A network security operation method and system based on an artificial intelligence digital person

Abstract

The application discloses a network security operation method and system based on an artificial intelligence digital person, and relates to the technical field of network security.The method comprises the following steps: constructing an AI digital person cognitive base and an execution capability system, adopting a "general large model + security vertical domain model" dual-engine architecture as a decision center, and constructing an execution capability system comprising an RPA unit, an AI intelligent agent unit, an external tool unit and an autonomous planning matrix; intelligently disassembling a task through a large model and a thinking chain, generating a digital person collaboration relationship graph and a data flow graph, and loading context on demand by adopting a retrieval enhancement generation technology; coordinating concurrent execution of each digital person instance by a comprehensive scheduling engine, collecting state data to form a structured feedback flow for dynamic correction; and iteratively optimizing the AI digital person by fusing execution feedback and manual correction.The application realizes intelligentization and automation transformation of security operation business, improves operation efficiency and result reliability, and forms complete traceable audit logs.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to network security operation technology based on artificial intelligence, and more specifically to an intelligent operation method that utilizes AI digital humans to achieve security alarm processing, intelligent judgment and automated response. Background Technology

[0002] As enterprises deepen their digital transformation, the number of alerts faced by cybersecurity operations is growing exponentially. The traditional security operation model that relies on manual handling is gradually revealing problems such as response delays, manpower bottlenecks, high false positive rates, difficulty in tracing, and inconsistent handling standards.

[0003] Currently, most existing automation tools adopt SOAR (Security Orchestration Automation and Response) technology to improve the efficiency of security incident response by pre-setting protection rules and standardizing workflows. However, this type of technology has the following shortcomings: (1) It requires security experts to pre-write and design protection rules, which is not flexible enough and difficult to adapt to dynamically changing security threats; (2) The integrated security equipment is suitable for static resource allocation and cannot dynamically respond to sudden attacks; (3) In large-scale complex scenarios, there are problems such as high difficulty in unified management and coordination of multiple lines and difficulty in adapting multiple devices. In addition, although existing AI alarm noise reduction and triage systems can achieve a certain degree of automation, they are often limited to a single link and lack a deep understanding of the core logic of traditional operations.

[0004] Therefore, there is an urgent need for a security operation method that can inherit the core elements of traditional security operation processes, upgrade key links such as alarm noise reduction, intelligent analysis, and automatic handling through artificial intelligence, retain the manual review mechanism to ensure the reliability of results, does not require the reconstruction of the existing system, and enables full-chain process traceability. Summary of the Invention

[0005] Technical problems to be solved

[0006] With the deepening of digital transformation, the number of security operation alarms has surged, and the traditional manual handling model faces the following problems: First, traditional security operations rely on manual handling of massive alarms, which leads to problems such as response delays, manpower bottlenecks, and misjudgments and omissions due to differences in experience; Second, existing automated tools are disconnected from the business system, which either requires process reconstruction and increases transformation costs, or results in poor implementation effects due to detachment from actual scenarios; Third, purely automated solutions lack manual backup at key nodes, which can easily lead to uncontrollable risks in complex scenarios and make it difficult to meet the requirements of accuracy and compliance; Fourth, traditional operation process records are incomplete, which cannot meet the needs of audit traceability and model optimization.

[0007] To address the aforementioned issues, this invention provides a network security operation method and system based on artificial intelligence digital humans. By using AI digital humans to inherit the core elements of traditional processes and achieve intelligent operation of key links, while retaining the manual review mechanism, it can improve operational efficiency and result reliability without reconstructing the existing system, and at the same time form a complete and traceable audit log.

[0008] This invention provides a cybersecurity operation method and system based on artificial intelligence digital humans. By using AI digital humans to inherit core elements of traditional processes and achieve intelligent operation of key links, while retaining manual review mechanisms, it improves operational efficiency and result reliability without restructuring the existing system, and simultaneously generates complete and traceable audit logs. This invention also provides a cybersecurity operation method based on artificial intelligence digital humans, comprising the following steps:

[0009] Building a cognitive foundation and execution capability system for AI digital humans;

[0010] By combining a large language model with thought chain reasoning technology, the input network security operation task is recursively decomposed through prompt word engineering and few-shot learning, and a digital human collaboration relationship graph and data flow graph are generated through a directed acyclic graph algorithm.

[0011] Using retrieval-enhanced generation technology, contextual information is loaded on demand for the execution unit of each independent AI digital human;

[0012] The integrated scheduling engine coordinates the concurrent execution of each digital human instance based on the aforementioned collaboration relationship diagram, and collects the status data, execution time, and abnormal information of each node in real time to form a structured feedback flow;

[0013] By integrating the structured feedback stream with manually corrected records, the execution capabilities of the AI ​​digital human are iteratively optimized.

