An agent identity authentication method and device based on behavior characteristics

Abstract

The specification provides an agent identity authentication method and device based on behavior characteristics. The method comprises: collecting behavior data to be tested of an agent; wherein the behavior data to be tested comprises data corresponding to operation behavior implemented by the agent when performing a current task; performing feature extraction on the behavior data to be tested to obtain real-time behavior characteristics of the agent; comparing the real-time behavior characteristics with benchmark behavior characteristics to obtain behavior deviation of the agent; and determining an identity authentication result for the agent according to the behavior deviation.

Description

Technical Field

[0001] This specification relates to the field of terminal technology in one or more embodiments, and in particular to an agent identity authentication method and apparatus based on behavioral characteristics. Background Technology

[0002] With the development of Artificial Intelligence (AI) technology, agents have been gradually applied to scenarios such as automated office work, intelligent customer service, industrial control, network operation and maintenance, digital employees, and multi-agent collaboration. Agents typically possess the ability to continuously execute tasks, access external resources, invoke application programming interfaces (APIs), and participate in cross-system collaborative processes. Therefore, effectively verifying the identity of agents to ensure that the agents currently participating in task execution are indeed legitimate and trustworthy target agents has become a key issue in ensuring the operational security of intelligent systems, the reliability of task execution, and the controllability of collaborative links.

[0003] However, most current agent identity verification methods use static authentication, which completes authentication once during the login or access phase and assumes that the subject's identity remains unchanged during subsequent operation. Since this authentication method is difficult to reflect the true identity status during operation in a timely manner, once authentication credentials are misused, sessions are hijacked, or the executing subject is replaced, unauthorized operations can easily continue to occur, seriously affecting the security and reliability of the agent execution process. Summary of the Invention

[0004] In view of the above, one or more embodiments of this specification provide the following technical solutions: According to a first aspect of one or more embodiments of this specification, a behavioral feature-based agent authentication method is proposed, which pre-extracts features from historical behavioral data generated by the agent under normal working conditions to determine the baseline behavioral features corresponding to the agent, the method comprising: Collect the test behavior data of the Agent; wherein, the test behavior data includes data corresponding to the operation behavior performed by the Agent when executing the current task; Feature extraction is performed on the behavioral data to be tested to obtain the real-time behavioral features of the Agent; The real-time behavioral features are compared with the baseline behavioral features to obtain the behavioral deviation of the Agent; Based on the behavioral deviations, the authentication result for the Agent is determined.

[0005] According to a second aspect of one or more embodiments of this specification, a behavioral feature-based agent authentication device is provided, comprising: The configuration module is used to pre-extract features from the historical behavior data generated by the Agent under normal working conditions, and determine the baseline behavior features corresponding to the Agent; The data acquisition module is used to acquire the test behavior data of the Agent; wherein, the test behavior data includes data corresponding to the operation behavior performed by the Agent when executing the current task; The extraction module is used to extract features from the behavior data to be tested, so as to obtain the real-time behavior features of the Agent; The comparison module is used to compare the real-time behavioral features with the baseline behavioral features to obtain the behavioral deviation of the Agent; The authentication module is used to determine the identity authentication result for the Agent based on the behavioral deviation.

[0006] According to a third aspect of one or more embodiments of this specification, an electronic device is provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor implements the steps of the method described above by executing the executable instructions.

[0007] According to a fourth aspect of one or more embodiments of this specification, a computer-readable storage medium is provided that stores computer instructions thereon, which, when executed by a processor, implement the steps of the method described above.

[0008] According to a fifth aspect of one or more embodiments of this specification, a computer program product is provided, comprising a computer program / instructions that, when executed by a processor, implement the steps of the method described above.

[0009] As can be seen from the above embodiments, this specification achieves dynamic determination of the Agent's identity status by continuously monitoring and analyzing the behavioral characteristics of the Agent during operation. Compared with existing static authentication methods, this application can dynamically verify the Agent's identity by combining its behavioral performance during operation, thereby improving the ability to identify abnormal identity situations during operation, reducing the risk of unauthorized operations, and improving the security and reliability of the intelligent system. Attached Figure Description

[0010] Figure 1 This is a schematic diagram of the architecture of an Agent identity authentication service system provided in an exemplary embodiment; Figure 2 This is a schematic diagram of a behavioral feature-based agent identity authentication method provided in an exemplary embodiment; Figure 3 This is an exemplary embodiment providing an overall flowchart of identity authentication; Figure 4 This is a schematic diagram of a collaborative behavior graph structure provided in an exemplary embodiment; Figure 5a This is a schematic diagram illustrating the distribution comparison of API calls provided in an exemplary embodiment; Figure 5b This is a schematic diagram illustrating the time distribution comparison of an output decision-making process, provided in an exemplary embodiment. Figure 5c This is a schematic diagram comparing the timing of tool usage as provided in an exemplary embodiment; Figure 5d This is a schematic diagram illustrating a change in behavioral deviation, provided in an exemplary embodiment. Figure 6 This is a schematic diagram of the structure of a device provided in an exemplary embodiment; Figure 7 This is a block diagram of an Agent identity authentication device based on behavioral characteristics, provided in an exemplary embodiment. Detailed Implementation

[0011] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0012] As large-model-based agents are increasingly applied to scenarios such as automated office work, intelligent customer service, intelligent operation and maintenance, risk control, and multi-agent collaboration, these agents typically need to access external application programming interfaces (APIs), invoke tools, perform multi-step inference, and output decision results during operation. For these intelligent agents that continuously perform tasks, completing only a static identity verification during the access phase is insufficient to cover identity security issues during runtime.

[0013] In existing technologies, common authentication methods mainly rely on access tokens, credential signing, decentralized identity identifiers, or session-level authorization information. These solutions can answer the question "Does the current subject possess legitimate credentials?", but they struggle to answer "Does the current action still originate from the claimed Agent?". When authentication credentials are stolen, sessions are hijacked, prompts are maliciously injected, or the executing entity is replaced during operation, attackers may still continue to perform abnormal operations while possessing legitimate credentials, and the system may not be able to identify this in a timely manner.

[0014] Furthermore, existing model identification or model fingerprinting technologies focus more on identifying the underlying model type or version, typically targeting model-level entities rather than specific Agent instances. Even if a model type can be identified, it's difficult to distinguish different Agents deployed on the same model, let alone continuously determine whether an Agent has been replaced or hijacked during task execution. Therefore, these solutions cannot meet the requirements for Agent instance-level, runtime, and persistent identity authentication.

[0015] Meanwhile, anomaly detection methods based solely on fixed thresholds suffer from insufficient adaptability. Agents typically exhibit varying levels of behavioral fluctuation when performing tasks of different complexities. For complex tasks, with more inference steps, more frequent tool switching, and longer response times, using a uniform static threshold can easily misclassify normal fluctuations as anomalies. Conversely, for simple tasks, setting the threshold too wide may overlook genuine identity-related abnormal behaviors, leading to decreased authentication accuracy.

