A data processing method and device based on a multi-agent system

Abstract

The application provides a kind of data processing method and device based on multi-agent system, it is related to data processing technical field.The method of one embodiment includes: obtaining a task to be processed;Intention recognition is carried out on the task to be processed using a management agent, and a task plan is generated according to the recognition result;Wherein, the task plan indicates at least one target execution agent determined from a plurality of execution agents;Wherein, the execution agent is an atomic level agent;According to the task plan, the task to be processed is processed using each target execution agent, and a first processing result output by each target execution agent is obtained;The management agent generates a second processing result corresponding to the task to be processed by synthesizing each first processing result.The embodiment constructs a multi-layer agent architecture including a management agent and a plurality of execution agents, highly decouples the data processing process, and overcomes the technical bottleneck of the existing single large language model in the data processing process.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a data processing method and apparatus based on a multi-agent system. Background Technology

[0002] With the continuous development of large language models, single large language models have been introduced into the data processing process to assist in the analysis of security events. However, when dealing with complex tasks, single large language models are easily constrained by the context window, making them prone to "illusions." Furthermore, when faced with multi-dimensional data processing standards, single models often cannot take all logical dimensions into account, leading to increased unreliability in decision-making. Summary of the Invention

[0003] This invention provides a data processing method and apparatus based on a multi-agent system. By constructing a multi-layer agent architecture including a management agent and multiple execution agents, the data processing process is highly decoupled, overcoming the technical bottleneck of existing single large language models in the data processing process.

[0004] This invention provides a data processing method based on a multi-agent system, the multi-agent system comprising a management agent and multiple execution agents, comprising the following steps: acquiring a task to be processed; using the management agent to perform intent recognition on the task to be processed, and generating a task plan based on the recognition result; wherein the task plan indicates at least one target execution agent determined from the multiple execution agents; wherein the execution agents are atomic-level agents; according to the task plan, using each of the target execution agents to process the task to be processed, obtaining a first processing result output by each of the target execution agents; the management agent synthesizing the first processing results to generate a second processing result corresponding to the task to be processed.

[0005] Optionally, the executing agent includes at least one of the following: an image analysis agent, a document analysis agent, a people analysis agent, an event processing agent, a log analysis agent, a supervisory agent, and an interactive agent.

[0006] Optionally, the step of using the management agent to perform intent recognition on the task to be processed, and determining at least one target execution agent from among the multiple execution agents based on the recognition result, includes at least one of the following: If the recognition result indicates that the intent of the task to be processed is to provide an information response, then the interactive agent is used as the target executing agent. If the identification result indicates that the intent of the task to be processed is document analysis, then the document analysis agent is used as the target execution agent. If the identification result indicates that the intent of the task to be processed is to analyze outgoing events, then at least one of the event processing agent, log analysis agent, image analysis agent, document analysis agent, personnel analysis agent, supervision agent, and interaction agent is used as the target execution agent.

[0007] Optionally, when the target execution agent includes the event processing agent and the log analysis agent, the step of processing the task to be processed using each of the target execution agents according to the execution order to obtain the first processing result corresponding to the task to be processed includes: using the event processing agent to split the log of the task to be processed, and sending the multiple target logs obtained from the splitting to multiple log analysis agents respectively; using each of the log analysis agents to analyze each target log respectively, and generating the first processing result corresponding to each target log.

[0008] Optionally, when the target execution agent includes an image analysis agent, a document analysis agent, and a personnel analysis agent, the step of using each of the log analysis agents to analyze each target log and generate an analysis result corresponding to each target log includes at least one of the following: The log analysis agent is used to call the image analysis agent, and the first image analysis result output by the image analysis agent is obtained. The log analysis agent is used to call the file analysis agent, and the first file analysis result output by the file analysis agent is obtained. The log analysis agent is used to invoke the personnel analysis agent, and the personnel analysis results output by the personnel analysis agent are obtained.

[0009] Optionally, the log analysis agent invokes the image analysis agent and the file analysis agent in parallel; the step of invoking the personnel analysis agent using the log analysis agent includes: sending the obtained first image analysis result and the first file analysis result to the personnel analysis agent to obtain the personnel analysis result output by the personnel analysis agent.

[0010] Optionally, when the target execution agent includes a supervisory agent; the step of using each of the log analysis agents to analyze each of the target logs and generate a first processing result corresponding to each of the target logs further includes: using the supervisory agent to perform reverse thinking verification on the first image analysis result and the first file analysis result to generate a second image analysis result and a second file analysis result; The management agent integrates the first processing results to generate a second processing result corresponding to the task to be processed, including: using the management agent to generate a second processing result corresponding to the task to be processed based on the first image analysis result, the second image analysis result, the first document analysis result, the second document analysis result, and the personnel analysis result.

[0011] Optionally, generating a second processing result corresponding to the task to be processed using the management agent based on the first image analysis result, the second image analysis result, the first document analysis result, the second document analysis result, and the personnel analysis result includes: generating a target processing strategy corresponding to the task to be processed using the management agent based on the first image analysis result, the second image analysis result, the first document analysis result, the second document analysis result, and the personnel analysis result; and generating a second processing result based on the target processing strategy.

[0012] Optionally, generating the second processing result according to the target processing strategy includes: when the target processing strategy is an automatic response strategy, using the management agent to call the interactive agent, and generating the second processing result in response to the interactive information received by the interactive agent; when the target processing strategy is a manual review strategy, sending the task to be processed to the manual review interface, and generating the second processing result in response to the manual review result received by the manual review interface.

