajectories of the main Agent session and the tool call trajectories of the sub-Agent sessions according to the execution time sequence; both can be read from the cross-session Agent tool call execution graph. Task-level alarms can refer to alarms generated at the granularity of the task to which the main Agent session belongs; multiple incremental alarms for the same task will be converged into a single task-level alarm.

[0131] This embodiment uses the integrity of the cross-session Agent tool call execution graph as the trigger condition. When the graph is complete, the tool call trajectories of the main Agent session and the sub-Agent session are merged for security auditing. Alarm deduplication is performed at the task level, so that multiple audits of the same task converge into a single task-level alarm, avoiding alarm fragmentation.

[0132] In some further embodiments, Figure 8 This is a flowchart of the execution integrity judgment for cross-session Agent tool call execution graph provided in this embodiment. Please refer to it. Figure 8 Step S141 specifically includes the following steps:

[0133] In a cross-session agent tool call execution graph, the graph is considered complete when it contains a derived call event, a derived confirmation event, and a sub-agent completion event.

[0134] If at least one of the following events is missing in the cross-session agent tool call execution graph: a derived call event, a derived confirmation event, or a sub-agent completion event, the cross-session agent tool call execution graph is considered incomplete.

[0135] Specifically, the event edges in the cross-session Agent tool call execution graph are traversed, and the derived call event, derived confirmation event, and sub-Agent completion event are checked one by one to see if they all exist. If all three types of events are present, the decision graph is complete; if any one is missing, the decision graph is incomplete.

[0136] In some feasible embodiments, step S141 further includes the following steps:

[0137] To determine if a cross-session agent tool call execution graph is complete, the following conditions must be met simultaneously: the cross-session agent tool call execution graph contains derived call events, derived confirmation events, and sub-agent completion events; the cross-session agent tool call execution graph contains at least one main agent node and one sub-agent node; the tool call trajectory of the main agent session has been written to the trajectory storage; the tool call trajectory of the sub-agent session has been written to the trajectory storage; and the number of tool call steps in the merged complete tool call trajectory is greater than a preset threshold. If any of the above conditions are not met, the cross-session agent tool call execution graph is considered incomplete.

[0138] This embodiment uses multiple conditions to jointly determine graph integrity, ensuring that security audits are triggered only when the structural and data integrity of the cross-session Agent tool call execution graph meets the requirements, thus avoiding misjudgments due to incomplete graph structure or trajectory data.

[0139] In some feasible embodiments, steps S142 and S143 can be understood with reference to the following examples:

[0140] The tool call trajectories of the main agent session and the sub-agent sessions are stored separately in the trajectory storage. The trajectory storage includes a main agent trajectory storage area and a sub-agent trajectory storage area. The tool call trajectories of the main agent session are written to the main agent trajectory storage area in timestamp order, and the tool call trajectories of the sub-agent sessions are written to the sub-agent trajectory storage area in timestamp order. In step S143, after reading from the main agent trajectory storage area and the sub-agent trajectory storage area respectively, they are merged into a complete tool call trajectories in timestamp order.

[0141] This embodiment stores the tool call trajectories of the main Agent session and the sub-Agent session separately and merges them by timestamp, providing a complete cross-session tool call timing sequence for security auditing.

[0142] In some feasible embodiments, the desensitization process in step S144 can be understood by referring to the following example: In the security audit results, field-level desensitization is performed on sensitive parameters and tool call return content, and the SHA256 hash value of the desensitized content is retained for post-verification.

[0143] This embodiment de-identifies sensitive content in the security audit results, thus protecting sensitive information from being leaked while retaining the hash value for subsequent verification of the integrity and authenticity of the audit results.

[0144] In some feasible embodiments, the alarm deduplication in step S145 can be understood with reference to the following examples:

[0145] An alarm deduplication flag is generated based on the task identifier of the task to which the main Agent session belongs. When a task-level alarm is generated for the first time, the alarm deduplication flag is stored in the preset alarm deduplication storage. When a task-level alarm for the same task is generated again, if the alarm deduplication flag is detected to already exist in the alarm deduplication storage, the alarm will not be generated again.

[0146] This embodiment uses an alarm deduplication flag to deduplicate multiple alarms for the same task, so that multiple audits of the same cross-session task generate only one task-level alarm, thus avoiding alarm fragmentation.

