Abnormal behavior monitoring and early warning method based on spatio-temporal graph neural network, medium and device

Abstract

The present application relates to the technical field of abnormal behavior recognition, and more particularly to an abnormal behavior monitoring and early warning method based on a space-time graph neural network, medium and equipment, which converts abstract behavior data into a graph structure containing three kinds of nodes and three kinds of edges by extracting the object-space-time ternary relationship contained in the behavior data of the target monitoring object, and quantifies the correlation strength through the edge weight, and carries out deep feature extraction and embedding representation for the object, space and time nodes respectively, converts the abstract graph node into a high-dimensional vector rich in semantic information, and gradually integrates the spatial semantic features and the time dynamic features into the object behavior features, and finally generates a space-time enhanced representation vector that can reflect the individual behavior mode of the object and the influence of the space-time environment, breaking through the limitations of a single object node graph, solving the problems of insufficient behavior space-time context modeling and fragmented processing of spatial features and time features, and realizing accurate identification and early warning of space-time coupled abnormal behavior.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of abnormal behavior recognition, in particular to an abnormal behavior monitoring and early warning method based on a spatio-temporal graph neural network, a medium and equipment. BACKGROUND

[0002] In the fields of security monitoring, city management, financial anti-fraud, etc., abnormal behavior monitoring and early warning of specific target monitoring objects such as personnel, vehicles, and accounts is a core requirement. Existing technical solutions mainly follow two paradigms:

[0003] The first is a method based on object behavior sequence, which mainly analyzes the historical behavior data of the target object itself, for example, learns its behavior rules through a sequence model, and determines the abnormality based on the deviation from the rules. However, this method completely ignores the environmental context of the behavior, resulting in a high false alarm rate. For example, the login behavior of a to-be-detected object during office hours is very different from the login behavior in the middle of the night in a non-office area, but this method cannot distinguish between the two.

[0004] The second is a method based on object association graph, which uses graph neural network technology to construct a relationship graph with the target object as the node, and discovers abnormal groups by analyzing the social, transaction, and other association relationships between objects. Although it can capture coordinated abnormalities, the model is essentially static and spatially unaware, and cannot analyze the key issue of when and where the associated behavior occurs. For example, multiple to-be-detected objects appear around a sensitive facility at night, and this method may miss them because there is no direct social association between the to-be-detected objects.

[0005] Therefore, existing technologies analyze behavior subjects, behavior spaces, and behavior times separately, and fail to establish a unified model to describe the complex dependency relationship between the "who-when-where" triplets, resulting in a lack of effective identification capability for extremely hidden and high-risk abnormal behaviors that may appear harmless individually but are extremely unusual when combined with time and space.

[0006] How to break through the limitations of existing monitoring methods in modeling the behavior spatio-temporal context, and provide a method that can deeply integrate object, space, and time information to accurately identify abnormal behavior patterns that only appear in a specific spatio-temporal context has become a problem to be solved. SUMMARY

[0007] To solve the above technical problems, the technical solution adopted by the present application is an abnormal behavior monitoring and early warning method based on a spatio-temporal graph neural network, which includes the following steps:

[0008] S100, constructing a ternary behavior graph containing object nodes, space nodes and time nodes according to the behavior data of each target monitoring object, wherein the ternary behavior graph includes space access edges between the object nodes and the space nodes, time correlation edges between the object nodes and the time nodes, space-time active edges between the space nodes and the time nodes, and weights of each space access edge, time correlation edge and space-time active edge.

[0009] S200, respectively performing feature embedding on each object node, space node and time node to obtain corresponding object behavior feature vectors, space semantic feature vectors and time context feature vectors.

[0010] S300, updating the object behavior feature vectors of each object node by using a preset space-time graph neural network according to the ternary behavior graph, the space semantic feature vectors and the time context feature vectors, and obtaining space-time enhanced representation vectors reflecting the behavior patterns of each target monitoring object in a specific space-time environment.

[0011] S400, obtaining the behavior recognition type and the early warning mode corresponding to each target monitoring object according to the similarity between the space-time enhanced representation vectors of each target monitoring object and a preset abnormal feature template vector, wherein the behavior recognition type is abnormal behavior or non-abnormal behavior, and the early warning mode is early warning or no early warning.

