An energy-computing network security situation assessment method based on multi-agent large model fusion

Abstract

An energy and computing power network security situation assessment method based on multi-agent large model fusion. In the method, multi-source heterogeneous standardized data is collected; the data is distributed to a professional agent cluster according to the data type, and preliminary analysis results are obtained; a collaborative analysis request is transmitted in the professional agent cluster, and collaborative analysis results are obtained; the preliminary analysis results and the collaborative analysis results are input into a large model fusion decision agent to obtain a security event; a reasoning context is constructed according to the security event, the reasoning context is fused and reasoned, and a comprehensive security situation assessment result is obtained; a security protection strategy is generated, the security protection strategy is executed, and an execution feedback result is obtained. The technical solution provided in the application helps to reduce the omission risk of complex security threats and improve the accuracy and comprehensiveness of the energy and computing power network security assessment result.

Description

Technical Field

[0001] This application relates to the field of network security technology, specifically to a method for assessing the network security situation of energy computing power based on the fusion of multiple agents and large models. Background Technology

[0002] During operation, energy computing networks generate various types of operational data, including network traffic data, energy data, and computing power scheduling data. Currently, security assessments of energy computing networks typically employ a centralized detection approach based on a single analysis model. This approach aggregates the collected operational data into a unified analysis platform, which then compares each piece of data against pre-configured detection rules to identify abnormal features and output corresponding security alerts.

[0003] However, due to the significant differences in data structure and semantic features among various types of operational data in energy computing networks, a single analysis model is insufficient to effectively mine the correlation threat characteristics between multiple types of operational data. This leads to the omission of complex security threats during the security assessment process, resulting in low accuracy of the security assessment results for energy computing networks. Summary of the Invention

[0004] To address the aforementioned technical issues, this application provides a method for assessing the cybersecurity situation of energy computing power networks based on the fusion of multiple agents and large models.

[0005] The first aspect of this application provides a method for assessing the cybersecurity situation of energy computing power networks based on multi-agent large model fusion, employing the following technical solution: Network traffic data, energy data, computing power scheduling data, user entity behavior data, and vulnerability scanning data in the energy computing power network are collected and processed for format standardization to obtain multi-source heterogeneous standardized data. The multi-source heterogeneous standardized data is distributed to a preset cluster of professional intelligent agents according to the data type. The distributed data is then analyzed in parallel by each professional intelligent agent in the cluster to obtain the preliminary analysis results corresponding to each professional intelligent agent. Based on a preset message bus, collaborative analysis requests are transmitted within the cluster of specialized intelligent agents. The collaborative analysis results are obtained by responding to the collaborative analysis requests through the target specialized intelligent agents. The target specialized intelligent agents are determined by the collaborative analysis requests. The preliminary analysis results and the collaborative analysis results are input into a preset large model fusion decision-making agent. The large model fusion decision-making agent performs format unification processing on the preliminary analysis results and the collaborative analysis results to obtain the security event. Based on the security events, a reasoning context is constructed, and the reasoning context is fused and reasoned through a preset large language security model to obtain a comprehensive security situation assessment result. A security protection strategy is generated based on the comprehensive security situation assessment results, and the security protection strategy is executed to obtain execution feedback results.

[0006] By adopting the above technical solutions and utilizing professional intelligent agent clusters to perform parallel processing and collaborative analysis of multi-source heterogeneous standardized data, it is possible to uncover the correlation threat characteristics across data types, making up for the shortcomings of single models in discovering complex threats. Combining large-scale model fusion decision-making and reasoning from large-scale language security models helps to reduce the risk of missing complex security threats and improve the accuracy and comprehensiveness of energy computing power network security assessment results.

[0007] Optionally, the step of distributing the multi-source heterogeneous standardized data to a preset cluster of specialized intelligent agents according to data type, and obtaining preliminary analysis results corresponding to each specialized intelligent agent through parallel analysis of the distributed data by each specialized intelligent agent in the cluster, includes: The network traffic data in the multi-source heterogeneous standardized data is distributed to the network traffic analysis agent in the professional agent cluster. The network traffic data is processed by intrusion feature identification through a preset deep learning traffic classification model to obtain network threat analysis results. The energy data in the multi-source heterogeneous standardized data is distributed to the energy data security agent in the professional intelligent agent cluster. Based on the preset energy data security baseline, deviation detection processing is performed on the energy data to obtain energy data security analysis results. The computing power scheduling data in the multi-source heterogeneous standardized data is distributed to the computing power scheduling security intelligent agent in the professional intelligent agent cluster. The computing power scheduling data is subjected to behavior comparison processing based on the preset computing power scheduling behavior pattern library to obtain computing power scheduling security analysis results. The user entity behavior data in the multi-source heterogeneous standardized data is distributed to the behavior analysis intelligent agent in the professional intelligent agent cluster. Based on the preset user entity behavior baseline, the deviation of the user entity behavior data is calculated to obtain the behavior risk analysis result. The vulnerability scanning data in the multi-source heterogeneous standardized data is distributed to the vulnerability detection agent in the professional agent cluster. Based on the preset vulnerability scoring rules, the vulnerability scanning data is processed for exploitability assessment to obtain vulnerability risk analysis results. The threat intelligence fusion agent in the professional intelligent agent cluster collects and processes the preset external threat intelligence database, and performs correlation analysis on the network threat analysis results, the behavioral risk analysis results, and the vulnerability risk analysis results based on the external threat intelligence database to obtain the threat intelligence correlation analysis results. The network threat analysis results, the energy data security analysis results, the computing power scheduling security analysis results, the behavioral risk analysis results, the vulnerability risk analysis results, and the threat intelligence correlation analysis results are used as the preliminary analysis results corresponding to each of the aforementioned professional intelligent agents.

[0008] By adopting the above technical solutions, each specialized intelligent agent uses an adapted analysis model to process different data types in parallel. The threat intelligence fusion agent performs correlation analysis on network threats, behavioral risks, and vulnerability risks, which helps to uncover the correlation threat characteristics across data types, improves the ability to identify complex security threats, and provides more comprehensive preliminary analysis results for subsequent collaborative and integrated decision-making, thereby reducing the risk of missing security threats.

[0009] Optionally, the step of transmitting collaborative analysis requests within the cluster of specialized intelligent agents based on a preset message bus, and obtaining collaborative analysis results by processing the response requests from the target specialized intelligent agents, includes: When the initiating professional intelligent agent in the professional intelligent agent cluster identifies a correlation feature that requires the assistance of the assisting professional intelligent agent during the preliminary analysis process, it constructs a collaborative analysis request based on the correlation feature according to a preset standardized message format. The request includes the sender intelligent agent identifier, the receiver intelligent agent identifier, the message type, and the analysis data to be shared. The assisting professional intelligent agent can be any one or more in the professional intelligent agent cluster. Based on the constructed collaborative analysis request, the collaborative analysis request is routed according to the recipient agent identifier in the collaborative analysis request through the asynchronous communication channel of the message bus, and the collaborative analysis request is delivered to the requested professional agent indicated by the recipient agent identifier. According to the preset priority rules, the message types in the delivered collaborative analysis requests are priority-labeled to obtain the priority tags corresponding to the collaborative analysis requests. The collaborative analysis requests with high priority tags are placed into a preset priority processing queue. The response time of the collaborative analysis requests placed into the priority processing queue is timed and monitored based on a preset timeout threshold to obtain the response time monitoring results. Based on the response time monitoring results, and in accordance with the order of the priority processing queue, the target professional intelligent agent processes the data to be shared in the collaborative analysis request, and sends the processed analysis data back to the initiating professional intelligent agent indicated by the sending intelligent agent identifier through the message bus, thereby obtaining the collaborative analysis result.

[0010] By adopting the above technical solution, utilizing the asynchronous communication channel and priority queue mechanism of the message bus, collaborative analysis requests are routed, delivered, and processed in an orderly manner, and the response time is monitored for timeout. This helps to reduce the waiting delay of collaborative analysis between professional intelligent agents, ensure the timeliness of the collaborative analysis process, and make the identification of related threats more timely, thereby reducing the risk of missing complex security threats and enhancing the real-time performance and accuracy of security assessment.

[0011] Optionally, the step of prioritizing the message types in the delivered collaborative analysis requests according to a preset priority rule to obtain priority tags corresponding to the collaborative analysis requests, placing the collaborative analysis requests with high priority tags into a preset priority processing queue, and monitoring the response time of the collaborative analysis requests placed into the priority processing queue based on a preset timeout threshold to obtain response time monitoring results, including: Based on the preset mapping relationship between message type and priority, the message type in the collaborative analysis request is matched to obtain the priority tag corresponding to the collaborative analysis request; The collaborative analysis requests with the priority tag of "high priority" are placed into the priority processing queue, and the collaborative analysis requests with the priority tag of "not high priority" are placed into the preset normal processing queue. Based on the timeout threshold, the response duration of the collaborative analysis request placed in the priority processing queue is timed. When the response duration exceeds the timeout threshold, a corresponding response duration monitoring result is generated.

