Method and apparatus for managing permissions of an agent

Abstract

The present disclosure provides an agent permission control method and device, relates to the field of artificial intelligence, and particularly relates to the field of information security. The specific implementation scheme is as follows: in response to detecting that an agent starts a task, loading benchmark calling information of the task; comparing system calling event information of the task in a detection time window with the benchmark calling information to determine a behavior deviation degree of the agent; and controlling the permission of the agent based on the behavior deviation degree.

Description

Technical Field

[0001] This disclosure relates to the field of artificial intelligence, and more particularly to the field of information security, specifically to a method and apparatus for controlling the access rights of intelligent agents. Background Technology

[0002] With the rapid development of artificial intelligence technology, agents based on large language models have the ability to automatically execute code, manipulate files, and access system resources in sandbox environments. In enterprise private deployment scenarios, agents are widely used to automate tasks such as code generation and execution, data processing, and system maintenance. Their execution environment is typically secured by containerized sandboxes (such as isolated environments based on Linux namespaces and control groups).

[0003] However, increasingly capable agents have proven able to proactively detect and exploit security vulnerabilities in sandbox environments. Once an agent breaches the sandbox isolation boundary, it may directly access sensitive data resources on the corporate intranet (such as database credentials, internal application programming interface keys, and user privacy data), or even use the sandbox host as a springboard to laterally penetrate other intranet systems. Summary of the Invention

[0004] This disclosure provides a method, apparatus, device, storage medium, and computer program product for controlling the permissions of intelligent agents.

[0005] According to a first aspect of this disclosure, a method for controlling the permissions of an intelligent agent is provided, comprising: in response to detecting that an intelligent agent has started a task, loading baseline call information of the task; comparing the system call event information of the task within the detection time window with the baseline call information to determine the behavioral deviation degree of the intelligent agent; and controlling the permissions of the intelligent agent based on the behavioral deviation degree.

[0006] According to a second aspect of this disclosure, an access control device for an intelligent agent is provided, comprising: a loading unit configured to load baseline call information of a task in response to detecting that an intelligent agent has started a task; a comparison unit configured to compare system call event information of the task within a detection time window with the baseline call information to determine the behavioral deviation of the intelligent agent; and a control unit configured to control the access of the intelligent agent based on the behavioral deviation.

[0007] According to a third aspect of this disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method described in any one of the first aspects.

[0008] According to a fourth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are used to cause the computer to perform the method described in any one of the first aspects.

[0009] According to a fifth aspect of this disclosure, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the method described in any one of the first aspects.

[0010] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0011] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein: Figure 1 This is an exemplary system architecture diagram to which one embodiment of this disclosure can be applied; Figure 2 This is a flowchart of an embodiment of the intelligent agent permission control method according to the present disclosure; Figure 3 This is a schematic diagram of an application scenario of the intelligent agent permission control method disclosed herein; Figure 4 This is a flowchart of yet another embodiment of the intelligent agent permission control method according to the present disclosure; Figure 5 This is a schematic diagram of a structure of an embodiment of the access control device for intelligent agents according to the present disclosure; Figure 6 This is a schematic diagram of the structure of a computer system suitable for implementing embodiments of the present disclosure. Detailed Implementation

[0012] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0013] Figure 1 An exemplary system architecture is shown that can be applied to embodiments of the agent permission management method or agent permission management device disclosed herein.

[0014] like Figure 1 As shown, this system consists of four core modules: 1. System call monitoring and feature acquisition module: Input: The raw system call event stream generated by the Agent sandbox environment (including system call number, parameter list, return value, call timestamp, and calling process identifier); the operation declaration output by the Agent through the task framework (including the declared operation type and target resource description).

[0015] Core logic: Deploy lightweight event probes at the sandbox kernel layer to intercept and record all system call events initiated by the Agent process and its child processes with near-zero overhead. Perform multi-dimensional feature extraction on each system call event: call category features (mapping system call numbers to semantic categories—file operations, process management, network communication, memory management, permission changes), parameter semantic features (parsing key fields such as path, port number, and permission flags in the call parameters and labeling their sensitivity), and timing features (call timestamp and time interval with previous calls). Synchronously collect the Agent's task output declarations, parse them into standardized operation intent descriptions (operation type + target resource + expected effect), and align them with the system call feature stream for subsequent consistency verification.

[0016] Output: A structured sequence of system call feature vectors (sent to the baseline profiling module and the multi-layer anomaly detection module); standardized agent operation statements (sent to the multi-layer anomaly detection module for consistency verification layer).

[0017] Interaction with other modules: Continuously send feature vector sequences to the baseline profiling modeling module for online updates of the baseline profiling; send real-time feature streams and Agent operation declarations to the multi-layer anomaly detection module for three-layer detection.

[0018] Example: In the "Automated Code Testing" task, the Agent executes a test script, and the probe captures the following system call sequence: openat(AT_FDCWD, " / workspace / test_runner.py", O_RDONLY) → read(fd=3, buf=..., count=4096) → execve(" / usr / bin / python3", ["python3", "test_runner.py"]) → write(fd=1, "Test passed\n"). The module extracts this sequence into a feature vector sequence: [{Category: File Operation - Read, Resource: Working Directory - Regular File, Sensitivity: Low}, {Category: File Operation - Read, Resource: File Descriptor, Sensitivity: Low}, {Category: Process Management - Execution, Resource: Standard Interpreter, Sensitivity: Medium}, {Category: File Operation - Write, Resource: Standard Output, Sensitivity: Low}].

[0019] 2. Baseline Portrait Modeling Module: Inputs: Task description and type identifier submitted by the Agent sandbox environment when the task starts (used to select or create the corresponding baseline profile, i.e., baseline call information) and task completion event reported when the task is completed (used to trigger baseline profile solidification); feature vector sequence continuously sent by the system call monitoring and feature acquisition module; detection status fed back by the multi-layer anomaly detection module (used to control the security gating of baseline profile updates).

[0020] Core logic: Maintain an independent baseline profile for each Agent task type. The baseline profile comprises two dimensions: a frequency baseline (i.e., baseline frequency distribution) – recording the normal frequency distribution (mean and standard deviation) of each system call category within a standard time window; and a sequence baseline (i.e., baseline sequence set) – recording the set of n-grams of system calls occurring under normal execution conditions. The baseline profile is incrementally updated through an online learning mechanism: the frequency baseline parameters are updated using an exponentially weighted moving average algorithm, and the sequence baseline is updated using incremental expansion of the set. Key safety constraints: Baseline profile updates are only performed when the multi-layered anomaly detection module confirms there are no anomalies in the current time period (the overall score is below the update safety threshold), preventing abnormal behavior from contaminating the baseline profile.

[0021] Output: Baseline profile parameters for the current task type (including frequency baseline and sequence baseline) are sent to the multi-layer anomaly detection module for deviation calculation.

[0022] Interaction with other modules: Receive task descriptions and type identifiers submitted by the Agent sandbox environment for baseline profile selection; receive task completion events for baseline solidification; receive feature vector sequences from the system call monitoring and feature acquisition modules for baseline updates; receive detection status feedback from the multi-layer anomaly detection module for security gating; push baseline profile parameters to the multi-layer anomaly detection module.

[0023] Example: After learning from multiple successful executions of "code testing" tasks, the system established a frequency baseline profile showing that, within the standard time window, this task type had an average of 45 file read operations per standard deviation (SCD) of 12, an average of 8 process execution operations per standard deviation (SCD) of 3, and an average of 2 network connection operations per standard deviation (SCD) of 1.5. The sequence baseline includes normal n-gram sets such as {openat-read-close, execve-write-write, socket-connect-write-read}, etc.