[0012] The application further provides a non-transitory computer-readable storage medium, and the non-transitory computer-readable storage medium stores at least one instruction or at least one program.

[0013] The application further provides an electronic device, which comprises a processor and the non-transitory computer-readable storage medium.

[0014] The present application has at least the following beneficial effects: by uniformly abstracting multi-source heterogeneous data into a graph structure containing node attributes and weighted edges, a unified representation space capable of simultaneously depicting entity features and relationship strength is provided for the graph neural network, laying a data foundation for mining complex collaborative behavior patterns from a network global perspective; through a multi-layer iterative, edge weight-based message passing mechanism, the feature representation of each node can continuously integrate the weighted information of its multi-order neighbors, thereby expanding the local direct association into a global potential network pattern representation, achieving enhancement of the deep features of the nodes; by performing similarity calculation and graph clustering analysis in the node high-order embedding space, nodes with similar behavior patterns and similar structural roles in the network can be automatically collected into communities, thereby accurately revealing potential risk groups with highly coordinated behavior but no strong direct connection, realizing the leap from individual identification to group mining; by comparing the high-order feature representation of the object to be identified with the historical abnormal pattern template, accurate and interpretable identification and classification of abnormal behavior are achieved, thereby not only determining individual abnormalities, but also identifying entire collaborative abnormal groups and their specific behavior patterns, significantly improving the accuracy of the identification results. BRIEF DESCRIPTION OF DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0016] Figure 1 A flowchart of an abnormal behavior monitoring and early warning method based on a spatio-temporal graph neural network provided for the first embodiment of the present application. DETAILED DESCRIPTION

[0017] The technical solutions in the embodiments of the present application will be described clearly and completely in the following with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the present application.

[0018] It should be noted that the terms first, second, etc. in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It can be understood that the above-described terms for distinguishing similar objects can be interchanged under appropriate circumstances, so that the present application can also be implemented in other embodiments in addition to the above-described embodiment or described embodiment. In addition, the terms include and have and any variation are intended to cover non-exclusive inclusion, for example, a process, method, system, product or server including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0019] Embodiment one

[0020] The embodiment one provides an abnormal behavior monitoring and early warning method based on a spatio-temporal graph neural network, as shown in the figure, the abnormal behavior monitoring and early warning method based on the spatio-temporal graph neural network comprises the following steps: Figure 1 As shown in the figure, the abnormal behavior monitoring and early warning method based on the spatio-temporal graph neural network comprises the following steps:

[0021] S100, according to the behavior data of each target monitoring object, a ternary behavior graph containing object nodes, space nodes and time nodes is constructed, wherein the ternary behavior graph includes space access edges between object nodes and space nodes, time correlation edges between object nodes and time nodes, spatio-temporal active edges between space nodes and time nodes, and the weight of each space access edge, time correlation edge and spatio-temporal active edge.

[0022] Wherein, the target monitoring object is a specific subject in the abnormal behavior monitoring and early warning method, which needs to be continuously tracked and analyzed its behavior data to judge whether there is an abnormality, such as "account with transaction behavior" in the financial risk control scene, "personnel entering the key area" in the public security scene, and not the subject irrelevant outside the scene. The target monitoring object has a unique identification (such as ID, number, feature code, etc.), which ensures that it can be distinguished from other objects, such as "user ID" of the account in the financial scene, "identity number" of the personnel in the public security scene, and "license plate number" of the vehicle in the intelligent transportation scene. The behavior data generated by the target monitoring object can be collected through sensors, system logs, monitoring devices, business databases and other devices, as the basic data source for subsequent construction of ternary behavior graph and analysis of abnormalities.

[0023] The object node is a node in the graph representing the target monitoring object, and each object node uniquely corresponds to a target monitoring object. By extracting all independent target monitoring objects in the behavior data, a unique object identifier is assigned to each object to form an object node set.

