A method and system for tracing and automatically disposing of a double-layered arranged multi-agent attack

Abstract

The application discloses a kind of double-layer arrangement multi-agent attack traceability and automated disposal method and system, the method constructs the double-layer arrangement framework including state layer and dynamic execution layer: state layer uses deterministic state machine arrangement to guarantee the stable controllable of global event flow conversion;Dynamic execution layer is based on the multi-agent collaborative execution attack traceability and disposal task of big model driving, including attack identification agent actively identifies malicious data attack in closed-loop control loop by dynamic watermarking technology, traceability analysis agent calls intelligence tool to carry out attack traceability, correlation analysis agent calculates horizontal movement explosion radius based on information-physical coupling sensitivity, scheduling agent aggregates analysis result to assess attack posture, disposal agent executes automated disposal action, instruction verification agent carries out online verification to control instruction based on signal temporal logic STL and enables flexible control mechanism to guarantee the safety of key equipment operation.

Description

Technical Field

[0001] This invention relates to the field of power system network security technology, and in particular to a two-layer orchestration method and system for tracing and automating attacks on multi-agent systems. Background Technology

[0002] As power systems transform towards digitalization and intelligence, advanced computing, communication, and control technologies are deeply integrated with the physical power grid, forming a typical power cyber-physical system. With the application of artificial intelligence technologies such as large language models in cybersecurity, some systems are attempting to introduce large models for automated attack tracing and handling. However, the inherent illusion problem of large models may lead to the generation of incorrect handling strategies, thereby affecting the stability of critical control processes and even causing business interruptions. At the attack tracing level, existing technologies mostly rely on passive detection methods, such as anomaly detection based on state estimation and pattern recognition based on historical data comparison, which are insufficient to effectively identify advanced persistent attacks such as spoofed data injection, replay attacks, and stealth attacks. At the automated handling level, existing automated technologies lack verification mechanisms for the safety of handling actions, and the handling process may cause secondary damage to the physical power grid due to incorrect strategies. Summary of the Invention

[0003] Purpose of the invention: The present invention aims to provide a two-layer orchestration multi-agent attack tracing and automated handling method with time-based source analysis capabilities to solve the problem of critical control flow interruption caused by model illusion; another purpose of the present invention is to provide a two-layer orchestration multi-agent attack tracing and automated handling system.

[0004] Technical solution: The dual-layer orchestration multi-agent attack tracing and automated handling method of the present invention includes the following steps:

[0005] A two-layer orchestration framework is constructed, including a state layer and a dynamic execution layer. A deterministic state machine is deployed in the state layer. The deterministic state machine predefines state nodes including an initial state, a detection state, a source tracing state, a disposal state, and a recovery state. A multi-agent collaborative system driven by a large language model is deployed in the dynamic execution layer to collaboratively execute attack source tracing and disposal tasks. The multi-agent collaborative system includes an attack identification agent, a source tracing analysis agent, a correlation analysis agent, a scheduling agent, a disposal agent, and an instruction verification agent.

[0006] For the power cyber-physical AGC system, an information flow network model including information nodes, information branches and information buses is established to determine the information-physical coupling sensitivity.

[0007] The attack identification agent continuously performs dynamic watermark detection during the issuance of control commands by the AGC system;

[0008] The source tracing analysis agent takes the attack alert events reported by the attack identification agent as the initial input and generates an intelligence query plan through a large language model.

[0009] The correlation analysis agent calculates the blast radius of lateral movement based on the information-physical coupling sensitivity;

[0010] The scheduling agent aggregates the source analysis results and the explosion radius results, and uses a situation assessment function to calculate the attack threat score;

[0011] The intelligent agent executes automated actions based on the attack threat score range, employing a tiered approach.

[0012] The instruction verification agent performs online verification of the AGC control instructions that are about to be issued to the generator set based on STL.

[0013] The results of the response are fed back to the state layer, the deterministic state machine transitions to the recovery state, and the system's operating indicators gradually return to normal before returning to the initial state, thus completing the response loop for this attack event.

[0014] Furthermore, the predefined state nodes of the deterministic state machine also include anomaly warning nodes and handling decision nodes, and each state node has clearly defined entry conditions, dwell actions and transfer conditions;

[0015] The deterministic state machine transitions between states based on the alarm level and correlation index of the abnormal warning information. The transition condition from the initial state to the detection state is that the attack detection module outputs an over-threshold alarm. The transition condition from the source tracing state to the handling state is that the attack threat score exceeds the handling initiation threshold. The transition condition from the handling state to the recovery state is that the handling action is completed and the system operation indicators return to normal.

[0016] Furthermore, the attack identification agent invokes an attack identification tool based on dynamic watermarking, superimposing a private excitation signal satisfying a Gaussian distribution onto the control commands of the closed-loop control system to obtain the superimposed input; steady-state Kalman filtering is used for state estimation, and a watermark detection quantity is defined within the detection window. The internal calculation detects indicators; when the detection indicators exceed the preset threshold, the attack identification agent determines that there is a malicious data attack, and reports the attack characteristics and detection conclusions as abnormal warning information to the state layer to trigger the state machine transition.