[0147] In some further embodiments, Figure 9 This is a flowchart of the cross-session Agent tool call execution graph provided in this embodiment. Please refer to it. Figure 9 When the judgment result indicates that the cross-session Agent tool call execution graph is incomplete, the method also includes the following steps:

[0148] When the judgment result indicates that the cross-session Agent tool call execution graph is incomplete, the incremental tool call execution of the main Agent session is bypassed, and the missing events in the derived call event, derived confirmation event, and sub-Agent completion event are waited for to arrive.

[0149] For example: Bypass processing, meaning that during the period when the cross-session agent tool call execution graph is incomplete, no alarms are triggered for tool calls arriving subsequently in the main agent session. Incremental tool calls can refer to all tool calls arriving in the main agent session during the period when the graph is incomplete. Specifically, when it is detected that at least one of the following is missing in the cross-session agent tool call execution graph: a derived call event, a derived confirmation event, or a sub-agent completion event, the system will temporarily not trigger security alarms for incremental tool calls arriving subsequently in the main agent session, and will continue to monitor the bypass-collected network traffic to wait for the missing event to arrive. Security auditing will be performed uniformly after the missing event is added to the cross-session agent tool call execution graph.

[0150] This embodiment bypasses the incremental tool call when the graph is incomplete, avoiding fragmented intermediate alarms caused by the incomplete graph construction, while continuing to wait for missing events until the graph is complete and a unified security audit is triggered.

[0151] In some feasible embodiments, the termination condition of bypass processing can be understood by referring to the following example: During the period when the cross-session Agent tool call execution graph is incomplete, all incremental tool calls that subsequently arrive in the main Agent session are bypassed until the cross-session Agent tool call execution graph is complete and a unified security audit is triggered, at which point the bypass processing terminates.

[0152] In some feasible embodiments, when the determination result indicates that the cross-session Agent tool call execution graph is incomplete, the step of bypassing the incremental tool call for the main Agent session and waiting for the missing event among the derived call event, derived confirmation event, and child Agent completion event to arrive can be understood with reference to the following example:

[0153] When the sub-Agent completion event arrives before the derived confirmation event, the sub-Agent completion event is temporarily stored in the orphan staging area, and an orphan index is created based on the session identifier corresponding to the sub-Agent completion event. The orphan index uses the session identifier as the key and points to the corresponding sub-Agent completion event in the orphan staging area. After the derived confirmation event arrives and a cross-session association is established, the orphan index is queried based on the session identifier, the corresponding sub-Agent completion event is extracted from the orphan staging area, the sub-Agent completion event is written into the corresponding sub-Agent completion edge in the cross-session agent tool call execution graph, and the corresponding sub-Agent completion event and orphan index in the orphan staging area are cleared.

[0154] This embodiment uses the orphan temporary storage area in conjunction with the orphan index to temporarily store the sub-Agent completion event in out-of-order scenarios where the sub-Agent completion event arrives before the derived confirmation event arrives, and then fills it back into the cross-session agent tool call execution graph after the derived confirmation event arrives, thus ensuring the integrity of the cross-session agent tool call execution graph in a distributed environment.

[0155] This application provides a security auditing system for constructing a cross-session agent tool call execution graph based on bypass network traffic. This system is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. The terms "module," "unit," and "subunit" used below refer to combinations of software and / or hardware that perform predetermined functions. Although the system described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0156] The system includes:

[0157] The graph event extraction module is used to identify the derived tool calls of the main agent session based on the network traffic collected by the bypass, and obtain the corresponding derived call events, derived confirmation events and sub-agent completion events; among them, the derived tool calls are used to derive sub-agent sessions;

[0158] The Agent context recognition module is used to establish cross-session associations between sub-Agent sessions and the main Agent session based on the session identifier of the sub-Agent session carried in the derived confirmation event.

[0159] The graph state storage module is used to construct a cross-session agent tool call execution graph based on derived call events, derived confirmation events, sub-Agent completion events, and cross-session associations.

[0160] The graph-aware auditing module is used to perform security audits based on cross-session agent tool calls.