[0016] To address the aforementioned issues, this specification provides a behavioral feature-based agent authentication method. This method pre-extracts features from historical behavioral data generated by the agent during normal operation to determine the baseline behavioral features corresponding to the agent. While the agent is performing its current task, it collects test behavioral data for the agent and extracts features from this data to obtain real-time behavioral features. Subsequently, the real-time behavioral features are compared with the baseline behavioral features to obtain the behavioral deviation, and the authentication result for the agent is determined based on the behavioral deviation.

[0017] By employing the above approach, the authentication process no longer relies solely on one-time static credential verification but introduces a continuous authentication mechanism based on runtime behavior. Since agents exhibit relatively stable behavioral patterns in API call data, tool usage data, inference chain data, and the time distribution data of the output decision-making process, baseline behavioral characteristics corresponding to each agent can be formed based on these patterns. During runtime, deviations between real-time behavioral characteristics and baseline behavioral characteristics are continuously detected, thereby identifying entities with valid credentials but abnormal behavior. This not only enhances identity authentication capabilities during runtime but also facilitates authentication decisions that are more aligned with actual business needs in scenarios with varying task complexity and multi-agent collaboration.

[0018] To facilitate understanding of the technical solutions in this specification, the key concepts involved are explained below: Agent: An intelligent agent capable of autonomously implementing actions based on task objectives. This agent can perform inference based on large models, call external application programming interfaces, select tools, generate intermediate decision-making processes, and output task results. In this specification, an Agent can be a standalone intelligent task execution unit or a collaborative node in a multi-Agent collaborative system.

[0019] Baseline behavioral features: These are behavioral feature representations extracted in advance based on historical behavioral data generated by the agent under normal working conditions. They are used to characterize the stable behavioral patterns of the agent under trusted conditions. These baseline behavioral features can be a feature vector, a feature sequence corresponding to multiple time windows, or statistical distribution parameters, hidden layer representations of the model, or other data structures that can characterize normal behavioral patterns.

[0020] Test Behavioral Data: Data corresponding to the operational behaviors performed by the Agent while executing the current task. This data can reflect the actual behavioral performance of the Agent in the current operational phase. In some embodiments, the test behavioral data includes at least one or more of the following: API call data, tool usage data, inference chain data, and time distribution data of the output decision process.

[0021] Real-time behavioral features: refers to the current behavioral representation obtained by extracting features from the behavioral data to be tested.

[0022] Behavioral bias: The degree of difference between real-time behavioral characteristics and baseline behavioral characteristics. In this specification, behavioral bias can be obtained using a single distance metric or by fusing multiple distance, distribution difference indicators, or statistical discrimination results. A larger behavioral bias generally indicates a more significant difference between the current behavior and the agent's normal behavioral pattern.

[0023] Identity Authentication Result: The authentication conclusion based on behavioral deviations regarding the current Agent's identity status. This conclusion can include different outcomes such as successful authentication, triggering secondary authentication, or authentication failure. It can also output more detailed authentication handling results in conjunction with the risk level.

[0024] The technical solutions described in the embodiments of this specification will be explained in detail below with reference to the accompanying drawings.

[0025] Figure 1 This is a schematic diagram of the architecture of an Agent identity authentication service system provided in an exemplary embodiment. For example... Figure 1 As shown, the system may include a server 11, a network 12, and several electronic devices, such as a personal computer (PC) 13, a mobile phone 14, etc.

[0026] Server 11 can be a physical server containing an independent host, or it can be a virtual server hosted in a host cluster. During operation, server 11 can run server-side programs for a certain application to implement the relevant functions of that application. For example, when server 11 runs an Agent authentication service program, it can function as a corresponding Agent authentication service platform.

[0027] PC13 and mobile phone14 are just some of the types of electronic devices that users can use. In reality, users can obviously also use electronic devices such as tablets, laptops, PDAs (Personal Digital Assistants), wearable devices (such as smart glasses, smartwatches, etc.), etc., and one or more embodiments in this specification do not limit this. During operation, the electronic device can run a client-side program of an application to implement the relevant functions of that application. For example, when the electronic device runs an Agent authentication service program, it can act as a client for that Agent authentication service. The aforementioned Agent authentication service client application can be launched and run on the electronic device. This client-side program can be a native application installed on the electronic device, or it can be a mini-program, quick app, or other similar form. Of course, when using web technologies such as HTML5 or similar, the relevant functions can be implemented through a page displayed by a browser. This browser can be a standalone browser application or a browser module embedded in some applications.

[0028] As for the network 12 that enables interaction between electronic devices such as PC13 and mobile phone 14 and server 11, communication can be achieved using either wired or wireless networks, depending on the communication methods supported by the respective electronic devices. This specification does not impose any restrictions on this. For example, PC13 can support both wired and wireless communication, so it can use either wired or wireless networks as needed. Mobile phone 14 typically only supports wireless communication, so it can use a wireless network for communication.

[0029] In this specification, the entity executing the Agent authentication method can be a server, client, task management program, or collaboration control program running the Agent; it can also be a dedicated Agent or other electronic device for authentication. For ease of description, the following will use a server as the executing entity to illustrate the Agent authentication method provided in this specification.

[0030] Figure 2 This is a schematic diagram of a behavioral feature-based agent authentication method provided in an exemplary embodiment, including the following steps: S200: Collect the behavioral data to be tested of the Agent; wherein, the behavioral data to be tested includes data corresponding to the operational behaviors performed by the Agent when executing the current task.

[0031] In scenarios such as intelligent customer service, automated office work, or multi-agent task orchestration, the server can continuously monitor the agent's behavior while the agent is continuously executing tasks, and use this monitoring to authenticate the agent's identity.

[0032] Before performing real-time identity authentication on the Agent, the server can pre-extract features from the historical behavioral data generated by the Agent under normal working conditions to determine the baseline behavioral features corresponding to the Agent. The method for determining the baseline behavioral features can be found in the relevant descriptions of the real-time behavioral feature extraction and baseline behavioral feature generation process below, which will not be elaborated on in this manual.

[0033] In addition, the server can first perform initial authentication on the Agent to determine whether the Agent has the permission to execute the current task. The authentication methods include, but are not limited to, authentication based on access credentials, authentication based on digital certificates, authentication based on tokens, or authentication based on keys. After the initial authentication is successful, the Agent is authorized to execute the current task. The server can perform continuous authentication on the Agent based on the test behavior data of the Agent during the task execution process.

[0034] In practical applications, servers can collect test behavior data from agent runtime frameworks, call gateways, tool executors, logging systems, or task orchestration systems. This test behavior data can be structured logs, event streams, message records, API call records, inference process records, or timestamp sequences, etc.

[0035] To improve the ability to characterize temporal changes in behavior, in some embodiments, the server can perform sliding window sampling of the behavior data to be tested according to a preset time window to obtain behavior data for multiple consecutive time periods. Accordingly, real-time behavior features may include behavior features corresponding to behavior data for multiple consecutive time periods.

[0036] The preset time window can be set according to the real-time requirements of the business. For example, in high-risk continuous task scenarios, the preset time window can be set to a shorter window to detect behavioral changes more quickly; in long-cycle planning task scenarios, the preset time window can be set to a longer window to improve feature stability. The window step size can be smaller than the window length, so that there is overlap between multiple consecutive time periods, thereby enhancing the ability to capture behavioral mutations.