[0017] Furthermore, the source tracing analysis agent generates an intelligence query plan through a large language model, iteratively calls a pre-configured intelligence query tool to obtain external intelligence data, cross-compares the external intelligence data with internal log features, iteratively corrects the source tracing reasoning conclusions, until the source tracing confidence reaches a preset threshold or the iteration rounds reach the upper limit, and outputs the attack type, attack source node and attacker information.

[0018] The intelligence query tools iteratively invoked by the source tracing analysis agent include: a threat intelligence query tool, used to obtain the affiliation of the attacking organization and historical attack associations; a vulnerability knowledge base query tool, used to match vulnerability details corresponding to the attack entry point from the CVE vulnerability database; an asset fingerprint query tool, used to obtain the operating system, service version, and configuration information of the attacked assets; and a historical attack event query tool, used to match attack patterns and identify attack methods. The source tracing analysis agent performs multiple rounds of cross-comparison between the results returned by each tool and internal log features, gradually converging to a high-confidence source tracing conclusion.

[0019] Furthermore, the association analysis agent acquires the network topology and business attribute information of the affected assets, and constructs an asset association graph starting from the initial affected assets. ,in For a set of asset nodes, Given the set of network connectivity edges between assets, for each edge... Calculate the propagation weight, which is jointly determined by network connectivity, vulnerability exploitability, and business dependencies. Weighted propagation calculations are performed along the asset association graph, and the set of assets whose probability of being affected exceeds a preset threshold is determined as the blast radius for horizontal movement.

[0020] Furthermore, the scheduling agent maintains the global task context during the collaboration process, and the source analysis agent and the correlation analysis agent report the intermediate inference status to the scheduling agent in real time. When any agent makes a key discovery, it is immediately pushed to the scheduling agent through an event notification mechanism, triggering an incremental update of the attack threat score. The scheduling agent dynamically adjusts the task priority and tool call permissions of the other agents based on the updated global task context.

[0021] The scheduling agent aggregates the source analysis results output by the source analysis agent and the explosion radius output by the correlation analysis agent, using an evaluation function. Calculate the attack threat score, where, To score the confidence level for source tracing, The normalized score for the explosion radius. To score the severity level of the alarm, , , To meet The preset weighting coefficients are used to calculate the risk index of the scheduling agent when the attack threat score exceeds a preset threshold. ,in To determine the probability of misjudgment, The business impact index of the target asset. To assess the confidence level of the analysis conclusions, when the risk index is lower than the preset safety threshold, the disposal agent is automatically authorized to perform the disposal action; otherwise, the disposal plan is submitted to the manual approval queue.

[0022] Furthermore, the handling agent adopts a tiered handling strategy. The first level is low-risk handling actions, including alarm notifications and log hardening; the second level is medium-risk handling actions, including access policy adjustments and traffic rate limiting; and the third level is high-risk handling actions, including asset isolation and network blocking. The handling agent selects the corresponding level based on the attack threat score. The execution of the third-level high-risk handling actions must be verified by the instruction verification agent or confirmed by manual approval before execution.

[0023] Furthermore, the instruction verification agent invokes a pre-configured instruction verification tool to perform online verification of the control instructions to be issued during the processing phase. It also invokes a data-driven neural network model to adaptively generate safety rules for the control instructions under the current operating conditions. These safety rules are expressed using STL formulas. This indicates the robustness of the computational control commands. The verification index is calculated and summarized within the verification window. ,in, STL safety rules for control instructions; () represents an STL global operator, indicating that the constraints within the parentheses in the validation window [t_w,t] always hold true; The control command at time t; The control commands are within the safe upper and lower limits; To control the lower limit threshold of the command; To control the upper limit threshold of instructions; Verify the sum of robustness R(t) within the verification window; when the verification index is negative, the instruction verification agent determines that the control instruction is abnormal, sends an alarm to the handling agent, and triggers the elastic control mechanism.

[0024] Furthermore, when the instruction verification agent determines that the control instruction is abnormal, a confidence-based elastic control mechanism is activated: maintaining a confidence counter. When robustness Execution ,when Execution ,in, This is the initial confidence level; when Below the preset threshold At that time, use the midpoint between the upper and lower limits of the STL security rules to generate correction instructions. Replace abnormal command issuance to ensure the safe operation of critical equipment.

[0025] The dual-layer orchestration multi-agent attack tracing and automated handling system of the present invention includes:

[0026] The two-layer orchestration framework module includes a state layer submodule and a dynamic execution layer submodule; the state layer submodule has a built-in deterministic state machine, and the dynamic execution layer submodule is responsible for instantiating and scheduling multiple agents;

[0027] The multi-agent collaboration module includes an attack identification agent, a source tracing analysis agent, a correlation analysis agent, a scheduling agent, a handling agent, and an instruction verification agent. Each agent works collaboratively based on a large language model and through a structured message passing mechanism.

[0028] The attack identification module is used to drive the attack identification agent to continuously perform dynamic watermark detection, calculate the watermark detection quantity and detection index through Kalman filtering, and report anomaly warnings to the state layer when an attack is detected.

[0029] The source tracing and analysis module is used to drive the source tracing and analysis agent to iteratively call threat intelligence, vulnerability knowledge base, asset fingerprint and historical attack event query tools and output source tracing and analysis results;

[0030] The explosion radius calculation module is used to drive the association analysis agent to calculate the lateral movement explosion radius based on the weighted propagation algorithm of the asset association graph;

[0031] The situation assessment and authorization module is used to drive the scheduling agent to calculate the attack threat score based on the situation assessment function, perform the risk index verification of the handling, and authorize the handling agent.

