Weak supervision event representation learning method and system for aid decision-making

Abstract

The invention relates to the technical field of electric digital data processing, in particular to a weak supervision event representation learning method and system for aid decision making, and the method comprises the following steps: forming an event sequence through the operation behaviors of a user on an operation and maintenance network, and generating an initial event representation; constructing a normal prototype of the multi-hypersphere; performing first-stage training to obtain a sequence encoder after first-stage parameter optimization and a normal prototype of the multi-hyper-sphere; calculating an abnormal score of each event in the event sequence to obtain a prediction result of the event; carrying out multi-instance learning, and carrying out second-stage training to obtain a sequence encoder after second-stage parameter optimization, a normal prototype of the multi-hypersphere and an anomaly discriminator; abnormal events are screened, and manual decision making of the intelligent operation and maintenance system is assisted. The method and the system provided by the invention provide better assistance for decision making of the intelligent operation and maintenance system.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic digital data processing, and in particular to a weakly supervised event representation learning method and system for auxiliary decision making. Background Art

[0002] With the rapid development of information technology, modern information systems have become the core infrastructure supporting the operations of businesses and organizations. The massive amounts of monitoring data they continuously generate, such as user behavior records, provide a crucial basis for security protection and risk control. For intelligent operations and maintenance systems, Discrete Event Sequence Anomaly Detection (DESAD) technology abstracts system records into discrete events and constructs event sequences, enabling automatic identification and detection of anomalous behavior. This technology can help businesses and organizations promptly identify potential security threats to intelligent operations and maintenance systems, assisting them in making appropriate decisions and implementing effective protective measures, thereby avoiding significant losses.

[0003] However, existing research on anomaly detection in discrete event sequences has significant limitations. Most current research focuses on sequence-level anomaly detection, abstracting user activities into events and aggregating them into sequences. Sequence models from natural language processing are then used to capture the temporal dependencies between user activities, enabling anomaly detection. While these approaches can identify anomalous sequences to a certain extent, they struggle to precisely locate specific anomalous events within them. Given that in real-world scenarios, an event sequence can contain hundreds or even thousands of independent events, developing fine-grained event-level detection techniques is crucial for reducing manual screening costs, improving threat location efficiency, assisting enterprise decision-making, and ensuring effective protection.

[0004] For event-level anomaly detection in discrete event sequences, providing anomaly labels for such a large number of events is unrealistic due to their extreme rarity and hidden nature. Existing research mostly employs unsupervised or single-class learning paradigms, modeling normal behavior patterns to identify abnormal events that deviate from them. However, this approach has significant shortcomings in practical applications: it cannot exhaustively enumerate all normal patterns, and the boundary between normal and abnormal is often blurred, resulting in high false positive and missed detection rates. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a weakly supervised event representation learning method and system for decision support. By constructing normal prototypes of multiple hyperspheres, the patterns of different normal events are learned, and weak supervision signals at the sequence level are introduced to perform multi-instance learning, thereby distinguishing normal events from abnormal events and effectively learning the feature representation of events, thereby providing better assistance for the decision-making of intelligent operation and maintenance systems.

[0006] The present invention is achieved through the following technical solutions: A weakly supervised event representation learning method for decision support includes the following steps: S1: The user's operation behavior on the operation and maintenance network is converted into an event sequence, and the event sequence is used to generate the initial event representation using a sequence encoder; S2: Randomly set the centers of multiple hyperspheres to construct normal prototypes of multiple hyperspheres; S3: Taking the representation of the center of the multi-hypersphere in the normal prototype of the multi-hypersphere and the representation of the normal event in the initial event representation as input, the sequence encoder and the normal prototype of the multi-hypersphere are trained to obtain the sequence encoder and the normal prototype of the multi-hypersphere after the first stage parameter optimization; S4: The sequence encoder after the first stage parameter optimization is used to generate the event representation after the first stage optimization. The anomaly discriminator calculates the anomaly score of each event in the event sequence based on the event representation after the first stage optimization and the representation of the center of the multi-hypersphere in the normal prototype of the multi-hypersphere after the first stage parameter optimization, and obtains the prediction result of the event. S5: Perform multi-instance learning to obtain the prediction results of the event sequence based on the event prediction results, and introduce the event sequence level label as a weak supervision signal. The event sequence prediction results and event sequence level label are used to train the sequence encoder, normal prototype of the multi-hypersphere, and abnormal discriminator after the first stage parameter optimization, and obtain the sequence encoder, normal prototype of the multi-hypersphere, and abnormal discriminator after the second stage parameter optimization; S6: The second-stage optimized event representation is generated by the sequence encoder after the second-stage parameter optimization. The second-stage optimized anomaly discriminator calculates the final anomaly score of each event in the event sequence based on the second-stage optimized event representation and the representation of the center of the multi-hypersphere in the second-stage optimized multi-hypersphere normal prototype, obtains the final prediction result of the event, screens abnormal events, and assists the manual decision-making of the intelligent operation and maintenance system.

[0007] Optimally, in step S1, the sequence encoder generates the initial event representation from the event sequence through two processes: event embedding and sequence context encoding.

[0008] Furthermore, in step S1, the sequence encoder generates the initial event representation from the event sequence through two processes: event embedding and sequence context encoding. The method is as follows: S11: The embedding layer of the sequence encoder projects the event into the embedding space and obtains the corresponding embedding vector; S12: Use a bidirectional gated recurrent unit to encode the event sequence according to formula (1) to generate the initial event representation: (1); in, An encoding representing a sequence of events, represents a bidirectional gated recurrent unit, Represent events respectively 、 ,..., The embedding vector of Indicates the number of events.

[0009] Furthermore, in step S2, a normal prototype of the multi-hypersphere is constructed by the following method: Random Settings The center of the hypersphere is expressed as formula (2): (2); in: represents the index of the hypersphere, represents a real number, Represents dimension, represents the center of the hypersphere, Represents the real number space.