[0013] Optionally, the multi-agent system further includes: an optimization agent; after obtaining the second processing result corresponding to the task to be processed, it further includes: using the optimization agent to optimize the image analysis agent and / or the document analysis agent based on the manual review result.

[0014] The present invention also provides a data processing device based on a multi-agent system, comprising the following modules: The acquisition module is used to acquire tasks to be processed. The management module is used to perform intent recognition on the task to be processed using the management agent, and determine at least one target execution agent from the multiple execution agents based on the recognition result; An execution module is configured to process the task to be processed using each of the target execution agents according to the execution order, and obtain the first processing result output by each of the target execution agents; The management module is further configured to use the management agent to synthesize the various first processing results to generate a second processing result corresponding to the task to be processed.

[0015] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the data processing method based on a multi-agent system as described above.

[0016] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data processing method based on a multi-agent system as described above.

[0017] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the data processing method based on a multi-agent system as described above.

[0018] The data processing method and apparatus based on a multi-agent system provided by this invention constructs a multi-layer agent architecture including a management agent and multiple execution agents. It can utilize the management agent to select and schedule execution agents according to the intent of the task to be processed, and use the determined atomic-level target execution agents to process the task to be processed. This achieves a high degree of decoupling of the data processing process and overcomes the technical bottleneck of existing single large language models in the data processing process. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating the data processing method based on a multi-agent system provided by the present invention.

[0021] Figure 2 This is a flowchart illustrating the process of generating a second processing result using a management intelligent agent, as provided by the present invention.

[0022] Figure 3 This is a schematic diagram of the structure of the data processing device based on a multi-agent system provided by the present invention.

[0023] Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0025] Figure 1 This is a flowchart illustrating a data processing method based on a multi-agent system provided by the present invention. The multi-agent system includes a management agent and multiple execution agents, such as... Figure 1 As shown, the method includes the following: Step 101: Obtain tasks to be processed; Step 102: Use a management agent to perform intent recognition on the task to be processed, and generate a task plan based on the recognition results; wherein, the task plan indicates at least one target execution agent determined from multiple execution agents; wherein, the execution agent is an atomic-level agent; Step 103: According to the task plan, each target execution agent processes the task to be processed to obtain the first processing result output by each target execution agent; Step 104: The management agent integrates the results of each first processing step to generate the second processing result corresponding to the task to be processed.

[0026] In this embodiment of the invention, the entire multi-agent system is divided into multiple levels. The management agent serves as the central brain of the entire system, capable of identifying the intent of the task and planning the task. The specific multi-dimensional processing is handled by atomic-level execution agents. These atomic-level agents are AI agents with atomic-level components at their core, adhering to single responsibility and composable contracts, and possess excellent processing performance in single-dimensional data processing. Therefore, this embodiment of the invention, by dividing the multi-agent system into multiple levels, highly decouples the data processing process, overcoming the technical bottlenecks of existing single large language models in data processing.

[0027] The present invention sets up a variety of execution agents according to the data processing functions required by the tasks to be processed in different scenarios. In one optional embodiment, the execution agent includes at least one of the following: image analysis agent, file analysis agent, personnel analysis agent, event processing agent, log analysis agent, supervision agent, and interaction agent.

[0028] In one optional embodiment, if the identification result indicates that the intent of the task to be processed is information response, the interactive agent is used as the target execution agent; if the identification result indicates that the intent of the task to be processed is document analysis, the document analysis agent is used as the target execution agent; if the identification result indicates that the intent of the task to be processed is outgoing event analysis, at least one of the following—an event handling agent, a log analysis agent, an image analysis agent, a document analysis agent, a personnel analysis agent, a supervisory agent, and an interactive agent—is used as the target execution agent. It is understood that different functions are required for different intents, and the corresponding target execution agents are also different. Therefore, the selection of the target execution agent can be specifically set according to the actual situation, and this invention does not impose specific limitations.

[0029] The following section provides a detailed introduction and explanation of the various execution agents, specifically for the enterprise data security intelligent analysis scenario applied in the embodiments of the present invention.

[0030] Image analysis agents are specifically designed for analyzing images, capable of detecting potential external transmissions and assessing their sensitivity. Document analysis agents, on the other hand, are specifically designed for analyzing documents, capable of detecting sensitive words and determining the document's sensitivity level. Through these image and document analysis agents, the security of specific content in processing tasks can be identified, determining whether there is a risk of content leakage.

[0031] For the image analysis agent, the internally encapsulated multimodal processing engine (ImgOffloadEngine) enables a "dual-track" architecture that combines hard text extraction with soft visual inference, overturning existing detection methods that rely solely on metadata. The first track is high-precision hard text extraction. In this embodiment, the multimodal processing engine integrates the EasyOCR and PaddleOCR frameworks, optimizing underlying operators for complex scenarios such as mixed Chinese and English text, tilted shots, and screen moiré interference. This allows for lossless removal of all plaintext symbols from the image, preventing omissions. Furthermore, the image analysis agent in this embodiment utilizes a deep learning word embedding model to establish a context-sensitive word library matching mechanism for detecting sensitive words in plaintext symbols. Compared to existing technologies that use regular expression polling for matching, this embodiment effectively identifies cases where text mutations bypass regular expression matching rules. For example, in outbound emails, if the email subject is "Test" but the actual content of the attached image is "First Quarter Revenue Core Data," the regular expression matching the email subject will determine that the email does not contain sensitive words, but the actual email attachment poses a security leakage risk. This embodiment of the invention, by stripping all plaintext symbols from the image, can effectively identify "First Quarter Revenue Core Data," thereby identifying the potential risks present in the image. The second principle is visual soft reasoning and semantic reconstruction. By inputting the image into a security-domain fine-tuned multimodal large model (Vision-LLM), the global semantic context of the image can be directly understood using the multimodal large model. For example, the multimodal large model (Vision-LLM) can identify enterprise-specific official document styles, unique layout UIs of internal OA systems, and even steganographic digital watermarks and physical seals contained in the image, and output a set of structured JSON judgment results, clearly defining the target area of ​​the image, image classification attributes (such as "contract scan," "code editor screenshot"), and the business environment at the time of the event. As can be seen, the image analysis agent built by the dual-track multimodal processing engine in this embodiment of the invention can effectively identify the plaintext information contained in the image, the image format, and the semantics in the image, so as to determine whether the image has a security leakage risk.