[0014] Furthermore, the construction of the AI ​​digital human cognitive foundation and execution capability system specifically includes:

[0015] The system adopts a dual-engine architecture of "general large model + security vertical domain model" as the decision-making center. The general large model is used to provide cross-domain semantic understanding and generalized reasoning capabilities, while the security vertical domain model is used to inject domain expertise and security compliance constraints.

[0016] An execution capability system is constructed, comprising a robotic process automation unit, an AI agent unit, an external tool unit, and an autonomous planning matrix module. The robotic process automation unit is configured to execute deterministic repetitive tasks based on preset rules. The AI ​​agent unit is configured to autonomously complete open tasks in a dynamic unstructured environment through a continuously running "perception-reasoning-action-learning" closed loop. The external tool unit is configured to interface with third-party system APIs and MCP protocol services.

[0017] Furthermore, the autonomous planning matrix module, as the scheduling core of the execution capability system, is configured with a rule engine and a semantic vector matching algorithm, and its scheduling process includes:

[0018] Rule priority matching phase: The parsed subtask is precisely matched with the preset rule library in the rule engine. If the match is successful and the confidence level meets the preset threshold, the corresponding robot process automation unit, AI agent unit or external tool interface unit is directly scheduled to execute.

[0019] Semantic fuzzy matching stage: When rule matching fails or the confidence level is lower than the preset threshold, the semantic vector matching algorithm is triggered to calculate the similarity between the subtask and each capability unit, and select the optimal capability unit;

[0020] Task graph orchestration and execution phase: The matching results are input into the state graph engine to construct an executable task topology graph that includes node dependencies, conditional branches, and loop control. The task graph is then globally verified and dynamically optimized through the dual-engine cognitive architecture to generate AI digital human instances that can replace maintenance personnel in performing professional domain operations.

[0021] Furthermore, in the semantic fuzzy matching stage, the semantic vector matching algorithm uses the cosine similarity formula to calculate the similarity between the subtask and each capability unit: , in, Represents the set of available capability units. For each capability unit vector, Code the subtasks. The target capability unit with the highest cosine similarity is selected; when the highest similarity is lower than a preset safety threshold, a manual confirmation mechanism or a downgrade processing strategy is triggered, wherein the preset safety threshold is a threshold value used to determine whether the semantic vector matching result is reliable.

[0022] Furthermore, the default value of the preset security threshold is 0.8, and the value range is [0,1], and it can be modified through system configuration.

[0023] Furthermore, the use of prompt word engineering and few-shot learning recursively decomposes complex tasks into atomic subtasks that can be executed independently by a single AI digital human, clarifying the exclusive responsibilities, input / output specifications, and execution boundaries of each digital human. The generation of digital human collaboration graphs and data flow graphs through the directed acyclic graph algorithm is based on the logical dependencies between subtasks. It automatically generates AI digital human collaboration graphs and constructs data flow graphs containing parallel / serial control logic, realizing automated mapping from abstract requirements to the topology of multi-digital human collaborative scheduling.

[0024] Furthermore, the on-demand loading of context information using retrieval enhancement generation technology specifically includes:

[0025] Real-time monitoring of parameter integrity and model output confidence of the current digital human task node;

[0026] Semantic similarity retrieval of the digital human's exclusive historical interaction records and knowledge base is triggered only when key input parameters are detected to be missing or the confidence level is lower than a preset threshold.

[0027] The search results are reordered and filtered for relevance before being injected into the reasoning context of the current digital human, avoiding token overload and error accumulation caused by full information preloading.

[0028] Furthermore, the output confidence score of the AI ​​digital human is calculated using a weighted fusion method:

[0029] in, The confidence level is limited to a range of [0,1]. Score the confidence level of a general large model; Calculate the confidence score for the large-scale model in the safety vertical domain; The default value for the confidence weight of the general large model is 0.4 and it is configurable; the default value for the preset threshold is 0.8, the value range is [0,1], and it is configurable.

[0030] Furthermore, the structured feedback stream is a standardized JSON structured feedback stream, containing the following fields:

[0031] The feedback stream includes a unique identifier, associated business task ID, collection time, overall execution status, node ID, node name, node role, node execution status, time elapsed in milliseconds, confidence score, and error details object; the error details object contains error code and error description information.

[0032] The standardized JSON structured feedback stream includes the following fields:

[0033] The feedback stream includes a unique identifier (feedback_id), the associated business task ID (task_id), the collection time (timestamp), the overall execution status (status), the node ID (node_id), the node name (node_name), the node role (agent_role), the node execution status (status), the time elapsed (duration_ms), the confidence score, and an error details object (error); the error details object contains the error code (code) and the error description information (message).

[0034] Furthermore, the structured feedback stream is used for dynamic error correction, timeout circuit breaking, and breakpoint resumption of the current digital human task, ensuring the robustness of task execution.