[0024] A spatial node is a node representing a physical or logical location where behavior occurs. One spatial node can correspond to an exact coordinate or a region, which is used to provide the spatial context of behavior and distinguish the influence of different location environments on behavior abnormality (such as non-public areas and public areas). By hierarchically encoding the location information of behavior occurrence in behavior data (such as physical address -> area division -> spatial ID), a set of spatial nodes is formed.

[0025] A time node is a node representing a time segment (such as an hour segment, a date type, and a holiday identifier) where behavior occurs. By mapping a timestamp to a time unit (such as 2023-10-01 10:00-11:00 this hour), continuous time is discretized to facilitate modeling and time series analysis, which is used to provide the temporal context of behavior and distinguish the influence of different time periods on behavior abnormality (such as night and day). By dividing the granularity of time information of behavior occurrence in behavior data (such as dividing by hour into 00:00-01:00, 01:00-02:00, or dividing by type into weekday daytime, holiday night), a set of time nodes is formed.

[0026] A spatial access edge connects an object node and a spatial node, indicating that the corresponding target monitoring object has behavior in the corresponding space, recording the mobility and spatial preference of the target monitoring object.

[0027] A time association edge connects an object node and a time node, indicating that the corresponding target monitoring object has behavior in the corresponding time, recording the time activity pattern of the target monitoring object.

[0028] A spatio-temporal activity edge connects a spatial node and a time node, indicating the overall behavior activity level of the corresponding space in the corresponding time, recording the time pattern of the place, which is a key to discovering regional abnormalities (such as high-frequency activities in non-active periods).

[0029] By associating the frequency and intensity of the three in behavior data, a weight representing the relationship intensity is assigned to each edge, making the graph structure upgrade from binary to weighted graph, which can distinguish the difference in association intensity and provide a basis for weight allocation in subsequent feature fusion.

[0030] As described above, by extracting the “object-space-time” three-way relationship contained in the behavior data of the target monitoring object, the abstract behavior data is converted into a graph structure containing object, space, and time nodes and spatial access, time association, and spatio-temporal activity edges. By quantifying the association strength through edge weights, the limitations of traditional single object node graphs are broken, and a three-way association model that can reflect “who (object) behaves where (space) at what time (time)” is constructed, providing a structured basis for subsequent spatio-temporal feature fusion.

[0031] In a specific embodiment, S100 includes the following steps:

[0032] S110, obtain behavior data of each target monitoring object, wherein the behavior data comprises object identification, behavior occurrence geographical position, behavior occurrence time stamp and behavior type.

[0033] S120, taking the target monitoring object as an object node, taking the behavior occurrence geographical position as a space node, and taking the time unit to which the behavior occurrence time stamp belongs as a time node.

[0034] S130, constructing a space access edge between the object node and the space node, a time correlation edge between the object node and the time node, and a space-time active edge between the space node and the time node according to the behavior data of each target monitoring object.

[0035] S140, obtaining the weight of each space access edge, time correlation edge and space-time active edge according to the behavior data of each target monitoring object.

[0036] S150, constructing a ternary behavior graph according to all object nodes, space nodes and time nodes, and all space access edges, time correlation edges and space-time active edges and corresponding weights.

[0037] The object identification uniquely identifies a target monitoring object. The behavior occurrence geographical position is the longitude and latitude or geographic code of the behavior occurrence place, which serves as the basis for the space node. The behavior occurrence time stamp is the precise time of the behavior occurrence, which serves as the basis for the association to the time node. The behavior type is the category of the behavior (such as login, transaction, movement), which is used for subsequent feature generation and weight calculation.

[0038] Based on the actual association of objects, spaces and times in the behavior data, the connection relationship between the three types of nodes is established, and the interaction of the three elements is intuitively presented. And through the quantitative index to evaluate the correlation strength of the three types of edges, the graph can not only reflect whether there is correlation, but also reflect the correlation strength, which provides the basis for the subsequent weight allocation of feature fusion.