[0037] For example, if an agent is currently performing the task of "generating an analysis report and calling an external data service," the server can continuously collect the agent's behavioral data in 5-minute time windows with 1-minute increments, thereby obtaining behavioral data for multiple consecutive time periods. Alternatively, in other embodiments, a fixed number of requests, a fixed number of inference rounds, or a fixed number of tool calls can be used as the basis for window division, rather than being limited to an absolute time length.

[0038] Of course, the server can also use other methods to obtain the behavior data to be tested. For example, the server can collect the behavior data to be tested based on a preset time interval; it can also collect the behavior data to be tested based on an event triggering method, that is, when a preset behavior event is detected, the related behavior data before and after the behavior event is extracted; it can also collect the behavior data to be tested based on a task stage division method, that is, collect behavior data according to different stages in the task execution process.

[0039] Regarding the content of the behavioral data to be tested, one approach is for the server to directly collect raw operational behavior data, such as the API endpoints called, call parameter patterns, return status, tool names, tool parameters, inference chain text fragments, and output decision timestamps. Another approach is for the server to first clean, de-identify, normalize, and time-align the raw logs before forming the behavioral data to be tested for subsequent feature extraction.

[0040] S202: Extract features from the behavioral data to be tested to obtain the real-time behavioral features of the Agent.

[0041] The server can extract features from the behavioral data to be tested to obtain real-time behavioral features. In order to improve the ability to characterize different types of behavioral patterns, in some embodiments, the server can extract features from the behavioral data to be tested from multiple dimensions, and then concatenate the extracted features from each dimension to obtain real-time behavioral features; wherein, the behavioral data to be tested from multiple dimensions may include one or more of the following: API call data, tool usage data, inference chain data, and time distribution data of the output decision process.

[0042] For API call data, the server can construct sequence features based on information such as API endpoint identifier, call order, call interval, parameter type, and return status, and then extract API call features using a sequence coding model. For example, an API call sequence within the same window can be represented as... The API call sequence is then encoded using a Transformer encoder to obtain the feature representation of the API call data. ,Right now: This method can reflect the API call habits of the agent when facing the current task. In addition, API call frequency vectors, adjacent API transition probability matrices, or call path subgraph features can be extracted and used as supplementary features of API call data.

[0043] For tool usage data, the server can extract features such as tool selection preferences, tool switching order, tool combination relationships, and parameter configuration patterns. For example, when processing document tasks, an agent typically calls a retrieval tool first, then a summarizing tool, and finally a formatting tool. If it frequently jumps to higher-privilege execution tools within the current task, the features corresponding to this tool usage data may deviate significantly from the baseline behavioral features. In practice, the server can construct tool embedding features based on the tool call sequence and extract tool usage features by combining the transition relationships between tool pairs. For example, the feature representation of tool usage data... It can be represented as: in, Indicates the sequence of tool calls. This represents adjacent tool call pairs. Besides the methods described above, the server can also use graph structure encoding to obtain tool usage characteristics.

[0044] For inference chain data, the server can extract features such as logical connection patterns, inference depth, branch structure, knowledge reference density, and intermediate decision paths from the inference chain text. Inference chain data can originate directly from the intermediate inference content output by the agent, or from internally recorded structured inference trajectories. For example, the server can first parse the inference chain into a tree structure, then extract structured information such as inference depth, logical connector frequency, and knowledge reference density, and encode this information using a graph neural network model or a structured Transformer model to obtain the feature representation corresponding to the inference chain data. ,Right now: in, This represents the tree structure obtained by parsing the inference chain. In addition to the tree structure, in some embodiments, the inference chain can also be parsed into a directed graph structure or a hierarchical sequence structure, and feature encoding can be performed based on the corresponding structure.

[0045] For the time distribution data of the output decision-making process, the server can extract mean, variance, skewness, kurtosis, autocorrelation features, or frequency domain features based on the time consumed by each decision output within the current window to obtain the time distribution features. For example, the feature representation corresponding to the time distribution data of the output decision-making process. It can be represented as: in, Represents the mean of the time distribution. The standard deviation of the time distribution Indicates skewness, Kuness represents kurtosis, and ACF represents autocorrelation characteristic. This represents the frequency domain coefficients obtained based on frequency domain transformation. This method reflects the agent's decision-making pace and computational load performance when handling the current task.

[0046] In some embodiments, the server can combine the above-mentioned features to form a unified real-time behavioral feature. For example, real-time behavioral features It can be represented as: The real-time behavioral feature can be a feature vector corresponding to a single time window, or a feature sequence corresponding to multiple consecutive time periods.

[0047] Optionally, during the process of concatenating features across various dimensions, the server can perform weighted fusion of the features based on the weights corresponding to each dimension to form real-time behavioral features. These weights can be pre-set fixed weights or determined by the task type of the current task.

[0048] In other words, the server can first determine the task type corresponding to the current task, then determine the weights of the behavioral data in each dimension based on the task type, and then generate real-time behavioral features based on the features in each dimension and their corresponding weights.

[0049] For example, the server can adaptively adjust the weights of each dimension of features in real-time behavioral features based on the behavioral focus of the current task. For complex reasoning tasks that require multi-step logical analysis and intermediate decision deduction, the agent usually relies more on the stability of the inference chain structure during execution, so higher weights can be assigned to the features corresponding to the inference chain data. For interface-intensive tasks that require frequent calls to external interfaces to complete information queries, data aggregation, or cross-system collaborative processing, the differences in the Agent's identity are more easily reflected in the API call path and call order. Therefore, the characteristics corresponding to the API call data can be given higher weights. For tool collaboration tasks that require continuous switching between multiple tools, higher weights can be assigned to the features corresponding to the tool usage data. For real-time response tasks that are highly sensitive to response time and where different agents have significantly different processing rhythms, higher weights can be assigned to the features corresponding to the time distribution data of the output decision-making process.

[0050] In this specification, the baseline behavioral features and real-time behavioral features can be obtained by feature extraction from a pre-trained feature extraction model.

[0051] In some embodiments, the feature extraction model can be trained in the following manner: the server acquires sample behavior data of the Agent; the sample behavior data is segmented according to a preset time window to obtain each sample behavior segment; each sample behavior segment is input into the feature extraction model to be trained to obtain the sample behavior features corresponding to each sample behavior segment, so as to form a sample behavior feature sequence, and the feature extraction model is used to predict the (t+1)th sample behavior feature based on the t-th sample behavior feature; wherein, the t-th sample behavior feature in the sample behavior feature sequence corresponds to the t-th time window; the model parameters of the feature extraction model are adjusted according to the deviation between the prediction result and the (t+1)-th sample behavior feature until the training conditions are met.