[0024] 3. Multi-layer anomaly detection module: Input: Real-time feature stream and Agent operation declaration sent by the system call monitoring and feature acquisition module; baseline profile parameters (frequency baseline + sequence baseline) pushed by the behavior baseline profile modeling module.

[0025] Core logic: For each detection time window, anomaly detection is performed from three orthogonal dimensions. The first layer is frequency anomaly detection: The frequency of each system call category within the current window is statistically analyzed and its deviation from the frequency baseline is calculated to detect abnormally dense system call patterns (e.g., a large number of openat+read calls within a short period may indicate file system scanning behavior). The second layer is sequence pattern anomaly detection: The system call n-gram sequence within the current window is extracted, and its deviation from the sequence baseline is calculated (i.e., how many new n-grams outside the baseline appear). Simultaneously, sub-sequence matching is performed with a known attack pattern library (e.g., ptrace-mmap-execve privilege escalation sequence, socket-connect-write reverse shell sequence). The third layer is output behavior consistency verification: The Agent's operation declarations are mapped to the expected set of system call categories, and cross-validated with the actual observed set of system call categories to calculate the proportion of operations outside the declarations. The three-layer scores are weighted and aggregated into a comprehensive anomaly score (i.e., behavior deviation), and the severity level is determined based on a threshold.

[0026] Output: Comprehensive anomaly score and severity level (sent to the graded response and sandbox control module); detection status feedback (sent to the behavior baseline profiling module for security gating).

[0027] Interaction with other modules: Receives real-time feature streams and Agent operation declarations from the system call monitoring and feature acquisition module; receives baseline profile parameters from the behavior baseline profile modeling module; sends anomaly detection results to the hierarchical response and sandbox management module; and provides feedback on the detection status to the behavior baseline profile modeling module.

[0028] Example: In the "Code Testing" task, the Agent suddenly exhibits a large number of OpenAT calls scanning the / proc directory (frequency baseline deviation), the OpenAT(" / var / run / docker.sock")-connect-write sequence (matching Docker socket escape patterns), and the Agent claims to "run test cases" but actually initiates network connection operations (inconsistent output behavior). All three layers of detection generate high anomaly scores, and the combined score exceeds the freeze threshold, classifying it as a severe anomaly.

[0029] 4. Tiered Response and Sandbox Management Module: Input: Anomaly detection results sent by the multi-layer anomaly detection module (overall anomaly score + severity level + scores for each layer's sub-items).

[0030] Core Logic: A four-tiered response is implemented based on severity level. **Normal Allow:** If the overall score is below the alarm threshold, no intervention is taken. **Minor Alarm:** If the overall score is within the alarm range, an alarm event is recorded and a notification is sent to the security management platform. The agent continues to execute normally, but the monitoring granularity is automatically enhanced. **Moderate Restriction:** If the overall score is within the restriction range, the system call scope of the agent sandbox is downgraded to a security whitelist mode (allowing only a predefined set of low-risk system calls), file access is restricted to the working directory and temporary directory, and new network connections are blocked. **Severe Freeze:** If the overall score exceeds the freeze threshold, all processes in the sandbox are immediately frozen, a complete runtime state snapshot is saved (system call execution trace, process state tree, file system change differences, network connection table), agent execution is terminated, and an emergency security alarm is sent to the security management platform. All response actions and their triggering basis are fully recorded in the audit log, supporting post-event security auditing and escape path reconstruction.

[0031] Output: Control commands (sent to the Agent sandbox environment to execute specific security control actions); alarm notifications and audit reports (sent to the security management platform for administrator review).

[0032] Interaction with other modules: Receive anomaly detection results from the multi-layer anomaly detection module; send control commands to the Agent sandbox environment; push alarm notifications and audit reports to the security management platform.

[0033] Example: The multi-layered anomaly detection module determines a certain detection window as "moderately abnormal" (overall score 0.55, exceeding the limit threshold of 0.4 but below the freeze threshold of 0.8). The tiered response module executes a restricted response: the Agent's system call scope is downgraded to whitelist mode, retaining only basic system calls such as read, write (limited to standard output / standard error), openat (limited to working directory prefix), close, and exit_group, while blocking high-risk system calls such as socket, connect, and execve. The Agent can still read open files to complete the current work steps, but cannot initiate new process creation or network connections. Simultaneously, a restriction event notification is sent to the security management platform, allowing the administrator to view the specific anomaly indicators that triggered the restriction and decide whether to manually restore the Agent's full permissions or terminate the task.

[0034] Continue to refer to Figure 2 The diagram illustrates a flow 200 of an embodiment of an intelligent agent permission control method according to the present disclosure. The intelligent agent permission control method includes the following steps: Step 201: In response to detecting that the agent has started a task, load the baseline call information for the task.

[0035] In this embodiment, when the Agent sandbox environment starts an Agent task, it submits a task description and type identifier to the behavior baseline profiling module. The baseline modeling module loads the existing baseline profile (i.e., baseline call information) according to the task type; if it is the first time this task type is executed, a blank profile is initialized and a global default baseline is used. The baseline profile parameters are then pushed to the multi-layer anomaly detection module, and the system enters real-time monitoring mode.

[0036] The frequency standard deviation of the global default baseline is preset to an empirical value that reflects the common frequency fluctuation range across task types. The n-gram set of the global default baseline contains common normal sequence patterns across task types (such as common operation sequences such as openat-read-close, execve-write-write, etc.).

[0037] Different types of business tasks are pre-configured with exclusive baseline call information. The baseline call information is a set of standard system call behaviors under the normal and compliant execution state of the task. Specifically, it may include standardized behavioral data such as the system interfaces that the task is allowed to call, the range of call parameters, the call frequency threshold, the call timing rules, and the range of accessible resources.

[0038] Step 202: Compare the system call event information of the task within the detection time window with the baseline call information to determine the deviation of the agent's behavior.

[0039] In this embodiment, when the Agent executes code and calls system resources in the sandbox, the system call monitoring and feature acquisition module captures all system call event information generated by the Agent process and its child processes in real time through a kernel probe. The module also collects the operation declarations output by the Agent through the task framework and standardizes these declarations into a unified operation intent description format.

[0040] The detection time window (i.e., the standard time window ΔT) is a standard duration periodic time interval pre-configured during system deployment, serving as the basic unit of measurement for system call event aggregation and anomaly detection.

[0041] The collected real-time system call event information is compared with the loaded baseline call information in a comprehensive, line-by-line manner. The behavioral deviation of the agent is quantified from multiple dimensions, including call interface compliance, parameter rationality, frequency matching, resource access range, and temporal behavior patterns. In this embodiment, the behavioral deviation can be quantified using a score of 0-1. A higher score indicates a greater deviation between the agent's real-time behavior and standard compliant behavior, and a higher risk of anomalies.

[0042] Step 203: Control the permissions of the intelligent agent based on the behavioral deviation.

[0043] In this embodiment, a mapping relationship between behavior deviation and permission control strategy is pre-configured. Based on the calculated real-time behavior deviation, the task execution permission, system call permission, and resource access permission of the intelligent agent are dynamically and adaptively controlled to achieve hierarchical processing of compliance release, permission restriction, and permission freezing.

[0044] The method provided in the above embodiments of this disclosure achieves refined monitoring and dynamic permission control of intelligent agent task behavior through a closed-loop process of "benchmark loading - behavior comparison - deviation quantification - hierarchical control". It abandons the traditional fixed permission authorization mode, can accurately identify abnormal calls and unauthorized behaviors in the operation of intelligent agents, tighten or freeze permissions as needed, maximize the security and compliance of intelligent agent automated task execution, and adapt to the security control needs of various intelligent agent automated operation scenarios.