[0010] Furthermore, in step S3, the sequence encoder and the normal prototype of the multi-hypersphere are trained using the following method to obtain the sequence encoder and the normal prototype of the multi-hypersphere after the first-stage parameter optimization: S31: During the training process, the distance from the representation of each normal event in the initial event representation to the center of each hypersphere is calculated according to formula (3): (3); in: Indicates the initial event representation Normal events to The Euclidean distance between the centers of the hyperspheres, Indicates the initial event representation Representation of normal events, represents the center of the hypersphere, represents the index of the hypersphere, Indicates calculation of Euclidean distance; S32: Based on the distance from the representation of each normal event in the initial event representation to the center of each hypersphere, the index of the nearest hypersphere center from the representation of each normal event in the initial event representation is calculated according to formula (4): (4); in: represents the index of the nearest hypersphere center to each normal event in the initial event representation, Represents the minimize operation, represents the total number of hyperspheres; S33: Calculate the multi-hypersphere center loss according to formula (5) based on the index of the nearest hypersphere center from the representation of each normal event in the initial event representation: (5); in: represents the multi-hypersphere center loss, represents the normal sequence of events in the event sequence, represents the number of normal event sequence events in the event sequence, represents the center of the nearest hypersphere from the event representation, Indicates calculation of squared Euclidean distance; S34: Calculate the hypersphere separability loss according to formula (6): (6); in: represents the hypersphere separability loss, Indicates the calculation of binary cross entropy loss, represents the exponential operation, represents the center of the hypersphere that is second closest to the representation of each normal event in the initial event representation, The index of the second closest hypersphere representing each normal event in the initial event representation; S35: Based on the multi-hypersphere center loss and hypersphere separability loss, the loss function of the first stage is calculated according to formula (7): (7); in: represents the loss function of the first stage, represents the weight of the hypersphere separability loss; S36: Iterative training is performed with the goal of minimizing the loss function of the first stage to complete the first stage training of the sequence encoder and the multi-hypersphere normal prototype, and the sequence encoder and the multi-hypersphere normal prototype after the first stage parameter optimization are obtained.

[0011] Furthermore, in step S4, the following method is used to generate the event representation optimized in the first stage using the sequence encoder after the first stage parameter optimization. Based on the event representation optimized in the first stage and the representation of the center of the multi-hypersphere in the normal prototype of the multi-hypersphere after the first stage parameter optimization, the abnormality score of each event in the event sequence is calculated to obtain the prediction result of the event: S41: The embedding layer of the sequence encoder after the first stage parameter optimization projects the event into the embedding space to obtain the embedding vector after the first stage optimization; S42: Use a bidirectional gated recurrent unit to encode the event sequence according to formula (8) to generate the event representation after the first stage optimization: (8); in, represents the encoding of the event sequence after the first stage optimization, represents a bidirectional gated recurrent unit, Represent events respectively 、 ,..., The embedding vector after the first stage optimization, Indicates the number of events.

[0012] S43: Calculate the distance between the representation of each event in the event representation after the first stage optimization and the center of each hypersphere in the normal prototype of the multi-hypersphere after the first stage parameter optimization according to formula (9): (9); in: Indicates the first phase of the event representation after optimization Event to the normal prototype of the multi-hypersphere after the first stage parameter optimization The Euclidean distance between the centers of the hyperspheres, Indicates the first phase of the event representation after optimization The representation of an event, It represents the normal prototype of the multi-hypersphere after the first stage parameter optimization. The center of a hypersphere, represents the index of the hypersphere, Indicates calculation of Euclidean distance; S44: Based on the distance between the representation of each event in the event representation after the first stage optimization and the center of each hypersphere in the normal prototype of the multi-hypersphere after the first stage parameter optimization, the index of the nearest hypersphere center in the normal prototype of the multi-hypersphere after the first stage parameter optimization is calculated according to formula (10): (10); in: represents the index of the nearest hypersphere center in the multi-hypersphere normal prototype after the first stage parameter optimization for each event representation in the first stage optimized event representation, Represents the minimize operation, represents the total number of hyperspheres; S45: The anomaly discriminator calculates the deviation score of each event in the event sequence based on the nearest hypersphere center according to formula (11): (11); in: It represents the deviation score of each event in the event sequence from the nearest hypersphere center in the multi-hypersphere prototype after the first stage parameter optimization, Indicates the first event in the sequence events, represents a sequence of events, Indicates the first phase of the event representation after optimization The representation of an event, The distance to the event after the first stage optimization represents the center of the hypersphere in the normal prototype of the multi-hypersphere after the first stage parameter optimization; S46: Calculate the anomaly discriminator score of each event in the event sequence according to formula (12) through the anomaly discriminator: (12); in: represents the abnormality discriminator score for each event in the event sequence, represents the activation function, represents the weight matrix, Indicates the first stage after optimization and enhancement The event indicated that Indicates bias, Represents a matrix transpose operation; S47: Based on the deviation score of each event in the event sequence from the nearest hypersphere center in the multi-hypersphere prototype after the first stage parameter optimization and the abnormal discriminator score of each event in the event sequence, the abnormal score of each event in the event sequence is calculated according to formula (13): (13); in: represents the anomaly score of each event in the event sequence, represents the model parameters, represents the dual-score balance factor; S48: Compare the anomaly score of each event in the event sequence with the set threshold. If the anomaly score of each event in the event sequence is less than the set threshold, the prediction result of the event is judged to be normal. If the anomaly score of each event in the event sequence is greater than or equal to the set threshold, the prediction result of the event is judged to be abnormal.

[0013] Furthermore, in step S5, the following method is used to obtain the prediction result of the event sequence based on the prediction result of the event: S51: Arrange the abnormal scores of events in the event sequence from high to low, and determine the previous Index of events: (14); in: Indicates the Before the event sequence The index of the event, Before calculation Function of an event, Indicates the A sequence of events, Indicates the Event sequence Anomaly score of events in ; S52: Based on Center front The index of an event is obtained according to formula (15): The prediction results are: (15); in: Indicates the The prediction results of a sequence of events, Indicates taking the absolute value.