[0012] By adopting the above technical solution, collaborative analysis requests are prioritized according to the mapping relationship between message type and priority. High-priority requests are placed in the priority processing queue and response time is monitored based on the timeout threshold. This helps to ensure that urgent collaborative tasks are processed and responded to in a timely manner, reduce the omission of related threat identification due to waiting delays, and improve the timeliness and reliability of the collaborative analysis process.

[0013] Optionally, the preliminary analysis results and the collaborative analysis results are input into a preset large-scale model fusion decision-making agent. The large-scale model fusion decision-making agent performs format unification processing on the preliminary analysis results and the collaborative analysis results to obtain a security event, including: By using the large model fusion decision-making agent, the preliminary analysis results and the collaborative analysis results are mapped according to the preset security event template to obtain intermediate analysis data. When there are conflicting analysis conclusions regarding the same analysis object in the intermediate analysis data, the conflicting analysis conclusions are adjudicated according to the preset evidence weights to obtain a unified analysis conclusion. Based on the unified analysis conclusion and the timestamps in the intermediate analysis data, the intermediate analysis data is timeline aligned and event aggregated to obtain the security event.

[0014] By adopting the above technical solutions, the large model fusion decision-making agent performs field mapping, conflict resolution, timeline alignment, and event aggregation on the preliminary analysis results and collaborative analysis results. This helps to solve the problem of inconsistent conclusions from multi-source analysis and restores discrete alarm information into logically coherent security events. This is beneficial to improving the input quality of subsequent fusion reasoning, thereby reducing the risk of missing complex threats and enhancing the accuracy of assessment results.

[0015] Optionally, the step of constructing a reasoning context based on the security event, and performing fusion reasoning on the reasoning context through a preset large language security model to obtain a comprehensive security posture assessment result includes: The event type, event severity, and event-related entities are extracted from the security event. The event type and the event severity are spliced ​​together to construct a security event timeline. The security event timeline and the event-related entities are used as the inference context. The reasoning context is input into the large language security model, and the large language security model is guided by the preset thinking chain reasoning module to perform step-by-step reasoning processing on the reasoning context to obtain intermediate reasoning results; Based on the intermediate reasoning results, relevant security knowledge data is retrieved from the preset energy computing power network security knowledge base. The security knowledge data and the intermediate reasoning results are then fused together using the big language security model to obtain the comprehensive security situation assessment result.

[0016] By adopting the above technical solution, a reasoning context containing timelines and related entities is constructed using security events. The reasoning module guides the large language security model to reason step by step, and then the energy computing power network security knowledge base is integrated for fusion processing. This helps to enhance the depth of logical reasoning and causal tracing capabilities for complex threats, and improve the accuracy and comprehensiveness of the overall security situation assessment.

[0017] Optionally, the step of generating a security protection strategy based on the comprehensive security situation assessment result, executing the security protection strategy, and obtaining execution feedback results includes: Based on the risk level and main threat type in the comprehensive security situation assessment results, the security protection strategy corresponding to the risk level and the main threat type is matched from the preset protection strategy library; The security protection strategy is distributed to the execution node corresponding to the security protection strategy in the energy computing power network, and the execution node executes the security protection strategy to obtain the execution feedback result. Based on the execution feedback results, the collection parameters of the network traffic data, energy data, computing power scheduling data, user entity behavior data, and vulnerability scanning data in the energy computing power network are adjusted to obtain the adjusted collection parameters, which are then used as the basis for the next round of data collection.

[0018] By adopting the above technical solutions, security protection strategies are matched and issued based on the risk level and threat type of the overall security situation, and data collection parameters are dynamically adjusted based on execution feedback. This helps to form an adaptive closed loop, enhance the pertinence and timeliness of security protection measures, and improve the continuous defense and dynamic optimization capabilities of energy computing networks against complex threats.

[0019] A second aspect of this application provides an electronic device including a processor, a memory, a user interface, and a network interface, wherein the memory is used to store instructions, the user interface and the network interface are both used to communicate with other devices, and the processor is used to execute the instructions stored in the memory to cause the electronic device to perform the method as described in any of the foregoing.

[0020] A third aspect of this application provides a computer-readable storage medium storing instructions that, when executed, perform the method described in any of the preceding descriptions.

[0021] A fourth aspect of this application provides a computer program product that, when run on an electronic device, causes the electronic device to perform the method as described in any of the preceding claims.

[0022] In summary, one or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages: By constructing a professional intelligent agent cluster to perform parallel analysis and collaborative interaction on multi-source heterogeneous data, and integrating large models for conflict adjudication, event aggregation, and thought chain reasoning, it helps to deeply explore the correlation threat characteristics across data types, reduce the risk of missing complex security threats, and improve the accuracy and comprehensiveness of security assessments. At the same time, by using priority queues and timeout monitoring mechanisms to ensure the timeliness of collaborative analysis, and by dynamically adjusting data collection parameters based on policy execution feedback, an adaptive closed loop can be formed, enhancing the continuous defense and dynamic optimization capabilities of the energy computing network. Attached Figure Description

[0023] Figure 1 This is a schematic diagram of the system architecture of an embodiment of an energy computing power network security situation assessment method based on multi-agent large model fusion according to this application; Figure 2 This is a flowchart illustrating a method for assessing the cybersecurity situation of energy computing power networks based on multi-agent large model fusion, as disclosed in an embodiment of this application. Figure 3 This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of this application.

[0024] Explanation of reference numerals in the attached figures: 100, System architecture; 101, First terminal device; 102, Second terminal device; 103, Third terminal device; 104, Network; 105, Server; 301, Processor; 302, Communication bus; 303, User interface; 304, Network interface; 305, Memory. Detailed Implementation

[0025] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0026] In the description of the embodiments of this application, the words "for example" or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design that is described as "for example" or "for instance" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design options. Rather, the use of the words "for example" or "for instance" is intended to present the relevant concepts in a specific manner.

[0027] In the description of the embodiments of this application, the term "multiple" means two or more. For example, multiple systems means two or more systems, and multiple screen terminals means two or more screen terminals. Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the indicated technical features. Thus, a feature defined with "first" or "second" may explicitly or implicitly include one or more of that feature. The terms "comprising," "including," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0028] like Figure 1 As shown, the system architecture 100 of this embodiment may include terminal device 101, terminal device 102, terminal device 103, network 104, and server 105. The system architecture 100 is used to support the operating environment of the energy computing power network security assessment method based on multi-agent fusion described in this application.

[0029] Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as industrial Ethernet, fiber optic private networks, 5G / 4G cellular networks, power line communication (PLC), and wireless communication links. It may also employ a hybrid network of these connection types to adapt to the communication needs of the energy computing network in different zones such as production control areas, management information areas, and internet service areas.

[0030] Terminal devices 101, 102, and 103 can correspond to nodes playing different roles in the energy computing network. Users can use terminal devices 101, 102, and 103 to interact with server 105 through network 104 to complete operations such as data reporting, status monitoring, and policy distribution. For example: Terminal device 101 can be used as a data acquisition terminal and deployed in key locations of the energy computing network (such as substation secondary systems, energy metering terminals, computing power scheduling controllers, edge computing nodes, etc.). It undertakes the task of collecting network traffic data, energy data, computing power scheduling data, user entity behavior data, and vulnerability scanning data, and uploads the collected data to server 105 through network 104. Terminal device 102 can be used as an operation and maintenance display terminal for security operation and maintenance personnel to receive and visualize the comprehensive security situation assessment results, security event details and security protection strategy execution status output by server 105, and support operation and maintenance personnel to perform manual review and intervention when necessary; Terminal device 103 can be used as a policy execution end and deployed in the energy computing network as a firewall, host security agent, micro-segmentation gateway or computing scheduler, etc. It is used to receive security protection policies issued by server 105, and parse and execute policy instructions locally to complete specific security actions such as blocking, isolation, rate limiting, and privilege downgrading. At the same time, the execution results are sent back to server 105 as execution feedback results.

[0031] Server 105 is used to support the computing power of core components such as the professional intelligent agent cluster, message bus, large model fusion decision intelligent agent, and large language security model described in this application. It is responsible for executing processing logic such as data distribution, parallel analysis, collaborative interaction, fusion decision-making, situational reasoning, and policy generation, and is the core processing node of this method. Server 105 can be a single physical server, a distributed cluster composed of multiple servers, or a cloud server or a hybrid deployment of local and cloud servers.