[0039] The above, by standardizing the analysis of the original behavior data, the core elements required for constructing the graph are extracted, ensuring the standardization and consistency of the data source, and providing reliable input for the subsequent automatic graphing process; by abstracting specific behavior instances into nodes in the graph, and systematically constructing three types of relationship edges, a full connection network between objects, spaces and times is established, so that the spatio-temporal integrity of the behavior data is presented in the ternary behavior graph; by assigning dynamic calculated weights to the edges, the ternary behavior graph can distinguish the strength of the relationship, so as to more finely depict the behavior pattern, and provide a key input for the weighted information aggregation in the subsequent graph neural network, which significantly improves the sensitivity of the model perception.

[0040] In an embodiment, S130 comprises the following steps:

[0041] S131, for any object node, when the target monitoring object corresponding to the object node has behavior in the behavior occurrence geographical position corresponding to any space node, a space access edge is established between the object node and the space node.

[0042] S132, when the target monitoring object corresponding to the object node has behavior in the time unit corresponding to any time node, a time association edge is established between the object node and the time node.

[0043] S133, for any space node, when the behavior occurrence geographical position corresponding to the space node has behavior in the time unit corresponding to any time node, a space-time active edge is established between the space node and the time node.

[0044] The space access edge is a direct embodiment of the object-space relationship and constitutes the basis of the object movement track and the space preference. As long as an object has behavior in a place, a connection is established, which intuitively records the object's footprint.

[0045] The time association edge is a direct embodiment of the object-time relationship and constitutes the basis of the object time activity rule (such as the habit of work and rest). By associating the behavior of an object to the time period in which it occurs, the active time of the object is recorded.

[0046] The space-time active edge connects the space node and the time node, represents whether a certain place is active in a certain time period, and describes the space-time mode of the environment itself. By mining the inherent association between space and time, the behavior of the object is no longer directly described, but the attribute of the place in time is described, and the space-time background is constructed.

[0047] The above, by establishing a space access edge for each object-geographical position pair, the space activity track of each object is accurately recorded, which provides the most direct data basis for analyzing the activity range of individuals and the spatial aggregation of groups; by establishing a time association edge for each object-time unit pair, the time activity rule of each object is clearly described, which lays the foundation for identifying abnormal time behavior; by establishing a space-time active edge, the inherent activity level of different geographical positions in different time periods is independently described, which provides a key context benchmark for subsequent judgment of whether the behavior of a certain object at a certain place-time point is abnormal to the normality of the place-time, greatly enhancing the ability to discover context anomalies.

[0048] In an embodiment, S140 comprises the following steps:

[0049] S141, for any spatial access edge, according to the first behavior frequency of the target monitoring object in the corresponding behavior occurrence geographical position, the weight of the current spatial access edge is obtained.

[0050] S142, for any time correlation edge, according to the second behavior frequency of the target monitoring object in the corresponding time unit, the weight of the current time correlation edge is obtained.

[0051] S143, for any space-time active edge, according to the third behavior frequency of the corresponding behavior occurrence geographical position of the target monitoring object in the corresponding time unit, the weight of the current space-time active edge is obtained.

[0052] Wherein, the first behavior frequency is the total number of behaviors of the target monitoring object occurring in this specific geographical position. The more frequently an object visits a place, the more important the place is to the target monitoring object, or the stronger the association between the target monitoring object and the place.

[0053] The second behavior frequency is the total number of behaviors of the target monitoring object occurring in this specific time unit. The more frequently a target monitoring object behaves in a certain period of time, the more active and the stronger the association in that period of time.

[0054] The third behavior frequency is the total number of behaviors of all target monitoring objects occurring in this specific geographical position and specific time unit. The more behaviors a place occurs in a certain period of time, the more active the place is in that period of time.

[0055] The above, by taking the access frequency as the weight of the spatial access edge, the model can distinguish between frequently visited places and occasional visited places, and can pay more attention to high-frequency and stable spatial associations during analysis; by taking the behavior frequency as the weight of the time correlation edge, the model can capture the core active period of the object, and provide a quantitative index for identifying changes in its work and rest rules; by taking the global behavior frequency as the weight of the space-time active edge, the popularity of each place-time combination is quantified, providing an objective, group behavior-based space-time background benchmark for the system.

[0056] S200, according to the behavior data, respectively embedding each object node, space node and time node to obtain the corresponding object behavior feature vector, space semantic feature vector and time context feature vector.