[0014] Furthermore, in step S5, the following method is used to introduce event sequence-level labels as weak supervisory signals. The sequence encoder, normal prototype of the multi-hypersphere, and abnormal discriminator are trained using the event sequence prediction results and the event sequence-level labels to obtain the sequence encoder, normal prototype of the multi-hypersphere, and abnormal discriminator after parameter optimization in the second stage: S53: Introduce event sequence level labels as weak supervision signals, and use event sequence level labels and event sequence prediction results to calculate the loss function of the second stage according to formula (16): (16); in: represents the loss function of the second stage, represents a collection of event sequences, represents the number of event sequences, Indicates the event sequence-level labels; S54: With the goal of minimizing the loss function of the second stage, the sequence encoder, the normal prototype of the multi-hypersphere, and the abnormal discriminator after the parameters are optimized in the first stage are trained to obtain the sequence encoder, the normal prototype of the multi-hypersphere, and the abnormal discriminator after the parameters are optimized in the second stage.

[0015] Optimally, in step S6, the final prediction result of the event is obtained using the following method: S61: Encode the event sequence using the sequence encoder after the second stage parameter optimization to generate the event representation after the second stage optimization; S62: calculating the distance between the representation of each event in the event representation optimized in the second stage and the center of each hypersphere in the normal prototype of the multi-hypersphere after the parameters are optimized in the second stage; S63: calculating the index of the nearest hypersphere center in the multi-hypersphere normal prototype after the second stage parameter optimization from each event representation in the event representation after the second stage optimization to each hypersphere center in the multi-hypersphere normal prototype after the second stage parameter optimization based on the distance between the representation of each event in the event representation after the second stage optimization and the center of each hypersphere in the multi-hypersphere normal prototype after the second stage parameter optimization; S64: Based on the event representation optimized in the second stage and the index of each event representation in the event representation optimized in the second stage to the nearest hypersphere center in the multi-hypersphere normal prototype after the second stage parameter optimization, calculate the final deviation score and the final anomaly discriminator score of each event based on the nearest hypersphere center, and further calculate to obtain the final anomaly score; S65: Screen abnormal events based on the final abnormality score.

[0016] A weakly supervised event representation learning system for decision support, for executing any one of the above-mentioned weakly supervised event representation learning methods for decision support, comprising a sequence encoder, a normal prototype of multiple hyperspheres, and an abnormal discriminator; The sequence encoder is used to convert the user's operation behavior on the operation and maintenance network into an event sequence, and generate an initial event representation from the event sequence; the sequence encoder after the first stage parameter optimization is used to generate the event representation after the first stage optimization from the event sequence; the sequence encoder after the second stage parameter optimization is used to generate the event representation after the second stage optimization from the event sequence; The normal prototype of the multiple hyperspheres includes a plurality of randomly set hypersphere centers; the normal prototype of the multiple hyperspheres after the first stage parameter optimization includes the plurality of hypersphere centers after the first stage parameter optimization; the normal prototype of the multiple hyperspheres after the second stage parameter optimization includes the plurality of hypersphere centers after the second stage parameter optimization; The anomaly discriminator is used to calculate the anomaly score of each event in the event sequence based on the event representation optimized in the first stage and the center of the multi-hypersphere in the normal prototype of the multi-hypersphere after the first stage parameter optimization, so as to obtain the prediction result of the event; the anomaly discriminator after the second stage parameter optimization is used to calculate the final anomaly score of each event in the event sequence based on the event representation optimized in the second stage and the center of the multi-hypersphere in the normal prototype of the multi-hypersphere after the second stage parameter optimization, so as to obtain the final prediction result of the event.

[0017] Beneficial effects of the invention: The present invention provides a weakly supervised event representation learning method and system for decision support. The method uses multiple hyperspheres to represent different normal modes of events, which solves the limitation that the single-class learning paradigm cannot exhaustively enumerate all normal modes and provides a good unsupervised starting point. The method introduces sequence-level weak supervision signals and performs multi-instance learning, making detection more robust, clarifying the boundaries between normal and abnormal events, and learning more precise event representations, thereby providing more accurate decision support for intelligent operation and maintenance systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a schematic flow chart of the present invention.

[0019] Figure 2 It is a schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION

[0020] A weakly supervised event representation learning method for decision-making assistance includes the following steps, and its flowchart is as follows: Figure 1 As shown: S1: The user's operation behavior on the operation and maintenance network is converted into an event sequence, and the event sequence is used to generate the initial event representation using a sequence encoder; Specifically, the user's operations on the operation and maintenance network here mainly include: logging in, accessing files, connecting devices, accessing the network, sending emails, receiving emails, etc.

[0021] The sequence encoder includes an embedding layer and a bidirectional gated recurrent unit, which can generate initial event representations from event sequences through two processes: event embedding and sequence context encoding.

[0022] The specific method of the sequence encoder to generate the initial event representation from the event sequence is as follows: S11: The embedding layer of the sequence encoder projects the event into the embedding space and obtains the corresponding embedding vector; S12: The bidirectional gated recurrent unit of the sequence encoder is used to encode the event sequence according to formula (1) to generate the initial event representation: (1); in, An encoding representing a sequence of events, , Respectively for events 、 ,..., The context representation of represents a bidirectional gated recurrent unit, Represent events respectively 、 ,..., The embedding vector of Indicates the number of events.

[0023] The sequence encoder can capture the semantic information of events. The bidirectional gated recurrent unit it uses can better capture the long-term dependencies between events, generate more effective initial event representations, and provide stronger feature support for subsequent analysis tasks.

[0024] S2: Randomly set the centers of multiple hyperspheres to construct normal prototypes of multiple hyperspheres; Specifically, the normal prototype of the multi-hypersphere can be constructed by the following method: Random Settings The center of the hypersphere is expressed as formula (2): (2); in: represents the index of the hypersphere, represents a real number, Represents dimension, represents the center of the hypersphere, Represents the real number space.

[0025] Randomly setting multiple hypersphere centers instead of a single hypersphere center can better handle multi-modal normal behaviors.