[0035] On the other hand, asynchronous writing to the long-term memory of the evolution module enables continuous iteration of scheduling strategies and individual digital human execution capabilities through reinforcement learning, thereby achieving a complete closed-loop adaptive evolution of the multi-digital human collaborative system from execution to optimization.

[0036] Furthermore, the iterative optimization of the execution capabilities of the AI ​​digital human specifically includes:

[0037] The system extracts multi-source data from the structured feedback stream, including task execution results, manual review and correction records, explicit user evaluations, and abnormal interruption logs. After removing noisy samples using automated cleaning rules, it combines preset business quality assessment indicators to perform weakly supervised labeling on the effective samples, generating a labeled evolutionary training dataset.

[0038] The baseline model of the AI ​​digital human is incrementally updated using a parameter-efficient fine-tuning technique, and an elastic weight consolidation mechanism is introduced during the fine-tuning process to improve the adaptability to new tasks while suppressing the catastrophic forgetting of existing general capabilities.

[0039] A reinforcement learning environment for scheduling policies is constructed by collecting execution time, resource consumption, and task success rate as reward signals. The initial policy network is trained using historical scheduling decision trajectories as an offline dataset. Then, the policy is iterated by continuously collecting state-action-reward triples through online interaction. The optimized policy network automatically updates the capability routing weights and priority allocation rules.

[0040] This invention also provides a cybersecurity operation system based on artificial intelligence digital humans, comprising:

[0041] The cognitive foundation and execution capability system construction module is used to build the cognitive foundation and execution capability system of AI digital humans;

[0042] The task decomposition and collaboration graph generation module is used to recursively decompose the input network security operation task by combining a large language model with the thinking chain reasoning technology, through prompt word engineering and few-shot learning, and generate a digital human collaboration relationship graph and data flow graph through the directed acyclic graph algorithm.

[0043] The context-on-demand loading module is used to load context information on demand for each individual AI digital human's execution unit using retrieval-enhanced generation technology.

[0044] The scheduling execution and feedback collection module is equipped with a comprehensive scheduling engine, which is used to coordinate the concurrent execution of each digital human instance according to the collaboration relationship diagram, and collect the status data, execution time and abnormal information of each node in real time to form a structured feedback flow.

[0045] The iterative optimization module is used to integrate the structured feedback stream with the manually corrected records to iteratively optimize the execution capabilities of the AI ​​digital human.

[0046] Furthermore, in the cognitive foundation and execution capability system construction module, the execution capability system includes a robotic process automation unit, an AI agent unit, an external tool unit, and an autonomous planning matrix module; the autonomous planning matrix module is configured with a rule engine and a semantic vector matching algorithm, used for:

[0047] The parsed subtasks are precisely matched with the pre-built rule library in the rule engine.

[0048] When rule matching fails or the confidence level is lower than the preset threshold, the cosine similarity formula is used to calculate the similarity between the subtask and each capability unit and select the optimal capability unit.

[0049] The matching results are input into the state graph engine to construct an executable task topology graph containing node dependencies and conditional branches, and global verification and dynamic optimization are performed through the dual-engine cognitive architecture.

[0050] Furthermore, the task decomposition and collaboration graph generation module includes:

[0051] The task decomposition unit is used to leverage large language models combined with thought chain reasoning technology to recursively decompose complex tasks into atomic subtasks through prompt word engineering and few-shot learning, clarifying the exclusive responsibilities, input and output specifications, and execution boundaries of each digital human.

[0052] The collaboration graph generation unit is used to automatically generate an AI digital human collaboration graph based on the logical dependencies between subtasks using a directed acyclic graph algorithm, and to construct a data flow graph containing parallel / serial control logic.

[0053] Furthermore, the iterative optimization module includes:

[0054] The data collection and labeling unit is used to extract multi-source data from the structured feedback stream, including task execution results, manual review and correction records, user explicit evaluations, and abnormal interruption logs. After removing noisy samples using automated cleaning rules, it performs weakly supervised labeling on the effective samples in combination with preset business quality evaluation indicators to generate a labeled evolutionary training dataset.

[0055] The model incremental fine-tuning unit is used to incrementally update the base model of the AI ​​digital human using efficient parameter fine-tuning technology, and introduces an elastic weight consolidation mechanism during the fine-tuning process to improve the adaptability to new tasks while suppressing the catastrophic forgetting of existing general capabilities.

[0056] The policy reinforcement learning optimization unit is used to construct a scheduling policy reinforcement learning environment by collecting execution time, resource consumption, and task success rate as reward signals. The initial policy network is trained using historical scheduling decision trajectories as an offline dataset, and then the policy is iterated by continuously collecting state-action-reward triples through online interaction. The optimized policy network automatically updates the capability routing weights and priority allocation rules.