[0032] In this embodiment of the invention, a closed-loop link is constructed for the interaction between the document analysis agent and the underlying atoms. Specifically, when the file in the task to be processed is detected to be a complex composite document (such as a PDF with dozens of high-definition scanned images, or an Excel workbook containing encrypted macros), the underlying atoms perform recursive deep unpacking, peeling off the text layer, metadata layer, and embedded multimedia layer one by one, and sending the fragmented information to the document analysis agent. The document analysis agent can determine the sensitivity of the file by quantifying and scoring the sensitivity of the file content. For files with deliberately obfuscated or disguised file extensions, binary magic number verification and information entropy analysis can be used to restore the true physical type of the file, thereby improving the accuracy of the file sensitivity determination.

[0033] In current enterprise management, it is not only necessary to determine the specific content of data leaks, but also to accurately trace the objects of the leaks in order to quickly remedy the leaked data. However, in the actual analysis of pending tasks, nicknames and aliases from instant messaging software are prevalent, which constitute a significant obstacle to identity association. Therefore, this invention proposes a personnel analysis agent, which addresses the problem of personnel risk identification by building internal personnel knowledge bases and personnel knowledge bases of enterprise partners within the personnel analysis agent. Specifically, for each enterprise employee or partner entity, their name pinyin variants, unique employee ID, current business department hierarchy, historical job change trajectory, bound terminal device fingerprints (such as MAC address and hostname), commonly used corporate email addresses, and social media account identifiers can be extracted and serialized into a highly structured comprehensive semantic long text. This text is then added to the vector retrieval index space to obtain a vectorized personnel knowledge base. This high-dimensional mapping allows personnel from the same business line and the same physical office area to exhibit obvious clustering characteristics in the vector space. Subsequently, by comparing the outgoing objects of the task to be processed with the vectorized personnel knowledge base, it is possible to quickly determine whether the outgoing objects of the task to be processed pose any security risks.

[0034] In real-world outbound scenarios, the captured target identities are often extremely vague and fragmented. For example, the device name generated through Apple Notes sync might only be "User's iPad," or a WeChat screenshot might only reveal half of the recipient's profile picture and the nickname "Project Team - Lao Li." For such vague personnel information, a multi-condition progressive query strategy can be adopted. First, a precise hard query based on a unique ID is attempted. If no results are found, the extracted vague keywords are used to perform K-nearest neighbor (K-NN) semantic similarity matching in the vector space to recall a set of candidate entities with the closest features. The recalled candidate list, the event outbound channel attributes, and even the dialogue context within the image identified by OCR (such as specific professional terms or project codes mentioned in the dialogue) are encapsulated into a structured Prompt, such as "Based on the channel information currently intercepted via AirDrop, the progress of the 'Kunpeng Project' discussed in the screenshot, and the historical behavior of the three employees named 'Li' recalled in the vector library, the most likely physical recipient is inferred." "The personnel analysis agent will integrate the above-mentioned multi-dimensional clues to perform logical chain deduction and finally locate the target object. Through this architecture that integrates high-dimensional retrieval and AI reasoning, the personnel identification accuracy in complex scenarios has jumped from less than 60% in traditional methods to over 90%, greatly reducing the scope of manual investigation."

[0035] The event handling agent and the log analysis agent are execution agents specifically designed for outgoing events. Specifically, each outgoing event may correspond to multiple logs, and each log may simultaneously contain images and files. Therefore, when performing security identification on outgoing events, the multiple logs in the event can be split and processed independently to improve overall processing efficiency. In an optional embodiment, when the target execution agents include an event handling agent and a log analysis agent, step 103 may specifically include: using the event handling agent to split the logs of the task to be processed, and sending the resulting multiple target logs to multiple log analysis agents respectively; using each log analysis agent to analyze each target log and generate a first processing result corresponding to each target log. It can be seen that in this embodiment of the invention, multiple log analysis agents are set up and independently invoked according to the number of logs to ensure that each log has a separate log analysis agent for analysis and processing.

[0036] Furthermore, after the event is log-segmented, the log analysis agent then invokes the image analysis agent, document analysis agent, and personnel analysis agent. Specifically, in an optional embodiment, when the target execution agent includes the image analysis agent, document analysis agent, and personnel analysis agent, step 103 may include at least one of the following: invoking the image analysis agent using the log analysis agent and obtaining the first image analysis result output by the image analysis agent; invoking the document analysis agent using the log analysis agent and obtaining the first document analysis result output by the document analysis agent; and invoking the personnel analysis agent using the log analysis agent and obtaining the personnel analysis result output by the personnel analysis agent.