[0026] S3: Taking the representation of the center of the multi-hypersphere in the normal prototype of the multi-hypersphere and the representation of the normal event in the initial event representation as input, the sequence encoder and the normal prototype of the multi-hypersphere are trained to obtain the sequence encoder after the first-stage parameter optimization and the normal prototype of the multi-hypersphere after the first-stage parameter optimization; Specifically, the following method can be used to train the sequence encoder and the normal prototype of the multi-hypersphere to obtain the sequence encoder after the first-stage parameter optimization and the normal prototype of the multi-hypersphere after the first-stage parameter optimization: S31: During the training process, the distance from the representation of each normal event in the initial event representation to the center of each hypersphere is calculated according to formula (3): (3); in: Indicates the initial event representation Normal events to The Euclidean distance between the centers of the hyperspheres, Indicates the initial event representation Representation of normal events, represents the center of the hypersphere, represents the index of the hypersphere, Indicates calculation of Euclidean distance; S32: Based on the distance from the representation of each normal event in the initial event representation to the center of each hypersphere, the index of the nearest hypersphere center from the representation of each normal event in the initial event representation is calculated according to formula (4): (4); in: represents the index of the nearest hypersphere center to each normal event in the initial event representation, Represents the minimize operation, represents the total number of hyperspheres; S33: Calculate the multi-hypersphere center loss according to formula (5) based on the index of the nearest hypersphere center from the representation of each normal event in the initial event representation: (5); in: represents the multi-hypersphere center loss, represents the normal sequence of events in the event sequence, represents the number of normal event sequence events in the event sequence, represents the center of the nearest hypersphere from the event representation, Indicates calculation of squared Euclidean distance; S34: Calculate the hypersphere separability loss according to formula (6): (6); in: represents the hypersphere separability loss, Indicates the calculation of binary cross entropy loss, represents the exponential operation, represents the center of the hypersphere that is second closest to the representation of each normal event in the initial event representation, The index of the second closest hypersphere representing each normal event in the initial event representation; S35: Based on the multi-hypersphere center loss and hypersphere separability loss, the loss function of the first stage is calculated according to formula (7): (7); in: represents the loss function of the first stage, represents the weight of the hypersphere separability loss; S36: Iterative training is performed with the goal of minimizing the loss function of the first stage to complete the first stage training of the sequence encoder and the multi-hypersphere normal prototype, and the sequence encoder and the multi-hypersphere normal prototype after the first stage parameter optimization are obtained.

[0027] The patterns of different normal events are learned through multiple hyperspheres. In the feature space, normal events are clustered near the center of each hypersphere. The multi-hypersphere center loss The detected event is brought closer to the center of the nearest hypersphere, resulting in loss of hypersphere separability. This makes the detected event farther away from the center of the second closest hypersphere, so that a better multi-hypersphere representation can be learned and the representation of the event can be optimized.

[0028] S4: The sequence encoder after the first stage parameter optimization is used to generate the event representation after the first stage optimization. The anomaly discriminator calculates the anomaly score of each event in the event sequence based on the event representation after the first stage optimization and the representation of the center of the multi-hypersphere in the normal prototype of the multi-hypersphere after the first stage parameter optimization, and obtains the prediction result of the event. The anomaly discriminator consists of a self-attention layer and a fully connected layer. The self-attention layer further enhances the representation ability of event features, and the fully connected layer is used to calculate the final anomaly discriminator score.

[0029] Specifically, the following method can be used to generate the event representation optimized in the first stage using the sequence encoder after the first stage parameter optimization. Based on the event representation optimized in the first stage and the representation of the center of the multi-hypersphere in the normal prototype of the multi-hypersphere after the first stage parameter optimization, the abnormality score of each event in the event sequence is calculated to obtain the event prediction result: S41: The embedding layer of the sequence encoder after the first stage parameter optimization projects the event into the embedding space to obtain the embedding vector after the first stage optimization; S42: Use a bidirectional gated recurrent unit to encode the event sequence according to formula (8) to generate the event representation after the first stage optimization: (8); in, represents the encoding of the event sequence after the first stage optimization, represents a bidirectional gated recurrent unit, Represent events respectively 、 ,..., The embedding vector after the first stage optimization, Indicates the number of events.

[0030] S43: Calculate the distance between the representation of each event in the event representation after the first stage optimization and the center of each hypersphere in the normal prototype of the multi-hypersphere after the first stage parameter optimization according to formula (9): (9); in: Indicates the first phase of the event representation after optimization Event to the normal prototype of the multi-hypersphere after the first stage parameter optimization The Euclidean distance between the centers of the hyperspheres, Indicates the first phase of the event representation after optimization The representation of an event, It represents the normal prototype of the multi-hypersphere after the first stage parameter optimization. The center of a hypersphere, represents the index of the hypersphere, Indicates calculation of Euclidean distance; S44: Based on the distance between the representation of each event in the event representation after the first stage optimization and the center of each hypersphere in the normal prototype of the multi-hypersphere after the first stage parameter optimization, the index of the nearest hypersphere center in the normal prototype of the multi-hypersphere after the first stage parameter optimization is calculated according to formula (10): (10); in: represents the index of the nearest hypersphere center in the multi-hypersphere normal prototype after the first stage parameter optimization for each event representation in the first stage optimized event representation, Represents the minimize operation, represents the total number of hyperspheres; S45: The anomaly discriminator calculates the deviation score of each event in the event sequence based on the nearest hypersphere center according to formula (11): (11); in: It represents the deviation score of each event in the event sequence from the nearest hypersphere center in the multi-hypersphere prototype after the first stage parameter optimization, Indicates the first event in the sequence events, represents a sequence of events, Indicates the first phase of the event representation after optimization The representation of an event, The distance to the event after the first stage optimization represents the center of the hypersphere in the normal prototype of the multi-hypersphere after the first stage parameter optimization; S46: Calculate the anomaly discriminator score of each event in the event sequence according to formula (12) through the anomaly discriminator: (12); in: represents the abnormality discriminator score for each event in the event sequence, represents the activation function, represents the weight matrix, Indicates the first stage after optimization and enhancement The event indicated that Indicates bias, Represents a matrix transpose operation; The self-attention layer of the anomaly discriminator is passed The event representation after the first stage optimization and self-attention layer enhancement can be obtained ,in The calculation of the self-attention layer further enhances the representation ability of event features; S47: Based on the deviation score of each event in the event sequence from the nearest hypersphere center in the multi-hypersphere prototype after the first stage parameter optimization and the abnormal discriminator score of each event in the event sequence, the abnormal score of each event in the event sequence is calculated according to formula (13): (13); in: represents the anomaly score of each event in the event sequence, represents the model parameters, represents the dual-score balance factor; S48: Compare the anomaly score of each event in the event sequence with the set threshold. If the anomaly score of each event in the event sequence is less than the set threshold, the prediction result of the event is judged to be normal. If the anomaly score of each event in the event sequence is greater than or equal to the set threshold, the prediction result of the event is judged to be abnormal.