[0052] For training objectives, regression loss can be used to measure the difference between the predicted result and the behavioral features of the (t+1)th sample. Alternatively, in addition to regression loss, probability distribution difference loss can be introduced to simultaneously constrain eigenvalue error and distribution error. For example, the numerical difference between the predicted vector and the true vector can be calculated based on the mean squared error term, and the difference between the predicted distribution and the actual distribution can be calculated based on the distribution divergence term. The two losses are then weighted and summed. The server adjusts the model parameters based on this loss until the loss converges, the number of iterations reaches a threshold, or the validation set performance meets the requirements.

[0053] Feature extraction models can employ Transformer models, structured coding models, graph neural network models, or combinations thereof. If the behavioral data to be tested is primarily time-series, Transformer models can be prioritized for extracting long-range dependent features; if the inference chain data or tool collaboration data exhibits clear structural relationships, graph coding modules can also be used for processing.

[0054] For baseline behavioral features, the server can first collect historical behavioral data generated by the Agent under normal working conditions, and organize the historical behavioral data according to a preset time window or other preset division method to obtain the corresponding historical behavioral data segments; then, the server can input the historical behavioral data segments into the trained feature extraction model to obtain the historical behavioral features corresponding to each historical behavioral data segment, and determine the baseline behavioral features corresponding to the Agent based on each historical behavioral feature.

[0055] It's important to note that although the feature extraction model employs a self-supervised learning approach during training—predicting the behavior features of the (t+1)th sample based on the behavior features of the t-th sample—the core purpose of this training process is to force the model to deeply learn and internalize the temporal dependencies, transition probability distributions, and potential behavioral patterns of the agent's behavior evolution under normal working conditions, rather than simply obtaining a specific predicted value. A fully trained model possesses the ability to represent the agent's "standard behavioral trajectory." At this point, the model is no longer merely a predictor, but an encoder capable of determining whether behavior conforms to a predetermined pattern. The final determined "baseline behavioral features" are the feature representations of the normal identity state on this manifold, used as a benchmark to measure whether real-time behavior deviates from the normal trajectory during the authentication phase.

[0056] In one implementation, the server can aggregate historical behavioral features corresponding to multiple historical behavioral data segments to generate baseline behavioral features. For example, methods such as averaging, weighted averaging, cluster center extraction, or distribution parameter estimation can be used to integrate multiple historical behavioral features to obtain baseline behavioral features that can characterize the normal behavioral pattern of the Agent.

[0057] In another implementation, the server can directly determine the historical behavioral feature sequence corresponding to multiple historical behavioral data segments as the baseline behavioral features. In this way, during subsequent identity authentication, the server can perform a sequence-level comparison between the real-time behavioral features and this historical behavioral feature sequence, thereby obtaining behavioral biases that better reflect the trend of behavioral evolution.

[0058] It should be noted that the sample behavior data used to train the feature extraction model and the historical behavior data used to determine the baseline behavior features can be the same historical behavior data or different historical behavior data.

[0059] To improve the robustness, generalization ability, or anomaly detection ability of the feature extraction model, the sample behavior data used to train the feature extraction model may not be limited to behavior data under normal working conditions, but may also include behavior data under abnormal behavior conditions; in this case, the sample behavior data used to train the feature extraction model and the historical behavior data used to determine the baseline behavior features may be different datasets.

[0060] S204: Compare real-time behavioral characteristics with baseline behavioral characteristics to obtain the agent's behavioral bias.

[0061] In this specification, there are various ways to compare real-time behavioral features with baseline behavioral features, including but not limited to: The currently acquired real-time behavioral features are compared with pre-determined baseline behavioral features to obtain the behavioral deviation. This behavioral deviation can be calculated for a single time window or jointly for multiple consecutive time periods.

[0062] The deviation between real-time behavioral features and baseline behavioral features is calculated based on similarity metrics. For example, cosine distance can be used to measure the difference in direction between two feature vectors. If the two vectors are close in direction, it indicates that the current behavioral pattern is relatively consistent with the normal behavioral pattern; otherwise, it indicates that the two are significantly different.

[0063] Behavioral biases can be calculated based on differences in probability distributions. For example, for API call distributions, tool usage distributions, or time distribution characteristics, baseline and real-time distributions can be established respectively, and the difference between the two can be measured using a divergence index.

[0064] Behavioral bias can be calculated using statistical distance. For example, for a baseline set of behavioral features with known mean and covariance structures, Mahalanobis distance can be used to measure the degree to which real-time behavioral features deviate from the center of the baseline distribution. This approach can take into account both scale differences and correlations across different feature dimensions.

[0065] In some embodiments, the server can synthesize multiple bias results to obtain the final behavioral bias. For example, feature orientation bias, distribution bias, and statistical bias can be calculated separately, and then weighted and fused according to preset weights to improve the ability to identify complex abnormal behaviors. Accordingly, behavioral bias It can be represented as: . in, Represents real-time behavioral characteristics Compared with benchmark behavioral characteristics The cosine distance between them Represents real-time behavior distribution Compared with the baseline behavior distribution The divergence value between them Represents real-time behavioral characteristics relative to the baseline distribution mean Covariance Matrix Mahalanobis distance; These represent the weighting coefficients corresponding to each deviation measurement item.

[0066] Furthermore, in scenarios spanning multiple consecutive time periods, the server can also perform temporal aggregation of behavioral deviations across multiple windows. For example, methods such as moving averages, exponential smoothing, maximum deviation retention, or trend slope analysis can be used to obtain more stable behavioral deviation results. This helps avoid authentication misjudgments caused by occasional jitter in a single window.

[0067] S206: Determine the authentication result for the Agent based on behavioral deviations.

[0068] In this step, the server can output the authentication result based on behavioral deviations.

[0069] To improve the adaptability of authentication decisions to task differences, in some embodiments, the server can first determine the task complexity based on the task information of the task currently being performed by the Agent, and then determine an adaptive threshold for identity authentication based on the task complexity. The authentication result is then determined based on a comparison between behavioral deviations and the adaptive threshold. This adaptive threshold is positively correlated with the task complexity.

[0070] The task information can include task type, number of task steps, expected number of resources called, types of tools required, inference rounds, context length, or task dependencies. The server can calculate the task complexity based on this information. For example, if the current task only needs to read a single piece of data and generate a short response, the task complexity is low; if the current task needs to call multiple system interfaces, perform multi-step inference, and organize complex output, the task complexity is high.

[0071] The adaptive threshold is positively correlated with task complexity, meaning that the more complex the task, the wider the allowable range of normal behavioral fluctuations. This reduces the probability of misjudgments triggered by normal behavioral fluctuations in complex task scenarios.

[0072] In some embodiments, the adaptive threshold includes a first deviation threshold and a second deviation threshold, wherein the first deviation threshold is less than the second deviation threshold. Accordingly, the server can determine the authentication result in the following manner: If the behavioral deviation is less than the first deviation threshold, the Agent identity authentication is considered successful. This indicates that the current behavior is basically consistent with the baseline behavioral characteristics, and the Agent identity is trustworthy.

[0073] If the behavioral deviation is greater than or equal to the first deviation threshold but less than the second deviation threshold, secondary authentication for the Agent is triggered. This indicates that the current behavior has some deviation, but it is not enough to directly determine that the identity is abnormal. Secondary authentication may include re-verifying identity credentials, shortening the subsequent monitoring window, restricting the use of high-risk tools, requiring manual confirmation, or increasing the granularity of recording.