[0037] Preferably, the image analysis agent and the document analysis agent are invoked synchronously in parallel. This is because image analysis and document analysis are two independent functions with no logical relationship between them, allowing for simultaneous invocation of the agents and improving data processing efficiency. Analysis of the recipient (personnel) is typically considered only after assessing the security risks of the content. Generally, precise identification of the sender is only performed when security risks exist; otherwise, the personnel agent is not invoked. Therefore, in a further optional embodiment, invoking the personnel analysis agent using the log analysis agent includes: sending the acquired first image analysis result and first document analysis result to the personnel analysis agent to obtain the personnel analysis result output by the agent.

[0038] The supervised agent in this invention aims to prevent attention drift or rule forgetting that can occur with monolithic large models when handling long logical chains and multi-constraint security strategies. It avoids the "illusion" problem common to monolithic large models at the architectural level. It is understood that the image analysis agent and document analysis agent in this embodiment are essentially still monolithic large models. Although they correspond to different functions and dimensions, allowing them to focus more on specific tasks, they still suffer from the "illusion" problem common to monolithic large models. Specifically, in this embodiment, the supervised agent can verify the output results of the image analysis agent and the document analysis agent, and further generate corresponding verification results.

[0039] Specifically, in an optional embodiment, when the target executing agent includes a supervisory agent, step 103 further includes: using the supervisory agent to perform reverse thinking verification on the first image analysis result and the first document analysis result, generating a second image analysis result and a second document analysis result. Reverse thinking effectively reduces the probability of misjudgments by the image analysis agent and the document analysis agent. For example, when the first image analysis result indicates that an image contains the sensitive word A, the reverse thinking verification will list counterexamples containing the sensitive word A but not actually posing a security risk. Then, by comparing the first image analysis result with the counterexamples, a second image analysis result is obtained. It can be seen that the supervisory agent plays the role of a "nitpicker" in the entire multi-agent system, performing a secondary check after the image analysis agent and the document analysis agent, thereby fundamentally avoiding the problem of unreliable decision-making in a single large model.

[0040] In a further optional embodiment, the management agent generating a second processing result corresponding to the task to be processed by integrating the various first processing results may specifically include: using the management agent to generate a second processing result corresponding to the task to be processed based on the first image analysis result, the second image analysis result, the first document analysis result, the second document analysis result, and the personnel analysis result. That is, the management agent can comprehensively evaluate the results output by various target execution agents to ultimately obtain the second processing result corresponding to the task to be processed. For example, the management agent can first generate a target processing strategy corresponding to the task to be processed based on the first image analysis result, the second image analysis result, the first document analysis result, the second document analysis result, and the personnel analysis result, and then generate the second processing result based on the target processing strategy. Specifically, the second processing result may simultaneously include the risk level corresponding to the task to be processed, the target processing strategy, and the processing result corresponding to the target processing strategy. The risk level may be high risk, medium risk, low risk, etc., the target processing strategy may be sending an alarm notification to the sender, and the processing result may be "An alarm notification has been successfully sent to the sender."

[0041] In one alternative embodiment, the process of generating a second processing result using a management agent can be as follows: Figure 2 As shown, it includes: Step 201: Utilize the management intelligence agent to generate the target processing strategy corresponding to the task to be processed based on the analysis results of the first image, the second image, the first document, the second document, and the personnel analysis results; When the target processing strategy is an automatic response strategy, step 202 is executed: the management agent calls the interactive agent, and a second processing result is generated in response to the interactive information received by the interactive agent. If the target processing strategy is manual review, step 203 is executed: the task to be processed is sent to the manual review interface, and a second processing result is generated in response to the manual review result received by the manual review interface.

[0042] Specifically, this invention utilizes browser extension technology at the Tampermonkey level for manual review. When manual review is required, a floating "AI Multi-Agent Assisted Decision Sidebar" is generated on the manual review interface. This sidebar pulls up the pending target tasks in real time and displays the AI's "internal activities" with a certain degree of transparency. These include: sensitive features extracted by each target execution agent, matching and highlighting of the source from the personnel knowledge base, and the causal logic diagram provided by the management agent. Human review experts only need to review this highly refined and structured chain of evidence to quickly make a manual judgment on the target task. Then, the human review expert can click the "Confirm Block," "Overwrite," or "Release" button on the manual review interface, and the Tampermonkey script will inject the manual review results into the system via a callback interface. This lightweight design allows the system to maintain manual review and supervision of 2% to 3% of the most critical events while ensuring high business continuity, effectively preventing catastrophic model cascading misjudgments.

[0043] In complex real-world enterprise business flows, disagreements among agents with different perspectives are common. For example, regarding a business communication email containing partial customer code, a document analysis agent might detect code fragments and issue a "high-risk blocking" first analysis result; while a supervisory agent, combining human analysis results, might determine that the receiving domain belongs to a legitimate outsourcing service provider with a signed NDA confidentiality agreement and issue a "compliant release" second analysis result. This leads to a discrepancy between the first and second analysis results. In such cases, the management agent can pre-configure the enterprise's highest-level security governance principles and arbitration constraints, including all possible conflict points, feature vectors, and the global context of the inference chain. When generating target processing strategies, the management agent not only compares static rules but also employs a Bayesian confidence update algorithm based on a probabilistic model. This dynamically evaluates the accuracy weights of each target execution agent in historical tasks and, combined with the current global context, calculates the posterior probability of each possible action path. Through a rigorous mathematical and logical hybrid reasoning process, multi-source divergent inferences can be converged into a comprehensive decision result with a quantified risk score. As can be seen, the management agent in this embodiment of the invention obtains the second processing result based on the first image analysis result, the second image analysis result, the first document analysis result, and the second document analysis result. This fundamentally eliminates the reckless blocking caused by the illusion of a single large model and ensures the high certainty of the conclusions output by the multi-agent system.