[0032] Terminal devices 101, 102, and 103 can be either hardware or software. When terminal devices 101, 102, and 103 are hardware, they can be electronic devices with corresponding data acquisition, display, or execution capabilities, including but not limited to industrial-grade data acquisition devices, energy metering terminals, computing power scheduling controllers, security operation and maintenance workstations, firewall devices, edge security gateways, and desktop computers, portable computers, etc. When terminal devices 101, 102, and 103 are software, they can be installed in the aforementioned hardware devices in the form of data acquisition agents, visualization clients, security policy execution agents, etc., and can be implemented as multiple distributed software modules or as a single software module. This application does not make specific limitations in this regard.

[0033] It should be noted that, Figure 1 The number of terminal devices and servers shown is for illustrative purposes only. In actual deployment, the energy computing network can contain dozens to thousands of data acquisition terminals, several operation and maintenance display terminals, and a large number of policy execution terminals. Server 105 can also be elastically expanded according to the load.

[0034] This embodiment discloses a method for assessing the cybersecurity situation of energy computing power networks based on the fusion of multi-agent large models. Figure 2 This is a flowchart illustrating a method for assessing the cybersecurity situation of energy computing power networks based on multi-agent large model fusion, as disclosed in an embodiment of this application. Figure 2 As shown, the method includes the following steps: S201 collects network traffic data, energy data, computing power scheduling data, user entity behavior data, and vulnerability scanning data in the energy computing power network, and performs format standardization processing to obtain multi-source heterogeneous standardized data. Specifically, the energy computing network integrates distributed computing resources with the collaborative operation of the energy network. Network traffic data may include quintuples and metadata; energy data may include voltage, power consumption, and scheduling instructions; computing power scheduling data may include node resource utilization and task logs; user entity behavior data may include authentication and operation audit logs; and vulnerability scanning data may include CVE numbers and CVSS (Common Vulnerability Scoring System) scores. The collection of the above data can employ at least one of the following implementation schemes: The first is active probe collection, which involves deploying probes at key nodes to collect network and energy data in real time via bypass mirroring or industrial communication protocols (such as Netflow, IEC 61850, etc.), and pulling scheduling and vulnerability data through system API integration; the second is passive reception, where each business system actively pushes operation logs to the collection end via Syslog or message middleware (such as Kafka); the third is a hybrid collection combining the above two methods, actively collecting high-real-time data and periodically extracting low-frequency data. Due to significant differences in message format, protocol architecture, and time precision among the multi-source raw data, format standardization processing must be performed simultaneously. This process specifically includes: field normalization (converting synonymous fields from different sources into unified standard names based on a preset mapping table), timestamp alignment (uniformly formatting to millisecond-level UTC time), data type conversion and physical unit conversion (e.g., unifying various energy consumption units), supplemented by sensitive information hashing and filtering of invalid empty messages. The standardized data is preferably structured using a unified JSON Schema or Protobuf protocol format, ensuring that each record encapsulates a source identifier, a global timestamp, and a standard field set. Key parameters such as the collection frequency and mapping rules in the above process can be flexibly configured according to the actual business scale. Through this step, the scattered and heterogeneous underlying raw records are transformed into structure-aligned, semantically unified multi-source heterogeneous standardized data, which can be directly accessed by multiple downstream professional intelligent agents across domains, laying a feasible data foundation for subsequent parallel analysis.

[0035] S202. Distribute the multi-source heterogeneous standardized data to a preset professional intelligent agent cluster according to the data type. The professional intelligent agents in the professional intelligent agent cluster analyze the distributed data in parallel to obtain the preliminary analysis results corresponding to each professional intelligent agent. Specifically, a data distribution bus (such as a Topic subscription mechanism) can be used to precisely route different types of standardized data to corresponding dedicated functional nodes for independent concurrent processing. The specific analysis process is as follows: Network traffic data is distributed to the network traffic analysis agent, which loads a lightweight deep learning traffic classification model (specifically, a CNN-based spatial feature extraction model or a Transformer-based temporal behavior classification model) to identify intrusion features of abnormal traffic such as DDoS attacks and malicious scans, obtaining network threat analysis results; Energy data is distributed to the energy data security agent, which establishes an energy data security baseline based on historical normal operation data and performs deviation detection processing through statistical threshold testing (such as the 3σ principle) or machine learning anomaly detection algorithms (such as the isolated forest algorithm), obtaining energy data security analysis results; Computing power scheduling data is distributed to the computing power scheduling security agent, which uses a pre-built computing power scheduling behavior pattern library and dynamic time warping... The system uses sequence matching or graph-dependent topology analysis algorithms for Warping (DTW) to compare scheduling behavior and obtain computing power scheduling security analysis results. User entity behavior data is distributed to the behavior analysis agent, which establishes a baseline of user entity behavior based on user daily operation profiles. This baseline is processed through unsupervised clustering deviation calculation or probability density likelihood calculation to obtain behavior risk analysis results. Vulnerability scanning data is distributed to the vulnerability detection agent, which performs actual exploitability assessment on vulnerability data based on general vulnerability scoring rules (its evaluation schemes include directly referencing CVSS static scoring or combining dynamic scoring with actual network exposure surfaces and graph database attack chain path analysis) to obtain vulnerability risk analysis results. Furthermore, based on parallel computing at each node, a threat intelligence fusion agent collects and compares data from a pre-set external threat intelligence database (such as an open-source IoC indicator library or a commercial security knowledge graph). Through precise indicator correlation or semantic graph inference technology, the aforementioned network threat analysis results, behavior risk analysis results, and vulnerability risk analysis results are denoised and correlated to generate threat intelligence correlation analysis results. Finally, the system aggregates the six types of analysis results generated in parallel from each business dimension, using them together as the preliminary analysis results for each professional intelligent agent. This distributed mechanism, which distributes data by type and allows for independent parallel computation by professional domain models, effectively improves the processing throughput of multimodal data in the energy computing network while ensuring the depth of data analysis in each dimension, laying an analytical foundation for discovering low-frequency, hidden, and complex threats.

[0036] Optionally, the step of distributing the multi-source heterogeneous standardized data to a preset cluster of specialized intelligent agents according to data type, and obtaining preliminary analysis results corresponding to each specialized intelligent agent through parallel analysis of the distributed data by each specialized intelligent agent in the cluster, includes: distributing network traffic data in the multi-source heterogeneous standardized data to a network traffic analysis intelligent agent in the cluster of specialized intelligent agents, performing intrusion feature identification processing on the network traffic data using a preset deep learning traffic classification model, and obtaining network threat analysis results; distributing energy data in the multi-source heterogeneous standardized data to an energy data security intelligent agent in the cluster of specialized intelligent agents, performing deviation detection processing on the energy data based on a preset energy data security baseline, and obtaining energy data security analysis results; distributing computing power scheduling data in the multi-source heterogeneous standardized data to a computing power scheduling security intelligent agent in the cluster of specialized intelligent agents, performing behavior comparison processing on the computing power scheduling data based on a preset computing power scheduling behavior pattern library, and obtaining computing power scheduling security analysis results; and distributing the multi-source heterogeneous standardized data to a computing power scheduling security intelligent agent in the cluster of specialized intelligent agents, performing behavior comparison processing on the computing power scheduling data based on a preset computing power scheduling behavior pattern library, and obtaining computing power scheduling security analysis results; and distributing the multi-source heterogeneous standardized data to a computing power scheduling security intelligent agent in the cluster of specialized intelligent agents, and performing behavior comparison processing on the computing power scheduling data based on a preset computing power scheduling behavior pattern library, and obtaining computing power scheduling security analysis results; and distributing the multi-source heterogeneous standardized data to a computing power scheduling security intelligent agent in the cluster of specialized intelligent agents. The user entity behavior data in the standardized multi-source heterogeneous data is distributed to the behavior analysis agent in the professional agent cluster. Based on a preset user entity behavior baseline, the deviation of the user entity behavior data is calculated to obtain behavior risk analysis results. The vulnerability scanning data in the standardized multi-source heterogeneous data is distributed to the vulnerability detection agent in the professional agent cluster. Based on preset vulnerability scoring rules, the exploitability of the vulnerability scanning data is evaluated to obtain vulnerability risk analysis results. The threat intelligence fusion agent in the professional agent cluster collects and processes a preset external threat intelligence database. Based on the external threat intelligence database, the network threat analysis results, the behavior risk analysis results, and the vulnerability risk analysis results are correlated to obtain threat intelligence correlation analysis results. The network threat analysis results, the energy data security analysis results, the computing power scheduling security analysis results, the behavior risk analysis results, the vulnerability risk analysis results, and the threat intelligence correlation analysis results are used as the preliminary analysis results corresponding to each of the professional agents.