[0074] If the behavioral deviation is greater than or equal to the second deviation threshold, the Agent authentication is deemed to have failed. This indicates a significant difference between the current behavior and the normal behavior pattern, suggesting a risk of hijacking, replacement, or credential misuse. The server may further interrupt the current task, restrict subsequent resource access, trigger security alerts, or initiate an identity re-registration process.

[0075] Figure 3 This is an exemplary embodiment providing an overall flowchart of identity authentication.

[0076] like Figure 3 The process is divided into two phases: a configuration phase and an authentication phase. In the configuration phase, the server trains a feature extraction model based on sample behavior data to learn the agent's temporal behavior patterns. Historical behavior data is then input into the trained feature extraction model to obtain corresponding baseline behavior features. In the authentication phase, the server acquires the agent's behavior data to be tested and extracts real-time behavior features using the feature extraction model. These real-time behavior features are then compared with the baseline behavior features to output the corresponding authentication result.

[0077] In practical applications, there can be multiple Agents. To further improve the accuracy of authentication results, the server can construct a collaborative behavior graph structure between Agents, with each Agent as a node and the collaborative relationship between Agents as an edge. For each Agent, authentication is performed based on the Agent's behavioral deviation and its collaborative relationship in the collaborative behavior graph structure.

[0078] Figure 4 This is a schematic diagram of a collaborative behavior graph structure provided in an exemplary embodiment.

[0079] In other words, in multi-agent collaboration scenarios, the server not only examines the behavioral deviations of individual agents but also performs joint authentication based on their role relationships within the collaborative behavior graph structure. Collaboration relationships can include message passing relationships, task handover relationships, call dependency relationships, master-slave collaboration relationships, or resource sharing relationships, etc.

[0080] For any Agent, if the Agent's behavioral deviation is less than a preset threshold and the Agent's collaborative relationship in the collaborative behavior graph structure matches the corresponding collaborative role, then the Agent is determined to have passed identity authentication; otherwise, the Agent is determined to have failed identity authentication.

[0081] For example, in a collaborative system consisting of a "task planning agent", a "data analysis agent" and a "report generation agent", if the data analysis agent suddenly and frequently calls high-privilege tools related to code execution in the current task, and this does not match the agent's established collaborative role, even if its individual behavioral deviation has not reached the high-risk threshold, its identity can be determined to have an abnormal risk.

[0082] For example, in a collaborative system consisting of Agent A and Agent B, if there is a collaborative relationship between Agent A and Agent B, after Agent A performs the task distribution action, Agent B should perform the corresponding data processing action. If the server detects that Agent B is not performing the corresponding data processing action, but rather performing other actions unrelated to the current collaborative task, it can be determined that Agent B's collaborative relationship does not match the corresponding collaborative role, and it can be determined that Agent B has an abnormal identity risk.

[0083] Furthermore, after determining that any Agent has failed authentication, the server can also authenticate other Agents that have a collaborative relationship with that Agent. This can identify whether the anomaly has propagated along the collaboration chain and distinguish between single-point anomalies and chain-level anomalies.

[0084] To enhance the system's adaptability to long-term behavioral evolution, in some embodiments, if the Agent passes identity authentication, the server can identify the corresponding behavior data to be tested as a normal behavior sample; and update the baseline behavior features based on the real-time behavior features corresponding to the normal behavior sample.

[0085] The baseline behavioral features can be updated in several ways. One approach is to use a moving average or exponentially weighted average to incrementally update historical baseline behavioral features. Another approach is to add newly acquired normal behavioral samples to the sample set and periodically retrain the feature extraction model or re-estimate the baseline feature distribution parameters. Yet another approach is to maintain multiple versions of baseline behavioral features to support version rollback and difference comparison during the natural evolution of behavioral patterns.

[0086] Furthermore, the server can monitor long-term trends in behavioral deviations. If behavioral deviations continue to rise over a prolonged period but do not reach the authentication failure threshold, it can be determined that there is a risk of behavioral pattern drift, triggering baseline behavioral feature reconstruction or feature extraction model retraining. This can prevent old baselines from becoming invalid due to Agent function upgrades, tool configuration changes, or task structure changes.

[0087] Figures 5a-5b This is a schematic diagram of the deviation comparison results provided in this manual, wherein: exist Figure 5a In the normal state, the Agent mainly makes query or read calls, while the Agent in the hijacked state makes a large number of delete or management calls, which reflects the obvious difference in API call data between the two states.

[0088] exist Figure 5bIn the normal state, the decision delay distribution of the Agent is relatively concentrated and stable, while the decision delay distribution of the Agent under hijacking is relatively dispersed and the overall mean is shifted. This indicates that the hijacking state will cause abnormal changes in the time distribution data of the Agent's output decision process.

[0089] exist Figure 5c In the normal state, agents exhibit diverse and highly sequential tool selection, while agents under hijacking show abnormal repetitive patterns in tool usage, reflecting that the agent's behavior pattern in tool usage data has deviated from the baseline behavior characteristics.

[0090] exist Figure 5d In the normal state, the behavioral deviation of the Agent is always below the preset threshold, while the behavioral deviation of the Agent in the hijacked state rises rapidly after the hijacking and exceeds the corresponding threshold. Therefore, it can be determined that the Agent has an abnormal identity risk.

[0091] The above solution will be further explained below with reference to specific scenarios.

[0092] An agent is responsible for the long-term task of "information retrieval—data analysis—result output". The server pre-collects historical behavioral data of this agent under normal conditions and extracts corresponding baseline behavioral features. During runtime, the server continuously collects behavioral data to be tested according to a preset time window. If, within the current window, the agent sequentially calls the data retrieval interface, analysis interface, and report output tool, and the inference chain structure and time distribution are close to the historical pattern, then the behavioral deviation is small, and the server determines that the identity authentication is successful.

[0093] Although an agent still possesses valid credentials, it suddenly generates a large number of high-privilege deletion API calls while executing the current task. Simultaneously, the inference chain is significantly shortened, the tool usage order deviates from historical patterns, and the time distribution of the output decision-making process also shows a significant shift. At this point, the server extracts real-time behavioral features from the tested behavior data and compares them with baseline behavioral features, revealing a significant behavioral deviation. If this deviation reaches a second deviation threshold, the server determines that the agent's authentication has failed and triggers security measures.

[0094] A certain agent is performing a complex cross-system coordination task. Because this task requires invoking more tools and undergoing more inference rounds, its real-time behavioral characteristics fluctuate more significantly compared to simpler tasks. Based on the task information, the server determines that the current task has high complexity and sets a larger adaptive threshold. In this case, although the behavioral deviation is higher than the conventional threshold for simple tasks, it remains below the first deviation threshold corresponding to this complexity, thus ensuring successful authentication and reducing false positives.