[0032] The automated processing module is used to drive the processing agent to execute automated processing actions according to the hierarchical processing strategy;

[0033] The instruction verification module is used to drive the instruction verification agent to call the neural network model to generate STL security rules and perform real-time verification of control instructions. When an anomaly is detected, it triggers the elastic control mechanism to generate correction instructions.

[0034] Beneficial Effects: Compared with existing technologies, the significant advantages of this invention are: 1. The two-layer orchestration framework constructed in this invention ensures the stability and controllability of global event flow through deterministic state machine orchestration at the state layer, effectively avoiding the risk of process interruption caused by large model illusions. Simultaneously, the dynamic execution layer fully leverages the capabilities of multiple agents in high-order tracing reasoning and automated processing, balancing the advantages of deterministic control and intelligent processing; 2. The attack identification agent introduced in this invention uses active identification technology based on dynamic watermarking as its core function, breaking through the limitations of traditional passive detection methods. By superimposing random excitation signals into control commands, it achieves detection of sensor tampering and delay. Real-time identification of covert attacks, combined with steady-state Kalman filtering, significantly improves the detection sensitivity and stability against cross-regional attacks and complex interference environments, and directly interfaces with the state-level deterministic state machine to form an automated detection-response closed loop; 3. The instruction verification agent introduced in this invention uses the online verification method of signal temporal logic STL as the core execution logic, and adaptively generates control instruction safety rules through a data-driven neural network model, realizing real-time monitoring of the inherent risks of the control strategy, and triggering an elastic control mechanism in collaboration with the disposal agent, effectively preventing physical failures caused by erroneous strategies and ensuring the operational safety of key equipment such as generator sets. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of a double-layered arranging frame;

[0036] Figure 2 This is a schematic diagram of the state transitions of a deterministic state machine at the state level.

[0037] Figure 3 A schematic diagram illustrating the active identification process of an intelligent agent for attack identification;

[0038] Figure 4 A schematic diagram of the intelligent agent verification process for instruction verification. Detailed Implementation

[0039] The method for tracing and automating attacks on two-layer orchestration multi-agent systems as described in this invention includes the following steps:

[0040] A two-layer orchestration framework is constructed, including a state layer and a dynamic execution layer. The state layer deploys a deterministic state machine, which predefines state nodes including an initial state, a detection state, a source state, a disposal state, and a recovery state. The triggering conditions and jump paths between each state node are preset by the system and are not affected by the output of the large model. The dynamic execution layer deploys a multi-agent collaborative system driven by a large language model.

[0041] During system initialization, an attack identification agent is instantiated in the dynamic execution layer. The attack identification agent continuously monitors measurement data and outputs anomaly warnings to the state layer when an attack is detected. The state layer captures anomaly warnings and other anomaly warning information generated by security devices in real time. Based on the type and severity of the anomaly warning information, it drives the deterministic state machine to flow between state nodes. When it flows to the source tracing state, it further instantiates a source tracing analysis agent, a correlation analysis agent, a scheduling agent, a handling agent, and an instruction verification agent in the dynamic execution layer.

[0042] The source tracing analysis agent takes the attack event as the initial input, generates an intelligence query plan through a large language model, iteratively calls the pre-configured intelligence query tool to obtain external intelligence data, cross-compares the external intelligence data with internal log features, iteratively corrects the source tracing reasoning conclusions, until the source tracing confidence reaches a preset threshold or the iteration rounds reach the upper limit, and outputs the attack type, attack source node and attacker information.

[0043] The association analysis agent acquires the network topology and business attribute information of the affected assets, and constructs an asset association graph starting from the initial affected assets. ,in For a set of asset nodes, Given the set of network connectivity edges between assets, for each edge... Calculate the propagation weight, which is jointly determined by network connectivity, vulnerability exploitability, and business dependencies. Weighted propagation calculations are performed along the asset association graph, and the set of assets whose probability of being affected exceeds a preset threshold is determined as the explosion radius for horizontal movement.

[0044] The scheduling agent aggregates the source analysis results output by the source analysis agent and the explosion radius output by the correlation analysis agent, and uses an evaluation function. Calculate the attack threat score, where To score the confidence level for source tracing, The normalized score for the explosion radius. To score the severity level of the alarm, , , To meet The preset weighting coefficients are used to calculate the risk index of the scheduling agent when the attack threat score exceeds a preset threshold. ,in To determine the probability of misjudgment, The business impact index of the target asset. To assess the confidence level of the analysis conclusions, the disposal agent is automatically authorized to perform disposal actions when the disposal risk index is lower than a preset safety threshold; otherwise, the disposal plan is submitted to the manual approval queue.

[0045] The handling agent selects and executes the corresponding level of handling action based on the range of the attack threat score. After the handling is completed, the deterministic state machine transitions to the recovery state.