[0057] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the network security operation method based on artificial intelligence digital human as described above.

[0058] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the network security operation method based on artificial intelligence digital human as described above.

[0059] The technical solution of the present invention has the following beneficial effects:

[0060] This invention constructs a digital human cybersecurity operation system driven by artificial intelligence, achieving intelligent transformation of security operations while inheriting the core elements of traditional operational processes. The digital human can efficiently perform tasks such as alarm noise reduction, intelligent analysis, and automatic handling, replacing manual labor in repetitive and time-sensitive operations, significantly shortening business response cycles, overcoming human resource bottlenecks, and improving operational efficiency. The system adopts standardized rules and large-scale model collaborative decision-making to avoid human subjective errors, while retaining key human review mechanisms to ensure accurate and reliable handling results and reduce the risk of misjudgments and omissions. All operations, decision-making basis, and data across the entire chain are structured and recorded, forming a complete and traceable audit log, meeting compliance and regulatory requirements and providing support for model optimization. This method only modifies links suitable for intelligence, without reconstructing the existing business system, ensuring business continuity while achieving intelligent upgrades, reducing transformation costs and implementation risks, and balancing technological advancement with practical applicability. Attached Figure Description

[0061] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0062] Figure 1 This is a schematic diagram of a network security operation method based on artificial intelligence digital humans according to the present invention;

[0063] Figure 2 This is a flowchart of the task orchestration process for the LangGraph state graph engine of this invention.

[0064] Figure 3 This is a schematic diagram of a network security operation method based on artificial intelligence digital humans according to the present invention. Detailed Implementation

[0065] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0066] the term

[0067] Robotic Process Automation (RPA), AI Agent, Large Language Model (LLM), CoT (Coding of Thought), Reranking, Prompt Engineering, Few-shot Learning, Memory Bank, Reinforcement Learning (RLHF), and Retrieval Enhancement Generation (RAG).

[0068] See Figure 1 As shown, a cybersecurity operation method based on artificial intelligence digital humans includes the following steps:

[0069] Building a cognitive foundation and execution capability system for AI digital humans;

[0070] By combining a large language model with thought chain reasoning technology, the input network security operation task is recursively decomposed through prompt word engineering and few-shot learning, and a digital human collaboration relationship graph and data flow graph are generated through a directed acyclic graph algorithm.

[0071] Using retrieval-enhanced generation technology, contextual information is loaded on demand for the execution unit of each independent AI digital human;

[0072] The integrated scheduling engine coordinates the concurrent execution of each digital human instance based on the aforementioned collaboration relationship diagram, and collects the status data, execution time, and abnormal information of each node in real time to form a structured feedback flow;

[0073] By integrating the structured feedback stream with manually corrected records, the execution capabilities of the AI ​​digital human are iteratively optimized.

[0074] Through the above core steps, we can achieve comprehensive capability enhancement and autonomous closed-loop operation of AI digital humans in safe operation scenarios.

[0075] In one embodiment, the construction of the AI ​​digital human cognitive foundation and execution capability system specifically includes:

[0076] The system adopts a dual-engine architecture of "general large model + security vertical domain model" as the decision-making center. The general large model is used to provide cross-domain semantic understanding and generalized reasoning capabilities, while the security vertical domain model is used to inject domain expertise and security compliance constraints.

[0077] An execution capability system is constructed, comprising a robotic process automation unit, an AI agent unit, an external tool unit, and an autonomous planning matrix module. The robotic process automation unit is configured to execute deterministic repetitive tasks based on preset rules. The AI ​​agent unit is configured to autonomously complete open tasks in a dynamic unstructured environment through a continuously running "perception-reasoning-action-learning" closed loop. The external tool unit is configured to interface with third-party system APIs and MCP protocol services.

[0078] The general large model and the security vertical domain model work together to provide digital humans with multi-dimensional knowledge interpretation and analysis capabilities.

[0079] In one embodiment, the autonomous planning matrix module serves as the scheduling core of the execution capability system, and is configured with a rule engine and a semantic vector matching algorithm. Its scheduling process includes:

[0080] Rule priority matching phase: The parsed subtask is precisely matched with the preset rule library in the rule engine. If the match is successful and the confidence level meets the preset threshold, the corresponding robot process automation unit, AI agent unit or external tool interface unit is directly scheduled to execute.