[0044] In addition to the two target processing strategies mentioned above, there are also options to choose not to perform any processing strategy if there is no security risk. The specific strategy settings can be made according to the actual situation and needs, and this invention does not impose any specific limitations on this.

[0045] In a further optional embodiment, the multi-agent system of this invention further includes: optimizing the agent. After step 104, it may further include: using the optimizing agent to optimize the image analysis agent and / or document analysis agent based on the human review results. In this embodiment, the human review results can be regarded as high-quality labeled data. After receiving the human review results from the human review interface, the human review results can be directly stored in the database, and the human review results can be read from the database periodically as training data to train the image analysis agent and / or document analysis agent. Specifically, the training data may include tasks to be processed where the first processing result deviates significantly from the human review result as an error sample set, and tasks to be processed where the first processing result is completely consistent with the human review result as a correct sample set. By optimizing the agent based on the training data, the self-reflection ability of the agent can be optimized, and the underlying causes of the previous misjudgment can be diagnosed by comparing the two types of sample sets, so as to facilitate subsequent data analysis and organization.

[0046] In a further optional embodiment, the optimization process of the agent does not rely on manual debugging by security engineers. Instead, the optimization agent generates a targeted optimization plan, which is then tested and verified against a test dataset before being executed on the image analysis agent / file analysis agent. For example, the optimization plan may include: (1) Automatically update the knowledge matrix: If a new term is found due to business expansion, the optimization agent will automatically extract entity information and automatically inject new entity embedding vectors into the underlying vector knowledge base.

[0047] (2) Reconstruct atomic prompt words: If it belongs to the logical blind spot, optimize the agent to rewrite the underlying initialization prompt word template of such as "file processing atom" or "image verification agent".

[0048] (3) Isolation Sandbox Scoring and Closed-Loop Deployment: To prevent newly generated prompts from causing systemic degradation, the system is designed with a strict sandbox verification mechanism. The new prompts are replayed and tested in an offline environment using the full historical sample set. The hot update mechanism is only triggered when the evaluation neural network determines that the recall and precision of the new prompts comprehensively surpass the old version.

[0049] Through this unsupervised evolution loop of self-reflection, proactive error correction, sandbox verification, and dynamic hot updates, the multi-agent system in this embodiment of the invention possesses powerful adaptive repair capabilities, greatly reducing the reliance on manual intervention in long-term system operation and maintenance.

[0050] In this embodiment of the invention, considering the different formats and protocols of the tasks to be processed obtained from different external channels, the multi-source stream data was also normalized, as shown in Table 1 below.

[0051] Table 1 Data processing strategies for different external channels Cloud-based multi-device synchronization Apple Notes, Lark Cloud Docs Features: No physical file transfers are generated; instead, synchronization is achieved through incremental state. Strategy: Memory snapshots or real-time screen capture streams from endpoints are captured via a specially configured adapter and converted into time-series image frames. Wireless peer-to-peer transmission AirDrop, Bluetooth sharing Features: Transmission lacks a centralized routing node. Strategy: Extract system call logs of a specific operating system through endpoint probes, parse the Bluetooth MAC address or random hash name of the target receiving device, and extract the entity file handle from the cache. Instant messaging bubbles WeChat, WeChat for Business, DingTalk Characteristics: Images are typically highly compressed and contain specific UI dialog box features. Strategy: Configure a specific algorithm to prioritize filtering out useless chat UI backgrounds, focusing on the substantive content of the images conveyed within the dialog box. Physical output devices Network printers, local direct-connect printers Strategy: Extract Spool files or SPL format files from the print queue and reverse-engineer them into high-resolution bitmap images using a virtual rendering engine.

[0052] In addition, in order to solve the problem of high concurrency of events obtained from different external channels, this embodiment of the invention also sets up a Kafka message queue as a buffer. Events obtained from different external channels are stored in the message queue and generated into tasks to be processed in the order of first in first out. This can not only smooth out peaks and valleys, but also transform heterogeneous events into standardized JSON tensor structures for flow into the management agent.

[0053] The following example illustrates the data processing method based on a multi-agent system provided in this embodiment of the invention, using a specific complex scenario as an example: Example 1: AirDrop cross-device file transfer Scenario: An employee on the company's intranet attempts to use a MacBook to send a spreadsheet containing a large amount of data to an unknown nearby device (named "Alex's iPad") via AirDrop from the office area.

[0054] Data processing procedure: (1) The endpoint probe captures the underlying Bluetooth and WiFi direct connection system calls, and the Eagle Cloud Bus obtains the event logs, pushes them into the Kafka message queue, and generates tasks to be processed. The events only contain fuzzy target device names.

[0055] (2) The management agent identifies the intent of the task to be processed and determines the identification result as an external event analysis.

[0056] (3) Call the event handling agent to split the event into logs and send the split target logs to multiple log analysis agents respectively.

[0057] (4) The log analysis agent calls the file analysis agent.

[0058] The file analysis agent intercepts the Excel buffer slice in memory, calls the file processing SKILL to decompress and penetrate multiple layers of sheets, and discovers that it not only contains regular data, but also contains an encrypted "core major customer address book" nested in hidden cells, thus obtaining the first file analysis result.