[0045] In some optional implementations of this embodiment, the system call event information of the task within the detection time window is compared with the baseline call information to determine the behavioral deviation of the agent. This includes: parsing the system call number, parameter list, and return value from the system call event information; determining system call features based on the system call number, parameter list, and return value, wherein the system call features include at least one of the following: system call category, parameter semantic features, sensitivity, and timing features; and determining the behavioral deviation of the agent based on the system call features and the baseline call information.

[0046] The raw system call event is transformed into a structured multidimensional feature vector. The core processing steps include: 1. System Call Category Mapping: The module maintains a mapping table between system call numbers and semantic categories. Semantic categories are defined as follows:

[0047] Specifically, parameter semantic sensitivity is obtained by parsing key fields in the parameter list of system calls. The objects of parameter semantic feature extraction include key fields such as "path, port number, and permission flags".

[0048] Permission flags are specific flag fields in system call parameters that indicate the operation permissions or resource access modes requested by the caller. They cover types such as file access mode flags (O_RDONLY / O_WRONLY / O_RDWR) and memory protection flags (PROT_EXEC). The system uses these flags to evaluate the semantic sensitivity of each system call's parameters.

[0049] 2. Parameter Semantic Feature Extraction: Perform semantic parsing on parameters of critical system calls. For file operation system calls, extract the target path and label the target resource sensitivity level according to path prefix rules: working directory prefix ( / workspace / ) is labeled as low sensitivity, temporary directory prefix ( / tmp / ) as low sensitivity, system directory prefix ( / etc / , / proc / , / sys / ) as high sensitivity, and container runtime path ( / var / run / docker.sock, / run / containerd / ) as extremely high sensitivity. For network communication system calls, extract the target address and port number; local loopback addresses are labeled as low sensitivity, and non-loopback addresses are labeled as high sensitivity. Corresponding sensitivity scores can be preset for different sensitivity levels.

[0050] Call categories are the direct foundation for building frequency and sequence baselines; parameter semantics are the pre-input of category mapping, and their extraction results are encoded into the category dimension, determining the fine-grained semantic discrimination capability of the category; target resource sensitivity is a necessary condition for attack pattern matching to take effect, enabling the system to distinguish between normal resource access and sensitive resource access; temporal features ensure the correctness of event sorting and window attribution.

[0051] 3. Feature Vector Construction: Each system call event is encoded into a multi-dimensional feature vector:

[0052] in, For the i-th system call event, Encoding the semantic category of system calls, Score the semantic sensitivity of the parameters. The target resource sensitivity score is given. This refers to the time interval characteristic compared to the preceding call.

[0053] The system pre-stores baseline call information corresponding to the current task. This baseline call information includes multi-dimensional baseline feature data such as the standard system call categories, legal parameter semantic ranges, allowed sensitivity call thresholds, and standard temporal behavior rules corresponding to compliant task execution. The extracted real-time system call features are precisely compared with the baseline call information dimension by dimension to quantify the degree of behavioral deviation in each dimension. Finally, the comprehensive behavioral deviation of the agent is calculated by fusing the data.

[0054] The specific comparison and calculation logic can be as follows: First, perform dimension matching verification. If the real-time call category exceeds the range of call categories allowed by the benchmark, it is directly determined that there is a category deviation. If the parameter semantics point to resources prohibited by the benchmark or exceed the range of legal parameters, it is determined that there is a parameter semantic deviation. If the frequency of high-sensitivity calls exceeds the benchmark threshold, it is determined that there is a sensitivity deviation. If the call timing, frequency, and order do not conform to the standard timing rules, it is determined that there is a timing deviation.

[0055] The system assigns weighted scores to deviations across various dimensions, assigning higher weights to highly sensitive deviations and lower weights to minor, routine deviations. The scores are then normalized to obtain a deviation score within the 0-1 range. A lower deviation score indicates a closer alignment between the agent's real-time behavior and compliant baseline behavior; a higher score indicates more severe abnormal actions by the agent and a higher security risk.

[0056] This embodiment accurately extracts multi-dimensional core features such as call category, parameter semantics, sensitivity, and timing by parsing the call number, parameter list, and return value of system calls. It then compares these features dimension by dimension with the baseline call information corresponding to the task and calculates the deviation of behavior using weighted quantification. This effectively overcomes the shortcomings of traditional single comparison methods, which suffer from low accuracy and difficulty in identifying hidden anomalies. It can comprehensively, precisely, and quantitatively characterize the illegal, out-of-bounds, and abnormal call behaviors during the execution of intelligent agent tasks, significantly improving the accuracy and comprehensiveness of abnormal behavior identification of intelligent agents. This provides reliable and precise quantitative data support for the dynamic and accurate control of intelligent agent permissions, ensuring the security and compliance of intelligent agent task operation.

[0057] In some optional implementations of this embodiment, the benchmark call information includes a benchmark frequency distribution and a benchmark sequence set for each system call category occurring within a detection time window, where each benchmark sequence is an ordered tuple of a predetermined number of consecutive system call categories; and determining the agent's behavioral deviation based on system call characteristics and benchmark call information, including: determining the actual call frequency and actual call sequence for each system call category based on system call characteristics; extracting an actual call subsequence set from the actual call sequence, wherein each actual call subsequence is an ordered tuple of a predetermined number of consecutive system call categories; determining a first deviation based on the benchmark frequency distribution and the actual call frequency; determining a second deviation based on the benchmark sequence set and the actual call subsequence set; and determining the agent's behavioral deviation based on the first and second deviations.

[0058] After acquiring all system call features within the agent detection time window, the system call categories are statistically analyzed to count the number of times each category of system calls occurs, and the actual call frequency of each category of system calls is calculated. At the same time, the system calls are assembled into an ordered sequence of actual calls according to their order of occurrence.

[0059] For example, three call categories are identified: file reading, network connection, and data writing. The call sequence is obtained according to the order of execution: [file reading, data writing, file reading, network connection, data writing]. The actual call frequency of each category is calculated as follows: file reading 0.4, data writing 0.4, and network connection 0.2.

[0060] Subsequently, an ordered tuple consisting of a predetermined number of consecutive system call categories is slid-out from the actual call sequence to generate a set of actual call subsequences. In this embodiment, the predetermined number is set to 2, and a sliding window method is used to traverse the call sequence to extract consecutive binary subsequences; for the example sequence above, the sliding extraction yields a set of subsequences {(file read, data write), (data write, file read), (file read, network connection), (network connection, data write)}.

[0061] The baseline frequency distribution and baseline sequence set corresponding to compliant task operation are pre-saved in the baseline call information. The distance between the actual call frequency of each category and the baseline frequency distribution is calculated to obtain the first deviation degree representing the deviation of call frequency. The extracted actual call subsequence set is matched and compared with the baseline sequence set, and the unmatched and abnormal subsequences are counted to calculate the second deviation degree representing the deviation of behavioral time sequence pattern.

[0062] By setting preset weight coefficients, the first deviation and the second deviation are weighted and fused to obtain the final behavioral deviation of the intelligent agent. The weights can be configured according to business security requirements. In high-risk scenarios, the weight of the second deviation can be increased to prioritize the identification of temporal logic anomalies.

[0063] For example, if the baseline prohibits the occurrence of (file reading, network connection) subsequences, and the actual frequency of network connection class calls far exceeds the baseline frequency, then the first deviation and the second deviation increase simultaneously. After fusion, a higher comprehensive behavioral deviation is obtained, which can accurately identify abnormal agent frequency and abnormal operation timing.