[0081] Semantic fuzzy matching stage: When rule matching fails or the confidence level is lower than the preset threshold, the semantic vector matching algorithm is triggered to calculate the similarity between the subtask and each capability unit, and select the optimal capability unit;

[0082] Task graph orchestration and execution phase: The matching results are input into the state graph engine to construct an executable task topology graph that includes node dependencies, conditional branches, and loop control. The task graph is then globally validated and dynamically optimized using the dual-engine cognitive architecture to generate an AI digital human instance capable of performing specialized tasks for maintenance personnel. In this embodiment, the matching results are input into the LangGraph state graph engine to construct the executable task topology graph. Figure 2 The flowchart for task orchestration in the LangGraph state graph engine demonstrates the complete decision-making path from subtask input, rule priority matching, semantic fuzzy matching to task graph orchestration and execution.

[0083] In one embodiment, during the semantic fuzzy matching stage, the semantic vector matching algorithm uses the cosine similarity formula to calculate the similarity between the subtask and each capability unit: , in, Represents the set of available capability units. For each capability unit vector, Code the subtasks. The target capability unit with the highest cosine similarity is selected. When the highest similarity is lower than a preset safety threshold, a manual confirmation mechanism or a downgrade processing strategy is triggered. The preset safety threshold is a threshold value used to determine whether the semantic vector matching result is reliable. When the highest similarity is lower than the safety threshold (the default value of the threshold is 0.8, and the threshold can be modified through system configuration, with a threshold range of [0,1]), a manual confirmation mechanism or a downgrade processing strategy is triggered.

[0084] In one embodiment, the default value of the preset security threshold is 0.8, and the value range is [0,1], and it can be modified through system configuration.

[0085] In one embodiment, the use of cue word engineering and few-shot learning recursively decomposes complex tasks into atomic subtasks that can be executed independently by a single AI digital human, clarifying the exclusive responsibilities, input / output specifications, and execution boundaries of each digital human. The generation of digital human collaboration graphs and data flow graphs through the directed acyclic graph algorithm is based on the logical dependencies between subtasks. The algorithm automatically generates the AI ​​digital human collaboration graph and constructs a data flow graph containing parallel / serial control logic, realizing the automated mapping from abstract requirements to the multi-digital human collaborative scheduling topology.

[0086] In one embodiment, the on-demand loading of context information using retrieval enhancement generation technology specifically includes:

[0087] Real-time monitoring of parameter integrity and model output confidence of the current digital human task node;

[0088] Semantic similarity retrieval of the digital human's exclusive historical interaction records and knowledge base is triggered only when key input parameters are detected to be missing or the confidence level is lower than a preset threshold.

[0089] The search results are reordered and filtered for relevance before being injected into the reasoning context of the current digital human, avoiding token overload and error accumulation caused by full information preloading.

[0090] The processing end uses retrieval enhancement generation technology to load the context on demand, avoiding token overload and error accumulation; the closed-loop feedback end coordinates concurrent execution through the scheduling engine, collects status data to form a feedback stream for dynamic correction, and asynchronously writes it into the memory to optimize the strategy, realizing a complete closed loop from task decomposition to adaptive evolution.

[0091] In one embodiment, the output confidence of the AI ​​digital human is calculated using a weighted fusion method:

[0092] in, The confidence level is limited to a range of [0,1]. Score the confidence level of a general large model; Calculate the confidence score for the large-scale model in the safety vertical domain; The default value for the confidence weight of the general large model is 0.4 and it is configurable; the default value for the preset threshold is 0.8, the value range is [0,1], and it is configurable.

[0093] Context loading mechanism for single-digital human execution: For each independent AI digital human execution unit, dynamic orchestration technology combining retrieval-enhanced generation (RAG) and vector database is used to load context information on demand.

[0094] In one embodiment, the structured feedback stream is a standardized JSON structured feedback stream, containing the following fields:

[0095] The feedback stream includes a unique identifier, associated business task ID, collection time, overall execution status, node ID, node name, node role, node execution status, time elapsed in milliseconds, confidence score, and error details object; the error details object contains error code and error description information.

[0096] The standardized JSON structured feedback stream includes the following fields:

[0097] The feedback stream includes a unique identifier (feedback_id), the associated business task ID (task_id), the collection time (timestamp), the overall execution status (status), the node ID (node_id), the node name (node_name), the node role (agent_role), the node execution status (status), the time elapsed (duration_ms), the confidence score, and an error details object (error); the error details object contains the error code (code) and the error description information (message).