[0057] Wherein, by extracting multi-dimensional attribute data related to the node and converting it into a machine-readable numerical vector, each node has a specific, distinguishable semantic meaning, providing a basis for subsequent graph neural network deep semantic understanding and reasoning.

[0058] The above, by extracting and embedding the depth features of the three types of nodes of objects, spaces and times, the abstract graph nodes are converted into high-dimensional vectors rich in semantic information, greatly enhancing the knowledge representation ability of the graph atlas, and providing important feature input for the model to learn complex spatio-temporal behavior semantic patterns from data.

[0059] In a specific embodiment, S200 includes the following steps:

[0060] S210, according to the behavior data corresponding to each object node, extracting the first feature data corresponding to each object node, and converting the first feature data into the corresponding object behavior feature vector, wherein the first feature data at least includes the behavior type, the fourth behavior frequency, the behavior duration and the historical behavior association.

[0061] S220, extracting the second feature data corresponding to each space node, and converting the second feature data into the corresponding space semantic feature vector, wherein the second feature data at least includes the geographic position coordinates, the regional function classification, the historical risk label and the surrounding POI distribution.

[0062] S230, extracting the third feature data corresponding to each time node, and converting the third feature data into the corresponding time context feature vector, wherein the third feature data at least includes the time period type, the average behavior duration in the time period, the behavior occurrence frequency and the behavior association degree with adjacent time periods.

[0063] The behavior attributes and historical patterns of the target monitoring object are extracted to convert the behavior features of the object into vector form, and the quantitative representation of the object behavior pattern is realized. Specifically, the behavior type is the category distribution of the operations performed by the object, such as login, query and transaction, which reflects the behavior preference through embedding coding. The fourth behavior frequency is the total number of behaviors of the object node in the global or specific time window, which reflects the overall activity. The behavior duration is the duration of a single behavior or the average behavior, which helps to distinguish behaviors of different natures, such as short queries and long browsing. The historical behavior association is the association degree of the current behavior and the historical behavior, or the behavior sequence features extracted based on a sequence model (such as RNN), which is used to capture the continuity and evolution pattern of the behavior.

[0064] The extracted first feature data is standardized (such as normalized to the [0, 1] interval, classification feature one-hot encoding, etc.), and the multi-dimensional features are mapped to fixed-dimensional vectors (such as 128-dimensional) through an embedding layer (such as a fully connected neural network), to obtain the object behavior feature vector. Those skilled in the art know that any fully connected neural network in the prior art falls within the protection scope of the present application, and will not be repeated here.

[0065] By extracting the geographical attributes and environmental characteristics of spatial nodes, the semantic information of space is converted into vector form, realizing the quantitative representation of the characteristics of the space environment. Specifically, the geographical position coordinates are the absolute position of the space, which is usually converted into a vector through GeoHash or sine-cosine encoding, preserving the spatial proximity. The regional function classification is the use of the region, such as residential, commercial, industrial, as a key context for judging the rationality of behavior. The historical risk label is whether the region has been marked as a high-crime area, fraud concentration area, etc. in history. The surrounding POI distribution is the type and density of interest points (such as banks, internet cafes, hotels) around the region, further refining the environmental characteristics of the region.

[0066] The extracted second feature data is standardized and converted into a fixed-dimensional vector through an embedding layer to obtain a spatial semantic feature vector.

[0067] By extracting the attributes and behavior patterns of time nodes, the context information of time is converted into vector form, realizing the quantitative representation of the characteristics of time and the association of behavior. Specifically, the time period type, such as weekdays / weekends, daytime / nighttime, holidays, etc., reflects the social and business attributes of time. The average duration of behavior within the time period is the average duration of all behaviors or specific behaviors within the time unit, reflecting the typical pattern of behavior in that period, such as shorter transaction duration at night. The behavior occurrence frequency is the total number of behaviors occurring within the time unit, reflecting the general level of activity in that period. The behavior association degree with adjacent time periods is the similarity or transition probability of the current time period and the previous / next time period in terms of behavior pattern, used to capture the periodicity and evolution of behavior.