[0161] In some embodiments, the graph event extraction module is further configured to obtain, based on the network traffic collected by the bypass, the call information and return result corresponding to the derived tool call of the main agent session; extract the call identifier and call parameters corresponding to the derived tool call based on the call information; generate a derived call event based on the call identifier and call parameters; wherein, the derived call event represents the main agent requesting the derived sub-agent session; and obtain the corresponding derived confirmation event and sub-agent completion event based on the return result.

[0162] In some further embodiments, the graph event extraction module is also used to extract the execution status corresponding to the derived tool call and the session identifier of the sub-Agent session based on the returned result; generate a derived confirmation event based on the execution status and session identifier; wherein the derived confirmation event indicates that the derived tool call has been executed and the sub-Agent session has been created; obtain the session traffic of the sub-Agent session based on the session identifier, and identify the sub-Agent completion event from the session traffic; wherein the sub-Agent completion event indicates that the sub-Agent session has been completed.

[0163] In some embodiments, the Agent context recognition module is further configured to obtain the task identifier of the task corresponding to the main Agent session; generate a cross-session mapping record based on the session identifier and the task identifier; store the cross-session mapping record in a mapping table; and use the mapping table as a cross-session association; wherein the mapping table is used to query the task corresponding to the main Agent session when network traffic carrying a session identifier is received.

[0164] In some embodiments, the graph state storage module is further configured to create a main agent node corresponding to the main agent and a sub-agent node corresponding to the sub-agent; combine derived call events, derived confirmation events, and sub-agent completion events with the main agent node and sub-agent node respectively to construct corresponding event edges; construct cross-session association edges from the task to which the main agent node belongs to the sub-agent node according to cross-session association; and perform corresponding combinations on the main agent node, sub-agent, event edges, and cross-session association edges to construct a cross-session agent tool call execution graph.

[0165] In some further embodiments, the graph state storage module is also used to construct a derived call edge from the main Agent node to the derived tool call based on the derived call event; construct a derived confirmation edge from the derived tool call to the child Agent node based on the derived confirmation event; and construct a child Agent completion edge from the child Agent node to the task completion status based on the child Agent completion event.

[0166] In some embodiments, the graph-aware auditing module is further configured to: perform integrity judgment on the cross-session Agent tool call execution graph and obtain a judgment result; when the judgment result indicates that the cross-session Agent tool call execution graph is complete, obtain the tool call trajectory of the main Agent session and the tool call trajectory of the sub-Agent session based on the cross-session Agent tool call execution graph; merge the tool call trajectory of the main Agent session and the tool call trajectory of the sub-Agent session into a complete tool call trajectory; perform security audit on the complete tool call trajectory and obtain a security audit result; and generate a task-level alarm for the task corresponding to the main Agent session based on the security audit result, and perform deduplication on the task-level alarms for the same task.

[0167] In some further embodiments, the graph-aware auditing module is also used to determine that the cross-session agent tool call execution graph is complete when it has a derived call event, a derived confirmation event, and a sub-agent completion event; and to determine that the cross-session agent tool call execution graph is incomplete when it lacks at least one of the derived call event, the derived confirmation event, and the sub-agent completion event.

[0168] In some further embodiments, the system further includes an alarm bypass processing module, which is used to perform bypass processing on the incremental tool call of the main agent session when the judgment result indicates that the cross-session agent tool call execution graph is incomplete, and wait for the missing events in the derived call event, derived confirmation event and sub-agent completion event to arrive.

[0169] It should be noted that the above modules can be functional modules or program modules, and can be implemented through software or hardware. For modules implemented through hardware, the above modules can reside in the same processor; or the above modules can be located in different processors in any combination.

[0170] The method embodiments provided in this example can be executed on a terminal, computer, or similar computing device. For example, it can run on a terminal. Figure 10This is a hardware structure block diagram of the terminal for the security auditing method of constructing a cross-session agent tool call execution graph based on bypass network traffic, as described in this embodiment. Figure 10 As shown, a terminal may include one or more ( Figure 10 Only one is shown in the diagram. A processor 102 and a memory 104 for storing data are also included. The processor 102 may be, but is not limited to, a microprocessor (MCU) or a programmable logic device (FPGA). The terminal may also include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that… Figure 10 The structure shown is for illustrative purposes only and does not limit the structure of the terminal described above. For example, the terminal may also include components that are larger than... Figure 10 The more or fewer components shown, or having the same Figure 10 The different configurations shown are illustrated.