[0059] (5) Log analysis agent calls personnel analysis agent The personnel analysis agent accesses the personnel information vector database, searches for the "Alex" feature in the multi-dimensional space, and combines the office area location with recent Bluetooth handshake records to infer that the iPad is not a company-issued device and belongs to an external visitor with no business overlap (the AI ​​inference confidence level is 0.75, which is a fuzzy boundary), thus obtaining the personnel analysis results.

[0060] (6) The management agent comprehensively obtains the first document analysis results and personnel analysis results, finds that the document contains extremely sensitive data, but the confidence level of the equipment ownership inference is not high, and generates a second processing result that indicates the manual review strategy.

[0061] (7) The task to be processed is sent to the manual review interface. The Tampermonkey sidebar displays the hidden cell screenshot and vector matching relationship diagram. After receiving the manual click "Force Block", the blocking command is issued and the blocking event is successfully resolved.

[0062] Example 2: Fileless Sync Transfer of Apple Notes to the Cloud Scenario: When an executive assistant was using a corporate terminal to process "2026 Q3 Financial Forecast and Restructuring Plan", he opened Apple Notes and typed in sensitive content, attempting to use the iCloud ecosystem to secretly sync it to his personal mobile phone.

[0063] Data processing procedure: (1) No file feature capture: Since this type of synchronization uses the private cloud protocol and does not use traditional file format, the ImgOffloadEngine adapter periodically captures high-definition screen snapshots of the active window and sends them to the Kafka message queue.

[0064] (2) The management agent identifies the intent of the task to be processed and determines the identification result as an external event analysis.

[0065] (3) Call the event handling agent to split the event into logs and send the split target logs to multiple log analysis agents respectively.

[0066] (4) The log analysis agent calls the image analysis agent.

[0067] Among them, the image analysis agent quickly understands the UI-level system of the image memo application, and at the same time combines the words "merger and acquisition", "restructuring" and "Q3 revenue forecast" extracted by OCR hard extraction, and outlines the core secrets that are being lost without any physical documents as evidence, and generates the first image analysis result.

[0068] (6) The management agent comprehensively obtains the first image analysis results and personnel analysis results. Because the operating subject is clear (senior assistant) and the operating behavior is clear (using non-controlled cloud disk to synchronize core strategy), the conclusions of all atomic-level agents are highly consistent. The management agent generates the second processing result that indicates session blocking and application process killing, and automatically archives the complete set of flow evidence as a report.

[0069] Example 3: Closed-loop evolution of notification words for WeChat / Enterprise WeChat screenshots Scenario: An internal employee sent a scanned image of a contract with heavy pixelation, attempting to obscure core business terms, to the supplier's contact person while communicating via WeChat.

[0070] Data processing procedure: (1) Configure a specific algorithm to filter out useless chat UI backgrounds, focus on the actual content of the images transmitted in the dialog box, push the actual content into the Kafka message queue and generate tasks to be processed.

[0071] (2) The management agent identifies the intent of the task to be processed and determines the identification result as an external event analysis.

[0072] (3) Call the event handling agent to split the event into logs and send the split target logs to multiple log analysis agents respectively.

[0073] (4) The log analysis agent calls the image analysis agent.

[0074] Among them, the image analysis agent failed to penetrate the mosaic interference of a certain intensity, failed to identify key monetary terms, and produced the first image analysis result indicating "routine business communication".

[0075] (5) During a routine security inspection, the abnormal image was discovered manually through a Tampermonkey script. It was determined that the image's outline had characteristics of a confidentiality agreement. The result of the incident was forcibly changed to "warning of unauthorized external release", and the result and the incident were stored in the database.

[0076] (6) Error sample feedback and self-reflection: The intelligent agent scanning database was optimized, and this sample of AI being "slapped in the face" by human was captured.

[0077] Dynamic reconstruction of prompt words: Through multimodal reflection, the optimization agent discovered that the original image processing skill prompt words relied too heavily on the completeness of plaintext characters. Subsequently, the optimization agent automatically generated a revised prompt word template, forcing the large visual model to perform contextual semantic cloze reasoning when encountering mosaic blocks, in conjunction with the surrounding un-masked layout format (such as table borders, red seal afterimages).

[0078] Sandbox Validation and Hot Deployment: The new suggestion words were retested in the sandbox with a similar mosaic image library, resulting in a significant increase in recall and proving usability.

[0079] (7) The system hot-updates the knowledge base, and the entire network gains a new immunity to targeted resistance to mosaic steganography, thus completing the silent evolution of security strategies.

[0080] In summary, the data processing method based on a multi-agent system provided in this invention constructs a multi-layered agent architecture including a management agent and multiple execution agents. This allows the management agent to select and schedule execution agents based on the intent of the task to be processed, and the determined atomic-level target execution agents to process the task. This achieves a high degree of decoupling of the data processing process and overcomes the technical bottleneck of existing single large language models in the data processing process.

[0081] The data processing apparatus based on a multi-agent system provided by the present invention is described below. The data processing apparatus based on a multi-agent system described below and the data processing method based on a multi-agent system described above can be referred to in correspondence.