[0046] Furthermore, the predefined state nodes of the deterministic state machine also include anomaly warning nodes and handling decision nodes. Each state node has clearly defined entry conditions, dwell actions, and transition conditions. The deterministic state machine performs state transitions based on the alarm level and correlation index of the anomaly warning information. The transition condition from the initial state to the detection state is that the attack detection module outputs an over-threshold alarm. The transition condition from the source tracing state to the handling state is that the attack threat score exceeds the handling initiation threshold. The transition condition from the handling state to the recovery state is that the handling action is completed and the system operation indicators return to normal.

[0047] Furthermore, the attack identification agent invokes a dynamic watermark-based attack identification tool within the closed-loop control system's control commands. The superposition of the two layers satisfies a Gaussian distribution. The private excitation signal is superimposed and then input. Steady-state Kalman filtering is used for state estimation, and the watermark detection quantity is defined. In the detection window Internal calculation of detection indicators When the detection index exceeds the preset threshold, the attack identification agent determines that there is a malicious data attack, and reports the attack characteristics and detection conclusion as anomaly warning information to the state layer to trigger the state machine transition.

[0048] Furthermore, the intelligence query tools iteratively invoked by the source tracing analysis agent include: a threat intelligence query tool, used to obtain the affiliation of the attacking organization and historical attack associations; a vulnerability knowledge base query tool, used to match vulnerability details corresponding to the attack entry point from the CVE vulnerability database; an asset fingerprint query tool, used to obtain the operating system, service version, and configuration information of the attacked assets; and a historical attack event query tool, used to perform attack pattern matching and identify attack methods. The source tracing analysis agent performs multiple rounds of cross-comparison between the results returned by each tool and internal log features, gradually converging to a high-confidence source tracing conclusion.

[0049] Furthermore, the scheduling agent maintains the global task context during the collaboration process, and the source tracing analysis agent and the correlation analysis agent report the intermediate inference status to the scheduling agent in real time. When any agent makes a key discovery, it is immediately pushed to the scheduling agent through an event notification mechanism, triggering an incremental update of the attack threat score. The scheduling agent dynamically adjusts the task priority and tool call permissions of the other agents based on the updated global task context.

[0050] Furthermore, the handling agent adopts a tiered handling strategy. The first level is low-risk handling actions, including alarm notifications and log hardening; the second level is medium-risk handling actions, including access policy adjustments and traffic rate limiting; and the third level is high-risk handling actions, including asset isolation and network blocking. The handling agent selects the corresponding level based on the attack threat score. The execution of the third-level high-risk handling actions must be verified by the instruction verification agent or confirmed by manual approval before execution.

[0051] Furthermore, the instruction verification agent invokes a pre-configured instruction verification tool to perform online verification of the control instructions to be issued during the processing phase. It also invokes a data-driven neural network model to adaptively generate safety rules for the control instructions under the current operating conditions. These safety rules are expressed using STL formulas. This indicates the robustness of the computational control commands. The verification index is calculated and summarized within the verification window. When the verification index is negative, the instruction verification agent determines that the control instruction is abnormal, sends an alarm to the handling agent, and triggers the elastic control mechanism.

[0052] Furthermore, when the instruction verification agent determines that the control instruction is abnormal, a confidence-based elastic control mechanism is activated: maintaining a confidence counter. When robustness Execution ,when Execution ,in This is the initial confidence level; when Below the preset threshold At that time, use the midpoint between the upper and lower limits of the STL security rules to generate correction instructions. Replace abnormal command issuance to ensure the safe operation of critical equipment.

[0053] The present invention provides a two-layer orchestration multi-agent attack tracing and automated handling system for power monitoring systems, comprising: a two-layer orchestration framework module, including a state layer sub-module and a dynamic execution layer sub-module, wherein the state layer sub-module has a built-in deterministic state machine, and the dynamic execution layer sub-module is responsible for instantiating and scheduling multi-agents;

[0054] The multi-agent collaboration module includes an attack identification agent, a source tracing analysis agent, a correlation analysis agent, a scheduling agent, a handling agent, and an instruction verification agent. Each agent works collaboratively based on a large language model and through a structured message passing mechanism.

[0055] The attack identification module is used to drive the attack identification agent to continuously perform dynamic watermark detection, calculate the watermark detection quantity and detection index through Kalman filtering, and report anomaly warnings to the state layer when an attack is detected.

[0056] The source tracing and analysis module is used to drive the source tracing and analysis agent to iteratively call threat intelligence, vulnerability knowledge base, asset fingerprint and historical attack event query tools and output source tracing and analysis results;

[0057] The explosion radius calculation module is used to drive the association analysis agent to calculate the lateral movement explosion radius based on the weighted propagation algorithm of the asset association graph;

[0058] The situation assessment and authorization module is used to drive the scheduling agent to calculate the attack threat score based on the situation assessment function, perform the risk index verification of the handling, and authorize the handling agent.

[0059] The automated processing module is used to drive the processing agent to execute automated processing actions according to the hierarchical processing strategy;

[0060] The instruction verification module is used to drive the instruction verification agent to call the neural network model to generate STL security rules and perform real-time verification of control instructions. When an anomaly is detected, it triggers the elastic control mechanism to generate correction instructions.

[0061] Example 1

[0062] This embodiment uses the automatic power generation control system of a regional power grid as an application scenario to illustrate the complete process of the attack tracing and automated handling method of the present invention.