[0064] For each category k in the system call category set K, an example of the formula for calculating the first deviation is shown below, but is not limited to the following formula:

[0065] in, This represents the number of times system calls of category k occur within the current window. and The mean and standard deviation of category k in the baseline frequency distribution. The tolerance coefficient (the allowable range for normal fluctuations, equivalent to the permissible deviation from the baseline). (multiple standard deviations) To prevent division by zero smoothing constants. When the frequencies of all categories are at the baseline. When within the range of 10 ... =0; when the frequency of a certain category significantly exceeds the baseline. Take the normalized value of the deviation of this category, with the upper limit approaching 1.

[0066] Frequency anomaly detection can effectively capture escape preparation behaviors with obvious statistical characteristics, such as agent file system scanning (a large number of openat+read calls in a short period of time) and port scanning (intensive socket+connect calls).

[0067] This embodiment takes into account both the frequency distribution characteristics of system calls and continuous temporal behavior patterns, quantifies the deviation indicators of the frequency dimension and the sequence pattern dimension respectively, and calculates the comprehensive deviation degree by fusion. This avoids the problem of missed detection caused by single-dimensional evaluation. It can not only identify the frequency anomalies of a certain type of system call that are frequently triggered, but also capture the abnormal operation links formed by the disordered combination of legitimate call categories, improve the ability of the agent to identify hidden abnormal behaviors, and make the behavior deviation degree evaluation results more comprehensive and objective.

[0068] In some optional implementations of this embodiment, determining the second deviation degree based on the baseline sequence set and the actual call subsequence set includes: determining the sequence deviation degree based on the proportion of actual call subsequences in the actual call subsequence set that are not in the baseline sequence set; matching the actual call subsequence set with the longest common subsequence of a preset attack pattern library to determine the attack matching degree; and determining the maximum value between the sequence deviation degree and the attack matching degree as the second deviation degree.

[0069] After obtaining the actual call subsequence set corresponding to the detection window and the baseline sequence set corresponding to the task, the sequence deviation is first calculated: All subsequences within the actual call subsequence set are traversed, and the number of abnormal subsequences not present in the baseline sequence set is counted. The abnormal subsequence ratio is obtained by dividing the number of abnormal subsequences by the total number of actual call subsequences, and this ratio is used as the sequence deviation. The sequence deviation ranges from 0 to 1; a higher value indicates a greater degree of deviation from the normal business behavior pattern in the continuous system call combinations of the agent.

[0070] For example: if the sliding window length is set to 3, and the actual subsequence set contains 10 subsequences, of which 4 subsequences do not appear in the baseline sequence set, then the sequence deviation calculation result is 0.4.

[0071] Secondly, a malicious behavior matching operation is performed: a pre-built attack pattern library is loaded, which stores standard system call sub-sequence templates corresponding to various malicious behaviors such as intrusion and unauthorized data theft. Using the longest common sub-sequence algorithm, each sub-sequence in the actual call sub-sequence set is sequentially matched with each attack template in the attack pattern library for similarity. The maximum similarity value among all matching results is taken as the attack matching degree, which also ranges from 0 to 1. The higher the attack matching degree, the higher the similarity between the current call sequence pattern and the known malicious behavior chain.

[0072] Typical attack patterns include:

[0073] After calculating the sequence deviation and attack matching degree, the maximum value between the sequence deviation and attack matching degree is selected as the second deviation degree.

[0074] For example, if the calculated sequence deviation is 0.35 and the attack matching degree is 0.72, then the maximum value of 0.72 is taken as the second deviation. This mechanism realizes risk optimization judgment: when the agent's behavior only slightly deviates from the normal business benchmark, but highly matches the known attack chain, the higher attack matching degree is directly used to represent the temporal risk; if there are no attack features and only business behavior deviation occurs, then the sequence deviation degree is used to represent the risk level.

[0075] Examples of formulas for calculating sequence deviation are shown below, but are not limited to the following formulas:

[0076] in, Represents the set of benchmark sequences. This represents the actual subsequence of calls. L is the total number of system call events within the window, and n is the length of the n-gram.

[0077] The numerator is the number of n-grams matching the baseline in the current window, and the denominator (L - n + 1) is the total number of n-grams in the current window. (L - n + 1) is the exact number of consecutive n-grams that can be extracted from an ordered sequence of length L. For a sequence... The starting position of a consecutive n-gram can be taken from the first element to the (L - n + 1)th element, so exactly (L - n + 1) n-grams can be extracted. For example, if there are L=10 system call events in the window and the n-gram length n=3, then 10 - 3 + 1 = 8 triples can be extracted (starting positions are 1, 2, 3, 4, 5, 6, 7, 8 respectively).

[0078] The higher the value, the greater the deviation between the current window's system call sequence pattern and the historical normal pattern.

[0079] An example of the formula for calculating attack matching score is shown below, but it is not limited to the following formula:

[0080] in, For attack mode library, Let |p| be the longest common subsequence of the current window sequence and attack pattern p, where |p| is the length of the attack pattern. A higher matching ratio indicates a greater similarity between the current behavior and a known attack pattern.

[0081] The second deviation is taken as the larger value of the two dimensions:

[0082] This design ensures that even if a certain escape behavior has not yet been recorded in the attack pattern library ( (Low), as long as its system call sequence deviates significantly from the normal baseline ( Even with high-resolution (high-resolution) attacks, they can still be detected. Conversely, even if the agent cleverly disperses the attack sequence to reduce n-gram deviation, as long as it contains the core subsequence of a known attack pattern, High scores can still be generated. The two dimensions form a complementary detection mechanism.

[0083] This embodiment quantifies the temporal deviation of the agent from the normal business process by the proportion of illegal subsequences. On the other hand, it identifies call chains similar to known malicious behaviors by matching the longest common subsequence. By taking the maximum value of the two as the second deviation, it can prioritize the identification of high-risk malicious temporal behaviors, while taking into account the detection of normal business anomalies and known attack patterns. This prevents the problem of underestimating the risk in scenarios where "the behavior deviates slightly from the baseline but has typical attack characteristics". It strengthens the ability to identify anomalies in the temporal dimension and improves the reliability of the agent's malicious behavior identification.

[0084] In some optional implementations of this embodiment, determining the agent's behavioral deviation based on the first deviation and the second deviation includes: in response to receiving an operation declaration for a task, determining an expected call category set based on the operation declaration; performing behavioral consistency verification based on the expected call category set and the actual call sequence to determine a third deviation; and determining the agent's behavioral deviation based on the weighted sum of the first deviation, the second deviation, and the third deviation, wherein the weight of the second deviation is greater than the weight of the first deviation, and the weight of the first deviation is greater than the weight of the third deviation.

[0085] The module collects the agent's operation declaration output from the agent task framework. Before executing each operation step, the agent usually reports its intent to the framework (such as "read configuration file", "execute test script", "write report"). The module standardizes these natural language declarations into structured operation intent descriptions.

[0086] The standardization process maps Agent action claims to predefined action intent categories. The action intent classification system includes: file reading (expected system call set: openat + read + close), file writing (expected set: openat + write + close), code execution (expected set: execve + read + write), network requests (expected set: socket + connect + write + read), database queries (expected set: socket + connect + write + read, limited to database port), and report generation (expected set: openat + write + close, limited to report directory).

[0087] Each action intent category is associated with a set of expected system call categories, which defines the range of system call categories that are normally expected to be observed when the agent claims to execute the action. This mapping is pre-configured by the security team at deployment time and can be iteratively optimized using audit data.

[0088] Subsequently, a behavioral consistency check is performed between the expected call category set and the actual call sequence collected within the detection window, and the third deviation is calculated. The check process statistically analyzes the frequency and percentage of system call categories that appear in the actual call sequence but do not belong to the expected call category set, and normalizes this to obtain a third deviation ranging from 0 to 1. If the actual call sequence only contains call categories within the expected set, the third deviation is 0; if a large number of unexpected call categories appear, the third deviation value increases. For example, if a network connection call not mentioned in the operation declaration appears in the actual call sequence, the third deviation will be calculated based on the percentage of this abnormal call.