[0171] Memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the security auditing method for constructing a cross-session agent tool call execution graph based on bypass network traffic in this embodiment. Processor 102 executes various functional applications and data processing by running the computer programs stored in memory 104, thereby implementing the above-described method. Memory 104 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, memory 104 may further include memory remotely located relative to processor 102, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0172] The transmission device 106 is used to receive or send data via a network. This network includes a wireless network provided by the terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 can be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0173] This embodiment also provides a computer device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0174] Optionally, the computer device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0175] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated in this embodiment.

[0176] Furthermore, in conjunction with the security auditing method for constructing a cross-session agent tool call execution graph based on bypass network traffic provided in the above embodiments, this embodiment can also provide a storage medium for implementation. This storage medium stores a computer program; when executed by a processor, this computer program implements any of the security auditing methods for constructing a cross-session agent tool call execution graph based on bypass network traffic in the above embodiments.

[0177] It should be noted that all information and data involved in this application are authorized by the user or fully authorized by all parties and will be used legally.

[0178] It should be understood that the specific embodiments described herein are merely illustrative of the application and not intended to limit it. All other embodiments derived by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application.

[0179] Obviously, the accompanying drawings are merely some examples or embodiments of this application. Those skilled in the art can apply this application to other similar situations based on these drawings without any creative effort. Furthermore, it is understood that although the work done in this development process may be complex and lengthy, for those skilled in the art, certain design, manufacturing, or production modifications made based on the technical content disclosed in this application are merely conventional technical means and should not be considered as insufficient disclosure of this application.

[0180] The term "embodiment" in this application refers to a specific feature, structure, or characteristic described in connection with an embodiment that may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily imply the same embodiment, nor does it imply that it is mutually exclusive with or independent of other embodiments. It will be clearly or implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0181] The above embodiments merely illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of patent protection. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the scope of protection of this application.

Claims

1. A security auditing method for constructing a cross-session agent tool call execution graph based on bypass network traffic, characterized in that, include: Based on the network traffic collected by the bypass, the derivation tool call execution of the main agent session is identified, and the corresponding derivation call event, derivation confirmation event and sub-agent completion event are obtained; The derived tool call is used to derive a sub-Agent session; Based on the session identifier of the sub-Agent session and the information of the main agent session carried in the derived confirmation event, a cross-session association is established between the sub-Agent session and the main agent session; Based on the derived call event, the derived confirmation event, the sub-Agent completion event, and the cross-session association, construct a cross-session agent tool call execution graph; Security audits are performed based on the cross-session agent tool call execution graph.

2. The security auditing method for constructing a cross-session agent tool call execution graph based on bypass network traffic according to claim 1, characterized in that, The step of identifying derived tool calls in the main agent session based on the network traffic collected via the bypass, and obtaining the corresponding derived call events, derived confirmation events, and sub-agent completion events, includes: Based on the network traffic collected by the bypass, obtain the call information and return results corresponding to the derived tool calls of the main Agent session; Based on the call information, extract the call identifier and call parameters corresponding to the derived tool call; Based on the call identifier and the call parameters, the derived call event is generated; wherein, the derived call event represents the main Agent requesting a derived sub-Agent session; Based on the returned results, the corresponding derived confirmation event and sub-Agent completion event are obtained.

3. The security auditing method for constructing a cross-session agent tool call execution graph based on bypass network traffic according to claim 2, characterized in that, The step of obtaining the corresponding derived confirmation event and sub-Agent completion event based on the returned result includes: Based on the returned results, extract the execution status corresponding to the derived tool call and the session identifier of the sub-Agent session; Based on the execution status and the session identifier, the derived confirmation event is generated; wherein, the derived confirmation event indicates that the derived tool call has been executed and the sub-Agent session has been created; Based on the session identifier, obtain the session traffic of the sub-Agent session, and identify the sub-Agent completion event from the session traffic; wherein, the sub-Agent completion event indicates that the sub-Agent session has been completed.