[0063] Step 1: First, construct a two-layer orchestration framework. The state layer uses a finite state machine for event flow orchestration, defining the following state nodes:

[0064] State S0: Initial state, system is running normally.

[0065] State S1: Detection state, an abnormal signal has been detected.

[0066] State S2: Source tracing state, entering the attack source tracing and analysis phase.

[0067] State S3: Handling state, performing automated handling.

[0068] State S4: Recovery state, the system resumes normal operation.

[0069] Each state node has clearly defined entry conditions, dwell actions, and transition conditions. The jump conditions between state nodes are preset as follows:

[0070] When attacks target the dynamic watermark detection metrics of intelligent agents... Exceeding the threshold Triggered

[0071] When the detection state duration exceeds the preset window Triggered

[0072] When the scheduling agent calculates the attack threat score Triggered when the processing start threshold is exceeded

[0073] When the agent performs the action and the instruction verifies the agent's STL verification index... Triggered when returning to normal

[0074] Triggered when all system performance indicators return to normal.

[0075] The dynamic execution layer deploys six agents: an attack identification agent, a source tracing analysis agent, a correlation analysis agent, a scheduling agent, a handling agent, and an instruction verification agent. Each agent is driven by a large language model and performs corresponding detection, analysis, and handling tasks. The attack identification agent starts running during system initialization; the other five agents transition to the source tracing state via a deterministic state machine. It is then activated uniformly by the agent instantiation module, which schedules the agent to initialize the global task context and record key information of the current attack alarm.

[0076] Step 2: Establish an information flow network model for the AGC system. Information nodes include: frequency deviation measurement nodes. Connection line power deviation measurement node , Area control deviation node ACE, Generator output control node The information branches include: measurement data transmission branches, control command issuance branches, and state estimation calculation branches.

[0077] A layered modeling approach is adopted, with the application layer carrying the information processing logic of AGC services, the data link layer representing the transmission path of frequency data and tie-line power data, and the channel layer representing the specific communication channels between the dispatch center and each substation.

[0078] Computational Information - Physical Coupling Sensitivity Let the information content be frequency measurement data. The physical state quantity is the power grid frequency. The sensitivity calculation formula is:

[0079]

[0080] in The sensitivity of generator power to frequency can be obtained through the generator power-frequency characteristic curve; The mapping relationship between frequency measurement data and control commands can be obtained through AGC control logic analysis. The association analysis agent will use this sensitivity as the basis for calculating the propagation weight in the asset association graph.

[0081] Step 3: The attack identifies the intelligent agent that continuously performs dynamic watermark detection during the issuance of control commands in the AGC system. Let the control command be... Superimposed private incentives that satisfy a Gaussian distribution The superimposed input is:

[0082]

[0083] State estimation is performed using steady-state Kalman filtering:

[0084]

[0085]

[0086] in For steady-state Kalman filter gain, This is the steady-state filtering error covariance term. Watermark detection quality is defined as follows:

[0087]

[0088] In the detection window The following are the calculation and testing indicators:

[0089]

[0090] in , To measure the noise covariance.

[0091] Set detection threshold ,in This serves as the baseline value for the detection threshold over a long timescale. These are empirical parameters. When the detection index exceeds the threshold, the attack identification agent determines that there is a malicious data attack in the area, extracts attack features, and reports the anomaly warning to the state layer, driving the deterministic state machine to transition to the detection state. Then it flows to the source tracing state This triggers the activation of other agents.

[0092] Step 4: The source tracing analysis agent uses the attack alert events reported by the attack identification agent as initial input, generates an intelligence query plan through a large language model, and iteratively calls the following four types of pre-configured intelligence query tools:

[0093] Threat intelligence query tool: query attacker identity information, attack organization affiliation, and correlation of historical attack events;

[0094] Vulnerability knowledge base query tool: Matches vulnerability details corresponding to attack entry points from the CVE vulnerability database based on attack characteristics;

[0095] Asset fingerprinting tool: Obtain the operating system version, open services, and configuration information of the attacked assets;

[0096] Historical attack event query tool: performs attack pattern matching and identifies attack types (such as fake data injection, replay attacks, and stealth attacks).

[0097] The source tracing analysis agent performs multiple rounds of cross-comparison between external intelligence data returned by various tools and internal log features, iteratively refining the source tracing inference conclusions. In this embodiment, the source tracing confidence level... If the value exceeds the preset threshold of 0.80, the source tracing analysis agent stops iterating and outputs the source tracing analysis results: The attack type is a spoofed data injection attack targeting the AGC frequency measurement loop; the attack entry point is the associated specific data injection vulnerability; and the attack source node is the frequency deviation measurement node. The source tracing analysis agent pushes the source tracing results to the scheduling agent through an event notification mechanism, triggering a preliminary assessment of the attack situation.

[0098] Step 5: The association analysis agent calculates the blast radius of lateral movement based on the network topology and business attributes of the affected assets. Let the affected assets be nodes. Its neighborhood node set is The formula for calculating the explosion radius is:

[0099]

[0100] in For information content For physical state Information-physical coupling sensitivity For nodes The business importance weight can be determined based on attributes such as node load level and generator capacity. Starting from the initially affected nodes, a weighted propagation calculation is performed along the asset association graph. The set of assets whose affected probability exceeds a preset threshold is determined as the explosion radius, and a normalized score for the explosion radius is calculated. .