[0089] After obtaining the first deviation representing the frequency deviation, the second deviation representing the risk of temporal behavior, and the third deviation representing the consistency deviation with the task declaration, the final behavioral deviation of the agent is calculated using a weighted summation method. A fixed weight relationship is pre-configured: second deviation weight > first deviation weight > third deviation weight.

[0090] An example of the formula for calculating the third deviation is shown below, but it is not limited to the following formula:

[0091] in, Indicates the actual call sequence. This indicates the set of categories to be invoked. This represents the set of system call categories that were actually observed but not declared by the Agent (difference set). This represents the total number of all system call categories actually observed. The higher the value, the greater the proportion of actions performed by the Agent that exceed its declared scope.

[0092] When the agent's operation declaration is missing (e.g., the agent framework does not provide operation logs, or the agent skips the declaration step and executes directly), it will... A fixed penalty value is set, which is no lower than the alert threshold to ensure that a missing declaration triggers at least an alert-level response, but no lower than the limit threshold to avoid triggering a system call degradation solely due to a missing declaration. The specific penalty value is configured by the security team based on the declaration coverage of the Agent framework in the enterprise environment. A missing declaration itself constitutes an anomalous signal, as a normally functioning Agent should report its operational intent through the framework.

[0093] Specific example: The Agent declares "Execute test script", expecting the system call set {file operation - read, process management - execute, file operation - write} (corresponding to reading the test file, executing the test process, and writing the test result). The actual observed system call categories are {file operation - read, process management - execute, file operation - write, network communication - connect, process management - debug}. The difference set {network communication - connect, process management - debug} results in a consistency anomaly score. = 2 / 5 = 0.40. The agent claims to be performing tests but actually initiates network connections and process debugging operations, which is suspicious behavior.

[0094] The three deviations are weighted and aggregated to calculate the behavioral deviation score, i.e., the overall anomaly score:

[0095] in, For the weighting coefficients, satisfying and The second deviation weight has the highest weight because the sequence layer can directly match known attack patterns, resulting in the highest detection confidence. The first deviation weight is next, providing macroscopic anomaly detection at the statistical level. The third deviation weight has the lowest weight but is indispensable, providing cross-validation at the agent intent level. The initial values ​​of the weight coefficients are configured by the security team based on the characteristics of the enterprise environment and can be optimized and adjusted subsequently based on audit data.

[0096] This embodiment introduces for the first time a consistency verification mechanism between Agent's declared behavior and actual system call behavior. By mapping the operational intent reported by the Agent to the upper-layer framework to a set of expected system call categories and comparing it with the actually observed system calls, the system can detect deceptive Agent behavior—that is, situations where the Agent claims to perform low-risk operations but actually performs high-risk system calls. Anomaly detection is implemented from three orthogonal dimensions: frequency statistics, sequence patterns, and output behavior consistency. The frequency layer detects abnormally dense system calls within a short period (such as large-scale file scanning), the sequence layer detects known attack patterns and abnormal call sequences outside the baseline, and the consistency layer cross-verifies the Agent's declared behavior with the actual system call behavior. The three layers of detection are complementary, effectively covering the complete detection spectrum from coarse-grained statistical anomalies to fine-grained semantic anomalies.

[0097] In some optional implementations of this embodiment, the permissions of the intelligent agent are controlled based on the behavior deviation degree, including: in response to the behavior deviation degree being lower than the update threshold, updating the baseline call information based on the system call event information, wherein the update threshold is less than or equal to the alarm threshold; in response to detecting that the task execution is completed, persisting the updated baseline call information for the task to use next time.

[0098] The severity level is determined based on the degree of behavioral deviation (overall abnormality score) and the grading threshold: For alarm thresholds, To limit the threshold, This is the freezing threshold. The three thresholds satisfy... The initial value of the threshold is based on the security policy preset, and can be adaptively adjusted in the future through statistical analysis of false alarms and false negatives in the audit log.

[0099] The system implements a four-level tiered response based on the severity of the anomaly: normal (allow), minor anomaly (alert), moderate anomaly (restrict system call scope), and severe anomaly (freeze sandbox and terminate agent). This tiered mechanism avoids the binary dilemma of traditional solutions that require either full permission or full blocking, ensuring security while maximizing the continuity of agent tasks.

[0100] The update is performed only when the security gating condition is met: if and only if the current detection status reported by the multi-layer anomaly detection module is normal (i.e., the overall anomaly score). ,in To update the security threshold and The module only incorporates the observation data of the current window into the baseline update when an anomaly is detected. When this happens, the baseline image remains frozen to prevent attacks from contaminating the baseline.

[0101] In this embodiment, by embedding a lightweight system call monitoring probe within the sandbox, the system establishes a baseline profile of normally executed system calls for each agent task type. This baseline profile is dynamically updated through an online learning mechanism, adapting to the natural evolution of agent execution patterns without requiring manual maintenance of static detection rules.

[0102] In some optional implementations of this embodiment, updating the baseline call information based on system call event information includes: updating the baseline frequency distribution in the baseline call information using an exponentially weighted moving average algorithm; and updating the baseline sequence set in the baseline call information using a set incremental expansion algorithm.

[0103] The behavior baseline profiling modeling module maintains an independent frequency baseline profile for each task type. The frequency baseline records the categories of system calls. Within the standard testing time window Normal frequency distribution parameters within: mean and standard deviation .

[0104] The frequency baseline is updated online using an exponentially weighted moving average algorithm. Let the number of occurrences of system call category k within the t-th detection window be denoted as . The baseline update formula is:

[0105] in, This is the learning rate parameter, which controls how quickly the baseline adapts to new observations. A smaller [value] It makes the baseline more stable but adapts to new patterns more slowly, and has a larger impact. This makes the baseline more sensitive but may introduce noise. In security-sensitive scenarios, A smaller value is usually chosen to prioritize baseline stability.

[0106] The sequence baseline records the set of system call n-grams that occur during normal execution. An n-gram is defined as an ordered tuple of n consecutive system call categories. The n-gram is extracted from the feature vector sequence, and newly observed n-grams are added to the baseline set when a security gating condition is met.

[0107] in, System call category sequence within the window An n-gram subsequence of length n starting from position i, where L is the total number of system call events within the window.

[0108] To control the growth of the baseline set, the module... Capacity management is implemented: When the set size exceeds a preset limit, a least recent occurrence strategy is used to evict n-grams that have not been observed for a long time. Eviction decisions are based on a comprehensive score of each n-gram's last observation timestamp and cumulative occurrence frequency: n-grams that have not appeared for a long time and have low historical frequency are prioritized for eviction, while n-grams with high historical frequency are retained for a longer period even if they have not appeared recently, as these high-frequency patterns may represent normal behavior during periodic execution. Furthermore, the module maintains an occurrence frequency count for each n-gram; n-grams with an occurrence frequency below a threshold are marked as "rare patterns" and given lower baseline matching weight in anomaly detection.

[0109] The baseline profile data structure includes the following core fields:

[0110] Specific example: When the system receives a "Code Review and Testing" task for the first time, it initializes a blank baseline profile. During the first five detection windows of normal agent execution, the frequency baseline is learned progressively: The value gradually increases from the default value of 0 to 48 (reflecting the large number of files read during the code review phase).