[0068] The extracted third feature data is standardized and converted into a fixed-dimensional vector through an embedding layer to obtain a time context vector.

[0069] As mentioned above, by integrating behavior type, frequency, duration, and sequence association, a comprehensive feature vector is generated that can fully depict individual behavior habits and patterns, providing a fine-grained semantic basis for distinguishing objects with different behavior characteristics. By integrating coordinates, functions, risks, and environmental multi-source geographic information, a semantic-rich spatial embedding vector is generated, enabling the model to understand the function and risk of a location, rather than just its position, providing deep semantic support for identifying spatial context anomalies. By integrating time period type, behavior intensity, duration, and time sequence association features, a context vector is generated that can depict the regularity and evolution of time, enabling the model to perceive the semantics of time itself, providing key features for identifying time regularity deviations and abnormal time sequence patterns.

[0070] S300, updating the object behavior feature vector of each object node by using a preset spatio-temporal graph neural network according to the ternary behavior graph, the space semantic feature vector and the time context feature vector, and obtaining a spatio-temporal enhanced representation vector reflecting the behavior mode of each target monitoring object in a specific spatio-temporal environment.

[0071] The space semantic feature and the time context feature are integrated into the object behavior feature in stages by the preset spatio-temporal graph neural network, and finally a spatio-temporal enhanced representation vector reflecting the behavior mode of the object in a specific spatio-temporal environment is generated, thereby breaking through the limitation of the traditional static graph model, realizing dynamic fusion of object, space and time features, and enabling the feature vector to contain individual behavior mode and spatio-temporal environment influence at the same time.

[0072] In a specific embodiment, the preset spatio-temporal graph neural network includes a space feature aggregation module, a time feature aggregation module and a cross-modal fusion module, wherein the space feature aggregation module uses a graph attention network, the time feature aggregation module uses a gated recurrent unit, and the cross-modal fusion module uses a spatio-temporal attention fusion network, and S300 includes the following steps:

[0073] S310, weighting and aggregating the object behavior feature vector of each object node and the space semantic feature vector of the connected space node by using the space feature aggregation module and the weight of the space access edge in the ternary behavior graph, to obtain an object-space fusion feature vector corresponding to each object node.

[0074] S320, time series aggregation of the object-space fusion feature vector corresponding to each object node and the time context feature vector of the connected time node according to the time sequence by using the time feature aggregation module and the weight of the time correlation edge in the ternary behavior graph, to obtain an object-time space fusion feature vector corresponding to each object node.

[0075] S330, attention mechanism weighting of the object-time space fusion feature vector corresponding to each object node by using the cross-modal fusion module and the weight of the spatio-temporal active edge in the ternary behavior graph, to obtain a spatio-temporal enhanced representation vector reflecting the behavior mode of each target monitoring object in a specific spatio-temporal environment.

[0076] The spatial feature aggregation module is responsible for capturing the spatial behavior pattern of the object. By using a graph attention network, each object node pays attention to each spatial node connected thereto. The object node dynamically calculates the attention weight according to the weight (access frequency) of the spatial access edge and the semantic feature (such as the risk label) of the spatial node itself, and then aggregates the information of the spatial nodes in a weighted manner, so as to integrate the semantic information of the activity track and the frequently visited place into the original object behavior feature, and obtain the corresponding object-space fusion feature vector. For example, after the behavior feature of a user is fused with the feature of a high-risk business district, the vector will carry the corresponding risk implication.

[0077] The time feature aggregation module is responsible for capturing the time evolution rule of the object behavior. By arranging the object-space fusion feature vectors of each object node in different time slices in time sequence, a time sequence is formed, and then a gated recurrent unit is used to learn the evolution rule of the sequence. The gating mechanism of the gated recurrent unit can determine how much historical information to remember, how much old information to forget, and how much new information to add, so as to further integrate the behavior change trend in the time dimension on the basis of the spatial fusion, and obtain the corresponding object-space-time fusion feature vector. For example, the object-space-time fusion feature vector can represent that the activity range of a user is gradually expanding, or that the transaction time is becoming increasingly abnormal.