[0101] Step 6: The scheduling agent aggregates the source analysis results and blast radius results, and calculates the attack threat score using a situation assessment function.

[0102]

[0103] In this embodiment, the source tracing confidence score Explosion radius normalized score Alarm severity rating (Fake data injection attack targets AGC core loop, high risk level). Weighting coefficient set to... , , Calculated If the preset initiation threshold of 0.70 is exceeded, the deterministic state machine transitions to the handling state. The scheduling agent enters the risk verification stage before authorization.

[0104] For generator output control nodes within the blast radius, the scheduling agent calculates the risk index of the handling action:

[0105]

[0106] Among them, the probability of misjudgment Core control node business impact index Analyze confidence level Calculated If the value is below the preset safety threshold of 0.05, the scheduling agent automatically authorizes the handling agent to perform the handling action and issues the authorization scope.

[0107] Step 7: The agent handles the attack threat based on the attack threat score. Within the affected area, a tiered handling strategy is employed for automated processing. For non-core affected assets, Level 2 (medium-risk) handling actions are implemented, including adjusting access policies for measurement data transmission branches and limiting traffic to abnormal data sources. Considering the attack has been located in the AGC core control loop, the handling agent further requests communication isolation for the frequency measurement node (Level 3 high-risk handling action). The scheduling agent submits this high-risk handling plan to the manual approval queue, and asset isolation operations are executed after confirmation by security operations personnel.

[0108] During the handling phase, the command verification agent performs online verification of the AGC control commands to be issued to the generator set based on STL. It then uses a neural network model to adaptively generate safety rules for the control commands under the current operating conditions, obtaining the upper and lower limit thresholds for the control commands. and This constitutes the STL formula:

[0109]

[0110] Calculate robustness at each time step The verification index is calculated and summarized within the verification window:

[0111]

[0112] When the verification index When the value is negative, the instruction verification agent determines that the control instruction is abnormal, issues an alarm to the handling agent, and activates the confidence-based elastic control mechanism. Maintain the confidence counter. :when hour ;when hour , This is the initial confidence level. When... Below the preset threshold At that time, a correction instruction is generated. Alternative abnormal commands are issued to ensure the safe operation of the generator set. In this embodiment, since the handling agent has isolated the attack source upstream, the control commands return to normal, and the verification index is verified. No sustained negative values ​​were observed, and the elastic control mechanism was not triggered.

[0113] The results of the action are fed back to the state layer, and the deterministic state machine transitions to the recovery state. After the system's operating indicators gradually returned to normal, it returned to its initial state. This completes the closed-loop response to this attack.

[0114] Example 2

[0115] This embodiment takes the load frequency control (LFC) scenario of a three-region interconnected power grid as an example to illustrate the implementation process of the cross-regional collaborative attack location method of the present invention.

[0116] The state-space model of the three-region LFC system is as follows:

[0117]

[0118]

[0119] Among them, state variables This includes frequency deviation for each region, prime mover output deviation, governor output deviation, regional control deviation integral, and tie-line power deviation. System disturbance. Measure noise .

[0120] Step 1: Control commands in each area Each is superimposed with an independent private incentive. , Dynamic watermark detection is performed independently in each region, with different detection metrics. Calculate separately:

[0121]

[0122] Assuming that regions 2 and 3 are simultaneously subjected to a coordinated replay attack, the attack window is... The test results for each region are as follows:

[0123] Area 2: An attack was detected.

[0124] Area 3: An attack was detected.

[0125] Area 1: No attack was directly detected (but the frequency was affected by unstable power in the communication line).

[0126] The attack detection agent reports the detection results and anomaly features of the three regions to the state layer, driving the deterministic state machine to sequentially enter the detection state. and tracing state Activate the other five intelligent agents.

[0127] Step 2: The source tracing analysis agent uses the exceedance of detection indicators in each region as initial input. It generates an intelligence query plan through a large language model, iteratively calling threat intelligence query tools, vulnerability knowledge base query tools, asset fingerprint query tools, and historical attack event query tools. External intelligence data is cross-referenced multiple times with internal regional alarm logs. After four rounds of iterative reasoning, the source tracing confidence level is determined. The value reached 0.82, exceeding the preset threshold of 0.80. The source analysis results were output: the attack type was a coordinated replay attack, the attack area was located in region 2 and region 3, and the attack method was to inject historical measurement data into the tie-line power measurement loop.

[0128] Step 3: The association analysis agent starts with the affected assets in Region 2 and Region 3, constructs a cross-regional asset association graph by combining the information-physical coupling sensitivity between regions, and calculates the propagation weight:

[0129]

[0130] The coupling sensitivity of the attack on region 2 to the physical state of region 1 Calculated using tie-line power transfer factor The operational importance weights of generator units in each region are assigned. Weighted propagation is performed starting from the initially affected nodes, and assets with an impact probability exceeding a preset threshold are defined as the "explosion radius." The explosion radius covers 11 key control nodes across three regions, and a normalized score is assigned to the explosion radius. .

[0131] Step 4: The scheduling agent aggregates the source analysis and blast radius results to calculate the attack threat score.