[0031] S5: Perform multi-instance learning to obtain the prediction results of the event sequence based on the prediction results of the event, and introduce the event sequence-level label as a weak supervision signal. The prediction results of the event sequence and the event sequence-level label are used to train the sequence encoder, the normal prototype of the multi-hypersphere, and the abnormal discriminator after the first-stage parameter optimization, and obtain the sequence encoder, the normal prototype of the multi-hypersphere, and the abnormal discriminator after the second-stage parameter optimization.

[0032] Specifically, the following method can be used to obtain the prediction results of the event sequence based on the prediction results of the event: S51: Arrange the abnormal scores of events in the event sequence from high to low, and determine the previous Index of events: (14); in: Indicates the Before the event sequence The index of the event, Before calculation Function of an event, Indicates the A sequence of events, Indicates the Event sequence Anomaly score of events in ; S52: Based on Center front The index of an event is obtained according to formula (15): The prediction results are: (15); in: Indicates the The prediction results of a sequence of events, Indicates taking the absolute value.

[0033] Furthermore, the following method can be used to introduce event sequence-level labels as weak supervisory signals. The sequence encoder, normal prototype of multiple hyperspheres, and abnormal discriminator are trained using the event sequence prediction results and event sequence-level labels. The sequence encoder, normal prototype of multiple hyperspheres, and abnormal discriminator are obtained after parameter optimization in the second stage: S53: Introduce event sequence level labels as weak supervision signals, and use event sequence level labels and event sequence prediction results to calculate the loss function of the second stage according to formula (16): (16); in: represents the loss function of the second stage, represents a collection of event sequences, represents the number of event sequences, Indicates the event sequence-level labels; S54: With the goal of minimizing the loss function of the second stage, the sequence encoder, the normal prototype of the multi-hypersphere, and the abnormal discriminator after the parameters are optimized in the first stage are trained to obtain the sequence encoder, the normal prototype of the multi-hypersphere, and the abnormal discriminator after the parameters are optimized in the second stage.

[0034] After two stages of training, the sequence encoder, normal prototype of multiple hyperspheres, and abnormal discriminator overcome the limitation of the single-class learning paradigm that cannot exhaustively enumerate all normal patterns, providing a good unsupervised starting point; by introducing weak supervision signals at the sequence level and performing multi-instance learning, detection is made more robust, the boundaries between normal and abnormal events are made clearer, and more precise event representations can be learned, thereby providing more accurate auxiliary decision-making for intelligent operation and maintenance systems.

[0035] S6: The second-stage optimized event representation is generated by the sequence encoder after the second-stage parameter optimization. The second-stage optimized anomaly discriminator calculates the final anomaly score of each event in the event sequence based on the second-stage optimized event representation and the representation of the center of the multi-hypersphere in the second-stage optimized multi-hypersphere normal prototype, obtains the final prediction result of the event, screens abnormal events, and assists the manual decision-making of the intelligent operation and maintenance system.

[0036] Specifically, the following method can be used to obtain the final prediction result of the event: S61: The embedding layer of the sequence encoder after the second stage parameter optimization projects the event into the embedding space to obtain the embedding vector optimized in the second stage, and uses the bidirectional gated recurrent unit to encode the event sequence according to formula (17) to generate the event representation optimized in the second stage: (17); in, Represents the encoding of the event sequence after the second stage optimization, represents a bidirectional gated recurrent unit, Represent events respectively 、 ,..., The embedding vector after the second stage optimization, Indicates the number of events.

[0037] S62: Calculate the distance between the representation of each event in the event representation after the second stage optimization and the center of each hypersphere in the normal prototype of the multi-hypersphere after the second stage parameter optimization according to formula (18): (18); in: Indicates the event representation after the second stage optimization Event to the normal prototype of the multi-hypersphere after the second stage parameter optimization The Euclidean distance between the centers of the hyperspheres, Indicates the event representation after the second stage optimization The representation of an event, Indicates the normal prototype of the multi-hypersphere after the second stage parameter optimization. The center of a hypersphere, represents the index of the hypersphere, Indicates calculation of Euclidean distance; S63: Based on the distance between the representation of each event in the event representation after the second stage optimization and the center of each hypersphere in the normal prototype of the multi-hypersphere after the second stage parameter optimization, the index of the nearest hypersphere center in the normal prototype of the multi-hypersphere after the second stage parameter optimization is calculated according to formula (19): (19); in: represents the index of the nearest hypersphere center in the multi-hypersphere normal prototype after the second stage parameter optimization for each event representation in the second stage optimized event representation, Represents the minimize operation, represents the total number of hyperspheres; S64: The anomaly discriminator calculates the deviation score of each event in the event sequence from the nearest hypersphere center in the multi-hypersphere prototype after the second stage parameter optimization according to formula (20): (20); in: It represents the deviation score of each event in the event sequence from the nearest hypersphere center in the multi-hypersphere prototype after the second stage parameter optimization, Indicates the first event in the sequence events, represents a sequence of events, Indicates the event representation after the second stage optimization The representation of an event, The distance to the event after the second stage optimization represents the center of the hypersphere in the normal prototype of the multi-hypersphere after the second stage parameter optimization; The anomaly discriminator calculates the anomaly discriminator score of each event in the event sequence according to formula (21): (twenty one); in: represents the final anomaly discriminator score for each event in the event sequence, represents the activation function, represents the optimized weight matrix, Represents the first The event indicated that represents the optimized bias, Represents a matrix transpose operation; The self-attention layer of the anomaly discriminator is passed The event representation after the second stage optimization and self-attention layer enhancement can be obtained ,in The calculation of the self-attention layer further enhances the representation ability of event features.