4. The security auditing method for constructing a cross-session agent tool call execution graph based on bypass network traffic according to claim 1, characterized in that, The step of establishing a cross-session association between the sub-Agent session and the main agent session based on the session identifier of the sub-Agent session carried in the derived confirmation event and the information of the main agent session includes: Obtain the task identifier of the task corresponding to the main Agent session; Generate a cross-session mapping record based on the session identifier and the task identifier; Store the cross-session mapping record in a mapping table; use the mapping table as the cross-session association; The mapping table is used to query the task corresponding to the main agent session when network traffic carrying the session identifier is received.

5. The security auditing method for constructing a cross-session agent tool call execution graph based on bypass network traffic according to claim 1, characterized in that, The step of constructing a cross-session agent tool call execution graph based on the derived call event, the derived confirmation event, the sub-Agent completion event, and the cross-session association includes: Create the main agent node corresponding to the main agent; create the sub-agent node corresponding to the sub-agent; The derived call event, the derived confirmation event, and the sub-Agent completion event are combined with the main agent node and the sub-agent node respectively to construct corresponding event edges; Based on the cross-session association, construct a cross-session association edge from the task to which the main Agent node belongs to the sub-Agent node; The main Agent node, the child Agent node, the event edge, and the cross-session association edge are combined accordingly to construct the cross-session Agent tool call execution graph.

6. The security auditing method for constructing a cross-session agent tool call execution graph based on bypass network traffic according to claim 5, characterized in that, The step of combining the derived call event, the derived confirmation event, and the sub-Agent completion event with the main agent node and the sub-Agent node respectively to construct corresponding event edges includes: Based on the derived call event, construct a derived call edge from the main Agent node to the derived tool call; Based on the derived confirmation event, construct a derived confirmation edge pointing from the derived tool call to the child Agent node; Based on the sub-Agent completion event, construct a sub-Agent completion edge pointing from the sub-Agent node to the task completion status.

7. The security auditing method for constructing a cross-session agent tool call execution graph based on bypass network traffic according to claim 1, characterized in that, The step of performing security audit based on the cross-session agent tool call execution graph includes: The cross-session Agent tool is invoked to perform an integrity check on the execution graph, and the check result is obtained. When the judgment result indicates that the cross-session Agent tool call execution graph is complete, the tool call trajectory of the main Agent session and the tool call trajectory of the sub-Agent session are obtained according to the cross-session Agent tool call execution graph; The tool call trajectory of the main agent session and the tool call trajectory of the sub-agent session are merged into a complete tool call trajectory; Perform a security audit on the complete tool call trajectory to obtain the security audit results; Based on the security audit results, a task-level alarm is generated for the task corresponding to the main Agent session, and deduplication is performed on the task-level alarms for the same task.

8. The security auditing method for constructing a cross-session agent tool call execution graph based on bypass network traffic according to claim 7, characterized in that, The integrity judgment of the cross-session Agent tool call execution graph, and the resulting judgment, include: When the cross-session agent tool call execution graph contains the derived call event, the derived confirmation event, and the sub-agent completion event, the cross-session agent tool call execution graph is determined to be complete. If at least one of the following events is missing in the cross-session Agent tool call execution graph: the derived call event, the derived confirmation event, and the sub-Agent completion event, the cross-session Agent tool call execution graph is determined to be incomplete.

9. The security auditing method for constructing a cross-session agent tool call execution graph based on bypass network traffic according to claim 7 or claim 8, characterized in that, The method further includes: When the judgment result indicates that the cross-session Agent tool call execution graph is incomplete, bypass processing is performed on the incremental tool call of the main Agent session, and the missing events in the derived call event, the derived confirmation event, and the sub-Agent completion event are waited for to arrive.

10. A security auditing system for constructing a cross-session agent tool call execution graph based on bypass network traffic, characterized in that, include: The graph event extraction module is used to identify the derived tool calls of the main agent session based on the network traffic collected by the bypass, and obtain the corresponding derived call events, derived confirmation events and sub-agent completion events; wherein, the derived tool call is used to derive the sub-agent session; The Agent context identification module is used to establish a cross-session association between the sub-Agent session and the main Agent session based on the session identifier of the sub-Agent session carried in the derived confirmation event; The graph state storage module is used to construct a cross-session agent tool call execution graph based on the derived call event, the derived confirmation event, the sub-Agent completion event, and the cross-session association. The graph-aware auditing module is used to perform security audits on graphs based on the cross-session Agent tool call.

Images