[0132]

[0133] in , , Weighting coefficient , , Calculated The threshold for initiating a response is exceeded by 0.70. The scheduling agent performs a risk index check on the core control nodes within the blast radius: probability of misjudgment. Core node business impact index Analyze confidence level Calculated If the value is below the safety threshold of 0.05, the intelligent agent will be automatically authorized to perform the action.

[0134] Step 5: Based on the hierarchical handling strategy, the handling agent performs the second-level medium-risk handling action on the power measurement nodes of the tie lines in Region 2 and Region 3, and performs the first-level low-risk handling action on the located replay attack data source; the isolation operation for the key frequency adjustment control node is executed after being submitted by the scheduling agent for manual approval and confirmation.

[0135] The command verification agent synchronously performs online STL verification of control commands for generator units in each region. During the process, region 1 experienced frequency instability due to an attack, and the command verification agent detected the verification index of some control commands in region 1. Negative values ​​occur, confidence counter Continued to decline and below the threshold Immediately trigger the elastic control mechanism to generate correction instructions. Replace abnormal commands to ensure the operational safety of generator sets in Area 1 during the transition period.

[0136] After receiving the execution result, the scheduling agent feeds it back to the state layer, and the deterministic state machine transitions to the recovery state. After the frequencies and tie-line power in each region return to normal ranges, the state machine returns to its initial state. This completes the closed-loop response to cross-regional coordinated attacks.

Claims

1. A method for tracing and automating attacks by multi-agent systems using a two-layer orchestration architecture, characterized in that, Includes the following steps: A two-layer orchestration framework is constructed, including a state layer and a dynamic execution layer. A deterministic state machine is deployed in the state layer. The deterministic state machine predefines state nodes including an initial state, a detection state, a source tracing state, a disposal state, and a recovery state. A multi-agent cooperative system based on a large language model is deployed in the dynamic execution layer to collaboratively execute attack source tracing and disposal tasks. A multi-agent collaborative system includes an attack identification agent, a source tracing analysis agent, a correlation analysis agent, a scheduling agent, a handling agent, and an instruction verification agent; For the power cyber-physical AGC system, an information flow network model including information nodes, information branches and information buses is established to determine the information-physical coupling sensitivity. The attack identification agent continuously performs dynamic watermark detection during the issuance of control commands by the AGC system; The source tracing analysis agent takes the attack alert events reported by the attack identification agent as the initial input and generates an intelligence query plan through a large language model. The correlation analysis agent calculates the blast radius of lateral movement based on the information-physical coupling sensitivity; The scheduling agent aggregates the source analysis results and the explosion radius results, and uses a situation assessment function to calculate the attack threat score; The intelligent agent executes automated actions based on the attack threat score range, employing a tiered approach. The instruction verification agent performs online verification of the AGC control instructions that are about to be issued to the generator set based on STL. The results of the response are fed back to the state layer, the deterministic state machine transitions to the recovery state, and the system's operating indicators gradually return to normal before returning to the initial state, thus completing the response loop for this attack event.

2. The method for tracing and automating attacks involving two-layer orchestration and multiple agents as described in claim 1, characterized in that, The predefined state nodes of the deterministic state machine also include anomaly warning nodes and handling decision nodes. Each state node has clearly defined entry conditions, dwell actions, and transfer conditions. The deterministic state machine transitions between states based on the alarm level and correlation index of the abnormal warning information. The transition condition from the initial state to the detection state is that the attack detection module outputs an over-threshold alarm. The transition condition from the source tracing state to the handling state is that the attack threat score exceeds the handling initiation threshold. The transition condition from the handling state to the recovery state is that the handling action is completed and the system operation indicators return to normal.

3. The method for tracing and automating attacks involving two-layer orchestration and multiple agents as described in claim 1, characterized in that, The attack identification agent calls an attack identification tool based on dynamic watermarking to superimpose a private excitation signal that satisfies a Gaussian distribution into the control instructions of the closed-loop control system, and obtains the superimposed input. Steady-state Kalman filtering is used for state estimation, and the watermark detection quantity is defined within the detection window. The internal calculation detects indicators; when the detection indicators exceed the preset threshold, the attack identification agent determines that there is a malicious data attack, and reports the attack characteristics and detection conclusions as abnormal warning information to the state layer to trigger the state machine transition.

4. The method for tracing and automating attacks involving two-layer orchestration and multiple agents as described in claim 1, characterized in that, The source tracing analysis agent generates an intelligence query plan through a large language model, iteratively calls a pre-configured intelligence query tool to obtain external intelligence data, cross-compares the external intelligence data with internal log features, iteratively corrects the source tracing reasoning conclusions, until the source tracing confidence reaches a preset threshold or the iteration rounds reach the upper limit, and outputs the attack type, attack source node and attacker information. The intelligence query tools iteratively invoked by the source tracing analysis intelligent agent include: threat intelligence query tools, used to obtain the affiliation of the attacking organization and the correlation of historical attacks; The vulnerability knowledge base query tool is used to match vulnerability details corresponding to attack entry points from the CVE vulnerability database; the asset fingerprint query tool is used to obtain the operating system, service version and configuration information of the attacked assets; the historical attack event query tool is used to match attack patterns and identify attack methods; the source tracing analysis agent performs multiple rounds of cross-comparison between the results returned by each tool and internal log features, gradually converging to a high-confidence source tracing conclusion.