[0082] The data processing device 300 based on a multi-agent system provided in this embodiment of the invention is as follows: Figure 3 As shown, the multi-agent system includes a management agent and multiple execution agents, including: Module 301 is used to acquire tasks to be processed; The management module 302 is used to perform intent recognition on the task to be processed using the management agent and generate a task plan based on the recognition result; wherein the task plan indicates at least one target execution agent determined from a plurality of execution agents; Execution module 303 is used to process the task to be processed by each of the target execution agents according to the task plan, and obtain the first processing result output by each of the target execution agents; The management module 302 is further configured to use the management agent to integrate the first processing results to generate a second processing result corresponding to the task to be processed.

[0083] In an optional embodiment of the present invention, the execution agent includes at least one of the following: an image analysis agent, a document analysis agent, a people analysis agent, an event processing agent, a log analysis agent, a supervisory agent, and an interactive agent.

[0084] In an optional embodiment of the present invention, the step of using the management agent to perform intent recognition on the task to be processed and generating a task plan based on the recognition result includes at least one of the following: If the recognition result indicates that the intent of the task to be processed is to provide an information response, then the interactive agent is used as the target executing agent. If the identification result indicates that the intent of the task to be processed is document analysis, then the document analysis agent is used as the target execution agent. If the identification result indicates that the intent of the task to be processed is to analyze outgoing events, then at least one of the event processing agent, log analysis agent, image analysis agent, document analysis agent, personnel analysis agent, supervision agent, and interaction agent is used as the target execution agent.

[0085] In an optional embodiment of the present invention, the execution module 303 is further configured to: use the event processing agent to split the task to be processed into logs, and send the multiple target logs obtained from the splitting to multiple log analysis agents respectively; use each of the log analysis agents to analyze each target log respectively, and generate a first processing result corresponding to each target log.

[0086] In an optional embodiment of the present invention, when the target execution agent includes an image analysis agent, a document analysis agent, and a personnel analysis agent, the step of using each of the log analysis agents to analyze each target log and generate a first processing result corresponding to each target log includes at least one of the following: The log analysis agent is used to call the image analysis agent, and the first image analysis result output by the image analysis agent is obtained. The log analysis agent is used to call the file analysis agent, and the first file analysis result output by the file analysis agent is obtained. The log analysis agent is used to invoke the personnel analysis agent, and the personnel analysis results output by the personnel analysis agent are obtained.

[0087] In an optional embodiment of the present invention, the log analysis agent calls the image analysis agent and the file analysis agent in parallel; the execution module 303 is further configured to send the obtained first image analysis result and the first file analysis result to the personnel analysis agent to obtain the personnel analysis result output by the personnel analysis agent.

[0088] In an optional embodiment of the present invention, when the target execution agent includes a supervisory agent, the execution module 302 is further configured to use the supervisory agent to perform reverse thinking verification on the first image analysis result and the first document analysis result, and generate a second image analysis result and a second document analysis result; the management module 303 is further configured to use the management agent to generate a second processing result corresponding to the task to be processed based on the first image analysis result, the second image analysis result, the first document analysis result, the second document analysis result, and the personnel analysis result.

[0089] In an optional embodiment of the present invention, the management module 303 is further configured to: generate a target processing strategy corresponding to the task to be processed using the management agent based on the first image analysis result, the second image analysis result, the first document analysis result, the second document analysis result, and the personnel analysis result; and generate a second processing result based on the target processing strategy.

[0090] In an optional embodiment of the present invention, the management module 303 is further configured to, when the target processing strategy is an automatic response strategy, use the management agent to call the interactive agent and generate the second processing result in response to the interactive information received by the interactive agent; and when the target processing strategy is a manual review strategy, send the task to be processed to the manual review interface and generate the second processing result in response to the manual review result received by the manual review interface.

[0091] In an optional embodiment of the present invention, the multi-agent system further includes: an optimization agent; the device further includes an optimization module, used to optimize the image analysis agent and / or the document analysis agent based on the manual review results using the optimization agent.

[0092] Figure 4 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 4As shown, the electronic device may include a processor 410, a communications interface 420, a memory 430, and a communication bus 440, wherein the processor 410, communications interface 420, and memory 430 communicate with each other via the communication bus 440. The processor 410 can call logical instructions in the memory 430 to execute a data processing method based on a multi-agent system. The multi-agent system includes a management agent and multiple execution agents. The method includes: acquiring a task to be processed; using the management agent to perform intent recognition on the task to be processed, and generating a task plan based on the recognition result; wherein the task plan indicates at least one target execution agent determined from the multiple execution agents; wherein the execution agent is an atomic-level agent; processing the task to be processed using each target execution agent according to the task plan, obtaining a first processing result output by each target execution agent; and the management agent synthesizing the first processing results to generate a second processing result corresponding to the task to be processed.

[0093] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0094] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the data processing method based on a multi-agent system provided by the above methods. The multi-agent system includes a management agent and multiple execution agents. The method includes: acquiring a task to be processed; using the management agent to perform intent recognition on the task to be processed, and generating a task plan based on the recognition result; wherein the task plan indicates at least one target execution agent determined from the multiple execution agents; wherein the execution agent is an atomic-level agent; processing the task to be processed using each of the target execution agents according to the task plan, and obtaining a first processing result output by each of the target execution agents; and the management agent integrating the first processing results to generate a second processing result corresponding to the task to be processed.

[0095] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the data processing method based on a multi-agent system provided by the above methods. The multi-agent system includes a management agent and multiple execution agents. The method includes: acquiring a task to be processed; using the management agent to perform intent recognition on the task to be processed, and generating a task plan based on the recognition result; wherein the task plan indicates at least one target execution agent determined from the multiple execution agents; wherein the execution agent is an atomic-level agent; processing the task to be processed using each of the target execution agents according to the task plan, obtaining a first processing result output by each of the target execution agents; and the management agent synthesizing the first processing results to generate a second processing result corresponding to the task to be processed.