[0037] As a preferred implementation of this embodiment, the process of distributing multi-source heterogeneous standardized data to a cluster of specialized intelligent agents for parallel analysis is specifically handled concurrently by dedicated intelligent agents according to data dimensions. First, network traffic data is distributed to a network traffic analysis intelligent agent, which identifies intrusion characteristics using a pre-set deep learning traffic classification model to obtain network threat analysis results. This model can use a CNN-based algorithm to extract spatial features to quickly identify large-volume anomalies, or an LSTM-based temporal model to uncover slow, covert attacks. Simultaneously, energy data is distributed to an energy data security intelligent agent, which performs deviation detection based on a pre-set energy data security baseline to obtain energy data security analysis results. Specifically, deviation detection can use the 3σ statistical threshold method to identify sudden energy consumption pulses, or utilize machine learning algorithms such as isolated forests to extract abnormal power consumption profiles. Furthermore, computing power scheduling data is distributed to a computing power scheduling security intelligent agent, which performs behavior comparison processing based on a pre-set computing power scheduling behavior pattern library to output computing power scheduling security analysis results. This comparison can use a rule engine to directly intercept known illegal instructions, or use the DTW algorithm to match operation state sequences to covertly uncover illegal computing resource preemption behavior.

[0038] While analyzing infrastructure status, the cluster simultaneously processes operational behavior and system vulnerability data in parallel. Specifically, user entity behavior data is distributed to a behavior analysis agent, which calculates deviation based on a preset user entity behavior baseline to obtain behavior risk analysis results. The deviation calculation is implemented by using a Hidden Markov Model to calculate the probability of a user's current access path sequence to capture unauthorized attempts, or by using unsupervised clustering algorithms such as DBSCAN to classify behaviors outside of historical legitimate operation clusters as account compromise risks. In parallel, vulnerability scanning data is distributed to a vulnerability detection agent, which performs exploitability assessments based on preset vulnerability scoring rules to obtain vulnerability risk analysis results. This assessment can not only directly map to the basic static score of CVSS as a better solution, but also dynamically weight and recalculate the static score by combining the logical topology and asset exposure surface parameters of the current energy computing network to objectively reflect the true threat level of vulnerabilities in the current complex network.

[0039] Furthermore, to achieve cross-validation and noise reduction of multi-dimensional results, a pre-defined external threat intelligence database is collected and introduced through a threat intelligence fusion agent within the cluster. Based on this external intelligence database, the agent performs correlation analysis on the aforementioned network threat analysis results, behavioral risk analysis results, and vulnerability risk analysis results to generate threat intelligence correlation analysis results. Specific correlation methods include direct rule cross-comparison using compromise indicators (IoC, such as malicious IPs or file hashes), and multi-dimensional attack graph path correlation reasoning using security knowledge graph technology. Finally, the system merges the analysis results of network threats, energy data security, computing power scheduling security, behavioral risks, and vulnerability risks independently output by each agent, along with the cross-correlation threat intelligence correlation analysis results, as the preliminary analysis results for the entire dataset. This mechanism of concurrent processing and intelligence correlation effectively addresses the processing latency problem caused by the massive burst of multimodal data in energy computing power networks, significantly reducing the false positive rate of a single data source while ensuring refined extraction of features across dimensions.

[0040] S203. Based on a preset message bus, a collaborative analysis request is transmitted within the professional intelligent agent cluster. The target professional intelligent agent responds to the collaborative analysis request and the collaborative analysis result is obtained. The target professional intelligent agent is determined by the collaborative analysis request. Specifically, to break down analytical silos across different professional fields, the pre-defined message bus can employ a high-concurrency distributed publish / subscribe message queue (e.g., Kafka, RabbitMQ) or a low-latency point-to-point microservice RPC framework (e.g., gRPC) to build the underlying communication pool. When an agent, during initial analysis, finds that single-dimensional evidence is insufficient to define risk (e.g., a behavioral analysis agent detects an abnormal account login and needs further confirmation of whether it is accompanied by external network connections), it can publish a collaborative analysis request to the bus containing contextual information such as the suspect target identifier (e.g., IP, device ID, or account ID), a specific time window, and the required verification features. The target professional agent (in the aforementioned example, the network traffic analysis agent) will be dynamically determined based on the topic tags or routing rules carried in the request. After intercepting the request, it will extract the internal contextual constraints and call its own feature library or analysis model to perform targeted secondary aggregation queries or deep verification matching on the data pool within its managed domain. Subsequently, the target professional agent will package the verification conclusions as collaborative analysis results and transmit them back through the bus. This on-demand cross-domain interaction mechanism based on a standardized bus not only avoids the computational power consumption and communication congestion caused by global data exchange, but also effectively completes complex attack links through multi-dimensional mutual verification, significantly reducing the false positive and false negative rates of single-point analysis.

[0041] Optionally, the step of transmitting collaborative analysis requests within the professional agent cluster based on a preset message bus, and obtaining collaborative analysis results by processing the collaborative analysis requests through the target professional agent, includes: when the initiating professional agent in the professional agent cluster identifies a correlation feature requiring assistance from a collaborating professional agent during the preliminary analysis, it constructs a collaborative analysis request based on the correlation feature according to a preset standardized message format, including the sender agent identifier, the receiver agent identifier, the message type, and the data to be shared for analysis. The collaborating professional agent can be any one or more in the professional agent cluster; based on the constructed collaborative analysis request, it routes the collaborative analysis request through the asynchronous communication channel of the message bus according to the receiver agent identifier in the collaborative analysis request, and then forwards the collaborative analysis... The request is delivered to the requested professional agent indicated by the recipient agent identifier; the message type in the delivered collaborative analysis request is prioritized according to a preset priority rule to obtain a priority tag corresponding to the collaborative analysis request; collaborative analysis requests with high priority tags are placed into a preset priority processing queue, and the response time of the collaborative analysis requests placed into the priority processing queue is timed and monitored based on a preset timeout threshold to obtain a response time monitoring result; based on the response time monitoring result, the target professional agent responds to the shared analysis data in the collaborative analysis request according to the order of the priority processing queue, and the processed analysis data is sent back to the initiating professional agent indicated by the sender agent identifier through the message bus to obtain the collaborative analysis result.

[0042] As a preferred implementation of the above embodiments, the process of transmitting collaborative analysis requests and processing responses based on a preset message bus can be specifically implemented by constructing a standardized asynchronous communication and priority scheduling mechanism. First, the collaborative mechanism is triggered by the boundary expansion of single-point analysis. When the initiating professional agent in the professional agent cluster identifies, during its independent preliminary analysis, a related feature that cannot be fully characterized by its own data and requires the cooperation of other assisting professional agents for analysis (for example, a behavioral analysis agent discovers an abnormal account login and needs a network agent to verify whether there are any abnormal external connections), it will construct a collaborative analysis request according to a preset standardized message format (such as JSON, XML, or Protobuf protocol format). This request is given explicit field constraints, specifically including: the sender agent identifier, the receiver agent identifier specifying one or more assisting nodes, the message type indicating the intent (such as status inquiry, evidence request, or feature comparison), and the shared analysis data encapsulating the context of the related features (such as a specific time window, IP address, or operation record).

[0043] After the request is constructed, the system distributes it by invoking the asynchronous communication channel of the message bus (e.g., middleware built on Kafka or RabbitMQ) based on the collaborative analysis request. Through the asynchronous channel, the initiator can continue executing other analysis tasks without blocking after sending the request. The bus system performs precise routing based on the recipient agent identifier in the collaborative analysis request header, delivering the collaborative analysis request to the requested specific professional agent node using unicast or multicast. To ensure timely processing of critical threat events, the target node, upon receiving the delivered request, will prioritize the message types it contains according to preset priority rules. Specifically, messages involving serious system damage or endangered critical assets may be labeled with high priority, while status queries may be labeled with medium to low priority. After labeling, the system forcibly removes the collaborative analysis requests with high priority labels and inserts them at the front of a preset priority processing queue.