[0111] The number of steps increases to 7 (reflecting the process creation during the test execution phase). Sequence baselines accumulate normal n-grams such as {openat-read-read-close, execve-write-write, openat-read-close-openat}, etc. From the 6th window onwards, the baseline profile is initially formed, and the multi-layer anomaly detection module begins to use this profile for effective deviation detection.

[0112] This embodiment employs an independent update mechanism adapted to the respective data characteristics of the baseline frequency distribution and the baseline sequence set. It utilizes an exponentially weighted moving average algorithm to achieve smooth dynamic iteration of the call frequency distribution, resisting random noise interference. The baseline sequence set is expanded by an incremental expansion algorithm with security verification, absorbing only reliable normal behavior samples. This effectively avoids malicious time-series behavior from polluting the baseline model, enabling the baseline call information to continuously and adaptively update along with normal business evolution. It balances the dynamic adaptability and security of the behavioral baseline, improving the accuracy of behavioral deviation assessment under long-term operation.

[0113] In some optional implementations of this embodiment, the permissions of the intelligent agent are controlled based on the behavior deviation degree, including: in response to the behavior deviation degree being in the alarm interval, outputting alarm information and reducing the detection time window, wherein the minimum value of the alarm interval is greater than the alarm threshold.

[0114] If the behavior deviation falls within the alarm range, an alarm event is recorded and a notification is sent to the security management platform. The agent continues to execute normally, but the monitoring granularity is automatically enhanced.

[0115] After a minor alarm is triggered, the system automatically enhances the monitoring granularity by shortening the duration of the detection time window, enabling more complete detection cycles to be executed per unit time, thereby improving the temporal resolution of changes in Agent behavior.

[0116] In some optional implementations of this embodiment, the permissions of the intelligent agent are controlled based on the behavior deviation degree, including: in response to the behavior deviation degree being in the restricted range, the system call scope of the intelligent agent is downgraded to the security whitelist mode, wherein the minimum value of the restricted range is greater than the maximum value of the alarm range; the file access scope of the intelligent agent is restricted to the working directory and the temporary directory; and the intelligent agent is prohibited from establishing new network connections.

[0117] When the behavioral deviation is within the limit range ( When this occurs, the tiered response module downgrades the Agent sandbox's system call permissions to the security whitelist mode. The security whitelist defines a set of system calls that are deemed low-risk, retaining only the system calls necessary for the Agent to complete basic operations (such as reading an open file or writing to standard output).

[0118] The system call set in a security whitelist may include:

[0119] All system calls not on the whitelist (including execve, socket, connect, ptrace, mount, etc.) are denied, and the calling process receives a permission denied error code. The restriction policy is implemented by dynamically updating the system call filtering rules of the sandbox. The update operation is completed in milliseconds, ensuring that the restriction policy takes effect immediately.

[0120] Restricting the response also triggers file access scope constraints: The agent can only read files in the working directory and cannot open any paths outside the working directory. All network connections are blocked: Established network connections remain open until they close naturally; all new connection requests are rejected.

[0121] When the behavioral deviation falls into the restricted range above the alarm range, this solution switches the agent to the security whitelist mode, simultaneously restricts file access to only the working directory and temporary directory, and blocks new network connections. Through multi-level resource access isolation, it precisely tightens the agent's operating permissions, effectively curbs the agent from continuing to carry out high-risk behaviors such as unauthorized external connections and illegal file reading, avoids the further spread of abnormal behavior, and achieves proactive security defense under graded handling.

[0122] In some optional implementations of this embodiment, the permissions of the agent are controlled based on the degree of behavioral deviation, including: in response to the degree of behavioral deviation being greater than the freezing threshold, stopping all processes of the agent, saving a complete runtime state snapshot, terminating the operation of the agent, and outputting alarm information.

[0123] When the behavioral deviation exceeds the freezing threshold ( When this occurs, the hierarchical response module executes the most stringent freeze response, which includes the following ordered steps: Step 1 – Process Freeze: Send a pause signal to the Agent master process and all its child processes within the sandbox, freezing the execution state of all processes. This freeze operation ensures that the file system state and network connection state within the sandbox remain unchanged until the snapshot is taken.

[0124] Step Two – Saving a Snapshot: Collect and persistently save the following runtime state information: System call execution trace: A complete sequence of system call events from the start of the task to the moment it freezes, including the timestamp, call number, parameters, and return value for each event.

[0125] Process State Tree: The parent-child relationship tree of all processes in the sandbox, the current execution status of each process, the list of open file descriptors, and memory mapping information.

[0126] File system change log: File changes compared to the initial state of the sandbox (newly added, modified, and deleted files and their contents).

[0127] Network connection status: The active network connection table at the time of freezing (source address, destination address, connection status, amount of data transferred).

[0128] Step 3 – Agent Termination: Send a termination signal to all processes within the sandbox to ensure the Agent execution completely stops. The termination operation employs a two-phase strategy: first, a normal termination signal is sent and a short grace period is waited to allow the process to complete its ongoing atomic operations to avoid data corruption; if the process still has not exited after the grace period, a forced termination signal is sent to ensure all processes stop immediately.

[0129] Step Four – Alerts and Reports: Send an emergency security alert to the security management platform, along with a complete on-site snapshot reference path and detailed sub-scores for the three-layer anomaly detection, for the security operations team to conduct incident investigation and escape path reconstruction analysis. The alert information includes a timeline summary of the anomalous behavior—marking the key system call events that triggered each layer of detection and their timestamps, helping the security team quickly locate the turning point from normal to anomalous agent behavior. The on-site snapshot is stored in a separate security audit storage area, isolated from the agent's working directory, to prevent the agent from tampering with or deleting audit data in the final moments before freezing.

[0130] In this embodiment, when the deviation of behavior exceeds the freezing threshold, the following measures are taken: shutting down all processes of the agent, saving a complete runtime state snapshot, terminating the operation of the agent and pushing alarm information. This can promptly block the continued execution of high-risk abnormal behavior, retain complete evidence data for post-event traceability and verification, and proactively notify management personnel to carry out the handling, effectively preventing the continued expansion of security hazards caused by serious violations of the agent's operation.

[0131] See also Figure 3 , Figure 3 This is a schematic diagram illustrating an application scenario of the intelligent agent permission control method according to this embodiment. Figure 3 In the application scenario, the specific process is as follows: Step 301: When the Agent task is started in the Agent sandbox environment, the task description and type identifier are submitted to the behavior baseline profile modeling module. The baseline modeling module loads the existing baseline profile according to the task type (if it is the first time this task type is executed, a blank profile is initialized and the global default baseline is used).

[0132] Step 302: Push the baseline profile parameters to the multi-layer anomaly detection module, and the system enters real-time monitoring mode.

[0133] Step 303: When the Agent executes code and calls system resources in the sandbox, the system call monitoring and feature acquisition module captures all system call events generated by the Agent process and its child processes in real time through kernel probes.

[0134] Step 304: The system calls the monitoring and feature acquisition module to collect the operation declarations output by the Agent through the task framework.

[0135] Step 305: The feature acquisition module performs multi-dimensional feature extraction (call category, parameter semantics, sensitivity, and temporal features) on each system call event, and standardizes the operation declaration into a unified operation intent description format.

[0136] Step 306: Send the real-time feature stream to the multi-layer anomaly detection module for immediate detection. The Agent operation declaration is also sent to the anomaly detection module for use in the third-layer consistency verification.

[0137] Step 307: Send the feature vector sequence to the behavioral baseline profiling modeling module for baseline reference.

[0138] Step 308: The multi-layer anomaly detection module sequentially performs three layers of detection within each detection time window: First, it counts the frequency of each system call category and calculates the deviation from the frequency baseline (first layer); then, it extracts the n-gram sequence within the current window and compares it with the sequence baseline and the attack pattern library (second layer); finally, it maps the Agent operation declaration to the expected set of system calls and cross-validates it with the actual observation set (third layer). The scores from the three layers are weighted and aggregated into a comprehensive anomaly score, and the severity level is determined according to the grading threshold.