[0038] Based on the deviation score of each event in the event sequence from the nearest hypersphere center in the multi-hypersphere prototype after the second-stage parameter optimization and the final anomaly discriminator score of each event in the event sequence, the final anomaly score of each event in the event sequence is calculated according to formula (22): (twenty two); in: represents the final anomaly score of each event in the event sequence, represents the optimized model parameters, represents the dual-score balance factor; S65: Compare the final anomaly score of each event in the event sequence with the set threshold. If the final anomaly score of each event in the event sequence is less than the set threshold, the final prediction result of the event is judged to be normal. If the final anomaly score of each event in the event sequence is greater than or equal to the set threshold, the final prediction result of the event is judged to be abnormal.

[0039] The event representation after the second-stage optimization is more accurate, and the representation of the centers of multiple hyperspheres in the normal prototype of multiple hyperspheres after the second-stage parameter optimization is more accurate. Therefore, abnormal events are screened by using the event representation after the second-stage optimization and the representation of the centers of multiple hyperspheres in the normal prototype of multiple hyperspheres after the second-stage parameter optimization. The screening results are more accurate and can more effectively assist the manual decision-making of the intelligent operation and maintenance system.

[0040] This paper validates the effectiveness of a weakly supervised event representation learning method for decision support. The method is evaluated on the CER r4.2 and CERT r5.2 datasets, which are widely used in the field of insider threat detection. The detailed information of the datasets is shown in Table 1: Table 1

[0041] We use the performance metrics of AUC (Area Under the ROC Curve), DR (Detection Rate), and FPR (False Positive Rate) to evaluate the performance of the proposed method. To ensure a fair comparison between methods, the same data partitioning was used.

[0042] Specifically, the experiments performed in the present invention include the following aspects: 1. Event-Level Anomaly Detection for Discrete Event Sequences: This paper compares 16 state-of-the-art methods, including DeepLog, TIRESIAS, FMLP, RNN, GRU, Transformer, RWKV, DIEN, BST, m-RNN, m-GRU, m-LSTM, m-Transformer, mFMLP, ITDBERT, and OC4Seq. DeepLog and TIRESIAS are two classic methods that approximate normal event sequences by learning to predict the next event in the context of a given event sequence. LSTM, RNN, GRU, Transformer, and RWKV are several widely popular sequence modeling architectures. DIEN and BST are two classic user behavior modeling methods. FMLP predicts future user behavior by filtering noise from historical user behavior data. m-RNN, m-GRU, m-LSTM, m-Transformer, and mFMLP learn to predict events at masked locations by using bidirectional RNNs, GRUs, LSTMs, Transformers, and FMLP. ITDBERT is an attention-based event-level detection method. OC4Seq embeds normal events into a hypersphere and detects anomalies by predicting the proximity of the event to the center of the hypersphere.

[0043] The specific event-level discrete event sequence anomaly detection data is shown in Table 2: Table 2

[0044] The results show that the proposed method outperforms other methods on both datasets, with the AUC and DR indicators improved and the FPR indicator decreased.

[0045] 2. Component Analysis Experiment: This is used to evaluate the contribution of each component in the present invention. The specific experimental results are shown in Table 3: Table 3

[0046] Experimental results demonstrate that our method achieves significant improvements across all metrics compared to training only on normal events using multiple hyperspheres, demonstrating the effectiveness of multi-instance learning. This suggests that introducing weakly supervised sequence-level annotations can effectively help the model distinguish between normal and abnormal events. Furthermore, our proposed method achieves superior metrics to those achieved using only multi-instance learning, demonstrating the effectiveness of training on normal events using multiple hyperspheres.

[0047] A weakly supervised event representation learning system for decision support is used to execute any of the above-mentioned weakly supervised event representation learning methods for decision support. The system structure diagram is shown in FIG. Figure 2As shown, Including sequence encoder, normal prototype of multiple hyperspheres and abnormal discriminator; The sequence encoder is used to convert the user's operation behavior on the operation and maintenance network into an event sequence and generate the initial event representation from the event sequence; the sequence encoder after the first stage parameter optimization is used to generate the event representation after the first stage optimization; the sequence encoder after the second stage parameter optimization is used to generate the event representation after the second stage optimization from the event sequence; The normal prototype of the multi-hypersphere includes multiple randomly set hypersphere centers; the normal prototype of the multi-hypersphere after the first stage parameter optimization includes multiple hypersphere centers optimized in the first stage; the normal prototype of the multi-hypersphere after the second stage parameter optimization includes multiple hypersphere centers optimized in the second stage; The anomaly discriminator is used to calculate the anomaly score of each event in the event sequence based on the event representation optimized in the first stage and the centers of the multiple hyperspheres in the normal prototype of the multiple hyperspheres after the first stage parameter optimization, and obtain the prediction result of the event; the anomaly discriminator after the second stage parameter optimization is used to calculate the final anomaly score of each event in the event sequence based on the event representation optimized in the second stage and the centers of the multiple hyperspheres in the normal prototype of the multiple hyperspheres after the second stage parameter optimization, and obtain the final prediction result of the event.

[0048] In summary, the present invention provides a weakly supervised event representation learning method and system for decision support. By constructing normal prototypes of multiple hyperspheres and training patterns of different normal events, and introducing weak supervision signals at the sequence level, multi-instance learning is performed to distinguish normal events from abnormal events in the intelligent operation and maintenance system, and effectively learn the feature representation of intelligent operation and maintenance events, thereby providing better assistance for the decision-making of the intelligent operation and maintenance system.