[0044] For requests entering the queue, to prevent a global communication avalanche due to a subsystem failure, the system independently starts timing monitoring for the response time of the collaborative analysis requests placed in the priority processing queue based on a preset timeout threshold (such as an adjustable configuration parameter between 50 milliseconds and 1 second), thereby continuously outputting response time monitoring results. Finally, based on the response time monitoring results (tasks about to time out can be discarded, downgraded, or transferred to release resources), the target professional agent strictly follows the order of the priority processing queue for dequeue processing, extracts the data to be shared for analysis, and inputs it into its own detection model for targeted analysis; subsequently, the verified analysis conclusions are also encapsulated as a message body and sent back to the initiating professional agent corresponding to the original sending agent identifier via the message bus, thus forming a complete collaborative analysis result. This closed-loop collaborative mechanism combining asynchronous routing, priority preemption, and timeout reset not only ensures flexible and loosely coupled communication between massive components but also ensures the absolute smooth operation of the core analysis link under sudden high-risk threats.

[0045] Optionally, the step of performing priority labeling processing on the message types in the delivered collaborative analysis requests according to preset priority rules to obtain priority tags corresponding to the collaborative analysis requests, placing the collaborative analysis requests with high priority tags into a preset priority processing queue, and timing and monitoring the response time of the collaborative analysis requests placed into the priority processing queue based on a preset timeout threshold to obtain response time monitoring results includes: matching the message types in the collaborative analysis requests according to a preset mapping relationship between message types and priorities to obtain the priority tags corresponding to the collaborative analysis requests; placing the collaborative analysis requests with high priority tags into the priority processing queue, and placing the collaborative analysis requests with priority tags that are not high priority into a preset ordinary processing queue; timing the response time of the collaborative analysis requests placed into the priority processing queue based on the timeout threshold, and generating the corresponding response time monitoring results when the response time exceeds the timeout threshold.

[0046] As a preferred embodiment for further optimizing the system's task scheduling mechanism in high-concurrency communication scenarios, the receiving node executes a refined hierarchical queuing and time-sensitive circuit breaker strategy after receiving the collaborative analysis request. Specifically, to prioritize massive requests, the system pre-defines a mapping table or rule set between message types and priorities. When the target node receives a collaborative analysis request, it uses the parsing module to extract the message type field from the request header and uses this field as a key to search or compare within the aforementioned mapping relationship, thereby outputting the corresponding priority label. For example, in a real-world energy network security scenario, configurable mapping relationships include mapping message types representing "real-time intrusion and privilege escalation comparison" and "instant exploitation verification of high-risk vulnerabilities" to high priority, while mapping message types representing "historical access log backtracking" and "offline resource usage verification" to medium or normal priority. Technically, this matching process can employ memory-level hash table lookup technology to achieve nanosecond-level ultra-fast matching, or a lightweight rule engine can be deployed to dynamically parse complex conditional statements for labeling.

[0047] After completing the tag allocation step, the scheduling component initiates the traffic distribution strategy. Completely isolated processing buffers are pre-allocated in system memory. When a high-priority tag is detected, the system immediately pushes the current co-analysis request into a dedicated priority processing queue. Conversely, if the priority tag is not high-priority, the scheduling component places the co-analysis request into a separate ordinary processing queue. As an optional implementation, the priority processing queue can be built based on a lock-free concurrent data structure to ensure that urgent tasks are not blocked by thread locks during enqueuing and dequeuing; while the ordinary processing queue can use a basic first-in-first-out circular queue. This tag-driven dual-track or multi-track isolation mechanism physically ensures that high-risk alarm verification tasks are allocated a significant amount of CPU time slices for computation.

[0048] Furthermore, to prevent high-priority tasks from being stuck in the queue for extended periods due to complex model calculations or temporary depletion of node resources, the system employs a robust time-limit defense. The moment a collaborative analysis request is pushed into the priority processing queue, the external monitoring daemon initiates an independent timing component based on a pre-set timeout threshold (e.g., an adjustable parameter of 50 milliseconds or 150 milliseconds). This component precisely updates the time elapsed between the task's arrival in the queue and its processing start (i.e., response time). The timing can be implemented using a high-precision hardware counter at the operating system level or a TimeWheel algorithm at the application layer. Within the timing period, if the response time exceeds the set timeout threshold, the monitoring logic proactively intervenes and generates an abnormal response time monitoring result. This result can be packaged into an alarm log to notify the system administrator, or directly parsed by the system as a discard, downgrade, or transfer instruction for the overdue request.

[0049] S204. Input the preliminary analysis results and the collaborative analysis results into a preset large model fusion decision-making agent. The large model fusion decision-making agent performs format unification processing on the preliminary analysis results and the collaborative analysis results to obtain a security event. In practical implementation, the preliminary analysis results generated by various underlying professional intelligent agents (such as process anomaly logs at the host level) and the collaborative analysis results (such as external link records for collaborative verification at the network level) often exhibit severe heterogeneity and fragmentation in terms of data structure, field dimensions, and semantic expression. Therefore, the system inputs both types of multi-source aggregated data into a large-scale model fusion decision intelligent agent located at the upper layer of the decision flow. Here, the decision intelligent agent refers to an intelligent component with computing power based on a large-scale language model possessing hundreds of billions of parameters or fine-tuned with knowledge from the security vertical domain, supplemented by the ability to orchestrate thought chains or workflows. When performing format unification processing, a preferred technical solution is to directly utilize the prompt word engineering of the large model, inputting the heterogeneous analysis results along with a pre-defined standard security event schema (data pattern) as context into the model. This instructs the large model to automatically extract core entities such as attack time, victim assets, exploitation methods, and confidence levels contained in the original logs using its natural language understanding capabilities, and accurately fill these entities into a standard JSON dictionary structure. Another alternative approach is to leverage the semantic mapping and generalization extraction capabilities of the large model to identify and eliminate entity referential ambiguities in multi-source reports (e.g., unifying "IP blacklist" and "malicious source address" from different logs into a standard field "Attacker_IP"), thereby aligning the terminology system. After the aforementioned denoising, completion, and structured reorganization of the large model, the underlying ambiguous and fragmented analysis results are completely reshaped, ultimately outputting security events with a clear timeline, a unified ontology structure, and direct machine recognition. This removes the data format barriers for subsequent higher-level covert threat assessments or tactical action generation.

[0050] Optionally, the step of inputting the preliminary analysis results and the collaborative analysis results into a preset large-scale model fusion decision-making agent, and then using the large-scale model fusion decision-making agent to perform format unification processing on the preliminary analysis results and the collaborative analysis results to obtain a security event, includes: using the large-scale model fusion decision-making agent to perform field mapping processing on the preliminary analysis results and the collaborative analysis results according to a preset security event template to obtain intermediate analysis data; when there are conflicting analysis conclusions for the same analysis object in the intermediate analysis data, adjudicating the conflicting analysis conclusions according to preset evidence weights to obtain a unified analysis conclusion; and based on the unified analysis conclusion and the timestamps in the intermediate analysis data, performing timeline alignment and event aggregation processing on the intermediate analysis data to obtain the security event.

[0051] As a further refinement and preferred implementation of the aforementioned fusion decision-making mechanism, the large-model fusion decision-making agent, upon receiving multi-source data, first enters a normalization and reconstruction phase. This involves performing field mapping processing on the preliminary analysis results and collaborative analysis results according to a preset security event template, thereby outputting structurally standardized intermediate analysis data. The preset security event template typically manifests as a standardized JSON entity constraint form or a specification dictionary based on international standards such as STIX 2.0, clearly defining key dimensions that must be covered, such as attack sources, target assets, and threat categories. At the technical implementation level, one approach relies on the large model's superior natural language understanding capabilities to directly read and digest the unstructured raw logs reported by various underlying professional agents. By understanding the context, it automatically extracts and fills the messy field information into the corresponding specification slots in the template. Another alternative technical solution is a rule engine integrated into the large model. For parts with fixed formats, regular expressions are used for pre-detection and hard segmentation and extraction, while for parts with grammatical ambiguity or distortion, the large model performs inference and mapping. This step completely breaks down the data barriers between multi-source heterogeneous devices, transforming the scattered and fragmented original clues into a unified intermediate material that is easy for subsequent machine processing.

[0052] Upon acquiring standardized intermediate analysis data, the system immediately triggers in-depth fact-checking logic. In a high-concurrency distributed monitoring network, conflicting analysis conclusions regarding the same analytical object (such as a specific file hash value or a specific process identifier) ​​are highly likely to occur. For example, a host defense agent might determine a downloaded file to be safe because it did not detect a known virus signature, while a network situation agent might determine it to be highly vulnerable because it monitored the file triggering continuous external connections with unknown malicious external addresses. Faced with such contradictions within the data, the system will initiate adjudication processing for conflicting analysis conclusions based on preset evidence weights. One specific implementation mechanism is to configure a static priority weight table, pre-assigning a higher weight score to conclusive bidirectional communication evidence at the network layer than to single-point static scan results at the host layer. The system then directly accepts the conclusion associated with the higher score. Another more adaptive implementation is that the large model calculates the dynamic confidence weight in the current scenario based on the richness of feature indicators in each report, the historical accuracy reputation of the evidence nodes, and the real-time baseline of the network threat intelligence. Then, it selects the final viewpoint that best approximates the truth through a weighted comprehensive score, resulting in a unified analytical conclusion. The conflict adjudication defense line effectively eliminates the cognitive limitations and false alarm interference of a single detection dimension, significantly improving the accuracy of threat alerts.