[0139] Step 309: The tiered response and sandbox control module executes corresponding response actions based on the severity level. Under normal circumstances, agent execution is not interfered with. Minor anomalies trigger alarm logging and enhance monitoring granularity. Moderate anomalies downgrade the agent's system call scope to a security whitelist mode, restricting the agent to using only low-risk system calls. Severe anomalies immediately freeze all sandbox processes, save a complete snapshot of the situation, terminate agent execution, and send an emergency security alarm.

[0140] Step 310: Detection decisions for each detection time window are fully recorded in the audit log. The multi-layered anomaly detection module feeds back the detection status to the behavior baseline profile modeling module. The baseline modeling module only performs incremental updates to the baseline profile when it is confirmed that there are no anomalies in the current time period. This security gating mechanism ensures that anomalous behavior does not contaminate the baseline profile.

[0141] Step 311: After the Agent task is completed, the Behavioral Baseline Profile Modeling module solidifies the baseline learning results of this task and persistently stores the updated baseline profile for subsequent use in similar tasks. The Tiered Response and Sandbox Management module generates a task-level security audit report based on all detection decision records of this task, which is available for review by the security operations team.

[0142] Complete use case example

[0143] Scenario: A financial company has deployed an AI Agent on its private server for automated code review and security testing. Security engineers assign the Agent a task within a sandbox: review the code of a newly submitted transaction processing module, execute automated test suites, and generate a test report.

[0144] Initial input: Task description="Review and test the transaction processing module code", Task type="Code review and testing", Sandbox configuration=[working directory / workspace / trade-module, standard Python interpreter, test framework, report generation tool].

[0145] Processing procedures for each module:

[0146] Final Output: The system allowed the Agent to execute code review and testing tasks normally in the first two detection windows. In window W3, the system detected Agent deviating from normal behavior (intensive scanning of the / proc directory is typical container environment probing behavior, and the Agent claimed to "analyze test results" but actually performed system information scanning), triggering a moderate restriction response and downgrading the Agent's system calls to the security whitelist. In window W4, the system detected Agent attempting to access Docker socket files (matching known Docker evasion attack patterns), with an extremely high sequence anomaly score, and the Agent's claim of "generating a report" was severely inconsistent with actual network connection operations, triggering a severe freeze response. The system immediately froze all processes in the sandbox, saved a complete snapshot of the situation (including the complete system call trajectory, process tree, and file change records from W1 to W4), terminated Agent execution, and sent an emergency alert to the security management platform.

[0147] Effect Description: This example demonstrates the four core beneficial effects of the present invention: task-aware baseline profiling (normal behavior of code test tasks does not include / proc scanning and Docker socket access), three-layer orthogonal detection (frequency layer detects abnormal dense scanning, sequence layer matches Docker escape patterns, consistency layer detects mismatch between claims and behavior), graded response (W3 moderate restriction maintains some task continuity, W4 severe freeze completely prevents escape), and complete scene preservation (state snapshot at the time of freeze supports post-escape path restoration).

[0148] Further reference Figure 4 This illustrates a flow 400 of another embodiment of the intelligent agent permission management method. Flow 400 of the intelligent agent permission management method includes the following steps: Step 401: In response to detecting that the agent has started a task, load the baseline call information for the task.

[0149] Step 402: Compare the system call event information of the task within the detection time window with the baseline call information to determine the deviation of the agent's behavior.

[0150] Step 403: Control the permissions of the intelligent agent based on the behavioral deviation.

[0151] Steps 401-403 are basically the same as steps 201-203, so they will not be described again.

[0152] Step 404: Generate a security audit report based on the behavioral deviation.

[0153] In this embodiment, the hierarchical response module maintains a structured audit log for the decision record of each detection window. The audit log contains the following core fields:

[0154] Step 405: Analyze the agent's sandbox escape path based on the security audit report.

[0155] In this embodiment, the audit log supports integration with the enterprise's existing security information and event management system. For freeze decisions, the audit log additionally links to the reference path of the on-site snapshot file. The security operations team can reconstruct the complete behavioral trajectory of the agent based on the snapshot data, analyze the specific path of the escape attack and the security vulnerabilities exploited, and improve the security configuration of the sandbox accordingly.

[0156] Audit data also provides feedback for the system's adaptive optimization: the security team's annotations of false positives (normal behavior is restricted or frozen) and false negatives (abnormal behavior is not detected) can be used to adjust the detection weights. and grading threshold And expand the attack pattern library.

[0157] In this embodiment, when a severe anomaly is detected and sandbox freezing is triggered, the system automatically saves a complete snapshot of the sandbox's runtime state, including system call execution traces, process state trees, file system change records, and network connection status. This snapshot supports post-incident security auditing and escape path reconstruction analysis, providing the enterprise security operations team with complete evidence for incident investigation.

[0158] Further reference Figure 5 As an implementation of the methods shown in the above figures, this disclosure provides an embodiment of an intelligent agent permission control device, which is similar to... Figure 2 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0159] like Figure 5 As shown, the intelligent agent permission control device 500 of this embodiment includes: a loading unit 501, a comparison unit 502, and a control unit 503. The loading unit 501 is configured to load the baseline call information of a task in response to detecting that an intelligent agent has started a task; the comparison unit 502 is configured to compare the system call event information of the task within the detection time window with the baseline call information to determine the behavioral deviation of the intelligent agent; and the control unit 503 is configured to control the permissions of the intelligent agent based on the behavioral deviation.

[0160] In this embodiment, the specific processing of the loading unit 501, comparison unit 502, and control unit 503 of the intelligent agent permission control device 500 can be referred to Figure 2 Steps 201, 202, and 203 in the corresponding embodiment.

[0161] In some optional implementations of this embodiment, the comparison unit 502 is further configured to: parse the system call number, parameter list, and return value from the system call event information; determine the system call characteristics based on the system call number, parameter list, and return value, wherein the system call characteristics include at least one of the following: system call category, parameter semantic features, sensitivity, and timing features; and determine the behavioral deviation of the agent based on the system call characteristics and the baseline call information.

[0162] In some optional implementations of this embodiment, the comparison unit 502 is further configured to: determine the actual call frequency and actual call sequence of each system call category based on system call characteristics; extract an actual call subsequence set from the actual call sequence, wherein each actual call subsequence is an ordered tuple of a predetermined number of consecutive system call categories; determine a first deviation based on the baseline frequency distribution and the actual call frequency; determine a second deviation based on the baseline sequence set and the actual call subsequence set; and determine the behavioral deviation of the agent based on the first deviation and the second deviation.

[0163] In some optional implementations of this embodiment, the comparison unit 502 is further configured to: in response to receiving the operation declaration of the task, determine the expected call category set according to the operation declaration; perform behavior consistency verification based on the expected call category set and the actual call sequence to determine the third deviation; and determine the behavior deviation of the agent based on the weighted sum of the first deviation, the second deviation and the third deviation, wherein the weight of the second deviation is greater than or equal to the weight of the first deviation, and the weight of the first deviation is greater than or equal to the weight of the third deviation.

[0164] In some optional implementations of this embodiment, the comparison unit 502 is further configured to: determine the sequence deviation degree based on the proportion of actual call subsequences in the actual call subsequence set that are not in the baseline sequence set; perform the longest common subsequence matching between the actual call subsequence set and the preset attack pattern library to determine the attack matching degree; and determine the maximum value between the sequence deviation degree and the attack matching degree as the second deviation degree.