[0098] Digital Human Collaborative Optimization Based on Structured Feedback Stream: The integrated scheduling engine coordinates the execution order and resource allocation of independent digital human instances based on the AI ​​digital human collaboration graph and execution priorities, using asynchronous concurrency control and resource pooling technology. During runtime, real-time data collection of each digital human node's status, execution time, and exception information forms a standardized JSON structured feedback stream. The JSON format is as follows:

[0099] {"feedback_id":"fb_20260710_001","task_id":"task_alert_88231","timestamp":"2026-07-10T14:30:25Z","status":"completed","nodes":[{"node_id":"node_001","node_name":"alert noise reduction","agent_role":"noise reduction digital human"]} {"status":"success","duration_ms":1800,"confidence":0.88,"error":null},{"node_id":"node_002","node_name":"Intelligent Judgment","agent_role":"Judging Digital Human"} {"status":"success","duration_ms":13400,"confidence":0.82,"error":null},{"node_id":"node_003","node_name":"IP blocking","agent_role":"Disposal of digital human"},{"node_id":"node_003","node_name":"IP blocking","agent_role":"Disposal of digital human"} ","status":"failed","duration_ms":30000,"confidence":null,"error":{"code":"TOOL_TIMEOUT","message":"Firewall API call timeout"}}]}, Field descriptions: feedback_id (unique identifier for the feedback stream), task_id (associated business task ID), timestamp (collection time), status (overall status), node_id (node ​​ID), node_name (node ​​name), agent_role (node ​​role), status (node ​​execution status), duration_ms (time elapsed in milliseconds), confidence (confidence score, may be empty), and error (error details object, including error code and detailed message description). This structure comprehensively records the entire chain of information from feedback access to the specific handling node. It provides clear timeout and API failure identifiers, especially for abnormal scenarios, facilitating subsequent root cause analysis and strategy optimization, and ensuring the traceability and stability of the automated handling process.

[0100] In one embodiment, the structured feedback stream is used for dynamic correction, timeout circuit breaking, and breakpoint resumption of the current digital human task, ensuring the robustness of task execution.

[0101] On the other hand, asynchronous writing to the long-term memory of the evolution module enables continuous iteration of scheduling strategies and individual digital human execution capabilities through reinforcement learning, thereby achieving a complete closed-loop adaptive evolution of the multi-digital human collaborative system from execution to optimization.

[0102] In one embodiment, the iterative optimization of the execution capabilities of the AI ​​digital human specifically includes:

[0103] The system extracts multi-source data from the structured feedback stream, including task execution results, manual review and correction records, explicit user evaluations, and abnormal interruption logs. After removing noisy samples using automated cleaning rules, it combines preset business quality assessment indicators to perform weakly supervised labeling on the effective samples, generating a labeled evolutionary training dataset.

[0104] The baseline model of the AI ​​digital human is incrementally updated using a parameter-efficient fine-tuning technique, and an elastic weight consolidation mechanism is introduced during the fine-tuning process to improve the adaptability to new tasks while suppressing the catastrophic forgetting of existing general capabilities.

[0105] A reinforcement learning environment for scheduling policies is constructed by collecting execution time, resource consumption, and task success rate as reward signals. The initial policy network is trained using historical scheduling decision trajectories as an offline dataset. Then, the policy is iterated by continuously collecting state-action-reward triples through online interaction. The optimized policy network automatically updates the capability routing weights and priority allocation rules.

[0106] See Figure 3 As shown, the present invention provides a network security operation system based on artificial intelligence digital humans, comprising:

[0107] The cognitive foundation and execution capability system construction module is used to build the cognitive foundation and execution capability system of AI digital humans;

[0108] The task decomposition and collaboration graph generation module is used to recursively decompose the input network security operation task by combining a large language model with the thinking chain reasoning technology, through prompt word engineering and few-shot learning, and generate a digital human collaboration relationship graph and data flow graph through the directed acyclic graph algorithm.

[0109] The context-on-demand loading module is used to load context information on demand for each individual AI digital human's execution unit using retrieval-enhanced generation technology.

[0110] The scheduling execution and feedback collection module is equipped with a comprehensive scheduling engine, which is used to coordinate the concurrent execution of each digital human instance according to the collaboration relationship diagram, and collect the status data, execution time and abnormal information of each node in real time to form a structured feedback flow.

[0111] The iterative optimization module is used to integrate the structured feedback stream with the manually corrected records to iteratively optimize the execution capabilities of the AI ​​digital human.

[0112] In one embodiment, the cognitive foundation and execution capability system construction module includes an execution capability system comprising a robotic process automation unit, an AI agent unit, an external tool unit, and an autonomous planning matrix module; the autonomous planning matrix module is configured with a rule engine and a semantic vector matching algorithm, used for:

[0113] The parsed subtasks are precisely matched with the pre-built rule library in the rule engine.

[0114] When rule matching fails or the confidence level is lower than the preset threshold, the cosine similarity formula is used to calculate the similarity between the subtask and each capability unit and select the optimal capability unit.

[0115] The matching results are input into the state graph engine to construct an executable task topology graph containing node dependencies and conditional branches, and global verification and dynamic optimization are performed through the dual-engine cognitive architecture.

[0116] In one embodiment, the task breakdown and collaboration graph generation module includes:

[0117] The task decomposition unit is used to leverage large language models combined with thought chain reasoning technology to recursively decompose complex tasks into atomic subtasks through prompt word engineering and few-shot learning, clarifying the exclusive responsibilities, input and output specifications, and execution boundaries of each digital human.