[0053] After ensuring the logical consistency of the conclusions, the system proceeds to the final step of constructing complete events. The large-scale model integrates the decision-making agent to directly extract the unified analysis conclusions after adjudication, and tightly couples the absolute or relative timestamps of the records left in the intermediate analysis data. It then performs timeline alignment and event aggregation processing on massive discrete data slices, ultimately generating a panoramic view of security events. In actual engineering operations, to correct timing errors caused by network latency or clock drift in each child node, the system needs to strictly sort and calibrate the timestamps of each action using methods such as resetting the baseline. For the subsequent event aggregation operation, one efficient implementation strategy is to apply a sliding time window algorithm to bundle and combine various isolated alarms initiated against the same network target within a short period. Another, more in-depth parallel logic involves the large-scale model using its internally developed hacker tactical graph to align the timeline-aligned data fragments onto a standard network kill chain model, connecting events such as initial "port probing," mid-term "credential theft," and later "lateral movement," extracting the causal logical links within. Through this fusion extraction mechanism that moves from micro-level behavior to macro-level campaigns, the system no longer throws out hundreds or thousands of meaningless fragmented alerts to operations and maintenance personnel, but instead directly delivers countermeasure-level security events with a complete evolutionary trajectory.

[0054] S205. Construct a reasoning context based on the security event, and perform fusion reasoning on the reasoning context through a preset big language security model to obtain a comprehensive security situation assessment result. In practical implementation, the system needs to extract the core business dimensions of the security event (such as the complete attack and kill chain, the topology of the victimized assets, and the temporal evolution process) from the previous steps, dynamically transform and encapsulate them, and thus construct an inference context that conforms to the input specifications of the large-scale model. Technically, one approach is to directly call a pre-built prompt word template project, concatenating the various attributes of the security event into natural language text with specified system and user commands, and supplementing it with a historical baseline of the current network environment as a reference background. Another option is to use a specific markup language (such as XML or JSON Schema) to semantically enhance and encapsulate highly sensitive nodes in the security event, so that the prompting model can focus its attention on them. Next, the system feeds the constructed context into the large-scale language security model for computation. This model typically uses an AI engine with a base of hundreds of billions of parameters and deep command fine-tuning using a professional network attack and defense corpus. For the fusion reasoning stage, the system preferentially employs thought chain prompting technology, forcibly constraining the large language model to strictly follow the logical steps of "analyzing attacker intent—calculating asset impact—determining global risk level" to conduct deduction step by step. Alternatively, retrieval-enhanced generation technology can be used as an alternative, allowing the model to dynamically retrieve and attach the latest external public threat intelligence database during the reasoning process, introducing an external knowledge pool to cross-verify the actual harm of the current event. After in-depth model deconstruction and comprehensive deduction, the system finally outputs a comprehensive security situation assessment result containing high-level dimensions such as the overall system risk score level, subsequent evolution prediction path, and the scope of potentially paralyzed business operations. This completes the core capability leap from low-level alarm combination to a macro-decision-level situational intelligence brain.

[0055] Optionally, the step of constructing a reasoning context based on the security event and performing fusion reasoning on the reasoning context through a preset big language security model to obtain a comprehensive security situation assessment result includes: extracting event type, event severity, and event-related entities from the security event; concatenating the event type and the event severity to construct a security event timeline; using the security event timeline and the event-related entities as the reasoning context; inputting the reasoning context into the big language security model; guiding the big language security model to perform step-by-step reasoning processing on the reasoning context through a preset thought chain reasoning module to obtain intermediate reasoning results; retrieving related security knowledge data from a preset energy computing power network security knowledge base based on the intermediate reasoning results; and fusing the security knowledge data with the intermediate reasoning results through the big language security model to obtain the comprehensive security situation assessment result.

[0056] As a further refinement and preferred implementation of the aforementioned fusion reasoning mechanism, the system first focuses on the extraction and temporal reconstruction of core dimensions during the reasoning construction phase. This involves selectively extracting event types representing attack methods, event severity representing destructive power, and event-related entities representing controlled nodes or stolen data from security events. Subsequently, the system performs forced concatenation of the extracted event types and severity levels to construct a skeletalized security event timeline. In practical engineering implementation, a straightforward approach is to assemble "timestamp-event type-severity score" into a one-dimensional linearly evolving dynamic text log stream using specific separators (such as vertical or horizontal lines) according to the absolute chronological order of each action, thus visually outlining the temporal evolution of the hacker attack process. Another preferred alternative is to utilize a structured markup language (such as JSON format) to objectify and nest the temporal sequence with its dynamically fluctuating security peaks. Finally, the system packages this highly condensed security event timeline, which encapsulates the time and behavioral trajectories, along with the surrounding event-related entities, as a dedicated reasoning context for the underlying large model to digest and absorb. This preprocessing step effectively removes redundant noise from the massive underlying data, significantly reduces the token length of input prompts, and focuses on the core issues.

[0057] After generating a highly refined reasoning context, the system immediately feeds it into a pre-trained and finely tuned large language security model. The model is then guided through a pre-defined Chain of Thought (CoT) module to perform in-depth deconstruction, yielding intermediate reasoning results. To prevent logical jumps or factual illusions when handling complex network attack and defense games, Chain of Thought forcibly requires the model to break down complex data into smaller parts, avoiding the tendency to directly output the final conclusion. Specifically, one technical implementation involves embedding a zero-shot thought chain template into the input instructions, such as adding a guiding prompt like "Please think step by step, first analyze the initial breakthrough point, then deduce the lateral movement path, and finally assess the data leakage risk," forcing the model to solve the problem step by step. Another advanced implementation uses a Few-shot thought chain strategy, injecting two to three sets of expert-level deduction process examples of typical energy network security events into the context beforehand, allowing the model to mimic and refer to this hierarchical and progressive thinking pattern to analyze the current data. After rigorous, step-by-step calculations, the model outputs intermediate inference results that include assumptions about the attacker's intent, the potential vulnerabilities exploited, and the initial scope of impact, giving the AI ​​analysis process a high degree of transparency and "white-box" interpretability.

[0058] To further enrich the preliminary inference conclusions with industry-specific attributes and solid intelligence support, the system, based on the intermediate inference results obtained earlier, engages in cross-domain collaboration and retrieves strongly correlated security knowledge data from a pre-defined energy computing power network security knowledge base. This data is then submitted to the Big Language Security Model for final fusion and verification. This knowledge base encompasses vertical domain "know-how," including a power-specific industrial control vulnerability database, historical tactical manuals of energy industry APT (Advanced Persistent Threat) organizations, and emergency response plans for computing power clusters. During the retrieval process, a mainstream approach is to use vectorized embedding cosine similarity matching technology to transform the intermediate inference results into semantic vectors, accurately recalling the most semantically matching defense documents or threat intelligence in the high-dimensional space of the knowledge graph. Alternatively, traditional keyword and entity association query techniques can be used as a supplement. After recalling relevant knowledge, the system essentially constructs a retrieval enhancement generation architecture, instructing the Big Language Security Model to perform deep logical cross-interlocking and correction between these external, authoritative security knowledge data and the previous intermediate inference results. Through this dual-track verification loop of "model-endogenous logical deduction + external industry authoritative knowledge verification", the system finally outputs a comprehensive security situation assessment result with extremely high credibility and close to industry business scenarios. Its content comprehensively covers the global risk level assessment of the current computing power network, the prediction of the probability of paralysis of vulnerable nodes, and the next situation spread map.

[0059] S206. Generate a security protection strategy based on the comprehensive security situation assessment results, execute the security protection strategy, and obtain execution feedback results.