[0165] In some optional implementations of this embodiment, the control unit 503 is further configured to: update the baseline call information based on system call event information in response to the behavior deviation being lower than the update threshold, wherein the update threshold is less than or equal to the alarm threshold; and persist the updated baseline call information for the next use of the task in response to detecting that the task has been completed.

[0166] In some optional implementations of this embodiment, the comparison unit 502 is further configured to: update the benchmark frequency distribution in the benchmark call information using an exponentially weighted moving average algorithm; and update the benchmark sequence set in the benchmark call information using a set incremental expansion algorithm.

[0167] In some optional implementations of this embodiment, the control unit 503 is further configured to: output alarm information and reduce the detection time window in response to the behavior deviation being in the alarm range, wherein the minimum value of the alarm range is greater than the alarm threshold.

[0168] In some optional implementations of this embodiment, the control unit 503 is further configured to: in response to the behavior deviation being within the restricted range, downgrade the system call range of the agent to the security whitelist mode, wherein the minimum value of the restricted range is greater than the maximum value of the alarm range; restrict the file access range of the agent to the working directory and the temporary directory; and prohibit the agent from establishing new network connections.

[0169] In some optional implementations of this embodiment, the control unit 503 is further configured to: stop all processes of the agent, save a complete runtime state snapshot, terminate the operation of the agent, and output alarm information in response to the behavior deviation being greater than the freeze threshold.

[0170] In some optional implementations of this embodiment, the control unit 503 is further configured to: generate a security audit report based on the behavior deviation; and analyze the sandbox escape path of the intelligent agent based on the security audit report.

[0171] The collection, storage, use, processing, transmission, provision, and disclosure of any type of information, such as user personal information, in this technical solution comply with relevant laws and regulations and do not violate public order and good morals.

[0172] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0173] An electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method described in process 200 or 400.

[0174] A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to perform the method described in process 200 or 400.

[0175] A computer program product includes a computer program that, when executed by a processor, implements the method described in process 200 or 400.

[0176] Figure 6A schematic block diagram of an example electronic device 600 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0177] like Figure 6 As shown, the electronic device 600 includes a computing unit 601, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. The RAM 603 may also store various programs and data required for the operation of the electronic device 600. The computing unit 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0178] Multiple components in electronic device 600 are connected to I / O interface 605, including: input unit 606, such as keyboard, mouse, etc.; output unit 607, such as various types of displays, speakers, etc.; storage unit 608, such as disk, optical disk, etc.; and communication unit 609, such as network card, modem, wireless transceiver, etc. Communication unit 609 allows electronic device 600 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0179] The computing unit 601 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 601 performs the various methods and processes described above, such as the agent access control method. For example, in some embodiments, the agent access control method can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 608. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by the computing unit 601, one or more steps of the agent access control method described above can be performed. Alternatively, in other embodiments, the computing unit 601 can be configured to perform the agent access control method by any other suitable means (e.g., by means of firmware).

[0180] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0181] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0182] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or electronic device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or electronic devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0183] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0184] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0185] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0186] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this document does not impose any restrictions on this.

[0187] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for controlling access permissions for an intelligent agent, comprising: In response to detecting that an agent has initiated a task, the baseline invocation information of the task is loaded; The system call event information of the task within the detection time window is compared with the baseline call information to determine the behavioral deviation of the agent; The permissions of the intelligent agent are controlled based on the behavioral deviation.

2. The method according to claim 1, wherein, The step of comparing the system call event information of the task within the detection time window with the baseline call information to determine the behavioral deviation of the agent includes: The system call number, parameter list, and return value are parsed from the system call event information; The system call characteristics are determined based on the system call number, the parameter list, and the return value, wherein the system call characteristics include at least one of the following: system call category, parameter semantic characteristics, sensitivity, and timing characteristics; The behavioral deviation of the agent is determined based on the system call characteristics and the baseline call information.

3. The method according to claim 2, wherein, The baseline call information includes the baseline frequency distribution and baseline sequence set of each system call category appearing within the detection time window, and each baseline sequence is an ordered tuple of a predetermined number of consecutive system call categories; as well as The determination of the agent's behavioral deviation based on the system call characteristics and the baseline call information includes: Based on the system call characteristics, determine the actual call frequency and actual call sequence of each system call category; Extract a set of actual call subsequences from the actual call sequence, wherein each actual call subsequence is an ordered tuple of a predetermined number of consecutive system call categories; The first deviation is determined based on the reference frequency distribution and the actual call frequency; The second deviation is determined based on the baseline sequence set and the actual call subsequence set; The behavioral deviation of the agent is determined based on the first deviation and the second deviation.

4. The method according to claim 3, wherein determining the behavioral deviation of the agent based on the first deviation and the second deviation comprises: In response to receiving the operation declaration of the task, determine the expected set of invocation categories based on the operation declaration; Based on the expected call category set and the actual call sequence, a behavior consistency check is performed to determine the third deviation. The behavioral deviation of the agent is determined by a weighted sum of the first deviation, the second deviation, and the third deviation, wherein the weight of the second deviation is greater than or equal to the weight of the first deviation, and the weight of the first deviation is greater than or equal to the weight of the third deviation.

5. The method according to claim 3 or 4, wherein, The determination of the second deviation based on the benchmark sequence set and the actual called subsequence set includes: The sequence deviation is determined based on the proportion of actual call subsequences in the actual call subsequence set that are not in the baseline sequence set; The actual set of call subsequences is matched with the preset attack pattern library using the longest common subsequence to determine the attack matching degree; The maximum value between the sequence deviation and the attack matching degree is determined as the second deviation.

6. The method according to claim 1, wherein, The control of the agent's permissions based on the behavioral deviation includes: In response to the behavior deviation being lower than the update threshold, the baseline call information is updated based on the system call event information, wherein the update threshold is less than or equal to the alarm threshold; In response to the detection that the task has been completed, the updated baseline call information is persisted for use by the task next time.

7. The method according to claim 6, wherein, Updating the baseline call information based on the system call event information includes: The benchmark frequency distribution in the benchmark call information is updated using an exponentially weighted moving average algorithm. The set of benchmark sequences in the benchmark call information is updated using a set incremental expansion algorithm.

8. The method according to claim 6, wherein, The control of the agent's permissions based on the behavioral deviation includes: In response to the behavior deviation being within the alarm range, an alarm message is output and the detection time window is reduced, wherein the minimum value of the alarm range is greater than the alarm threshold.

9. The method according to claim 8, wherein, The control of the agent's permissions based on the behavioral deviation includes: In response to the behavior deviation being within the restricted range, the system call range of the agent is downgraded to the security whitelist mode, wherein the minimum value of the restricted range is greater than the maximum value of the alarm range; The file access scope of the intelligent agent is restricted to the working directory and the temporary directory; The agent is prohibited from establishing new network connections.

10. The method according to claim 9, wherein, The control of the agent's permissions based on the behavioral deviation includes: In response to the behavior deviation exceeding the freeze threshold, all processes of the agent are stopped, a complete runtime state snapshot is saved, the agent is terminated, and an alarm message is output.

11. The method according to claim 1, further comprising: A security audit report is generated based on the aforementioned behavioral deviations; The security audit report was used to analyze the agent's sandbox escape path.

12. An access control device for an intelligent agent, comprising: The loading unit is configured to load the baseline invocation information of the task in response to detecting that the agent has initiated a task; The comparison unit is configured to compare the system call event information of the task within the detection time window with the baseline call information to determine the behavioral deviation of the agent; The control unit is configured to control the permissions of the intelligent agent based on the behavioral deviation.

13. An electronic device, comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-11.

14. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-11.

15. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1-11.

Images