[0078] The cross-modal fusion module is responsible for comprehensively evaluating the contribution of different spatio-temporal contexts to the final behavior judgment. By using a spatio-temporal attention fusion network, the importance weight of each object node in different place-time combinations (i.e., spatio-temporal active edges) is calculated, and a spatio-temporally enhanced representation vector is obtained as the object representation after spatio-temporal attention weighting adjustment, which emphasizes the spatio-temporal context most related to the object anomaly and weakens the irrelevant context.

[0079] As described above, the spatial semantic features are aggregated by the graph attention network, so that the object node can adaptively absorb the geographical context information according to the association strength with different places, thereby enhancing the perception ability of the model to the spatial behavior preference of the object. The time sequence behavior features are modeled by the gated recurrent unit, so that the model can capture the dynamic evolution process of the object behavior pattern, thereby being able to identify the behavior that is not significant at a single time point but presents an abnormal trend in the time line. The fused features are finally calibrated by the spatio-temporal attention mechanism, so that the model can focus on the key spatio-temporal scene most related to the abnormal behavior, thereby generating a spatio-temporally enhanced representation vector with extremely strong discrimination, and greatly improving the precision and robustness of the abnormal identification link.

[0080] S400, according to the similarity degree between the space-time enhanced feature vector of each target monitoring object and the preset abnormal feature template vector, obtaining the behavior recognition type and the early warning mode corresponding to each target monitoring object, wherein the behavior recognition type is an abnormal behavior or a non-abnormal behavior, and the early warning mode is to perform early warning or not to perform early warning.

[0081] The abnormal feature template library is constructed based on the space-time enhanced feature vectors of historical abnormal behaviors, and the similarity degree between the space-time enhanced feature vector of the to-be-detected object and the abnormal feature template vector is compared to determine whether the behavior of the to-be-detected object is abnormal and to determine the early warning mode. The historical abnormal mode is associated with the current behavior feature, and accurate identification and early warning of the space-time coupled abnormal behavior are achieved.

[0082] In a specific embodiment, S400 includes the following steps:

[0083] S410, clustering the space-time enhanced feature vectors of a plurality of historical abnormal behaviors to obtain a plurality of abnormal feature template vectors, wherein each abnormal feature template vector corresponds to an abnormal behavior mode.

[0084] S420, comparing the space-time enhanced feature vector of each target monitoring object with each abnormal feature template vector to obtain the behavior recognition type and the early warning mode corresponding to each target monitoring object.

[0085] The historical abnormal behavior sample is a behavior record that occurs in the past and shows significant differences compared with the normal behavior mode. The behavior sample labeled as abnormal can be screened from the historical operation data of an actual business scene, for example, an abnormal transaction behavior screened from a bank transaction log, a suspicious personnel behavior screened from a security system log, and a rule violation driving record behavior screened from a toll gate log. Any method for obtaining a historical abnormal behavior in the prior art known to those skilled in the art falls within the protection scope of the present application, and will not be described here.

[0086] The samples of the same type of abnormal behavior have high similarity in the key feature dimension, and the abnormal behavior and the normal behavior have a significant gap in the core feature dimension. Taking a financial risk control scene as an example: if the feature space includes three core dimensions of “transaction time deviation degree”, “transaction location risk value”, and “transaction frequency”, the feature vector of the “late-night cross-border large-amount transaction” type of abnormal sample will be clustered in the “high transaction time deviation degree (late night)”, “high transaction location risk value (overseas)”, and “low transaction frequency (single large amount)” regions to form an independent cluster; and the “inland multi-account small-amount brushing” type of abnormal sample will be clustered in the “low transaction time deviation degree (daytime)”, “low transaction location risk value (inland)”, and “high transaction frequency (multiple small amounts)” regions to form another independent cluster.

[0087] By clustering the time-space enhanced representation vectors of several historical abnormal behaviors, several clusters are formed, each of which represents a typical abnormal behavior pattern. Through the clustering algorithm, the typical abnormal behavior pattern can be found, and the templates are formed in the form of cluster centers, and several abnormal feature template vectors are obtained.