[0049] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A weakly supervised event representation learning method for decision support, characterized by: The steps include: S1: The user's operation behavior on the operation and maintenance network is converted into an event sequence, and the event sequence is used to generate the initial event representation using a sequence encoder; S2: Randomly set the centers of multiple hyperspheres to construct normal prototypes of multiple hyperspheres; S3: Taking the representation of the center of the multi-hypersphere in the normal prototype of the multi-hypersphere and the representation of the normal event in the initial event representation as input, the sequence encoder and the normal prototype of the multi-hypersphere are trained to obtain the sequence encoder and the normal prototype of the multi-hypersphere after the first stage parameter optimization; S4: The sequence encoder after the first stage parameter optimization is used to generate the event representation after the first stage optimization. The abnormality discriminator obtains the event prediction result based on the event representation after the first stage optimization and the representation of the center of the multi-hypersphere in the normal prototype of the multi-hypersphere after the first stage parameter optimization. S5: Perform multi-instance learning to obtain the prediction results of the event sequence based on the event prediction results, and introduce the event sequence level label as a weak supervision signal. The event sequence prediction results and event sequence level label are used to train the sequence encoder after the first stage parameter optimization, the normal prototype of the multi-hypersphere after the first stage parameter optimization, and the abnormal discriminator, and obtain the sequence encoder, normal prototype of the multi-hypersphere, and abnormal discriminator after the second stage parameter optimization; S6: The sequence encoder after the second-stage parameter optimization generates the event representation after the second-stage parameter optimization. The abnormality discriminator after the second-stage parameter optimization obtains the final prediction result of the event based on the event representation after the second-stage optimization and the representation of the center of the multi-hypersphere in the normal prototype of the multi-hypersphere after the second-stage parameter optimization, screens abnormal events, and assists the manual decision-making of the intelligent operation and maintenance system.

2. The weakly supervised event representation learning method for decision support according to claim 1, characterized in that: In step S1, the sequence encoder generates the initial event representation from the event sequence through two processes: event embedding and sequence context encoding.

3. The weakly supervised event representation learning method for decision support according to claim 2, characterized in that: The method of generating the initial event representation using the sequence encoder in step S1 is as follows: S11: The embedding layer of the sequence encoder projects the event into the embedding space and obtains the corresponding embedding vector; S12: Use a bidirectional gated recurrent unit to encode the event sequence according to formula (1) to generate the initial event representation: （1）； in, An encoding representing a sequence of events, represents a bidirectional gated recurrent unit, Represent events respectively 、 ,..., The embedding vector of Indicates the number of events.

4. The weakly supervised event representation learning method for decision support according to claim 1, characterized in that: In step S2, the normal prototype of the multi-hypersphere is constructed by the following method: Random Settings The center of the hypersphere is expressed as formula (2): （2）； in: represents the index of the hypersphere, represents a real number, Represents dimension, represents the center of the hypersphere, Represents the real number space.

5. The weakly supervised event representation learning method for decision support according to claim 1, characterized in that: In step S3, the following method is used to train the sequence encoder and the normal prototype of the multi-hypersphere to obtain the sequence encoder and the normal prototype of the multi-hypersphere after the first stage parameter optimization: S31: During the training process, the distance from the representation of each normal event in the initial event representation to the center of each hypersphere is calculated according to formula (3): （3）； in: Indicates the initial event representation Normal events to The Euclidean distance between the centers of the hyperspheres, Indicates the initial event representation A normal event, represents the center of the hypersphere, represents the index of the hypersphere, Indicates calculation of Euclidean distance; S32: Based on the distance from the representation of each normal event in the initial event representation to the center of each hypersphere, the index of the nearest hypersphere center from the representation of each normal event in the initial event representation is calculated according to formula (4): （4）； in: represents the index of the nearest hypersphere center to each normal event in the initial event representation, Represents the minimize operation, represents the total number of hyperspheres; S33: Calculate the multi-hypersphere center loss according to formula (5) based on the index of the nearest hypersphere center from the representation of each normal event in the initial event representation: （5）； in: represents the multi-hypersphere center loss, represents the normal sequence of events in the event sequence, represents the number of normal event sequence events in the event sequence, represents the center of the nearest hypersphere from the event representation, Indicates calculation of squared Euclidean distance; S34: Calculate the hypersphere separability loss according to formula (6): （6）； in: represents the hypersphere separability loss, Indicates the calculation of binary cross entropy loss, represents the exponential operation, represents the center of the hypersphere that is second closest to the representation of each normal event in the initial event representation, The index of the second closest hypersphere representing each normal event in the initial event representation; S35: Based on the multi-hypersphere center loss and hypersphere separability loss, the loss function of the first stage is calculated according to formula (7): （7）； in: represents the loss function of the first stage, represents the weight of the hypersphere separability loss; S36: Iterative training is performed with the goal of minimizing the loss function of the first stage to complete the first stage training of the sequence encoder and the multi-hypersphere normal prototype, and the sequence encoder and the multi-hypersphere normal prototype after the first stage parameter optimization are obtained.