5. The method for tracing and automating attacks involving two-layer orchestration and multiple agents according to claim 1, characterized in that, The association analysis agent acquires the network topology and business attribute information of the affected assets, and constructs an asset association graph starting from the initial affected assets. ,in For a set of asset nodes, Given the set of network connectivity edges between assets, for each edge... Calculate the propagation weight, which is jointly determined by network connectivity, vulnerability exploitability, and business dependencies. Weighted propagation calculations are performed along the asset association graph, and the set of assets whose probability of being affected exceeds a preset threshold is determined as the blast radius for horizontal movement.

6. The method for tracing and automating attacks involving two-layer orchestration and multiple agents according to claim 1, characterized in that, The scheduling agent maintains the global task context during the collaboration process. The source tracing analysis agent and the correlation analysis agent report the intermediate inference status to the scheduling agent in real time. When any agent makes a key discovery, it is immediately pushed to the scheduling agent through the event notification mechanism, triggering an incremental update of the attack threat score. The scheduling agent dynamically adjusts the task priority and tool call permissions of the other agents based on the updated global task context. The scheduling agent aggregates the source analysis results output by the source analysis agent and the explosion radius output by the correlation analysis agent, using an evaluation function. Calculate the attack threat score, where, To score the confidence level for source tracing, The normalized score for the explosion radius. To score the severity level of the alarm, , , To meet The preset weighting coefficients are used to calculate the risk index of the scheduling agent when the attack threat score exceeds a preset threshold. ,in To determine the probability of misjudgment, The business impact index of the target asset. To assess the confidence level of the analysis conclusions, when the risk index is lower than the preset safety threshold, the disposal agent is automatically authorized to perform disposal actions; otherwise, the disposal plan is submitted to the manual approval queue.

7. The method for tracing and automating attacks involving two-layer orchestration and multiple agents according to claim 1, characterized in that, The intelligent agent for handling the situation adopts a tiered handling strategy. The first level is low-risk handling actions, including alarm notifications and log hardening; the second level is medium-risk handling actions, including access policy adjustments and traffic rate limiting; and the third level is high-risk handling actions, including asset isolation and network blocking. The intelligent agent selects the corresponding level based on the attack threat score. The execution of the third-level high-risk handling actions must be verified by the instruction verification agent or approved by a human before execution.

8. The method for tracing and automating attacks involving two-layer orchestration multi-agent attacks according to claim 1, characterized in that, The command verification agent invokes a pre-configured command verification tool to perform online verification of the control commands to be issued during the processing phase. It then uses a data-driven neural network model to adaptively generate safety rules for the control commands under the current operating conditions. These safety rules are expressed using STL formulas. This indicates the robustness of the computational control commands. The verification index is calculated and summarized within the verification window. ,in, STL safety rules for control instructions; () represents an STL global operator, indicating that the constraints within the parentheses in the validation window [t_w,t] always hold true; The control command at time t; To ensure that control commands are within safe upper and lower limits; To control the lower limit threshold of the command; To control the upper limit threshold of instructions; To verify the sum of robustness R(t) within the window; when the verification index is negative, the instruction verification agent determines that the control instruction is abnormal, sends an alarm to the handling agent and triggers the elastic control mechanism.

9. The method for tracing and automating attacks involving two-layer orchestration multi-agent attacks according to claim 8, characterized in that, When the instruction verification agent determines that the control instruction is abnormal, a confidence-based elastic control mechanism is activated: maintaining a confidence counter. When robustness Execute at time ,when Execute at time ,in, This is the initial confidence level; when Below the preset threshold At that time, use the midpoint between the upper and lower limits of the STL security rules to generate correction instructions. Replace abnormal command issuance to ensure the safe operation of critical equipment.

10. A two-layer orchestration multi-agent attack tracing and automated handling system, characterized in that, include: The two-layer orchestration framework module includes a state layer submodule and a dynamic execution layer submodule; The state layer submodule has a built-in deterministic state machine, while the dynamic execution layer submodule is responsible for instantiating and scheduling multiple agents. The multi-agent collaboration module includes an attack identification agent, a source tracing analysis agent, a correlation analysis agent, a scheduling agent, a handling agent, and an instruction verification agent. Each agent works collaboratively based on a large language model and through a structured message passing mechanism. The attack identification module is used to drive the attack identification agent to continuously perform dynamic watermark detection, calculate the watermark detection quantity and detection index through Kalman filtering, and report anomaly warnings to the state layer when an attack is detected. The source tracing and analysis module is used to drive the source tracing and analysis agent to iteratively call threat intelligence, vulnerability knowledge base, asset fingerprint and historical attack event query tools and output source tracing and analysis results; The explosion radius calculation module is used to drive the association analysis agent to calculate the lateral movement explosion radius based on the weighted propagation algorithm of the asset association graph; The situation assessment and authorization module is used to drive the scheduling agent to calculate the attack threat score based on the situation assessment function, perform the risk index verification of the handling, and authorize the handling agent. The automated processing module is used to drive the processing agent to execute automated processing actions according to the hierarchical processing strategy; The instruction verification module is used to drive the instruction verification agent to call the neural network model to generate STL security rules and perform real-time verification of control instructions. When an anomaly is detected, it triggers the elastic control mechanism to generate correction instructions.

Images