[0060] Specifically, based on the global risk situation and predicted evolution path output from the preceding steps, the system generates targeted blocking or remediation solutions. In terms of the specific technical implementation of strategy generation, one approach is to leverage the instruction generation capabilities of the large language security model to automatically construct dynamic security protection strategies containing defense logic, specific remediation code, or interception scripts directly based on the assessment results. Another reliable alternative is to employ the playbook technology of the Security Orchestration Automation and Response (SOAR) platform. Based on the risk level and attack type in the assessment results, it matches and extracts corresponding standard defense action sequences (such as malicious IP blocking, network isolation of infected hosts, or user account privilege reduction) from a pre-built emergency response plan library as security protection strategies. Subsequently, the system translates the generated security protection strategies into control instructions that can be recognized by underlying heterogeneous network devices (such as firewalls, situational awareness probes, or endpoint antivirus software), and uniformly distributes them to the target execution nodes via API interfaces for automated blocking operations. After the command is issued and executed, the underlying target node will send the implementation status of the specific action (such as "policy successfully issued", "port blocking completed", or "execution failed due to restricted permissions") back to the central control node through a status callback function or real-time log reporting mechanism, thus obtaining a complete closed-loop execution feedback result. This step, by establishing an end-to-end response mechanism from intelligent analysis and assessment to automated action issuance, greatly reduces the threat handling delay caused by human intervention, and achieves second-level proactive blocking and physical containment of high-risk network security attacks.

[0061] Optionally, the step of generating a security protection strategy based on the comprehensive security situation assessment result, executing the security protection strategy, and obtaining an execution feedback result includes: matching the security protection strategy corresponding to the risk level and the main threat type from a preset protection strategy library based on the risk level and the main threat type in the comprehensive security situation assessment result; distributing the security protection strategy to the execution node corresponding to the security protection strategy in the energy computing power network, and executing the security protection strategy through the execution node to obtain the execution feedback result; and adjusting the collection parameters of the network traffic data, energy data, computing power scheduling data, user entity behavior data, and vulnerability scanning data in the energy computing power network based on the execution feedback result to obtain adjusted collection parameters, and using the adjusted collection parameters as the basis for the next round of data collection.

[0062] As a preferred implementation method, to improve the accuracy of response and the effectiveness of defense against complex network attacks, the step of generating security protection strategies based on the comprehensive security situation assessment results is specifically manifested as a strategy mapping based on multi-dimensional features. The system analyzes the assessment results output by the large model in detail, focusing on extracting the quantitative indicators "risk level" (e.g., low risk, medium risk, high risk, critical risk) and the qualitative indicators "main threat types" (e.g., DDoS attacks, ransomware lateral movement, mining trojans, or abnormal computing power consumption). Subsequently, the system uses these two as a joint search key to perform precise matching in a preset protection strategy library. In terms of technical implementation, one approach is to use a hard-coded decision matrix based on a rule engine. For example, when the search key is "high-risk + ransomware lateral movement," the rule engine directly maps it to the standard policy contingency plan of "immediately cutting off the external connections of the infected subnet and freezing related computing power containers." A more flexible alternative is to use semantic vector calculation matching. This transforms the comprehensive security situation assessment results into multi-dimensional spatial vectors, calculates the cosine similarity with the policy description feature vectors in the protection policy model library, and intelligently recommends and generates one or more sets of combined security protection policies with the highest matching degree. This "level + type" based cross-matching mechanism effectively avoids false positives caused by "one-size-fits-all" defense, achieving targeted solutions.

[0063] After successfully matching and generating security protection policies, the system needs to establish a reliable automated orchestration mechanism to ensure the actual implementation and execution of the policies. Specifically, the control center does not directly implement blocking actions, but dynamically translates abstract security protection policies (such as "blocking the continuous access of a malicious IP") into specific low-level command operations that the execution nodes can recognize (such as the ACL configuration command line of a specific firewall vendor). Subsequently, the system sends these commands to the corresponding execution nodes (such as edge firewalls, host antivirus agents, micro-segmentation gateways, or computing power schedulers) that are at the forefront of the energy computing power network and have the best defense positions. In terms of execution methods, one approach is to centrally push configurations to gateway devices with agentless architectures through standardized network protocols such as RESTful APIs, SSH, or Netconf; another approach is to rely on security agents (agent programs) pre-deployed inside the physical machines or virtual machines of each computing power node to forcibly take over processes, block network connections, or downgrade user privileges locally, thereby executing the policy. After completing the interception, isolation, or repair attempt, whether successful or blocked (such as due to insufficient permissions leading to blocking failure), the execution node will send detailed execution logs back to the control center through an asynchronous message queue or real-time callback interface. The information returned is collected and aggregated by the system, ultimately forming a closed-loop execution feedback result that can be used for auditing and subsequent analysis.

[0064] After obtaining the aforementioned execution feedback results, a feedback and adaptive fine-tuning mechanism was further established to drive the optimization of the next round of monitoring system. The system uses the execution feedback results to assess whether there are blind spots or excessive consumption in the current monitoring field, and then dynamically adjusts the multi-source data acquisition parameters involving the entire energy computing power network infrastructure. The data sources of these parameters to be adjusted comprehensively cover the initial input dimensions, including network traffic data, energy data, computing power scheduling data, user entity behavior data, and vulnerability scanning data. The adjusted "acquisition parameters" may include, but are not limited to, acquisition frequency, sampling depth, detection time window, high-risk port listening weight, and packet alarm threshold. In practical implementation, one approach is to adjust based on feedback status. For example, if the feedback result shows that "the defense of a certain business network segment has been breached or blocked," the system will increase the packet capture frequency of network traffic within that escaped network segment from once every 10 minutes to real-time deep packet inspection (DPI), and significantly lower the threshold for collecting entity behavior data from key users to achieve high-frequency probing. Another approach is to use an automated scoring attenuation and enhancement model. For regular computing power scheduling data nodes that have successfully defended multiple times without abnormal expansion, the system appropriately reduces their polling heartbeat frequency to save system overhead, resulting in downgraded collection parameters. Finally, the system directly distributes the adjusted collection parameters obtained after this series of dynamic dimensionality upgrades or downgrades to various underlying sensors and probes, using them as a new benchmark to drive the next round of data collection activities. This design endows the system with powerful dynamic learning and evolution capabilities, enabling the defense system to automatically redirect "attention (i.e., data collection resources)" to the most dangerous business vulnerabilities based on real-world feedback, thereby constructing a spiraling, adaptive energy and computing power security barrier.

[0065] It should be noted that the above embodiments of the apparatus are only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0066] This embodiment also discloses an electronic device, as shown in the reference. Figure 3 The electronic device may include: at least one processor 301, at least one communication bus 302, user interface 303, network interface 304, and at least one memory 305.

[0067] The communication bus 302 is used to enable communication between these components.

[0068] The user interface 303 may include a display screen and a camera. Optionally, the user interface 303 may also include a standard wired interface and a wireless interface.

[0069] The network interface 304 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface).

[0070] The processor 301 may include one or more processing cores. The processor 301 connects to various parts of the server using various interfaces and lines, and performs various server functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in memory 305, and by calling data stored in memory 305. Optionally, the processor 301 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The processor 301 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content required for display; and the modem handles wireless communication. It is understood that the modem may also not be integrated into the processor 301 and may be implemented as a separate chip.

[0071] The memory 305 may include random access memory (RAM) or read-only memory. Optionally, the memory 305 may include a non-transitory computer-readable storage medium. The memory 305 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 305 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-described method embodiments, etc.; the data storage area may store data involved in the above-described method embodiments, etc. Optionally, the memory 305 may also be at least one storage device located remotely from the aforementioned processor 301. Figure 3As shown, the memory 305, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and an application program for assessing the cybersecurity situation of energy computing power networks based on multi-Agent large model fusion.

[0072] exist Figure 3 In the electronic device shown, the user interface 303 is mainly used to provide an input interface for the user and obtain the user input data; while the processor 301 can be used to call the application stored in the memory 305, which is an energy computing power network security situation assessment method based on multi-Agent large model fusion. When executed by one or more processors 301, the electronic device executes one or more methods as described in the above embodiments.

[0073] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0074] In the several embodiments provided in this application, it should be understood that the disclosed apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the shown or discussed mutual couplings or direct couplings or communication connections may be through some service interfaces; indirect couplings or communication connections between apparatuses or units may be electrical or other forms.

[0075] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0076] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory 305 and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods in the various embodiments of this application. The aforementioned memory 305 includes various media capable of storing program code, such as a USB flash drive, external hard drive, magnetic disk, or optical disk.

[0077] The foregoing description is merely an exemplary embodiment of this disclosure and should not be construed as limiting the scope of this disclosure. Any equivalent changes and modifications made in accordance with the teachings of this disclosure shall still fall within the scope of this disclosure. Other embodiments of this disclosure will be readily apparent to those skilled in the art upon consideration of the disclosure in this specification. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not described in this disclosure. The specification and embodiments are to be considered exemplary only, and the scope and spirit of this disclosure are defined by the claims.