[0095] In multi-agent collaboration scenarios, the server constructs a collaborative behavior graph structure and calculates the behavioral deviation for each agent. If an agent's behavioral deviation falls within the middle range, and its collaborative relationship exhibits a mismatch with its predetermined collaborative role—for example, an agent originally responsible for analysis continuously making calls to an external execution engine—the server can directly determine that the agent has failed authentication or trigger a higher-level secondary authentication. Subsequently, the server further authenticates other agents that have collaborative relationships with this agent to identify potential cascading risks in the collaboration chain.

[0096] Optionally, in addition to authenticating the Agent based on the above behavioral characteristics, the Agent's role classification can also be referenced during the continuous authentication process.

[0097] Specifically, before the Agent performs the actual inference task, the server can pre-register the Agent's role type signature. This registration process can serve as a pre-access initialization process or a deployment-time configuration process.

[0098] The server can obtain the identity credentials declared by the Agent, configure the role type signature corresponding to the Agent, and then bind and store the identity credentials with the configured role type signature.

[0099] Character type signature can be represented as ,in, This represents the set of inference steps that the Agent is allowed to perform. This represents the set of inference step types that are prohibited from being executed by the Agent, and Σ represents the sequence of allowed inference step type conversions.

[0100] After the server obtains the reasoning process data, it can first parse out multiple reasoning steps from the reasoning process data.

[0101] After determining the reasoning steps, the server needs to label the type of the reasoning steps.

[0102] The server can then obtain the role type signature corresponding to the Agent from the registered binding relationship, and perform compliance verification on the labeled inference step type based on the role type signature.

[0103] Specifically, the server can determine whether a labeled inference step type belongs to the inference step types allowed for the Agent to execute, and whether it belongs to the inference step types prohibited for the Agent to execute. If an inference step type belongs to the allowed type set, it can be determined that the inference step type has passed the basic compliance verification; if an inference step type belongs to the prohibited type set, it can be determined that the inference step type has failed the compliance verification.

[0104] In practical applications, there may be situations where a certain inference step type belongs to neither the allowed type set nor the prohibited type set. This can be understood as an undefined type or a type awaiting confirmation. For example, a newly emerging inference step type may not be covered by the current role template, or the classifier may output a new category that has not yet been registered in the role type signature. In such cases, the server can determine that the Agent is in an unconfirmed state and trigger secondary authentication for that Agent.

[0105] Role type signatures can also include prohibited type conversion relationships, which represent the forbidden sequential relationships between the same reasoning step types. When performing compliance verification on the marked reasoning step types, the server can determine whether a prohibited type conversion relationship exists between two adjacent reasoning step types. If it does, then the reasoning step type has failed the compliance verification.

[0106] The types of inference steps allowed for an agent to execute can also include at least one core inference step type. During compliance verification, the server can determine whether the labeled inference step types include this core inference step type. If not, it can be determined that the inference step type has failed compliance verification.

[0107] In addition, the server can also detect the stability of the Agent's reasoning ability. This detection may include: evaluating the Agent's current reasoning ability for the labeled reasoning step type to obtain the Agent's real-time reasoning ability score; if the real-time reasoning ability score does not exceed the reasoning ability boundary set in advance for the Agent, then the Agent is determined to have passed the reasoning ability stability test; otherwise, the Agent is determined to have failed the reasoning ability stability test.

[0108] The server can also detect the consistency of the cross-session inference type distribution of the agent. This detection may include: determining the number of inference steps belonging to each inference step type in the current session, and determining the inference type distribution corresponding to the current session based on the number; obtaining the historical inference type distribution corresponding to the historical sessions; calculating the distribution deviation between the inference type distribution corresponding to the current session and the historical inference type distribution; if the distribution deviation does not exceed a preset deviation threshold, the agent is determined to have passed the cross-session inference type distribution consistency detection; otherwise, the agent is determined to have failed the cross-session inference type distribution consistency detection.

[0109] The server can comprehensively evaluate the above test results and obtain the final identity authentication result.

[0110] Furthermore, in some alternative embodiments, the Agent authentication can also be implemented using other behavior modeling or feature extraction methods.

[0111] For example, agent authentication can be modeled as a sequential decision problem of anomaly detection, and authentication decisions can be made based on agent behavior using a reinforcement learning model. In this case, the server can iteratively update the authentication strategy based on continuous behavioral states, historical authentication results, and authentication feedback information to output the corresponding authentication result.

[0112] Alternatively, a contrastive learning-based approach can be used for behavioral feature extraction. Specifically, the server can train the feature extraction model using behavioral data of the same agent at different time periods as positive samples and behavioral data of different agents as negative samples to obtain feature representations that distinguish the behavioral patterns of different agents, and then perform subsequent identity authentication based on these feature representations.

[0113] Distributed behavioral baseline modeling can also be performed using a federated learning approach. Specifically, different nodes can train their own local behavioral models based on locally collected Agent behavioral data, and then upload the model parameters or gradient information to the central node for aggregation, thereby generating a global model or a shared feature extraction model for identity authentication.

[0114] Alternatively, proactive probe authentication can be used. Specifically, the server can send a preset probe request to the Agent and verify the Agent's identity based on the Agent's response content, response structure, or response behavior characteristics.

[0115] It should be noted that the above optional embodiments can be used alone or in combination with the aforementioned identity authentication methods based on the behavior data to be tested, real-time behavior characteristics, baseline behavior characteristics, and behavior deviations. This specification does not limit this.

[0116] Figure 6 This is a schematic structural diagram of a device provided in an exemplary embodiment. For example... Figure 6 As shown, device 600 mainly consists of a communication interface 602, a user interface 604, a processor 606, and a data storage 608. These components are interconnected and communicate with each other via a system bus, network, or other connection mechanism 610. The communication interface 602 enables device 600 to communicate with other devices, access networks, and transmission networks via analog or digital modulation. For example, the communication interface 602 may include a chipset and antenna for wireless communication with a radio access network or access point. Furthermore, the communication interface 602 can be a wired interface such as Ethernet, Token Ring, or a USB port, or a wireless interface such as Wi-Fi, Bluetooth, Global Positioning System (GPS), or a wide-area wireless interface (e.g., WiMAX or LTE). Of course, the communication interface 602 can also support other forms of physical layer interfaces and standard or proprietary communication protocols. The communication interface 602 may also include multiple physical communication interfaces, such as Wi-Fi, Bluetooth, and wide-area wireless interfaces.

[0117] User interface 604 includes receiving user input and providing output to the user. Therefore, user interface 604 may include input components such as a keypad, keyboard, touch-sensitive or presence-sensitive panel, computer mouse, trackball, joystick, microphone, still camera, and video camera, and output components such as a display screen (which may be combined with a touch-sensitive panel), CRT, LCD, LED, display using DLP technology, printer, and other similar devices known or developed in the future. User interface 604 may also generate auditory output via speakers, speaker jacks, audio output ports, audio output devices, headphones, and other similar devices known or developed in the future. In some embodiments, user interface 604 may include software, circuitry, or other forms of logic capable of transmitting and receiving data from external user input / output devices. Additionally or alternatively, device 600 may support remote access from other devices via communication interface 602 or another physical interface (not shown). User interface 604 may be configured to receive user input, the position and movement of which may be indicated by indicators or cursors described herein. User interface 604 may also be configured as a display device for rendering or displaying text fragments.