[0118] The collaboration graph generation unit is used to automatically generate an AI digital human collaboration graph based on the logical dependencies between subtasks using a directed acyclic graph algorithm, and to construct a data flow graph containing parallel / serial control logic.

[0119] In one embodiment, the iterative optimization module includes:

[0120] The data collection and labeling unit is used to extract multi-source data from the structured feedback stream, including task execution results, manual review and correction records, explicit user evaluations, and abnormal interruption logs. After removing noisy samples using automated cleaning rules, the effective samples are weakly supervised and labeled using preset business quality evaluation indicators to generate a labeled evolutionary training dataset. The labeling process supports human-machine collaborative verification to ensure the accurate retention of high-value negative samples and boundary cases.

[0121] The model incremental fine-tuning unit is used to incrementally update the base model of the AI ​​digital human using efficient parameter fine-tuning technology, and introduces an elastic weight consolidation mechanism during the fine-tuning process to improve the adaptability to new tasks while suppressing the catastrophic forgetting of existing general capabilities.

[0122] The policy reinforcement learning optimization unit is used to construct a scheduling policy reinforcement learning environment by collecting execution time, resource consumption, and task success rate as reward signals. The initial policy network is trained using historical scheduling decision trajectories as an offline dataset, and then the policy is iterated by continuously collecting state-action-reward triples through online interaction. The optimized policy network automatically updates the capability routing weights and priority allocation rules.

[0123] The present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor, when executing the program, implements the network security operation method based on artificial intelligence digital human as described above.

[0124] The present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the network security operation method based on artificial intelligence digital human as described above.

[0125] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A cybersecurity operation method based on artificial intelligence digital humans, characterized in that, Includes the following steps: Building a cognitive foundation and execution capability system for AI digital humans; By combining a large language model with thought chain reasoning technology, the input network security operation task is recursively decomposed through prompt word engineering and few-shot learning, and a digital human collaboration relationship graph and data flow graph are generated through a directed acyclic graph algorithm. Using retrieval-enhanced generation technology, contextual information is loaded on demand for the execution unit of each independent AI digital human; The integrated scheduling engine coordinates the concurrent execution of each digital human instance based on the aforementioned collaboration relationship diagram, and collects the status data, execution time, and abnormal information of each node in real time to form a structured feedback flow; By integrating the structured feedback stream with manually corrected records, the execution capabilities of the AI ​​digital human are iteratively optimized.

2. The method according to claim 1, characterized in that, The construction of the AI ​​digital human cognitive foundation and execution capability system specifically includes: The system adopts a dual-engine architecture of "general large model + security vertical domain model" as the decision-making center. The general large model is used to provide cross-domain semantic understanding and generalized reasoning capabilities, while the security vertical domain model is used to inject domain expertise and security compliance constraints. An execution capability system is constructed, comprising a robotic process automation unit, an AI agent unit, an external tool unit, and an autonomous planning matrix module. The robotic process automation unit is configured to execute deterministic repetitive tasks based on preset rules. The AI ​​agent unit is configured to autonomously complete open tasks in a dynamic unstructured environment through a continuously running "perception-reasoning-action-learning" closed loop. The external tool unit is configured to interface with third-party system APIs and MCP protocol services.

3. The method according to claim 2, characterized in that, The autonomous planning matrix module, serving as the scheduling core of the execution capability system, is equipped with a rule engine and a semantic vector matching algorithm. Its scheduling process includes: Rule priority matching phase: The parsed subtask is precisely matched with the preset rule library in the rule engine. If the match is successful and the confidence level meets the preset threshold, the corresponding robot process automation unit, AI agent unit or external tool interface unit is directly scheduled to execute. Semantic fuzzy matching stage: When rule matching fails or the confidence level is lower than the preset threshold, the semantic vector matching algorithm is triggered to calculate the similarity between the subtask and each capability unit, and select the optimal capability unit; Task graph orchestration and execution phase: The matching results are input into the state graph engine to construct an executable task topology graph that includes node dependencies, conditional branches, and loop control. The task graph is then globally verified and dynamically optimized through the dual-engine cognitive architecture to generate AI digital human instances that can replace maintenance personnel in performing professional domain operations.

4. The method according to claim 3, characterized in that, In the semantic fuzzy matching stage, the semantic vector matching algorithm uses the cosine similarity formula to calculate the similarity between the subtask and each capability unit: ， in, Represents the set of available capability units. For each capability unit vector, Code the subtasks. The target capability unit with the highest cosine similarity is selected; when the highest similarity is lower than a preset safety threshold, a manual confirmation mechanism or a downgrade processing strategy is triggered, wherein the preset safety threshold is a threshold value used to determine whether the semantic vector matching result is reliable.