Claims

1. A method for assessing the cybersecurity situation of energy computing power networks based on multi-agent large model fusion, characterized in that, The method includes: Network traffic data, energy data, computing power scheduling data, user entity behavior data, and vulnerability scanning data in the energy computing power network are collected and processed for format standardization to obtain multi-source heterogeneous standardized data. The multi-source heterogeneous standardized data is distributed to a preset cluster of professional intelligent agents according to the data type. The distributed data is then analyzed in parallel by each professional intelligent agent in the cluster to obtain the preliminary analysis results corresponding to each professional intelligent agent. Based on a preset message bus, collaborative analysis requests are transmitted within the cluster of specialized intelligent agents. The collaborative analysis results are obtained by responding to the collaborative analysis requests through the target specialized intelligent agents. The target specialized intelligent agents are determined by the collaborative analysis requests. The preliminary analysis results and the collaborative analysis results are input into a preset large model fusion decision-making agent. The large model fusion decision-making agent performs format unification processing on the preliminary analysis results and the collaborative analysis results to obtain the security event. Based on the security events, a reasoning context is constructed, and the reasoning context is fused and reasoned through a preset large language security model to obtain a comprehensive security situation assessment result. A security protection strategy is generated based on the comprehensive security situation assessment results, and the security protection strategy is executed to obtain execution feedback results.

2. The method according to claim 1, characterized in that, The process involves distributing the multi-source heterogeneous standardized data to a pre-defined cluster of specialized intelligent agents according to data type. Each specialized intelligent agent in the cluster then analyzes the distributed data in parallel to obtain preliminary analysis results for each agent, including: The network traffic data in the multi-source heterogeneous standardized data is distributed to the network traffic analysis agent in the professional agent cluster. The network traffic data is processed by intrusion feature identification through a preset deep learning traffic classification model to obtain network threat analysis results. The energy data in the multi-source heterogeneous standardized data is distributed to the energy data security agent in the professional intelligent agent cluster. Based on the preset energy data security baseline, deviation detection processing is performed on the energy data to obtain energy data security analysis results. The computing power scheduling data in the multi-source heterogeneous standardized data is distributed to the computing power scheduling security intelligent agent in the professional intelligent agent cluster. The computing power scheduling data is subjected to behavior comparison processing based on the preset computing power scheduling behavior pattern library to obtain computing power scheduling security analysis results. The user entity behavior data in the multi-source heterogeneous standardized data is distributed to the behavior analysis intelligent agent in the professional intelligent agent cluster. Based on the preset user entity behavior baseline, the deviation of the user entity behavior data is calculated to obtain the behavior risk analysis result. The vulnerability scanning data in the multi-source heterogeneous standardized data is distributed to the vulnerability detection agent in the professional agent cluster. Based on the preset vulnerability scoring rules, the vulnerability scanning data is processed for exploitability assessment to obtain vulnerability risk analysis results. The threat intelligence fusion agent in the professional intelligent agent cluster collects and processes the preset external threat intelligence database, and performs correlation analysis on the network threat analysis results, the behavioral risk analysis results, and the vulnerability risk analysis results based on the external threat intelligence database to obtain the threat intelligence correlation analysis results. The network threat analysis results, the energy data security analysis results, the computing power scheduling security analysis results, the behavioral risk analysis results, the vulnerability risk analysis results, and the threat intelligence correlation analysis results are used as the preliminary analysis results corresponding to each of the aforementioned professional intelligent agents.

3. The method according to claim 1, characterized in that, The method involves transmitting collaborative analysis requests within the cluster of specialized intelligent agents based on a preset message bus, and then processing these requests through the target specialized intelligent agents to obtain collaborative analysis results, including: When the initiating professional intelligent agent in the professional intelligent agent cluster identifies a correlation feature that requires the assistance of the assisting professional intelligent agent during the preliminary analysis process, it constructs a collaborative analysis request based on the correlation feature according to a preset standardized message format. The request includes the sender intelligent agent identifier, the receiver intelligent agent identifier, the message type, and the analysis data to be shared. The assisting professional intelligent agent can be any one or more in the professional intelligent agent cluster. Based on the constructed collaborative analysis request, the collaborative analysis request is routed according to the recipient agent identifier in the collaborative analysis request through the asynchronous communication channel of the message bus, and the collaborative analysis request is delivered to the requested professional agent indicated by the recipient agent identifier. According to the preset priority rules, the message types in the delivered collaborative analysis requests are priority-labeled to obtain the priority tags corresponding to the collaborative analysis requests. The collaborative analysis requests with high priority tags are placed into a preset priority processing queue. The response time of the collaborative analysis requests placed into the priority processing queue is timed and monitored based on a preset timeout threshold to obtain the response time monitoring results. Based on the response time monitoring results, and in accordance with the order of the priority processing queue, the target professional intelligent agent processes the data to be shared in the collaborative analysis request, and sends the processed analysis data back to the initiating professional intelligent agent indicated by the sending intelligent agent identifier through the message bus, thereby obtaining the collaborative analysis result.

4. The method according to claim 3, characterized in that, The process involves prioritizing the message types in the delivered collaborative analysis requests according to a preset priority rule to obtain priority tags corresponding to the collaborative analysis requests. Collaborative analysis requests with high-priority tags are then placed into a preset priority processing queue. Furthermore, the response time of the collaborative analysis requests placed in the priority processing queue is monitored based on a preset timeout threshold to obtain response time monitoring results, including: Based on the preset mapping relationship between message type and priority, the message type in the collaborative analysis request is matched to obtain the priority tag corresponding to the collaborative analysis request; The collaborative analysis requests with the priority tag of "high priority" are placed into the priority processing queue, and the collaborative analysis requests with the priority tag of "not high priority" are placed into the preset normal processing queue. Based on the timeout threshold, the response duration of the collaborative analysis request placed in the priority processing queue is timed. When the response duration exceeds the timeout threshold, a corresponding response duration monitoring result is generated.

5. The method according to claim 1, characterized in that, The preliminary analysis results and the collaborative analysis results are input into a preset large-scale model fusion decision-making agent. The large-scale model fusion decision-making agent performs format unification processing on the preliminary analysis results and the collaborative analysis results to obtain security events, including: By using the large model fusion decision-making agent, the preliminary analysis results and the collaborative analysis results are mapped according to the preset security event template to obtain intermediate analysis data. When there are conflicting analysis conclusions regarding the same analysis object in the intermediate analysis data, the conflicting analysis conclusions are adjudicated according to the preset evidence weights to obtain a unified analysis conclusion. Based on the unified analysis conclusion and the timestamps in the intermediate analysis data, the intermediate analysis data is timeline aligned and event aggregated to obtain the security event.

6. The method according to claim 1, characterized in that, The step of constructing a reasoning context based on the security event, and then performing fusion reasoning on the reasoning context using a preset large language security model to obtain a comprehensive security situation assessment result includes: The event type, event severity, and event-related entities are extracted from the security event. The event type and event severity are spliced ​​together to construct a security event timeline. The security event timeline and event-related entities are used as the inference context. The reasoning context is input into the large language security model, and the large language security model is guided by the preset thinking chain reasoning module to perform step-by-step reasoning processing on the reasoning context to obtain intermediate reasoning results; Based on the intermediate reasoning results, relevant security knowledge data is retrieved from the preset energy computing power network security knowledge base. The security knowledge data and the intermediate reasoning results are then fused together using the big language security model to obtain the comprehensive security situation assessment result.

7. The method according to claim 1, characterized in that, The process of generating a security protection strategy based on the comprehensive security situation assessment results, executing the security protection strategy, and obtaining execution feedback results includes: Based on the risk level and main threat type in the comprehensive security situation assessment results, the security protection strategy corresponding to the risk level and the main threat type is matched from the preset protection strategy library; The security protection strategy is distributed to the execution node corresponding to the security protection strategy in the energy computing power network, and the execution node executes the security protection strategy to obtain the execution feedback result; Based on the execution feedback results, the collection parameters of the network traffic data, energy data, computing power scheduling data, user entity behavior data, and vulnerability scanning data in the energy computing power network are adjusted to obtain the adjusted collection parameters, which are then used as the basis for the next round of data collection.

8. An electronic device, characterized in that, The device includes a processor, a memory, a user interface, and a network interface. The memory is used to store instructions. The user interface and the network interface are both used to communicate with other devices. The processor is used to execute the instructions stored in the memory to cause the electronic device to perform the method as described in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed, perform the method as described in any one of claims 1-7.

10. A computer program product, characterized in that, When the computer program product is run on an electronic device, it causes the electronic device to perform the method as described in any one of claims 1-7.

Images