6. The weakly supervised event representation learning method for decision support according to claim 1, characterized in that: In step S4, the prediction result of the event is obtained by the following method: S41: The embedding layer of the sequence encoder after the first stage parameter optimization projects the event into the embedding space to obtain the embedding vector after the first stage optimization; S42: Use a bidirectional gated recurrent unit to encode the event sequence according to formula (8) to generate the event representation after the first stage optimization: （8）； in, represents the encoding of the event sequence after the first stage optimization, represents a bidirectional gated recurrent unit, Represent events respectively 、 ,..., The embedding vector after the first stage optimization, Indicates the number of events; S43: Calculate the distance between the representation of each event in the event representation after the first stage optimization and the center of each hypersphere in the normal prototype of the multi-hypersphere after the first stage parameter optimization according to formula (9): （9）； in: Indicates the first phase of the event representation after optimization Event to the normal prototype of the multi-hypersphere after the first stage parameter optimization The Euclidean distance between the centers of the hyperspheres, Indicates the first phase of the event representation after optimization The representation of an event, It represents the normal prototype of the multi-hypersphere after the first stage parameter optimization. The center of a hypersphere, Indicates calculation of Euclidean distance; S44: Calculate the index of the nearest hypersphere center in the multi-hypersphere normal prototype after the first stage parameter optimization for each event representation in the first stage optimized event representation according to formula (10): （10）； in: represents the index of the nearest hypersphere center in the multi-hypersphere normal prototype after the first stage parameter optimization for each event representation in the first stage optimized event representation, Represents the minimize operation, represents the total number of hyperspheres; S45: The anomaly discriminator calculates the deviation score of each event in the event sequence based on the nearest hypersphere center according to formula (11): （11）； in: It represents the deviation score of each event in the event sequence from the nearest hypersphere center in the multi-hypersphere prototype after the first stage parameter optimization, Indicates the first event in the sequence events, represents a sequence of events, Indicates the first phase of the event representation after optimization The representation of an event, The distance to the event after the first stage optimization represents the center of the hypersphere in the normal prototype of the multi-hypersphere after the first stage parameter optimization; S46: Calculate the anomaly discriminator score of each event in the event sequence according to formula (12) through the anomaly discriminator: （12）； in: represents the abnormality discriminator score for each event in the event sequence, represents the activation function, represents the weight matrix, Indicates the first stage after optimization and enhancement The event indicated that Indicates bias, Represents a matrix transpose operation; S47: Calculate the anomaly score of each event in the event sequence according to formula (13): （13）； in: represents the anomaly score of each event in the event sequence, represents the model parameters, represents the dual-score balance factor; S48: Compare the anomaly score of each event in the event sequence with the set threshold. If the anomaly score of each event in the event sequence is less than the set threshold, the prediction result of the event is judged to be normal. If the anomaly score of each event in the event sequence is greater than or equal to the set threshold, the prediction result of the event is judged to be abnormal.

7. The weakly supervised event representation learning method for decision support according to claim 1, characterized in that: In step S5, the following method is used to obtain the prediction result of the event sequence based on the prediction result of the event: S51: Arrange the abnormal scores of events in the event sequence from high to low, and determine the previous Index of events: （14）； in: Indicates the Before the event sequence The index of the event, Before calculation Function of an event, Indicates the A sequence of events, Indicates the Event sequence Anomaly score of events in ; S52: Based on Center front The index of an event is obtained according to formula (15): The prediction results are: （15）； in: Indicates the The prediction results of a sequence of events.

8. The weakly supervised event representation learning method for decision support according to claim 7, characterized in that: In step S5, the following method is used to obtain the sequence encoder, normal prototype of the multi-hypersphere, and abnormal discriminator after the second stage parameter optimization: S53: Introduce event sequence level labels as weak supervision signals, and use event sequence level labels and event sequence prediction results to calculate the loss function of the second stage according to formula (16): （16）； in: represents the loss function of the second stage, represents a collection of event sequences, represents the number of event sequences, Indicates the event sequence-level labels; S54: With the goal of minimizing the loss function of the second stage, the sequence encoder, the normal prototype of the multi-hypersphere, and the abnormal discriminator after the parameters are optimized in the first stage are trained to obtain the sequence encoder, the normal prototype of the multi-hypersphere, and the abnormal discriminator after the parameters are optimized in the second stage.

9. The weakly supervised event representation learning method for decision support according to claim 1, characterized in that: In step S6, the final prediction result of the event is obtained by the following method: S61: Encode the event sequence using the sequence encoder after the second stage parameter optimization to generate the event representation after the second stage optimization; S62: calculating the distance between the representation of each event in the event representation optimized in the second stage and the center of each hypersphere in the normal prototype of the multi-hypersphere after the parameters are optimized in the second stage; S63: calculating the index of the nearest hypersphere center in the multi-hypersphere normal prototype after the second stage parameter optimization from each event representation in the event representation after the second stage optimization to each hypersphere center in the multi-hypersphere normal prototype after the second stage parameter optimization based on the distance between the representation of each event in the event representation after the second stage optimization and the center of each hypersphere in the multi-hypersphere normal prototype after the second stage parameter optimization; S64: Based on the event representation optimized in the second stage and the index of each event representation in the event representation optimized in the second stage to the nearest hypersphere center in the multi-hypersphere normal prototype after the second stage parameter optimization, calculate the final deviation score and the final anomaly discriminator score of each event based on the nearest hypersphere center, and further calculate to obtain the final anomaly score; S65: Screen abnormal events according to the final abnormality score to obtain the final prediction result of the event.

10. A weakly supervised event representation learning system for decision support, characterized by: Used to execute a weakly supervised event representation learning method for auxiliary decision-making according to any one of claims 1 to 9, comprising a sequence encoder, a normal prototype of multiple hyperspheres, and an abnormal discriminator; The sequence encoder is used to convert the user's operation behavior on the operation and maintenance network into an event sequence, and generate an initial event representation from the event sequence. The sequence encoder after the first-stage parameter optimization is used to generate the event representation after the first-stage optimization. The sequence encoder after the second-stage parameter optimization is used to generate the event representation after the second-stage optimization from the event sequence. The normal prototype of the multiple hyperspheres includes a plurality of randomly set hypersphere centers, the normal prototype of the multiple hyperspheres after the first stage parameter optimization includes the multiple hypersphere centers after the first stage parameter optimization, and the normal prototype of the multiple hyperspheres after the second stage parameter optimization includes the multiple hypersphere centers after the second stage parameter optimization; The anomaly discriminator is used to calculate the anomaly score of each event in the event sequence based on the event representation optimized in the first stage and the center of the multi-hypersphere in the normal prototype of the multi-hypersphere after the parameters are optimized in the first stage, so as to obtain the prediction result of the event; The anomaly discriminator after the second-stage parameter optimization is used to calculate the final anomaly score of each event in the event sequence based on the event representation optimized in the second stage and the center of the multi-hypersphere in the normal prototype of the multi-hypersphere after the second-stage parameter optimization, and obtain the final prediction result of the event.

Images