[0118] Processor 606 may contain one or more general-purpose processors and / or special-purpose processors.

[0119] Data storage 608 may include one or more volatile and / or non-volatile storage components and may be integrated wholly or partially with processor 606. Data storage 608 may include removable and non-removable components.

[0120] Processor 606 is capable of executing program instructions 618 (e.g., compiled or uncompiled program logic and / or machine code) stored in data storage 608 to perform the various functions described herein. Data storage 608 may contain a non-transitory computer-readable medium on which program instructions are stored, which, when executed by device 600, enable device 600 to perform any methods, processes, or functions disclosed in this specification and / or the accompanying drawings. Execution of program instructions 618 by processor 606 may result in processor 606 using data 612.

[0121] For example, program instructions 618 may include an operating system 622 (e.g., an operating system kernel, device drivers, and / or other modules) installed on device 600 and one or more applications 620 (e.g., a browser, social application, or game application). Similarly, data 612 may include operating system data 616 and application data 614. Operating system data 616 is primarily accessible to the operating system 622, while application data 614 is primarily accessible to one or more applications 620. Application data 614 may reside in a file system visible or hidden from the user of device 600.

[0122] Application 620 can communicate with operating system 622 through one or more application programming interfaces (APIs). These APIs help application 620 read and / or write application data 614, transmit or receive information via communication interface 602, receive or display information on user interface 604, etc.

[0123] In some terminology, application 620 may be simply referred to as "app". Furthermore, application 620 can be downloaded to device 600 through one or more online app stores or app markets. However, applications can also be installed on device 600 in other ways, such as through a web browser or a physical interface on device 600 (e.g., a USB port).

[0124] Please refer to Figure 7 Behavioral feature-based agent authentication devices can be applied to, for example... Figure 6 The device shown is used to implement the technical solution of this specification. The device may include: The configuration module 700 is used to pre-extract features from the historical behavior data generated by the Agent under normal working conditions, and determine the baseline behavior features corresponding to the Agent. The data acquisition module 702 is used to acquire the test behavior data of the Agent; wherein, the test behavior data includes data corresponding to the operation behavior performed by the Agent when executing the current task; The extraction module 704 is used to extract features from the behavior data to be tested to obtain the real-time behavior features of the Agent; The comparison module 706 is used to compare the real-time behavioral features with the baseline behavioral features to obtain the behavioral deviation of the Agent; The authentication module 708 is used to determine the identity authentication result for the Agent based on the behavioral deviation.

[0125] Optionally, the acquisition module 702 is specifically used to perform sliding window sampling on the behavior data to be tested according to a preset time window to obtain behavior data for multiple consecutive time periods; wherein, the real-time behavior features include behavior features corresponding to the behavior data for the multiple consecutive time periods.

[0126] Optionally, the extraction module 704 is specifically used to extract features from the test behavior data of multiple dimensions respectively, and to concatenate the extracted features of each dimension to obtain the real-time behavior features; wherein, the test behavior data of multiple dimensions includes at least: API call data, tool usage data, inference chain data, and time distribution data of the output decision process.

[0127] Optionally, the authentication module 708 is specifically configured to: determine the task complexity based on the task information of the task currently being executed by the Agent; determine an adaptive threshold for identity authentication based on the task complexity, wherein the adaptive threshold is positively correlated with the task complexity; and determine the identity authentication result based on the comparison result between the behavior deviation and the adaptive threshold.

[0128] Optionally, the adaptive threshold includes a first deviation threshold and a second deviation threshold, wherein the first deviation threshold is less than the second deviation threshold; The authentication module 708 is specifically configured to: if the behavior deviation is less than the first deviation threshold, determine that the Agent identity authentication is successful; if the behavior deviation is greater than or equal to the first deviation threshold and less than the second deviation threshold, trigger a second identity authentication for the Agent; if the behavior deviation is greater than or equal to the second deviation threshold, determine that the Agent identity authentication fails.

[0129] Optionally, the Agent includes multiple Agents, and the authentication module 708 is further configured to construct a collaborative behavior graph structure between Agents, with each Agent as a node and the collaborative relationship between Agents as an edge; and to perform identity authentication on each Agent based on the Agent's behavioral deviation and the Agent's collaborative relationship in the collaborative behavior graph structure.

[0130] Optionally, the authentication module 708 is specifically used to determine that the Agent has passed identity authentication if the Agent's behavioral deviation is less than a preset threshold and the Agent's collaborative relationship in the collaborative behavior graph structure matches the corresponding collaborative role; otherwise, it is determined that the Agent has failed identity authentication.

[0131] Optionally, the authentication module 708 is further configured to perform identity authentication on other agents that have a cooperative relationship with the agent after determining that any agent has failed identity authentication.

[0132] Optionally, the configuration module 700 is specifically used to: acquire sample behavior data of the Agent; segment the sample behavior data according to a preset time window to obtain each sample behavior segment; input each sample behavior segment into a feature extraction model to be trained to obtain sample behavior features corresponding to each sample behavior segment, so as to form a sample behavior feature sequence; and predict the (t+1)th sample behavior feature based on the t-th sample behavior feature through the feature extraction model; wherein, the t-th sample behavior feature in the sample behavior feature sequence corresponds to the t-th time window; and adjust the model parameters of the feature extraction model according to the deviation between the prediction result and the (t+1)-th sample behavior feature until the training conditions are met.

[0133] Optionally, the device further includes: The update module 710 is used to determine the corresponding behavior data to be tested as a normal behavior sample if the Agent passes the identity authentication; and to update the baseline behavior features based on the real-time behavior features corresponding to the normal behavior sample.

[0134] For ease of description, the above devices are described by dividing them into various modules or units based on their functions. Of course, when implementing one or more of these specifications, the functions of each module or unit can be implemented in the same or different software and / or hardware, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0135] Based on the same concept as the methods described above, this specification also provides an electronic device, including: a processor; a memory for storing processor-executable instructions; wherein the processor performs the steps of the method as described in any of the above embodiments by executing the executable instructions.

[0136] Based on the same concept as the methods described above, this specification also provides a computer-readable storage medium having computer instructions stored thereon that, when executed by a processor, implement the steps of the methods as described in any of the above embodiments.

[0137] Based on the same concept as the methods described above, this specification also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the methods as described in any of the above embodiments.

[0138] What those skilled in the art will understand is: In this specification, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitation, the presence of additional identical or equivalent elements in a process, method, product, or apparatus that includes said elements is not excluded.

[0139] In this specification, “a,” “an,” and “the” do not specifically refer to the singular, but may also include the plural.

[0140] In this specification, ordinal numbers such as "first," "second," etc., do not necessarily indicate order; they are often used to distinguish between objects. For example, "first server" and "second server" usually refer to two servers. To differentiate between these two servers, they are described as "first server" and "second server." Of course, sometimes these two servers may be the same server.