[0096] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0097] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0098] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data processing method based on a multi-agent system, characterized in that, The multi-agent system includes a management agent and multiple execution agents, including: Get tasks to be processed; The management agent performs intent recognition on the task to be processed and generates a task plan based on the recognition result; wherein the task plan indicates at least one target execution agent determined from a plurality of execution agents; wherein the execution agent is an atomic-level agent; According to the task plan, the task to be processed is processed by each of the target execution agents to obtain the first processing result output by each of the target execution agents; The management agent integrates the first processing results to generate the second processing result corresponding to the task to be processed.

2. The data processing method according to claim 1, characterized in that, The execution agent includes at least one of the following: image analysis agent, document analysis agent, people analysis agent, event processing agent, log analysis agent, supervision agent, and interaction agent.

3. The data processing method according to claim 2, characterized in that, The step of using the management agent to perform intent recognition on the task to be processed and generating a task plan based on the recognition result includes at least one of the following: If the recognition result indicates that the intent of the task to be processed is to provide an information response, then the interactive agent is used as the target executing agent. If the identification result indicates that the intent of the task to be processed is document analysis, then the document analysis agent is used as the target execution agent. If the identification result indicates that the intent of the task to be processed is to analyze outgoing events, then at least one of the event processing agent, log analysis agent, image analysis agent, document analysis agent, personnel analysis agent, supervision agent, and interaction agent is used as the target execution agent.

4. The data processing method according to claim 3, characterized in that, When the target execution agent includes the event processing agent and the log analysis agent, the step of processing the task to be processed using each of the target execution agents according to the task planning to obtain the first processing result corresponding to the task to be processed includes: The event processing agent is used to split the logs of the task to be processed, and the multiple target logs obtained from the splitting are sent to multiple log analysis agents respectively. Each of the aforementioned log analysis agents is used to analyze each of the target logs, generating a first processing result corresponding to each of the target logs.

5. The data processing method according to claim 4, characterized in that, When the target execution agent includes an image analysis agent, a document analysis agent, and a personnel analysis agent, the step of using each of the log analysis agents to analyze each target log and generate a first processing result corresponding to each target log includes at least one of the following: The log analysis agent is used to call the image analysis agent, and the first image analysis result output by the image analysis agent is obtained. The log analysis agent is used to call the file analysis agent, and the first file analysis result output by the file analysis agent is obtained. The log analysis agent is used to invoke the personnel analysis agent, and the personnel analysis results output by the personnel analysis agent are obtained.

6. The data processing method according to claim 5, characterized in that, The log analysis agent invokes the image analysis agent and the file analysis agent in parallel. The step of using the log analysis agent to invoke the personnel analysis agent includes: The obtained first image analysis results and first file analysis results are sent to the personnel analysis agent to obtain the personnel analysis results output by the personnel analysis agent.

7. The data processing method according to claim 5, characterized in that, In the case where the target executing agent includes a supervising agent; The step of using each of the log analysis agents to analyze each of the target logs and generate a first processing result corresponding to each of the target logs also includes: using the supervisory agent to perform reverse thinking verification on the first image analysis result and the first file analysis result to generate a second image analysis result and a second file analysis result. The management agent integrates the first processing results to generate a second processing result corresponding to the task to be processed, including: using the management agent to generate a second processing result corresponding to the task to be processed based on the first image analysis result, the second image analysis result, the first document analysis result, the second document analysis result, and the personnel analysis result.

8. The data processing method according to claim 7, characterized in that, The step of generating a second processing result corresponding to the task to be processed using the management intelligence agent based on the first image analysis result, the second image analysis result, the first document analysis result, the second document analysis result, and the personnel analysis result includes: The management agent generates a target processing strategy for the task to be processed based on the analysis results of the first image, the second image, the first document, the second document, and the personnel analysis results. A second processing result is generated based on the target processing strategy.

9. The data processing method according to claim 8, characterized in that, The step of generating a second processing result according to the target processing strategy includes: When the target processing strategy is an automatic response strategy, the management agent calls the interactive agent, and the second processing result is generated in response to the interactive information received by the interactive agent. When the target processing strategy is a manual review strategy, the task to be processed is sent to the manual review interface, and a second processing result is generated in response to the manual review result received by the manual review interface.

10. The data processing method according to claim 9, characterized in that, The multi-agent system further includes: an optimizing agent; and after obtaining the second processing result corresponding to the task to be processed, it further includes: The image analysis agent and / or the document analysis agent are optimized based on the results of the manual review.

11. A data processing device based on a multi-agent system, characterized in that, The multi-agent system includes a management agent and multiple execution agents, including: The acquisition module is used to acquire tasks to be processed. A management module is used to perform intent recognition on the task to be processed using the management agent, and generate a task plan based on the recognition result; wherein the task plan indicates at least one target execution agent determined from a plurality of execution agents; An execution module is used to process the task to be processed using each of the target execution agents according to the task plan, and to obtain the first processing result output by each of the target execution agents; The management module is further configured to use the management agent to synthesize the various first processing results to generate a second processing result corresponding to the task to be processed.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the data processing method based on a multi-agent system as described in any one of claims 1 to 10.

13. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the data processing method based on a multi-agent system as described in any one of claims 1 to 10.

14. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the data processing method based on a multi-agent system as described in any one of claims 1 to 10.

Images