5. The method according to claim 1, characterized in that, The aforementioned use of prompt word engineering and few-shot learning recursively decomposes complex tasks into atomic subtasks that can be independently executed by a single AI digital human, clarifying the exclusive responsibilities, input / output specifications, and execution boundaries of each digital human. The generation of digital human collaboration graphs and data flow graphs through the directed acyclic graph algorithm is based on the logical dependencies between subtasks. It automatically generates AI digital human collaboration graphs and constructs data flow graphs containing parallel / serial control logic, realizing automated mapping from abstract requirements to the multi-digital human collaborative scheduling topology.

6. The method according to claim 1, characterized in that, The specific aspects of using retrieval enhancement generation technology to load context information on demand include: Real-time monitoring of parameter integrity and model output confidence of the current digital human task node; Semantic similarity retrieval of the digital human's exclusive historical interaction records and knowledge base is triggered only when key input parameters are detected to be missing or the confidence level is lower than a preset threshold. The search results are reordered and filtered for relevance before being injected into the reasoning context of the current digital human, avoiding token overload and error accumulation caused by full information preloading.

7. The method according to claim 2 or 6, characterized in that, The output confidence score of the AI ​​digital human is calculated using a weighted fusion method: ， in, The confidence level is limited to a range of [0,1]. Score the confidence level of a general large model; Calculate the confidence score for the large-scale model in the safety vertical domain; The default value for the confidence weight of the general large model is 0.4 and it is configurable; the default value for the preset threshold is 0.8, the value range is [0,1], and it is configurable.

8. The method according to claim 1, characterized in that, The structured feedback stream is a standardized JSON structured feedback stream, containing the following fields: The feedback stream includes a unique identifier, associated business task ID, collection time, overall execution status, node ID, node name, node role, node execution status, execution time in milliseconds, confidence score, and error details object; the error details object contains error code and error description information. The standardized JSON structured feedback stream includes the following fields: The feedback stream includes a unique identifier (feedback_id), the associated business task ID (task_id), the collection time (timestamp), the overall execution status (status), the node ID (node_id), the node name (node_name), the node role (agent_role), the node execution status (status), the time elapsed in milliseconds (duration_ms), the confidence score, and an error detail object (error); the error detail object contains the error code (code) and the error description information (message). The structured feedback flow is used on the one hand for dynamic correction, timeout circuit breaking, and breakpoint resumption of the current digital human task, ensuring the robustness of task execution; on the other hand, it is asynchronously written into the long-term memory of the evolution module, and through reinforcement learning, it continuously iterates the scheduling strategy and the execution capabilities of individual digital humans, realizing the complete closed-loop adaptive evolution of the multi-digital human collaborative system from execution to optimization.

9. The method according to claim 1, characterized in that, The iterative optimization of the execution capabilities of the AI ​​digital human specifically includes: The system extracts multi-source data from the structured feedback stream, including task execution results, manual review and correction records, explicit user evaluations, and abnormal interruption logs. After removing noisy samples using automated cleaning rules, it combines preset business quality assessment indicators to perform weakly supervised labeling on the effective samples, generating a labeled evolutionary training dataset. The baseline model of the AI ​​digital human is incrementally updated using a parameter-efficient fine-tuning technique, and an elastic weight consolidation mechanism is introduced during the fine-tuning process to improve the adaptability to new tasks while suppressing the catastrophic forgetting of existing general capabilities. A reinforcement learning environment for scheduling policies is constructed by collecting execution time, resource consumption, and task success rate as reward signals. The initial policy network is trained using historical scheduling decision trajectories as an offline dataset. Then, the policy is iterated by continuously collecting state-action-reward triples through online interaction. The optimized policy network automatically updates the capability routing weights and priority allocation rules.

10. A network security operation system based on artificial intelligence digital humans, characterized in that, include: The cognitive foundation and execution capability system construction module is used to build the cognitive foundation and execution capability system of AI digital humans; The task decomposition and collaboration graph generation module is used to recursively decompose the input network security operation task by combining a large language model with the thinking chain reasoning technology, through prompt word engineering and few-shot learning, and generate a digital human collaboration relationship graph and data flow graph through the directed acyclic graph algorithm. The context-on-demand loading module is used to load context information on demand for each individual AI digital human's execution unit using retrieval-enhanced generation technology. The scheduling execution and feedback collection module is equipped with a comprehensive scheduling engine, which is used to coordinate the concurrent execution of each digital human instance according to the collaboration relationship diagram, and collect the status data, execution time and abnormal information of each node in real time to form a structured feedback flow. The iterative optimization module is used to integrate the structured feedback stream with the manually corrected records to iteratively optimize the execution capabilities of the AI ​​digital human.

Images