[0141] In this specification, unless explicitly stated otherwise, "receiving and sending data" does not necessarily mean direct receiving and sending; it can also mean indirect receiving and sending. For example, A receiving data sent by B can be understood as A directly receiving the data sent by B, or it can be understood as A indirectly receiving the data sent by B through other entities such as C. Similarly, B sending data to A can be understood as B sending the data directly to A, or it can be understood as B indirectly sending the data to A through other entities such as C. Here, C can be one entity, or it can be two or more entities.

[0142] In this specification, unless explicitly stated otherwise, the relationships between structures can be direct or indirect. For example, when describing "A is connected to B," unless it is explicitly stated that A and B are directly connected, it should be understood that A can be directly connected to B or indirectly connected to B. Similarly, when describing "A is on top of B," unless it is explicitly stated that A is directly above B (AB is adjacent and A is above B), it should be understood that A can be directly above B or indirectly above B (AB is separated by other elements, and A is above B). And so on.

[0143] This specification uses specific terms to describe embodiments thereof. Terms such as "an embodiment," "one embodiment," and / or "some embodiments" refer to a particular feature, structure, or characteristic associated with at least one embodiment of this specification. Therefore, it should be emphasized and noted that references to "an embodiment," "one embodiment," or "an alternative embodiment" in different locations throughout this specification do not necessarily refer to the same embodiment. Furthermore, those skilled in the art can combine and integrate the different embodiments or examples described herein, as well as the features of those different embodiments or examples, without contradiction.

[0144] Although one or more embodiments of this specification provide method steps as described in the embodiments or flowcharts, it is understood that the order of steps listed in the embodiments or flowcharts is only one of many possible execution orders and does not represent the only execution order. Therefore, when the claims involve method steps, any changes or adjustments to the order of such steps, or the parallelism between steps, are also within the scope of protection of the claims.

Claims

1. A behavioral feature-based agent authentication method, comprising pre-extracting features from historical behavioral data generated by the agent under normal working conditions to determine the baseline behavioral features corresponding to the agent, the method comprising: Collect the test behavior data of the Agent; wherein, the test behavior data includes data corresponding to the operation behavior performed by the Agent when executing the current task; Feature extraction is performed on the behavioral data to be tested to obtain the real-time behavioral features of the Agent; The real-time behavioral features are compared with the baseline behavioral features to obtain the behavioral deviation of the Agent; Based on the behavioral deviations, the authentication result for the Agent is determined.

2. The method as described in claim 1, wherein collecting the test behavior data of the Agent specifically includes: The behavioral data to be tested is sampled using a sliding window according to a preset time window to obtain behavioral data for multiple consecutive time periods. The real-time behavioral features include behavioral features corresponding to behavioral data from the multiple consecutive time periods.

3. The method as described in claim 1, wherein extracting real-time behavioral features corresponding to the Agent based on the behavior data to be tested specifically includes: Feature extraction is performed on the behavioral data to be tested from multiple dimensions, and the extracted features from each dimension are concatenated to obtain the real-time behavioral features. The measured behavioral data in the multiple dimensions includes at least: API call data, tool usage data, inference chain data, and time distribution data of the output decision process.

4. The method as described in claim 1, wherein determining the identity authentication result for the Agent based on the behavioral deviation, specifically includes: The task complexity is determined based on the task information of the task currently being executed by the Agent; An adaptive threshold for identity authentication is determined based on the task complexity, wherein the adaptive threshold is positively correlated with the task complexity; The identity authentication result is determined based on the comparison between the behavioral deviation and the adaptive threshold.

5. The method of claim 4, wherein the adaptive threshold includes a first deviation threshold and a second deviation threshold, wherein, The first deviation threshold is less than the second deviation threshold; The identity authentication result is determined based on the comparison between the behavioral deviation and the adaptive threshold, specifically including: If the behavioral deviation is less than the first deviation threshold, then the Agent identity authentication is determined to be successful; If the behavioral deviation is greater than or equal to the first deviation threshold and less than the second deviation threshold, then secondary authentication for the Agent is triggered. If the behavioral deviation is greater than or equal to the second deviation threshold, then the Agent identity authentication is determined to have failed.

6. The method of claim 1, wherein the Agent comprises multiple agents, and the method further comprises: Construct a collaborative behavior graph structure between agents, with each agent as a node and the collaborative relationships between agents as edges; For each Agent, authentication is performed based on the Agent's behavioral deviations and its collaborative relationships within the collaborative behavior graph structure.

7. The method as described in claim 6, wherein the Agent is authenticated based on the Agent's behavioral deviations and its collaborative relationships within the collaborative behavior graph structure, specifically including: If the Agent's behavioral deviation is less than a preset threshold, and the Agent's collaborative relationship in the collaborative behavior graph structure matches the corresponding collaborative role, then the Agent is determined to have passed identity authentication. Otherwise, it is determined that the Agent has not passed identity verification.

8. The method of claim 6, further comprising: Once it is determined that any Agent has failed authentication, authentication is performed on other Agents that have a collaborative relationship with that Agent.

9. The method of claim 1, wherein the baseline behavioral features and the real-time behavioral features are obtained by feature extraction from a pre-trained feature extraction model, and the feature extraction model is trained through the following steps: Obtain sample behavioral data of the Agent; The sample behavior data is segmented according to a preset time window to obtain each sample behavior segment; Each sample behavior segment is input into the feature extraction model to be trained to obtain the sample behavior features corresponding to each sample behavior segment, so as to form a sample behavior feature sequence. The feature extraction model is then used to predict the (t+1)th sample behavior feature based on the tth sample behavior feature. The tth sample behavior feature in the sample behavior feature sequence corresponds to the tth time window. Based on the deviation between the prediction result and the behavioral features of the (t+1)th sample, the model parameters of the feature extraction model are adjusted until the training conditions are met.

10. The method of claim 1, further comprising: If the Agent passes identity authentication, the corresponding behavioral data to be tested will be identified as a normal behavioral sample. The baseline behavior features are updated using the real-time behavior features corresponding to the normal behavior samples.

11. A behavioral feature-based agent authentication device, comprising: The configuration module is used to pre-extract features from the historical behavior data generated by the Agent under normal working conditions, and determine the baseline behavior features corresponding to the Agent; The data acquisition module is used to acquire the test behavior data of the Agent; wherein, the test behavior data includes data corresponding to the operation behavior performed by the Agent when executing the current task; The extraction module is used to extract features from the behavior data to be tested, so as to obtain the real-time behavior features of the Agent; The comparison module is used to compare the real-time behavioral features with the baseline behavioral features to obtain the behavioral deviation of the Agent; The authentication module is used to determine the identity authentication result for the Agent based on the behavioral deviation.

12. An electronic device, comprising: processor; A memory for storing processor-executable instructions; wherein the processor implements the steps of the method as described in any one of claims 1-10 by executing the executable instructions.

13. A computer-readable storage medium having stored thereon computer instructions that, when executed by a processor, implement the steps of the method as claimed in any one of claims 1-10.

14. A computer program product comprising a computer program / instructions that, when executed by a processor, implement the steps of the method as claimed in any one of claims 1-10.

Images