[0088] Any clustering algorithm in the prior art falls within the protection scope of the present application, and will not be described here.

[0089] In a specific embodiment, S420 includes the following steps:

[0090] S421, for any target monitoring object, calculating the similarity between the time-space enhanced representation vector of the current target monitoring object and each preset abnormal feature template vector;

[0091] S422, if the similarity between the current target monitoring object and any preset abnormal feature template vector is greater than the preset similarity threshold, determining that the behavior recognition type corresponding to the current target monitoring object is abnormal behavior, determining that the abnormal type corresponding to the current target monitoring object is the abnormal behavior pattern corresponding to the abnormal feature template vector, and determining that the warning mode is to perform warning;

[0092] S423, if the similarity between the current target monitoring object and each preset abnormal feature template vector is less than or equal to the preset similarity threshold, determining that the behavior recognition type corresponding to the current target monitoring object is non-abnormal behavior, and determining that the warning mode is not to perform warning.

[0093] The similarity is usually calculated by using a cosine similarity or other measurement method to measure the consistency of the two vectors in the direction. The closer the value is to 1, the more similar the behavior patterns are. The higher the preset similarity threshold is, the more conservative the determination is, and the possibility of false negatives increases. The lower the preset similarity threshold is, the more relaxed the determination is, and the possibility of false positives increases. The specific value can be set by the implementer according to the actual situation. In the present embodiment, 0.7 is preferred.

[0094] As described above, by clustering the deep features of historical abnormal cases, several representative abnormal behavior pattern templates are extracted, and the dispersed case knowledge is converted into systematic and reusable detection criteria, providing accurate comparison basis for online real-time detection. By calculating the similarity between the to-be-detected object and each abnormal template, the abstract behavior abnormality problem is converted into a quantifiable numerical comparison problem, providing objective and unified data support for subsequent threshold decision-making, realizing rapid and automatic abnormal screening of large-scale target monitoring objects, and ensuring the efficiency of the identification process.

[0095] The above, by extracting the "object-space-time" ternary relationship contained in the target monitoring object behavior data, the abstract behavior data is converted into a graph structure containing three nodes of object, space and time and three edges of space access, time correlation and space-time activity, and the correlation strength is quantified through the edge weight, which breaks through the limitation of the traditional single object node graph and constructs a ternary correlation model that can reflect "who (object) behaves at what time (time) and where (space)"; by respectively performing deep feature extraction and embedding representation on the three types of nodes of object, space and time, the abstract graph nodes are converted into high-dimensional vectors rich in semantic information, which greatly enhances the multidimensional representation ability of the graph; by integrating the spatial semantic features and the temporal dynamic features into the object behavior features in stages, the finally generated space-time enhanced representation vector can reflect the individual behavior pattern of the object and the space-time environmental influence, solves the problems of insufficient behavior space-time context modeling and fragmented processing of spatial features and temporal features, effectively captures the when-where-who collaborative abnormal pattern, and realizes the accurate identification and early warning of the space-time coupled abnormal behavior.

[0096] Embodiment two

[0097] The embodiment two of the present application provides a non-transitory computer readable storage medium, which can be arranged in an electronic device to save at least one instruction or at least one program related to a method in the method embodiment, and the at least one instruction or the at least one program is loaded and executed by the processor to realize the abnormal behavior monitoring and early warning method based on the space-time graph neural network provided in the above embodiment.

[0098] Embodiment three

[0099] The embodiment three of the present application provides an electronic device, which comprises a processor and the non-transitory computer readable storage medium in the embodiment two of the present application.

[0100] The above is only a preferred embodiment of the present application, and does not limit the present application in any form. Although the present application has been disclosed as above, it is not intended to limit the present application. Any skilled person in the art can make some changes or modifications to the above disclosed technical content to obtain equivalent embodiments with equivalent changes, as long as the changes do not deviate from the technical solution of the present application. Any simple modification, equivalent change and modification of the above embodiments according to the technical essence of the present application are still within the scope of the technical solution of the present application.

Claims

1. A method for monitoring and early warning of abnormal behavior based on spatiotemporal graph neural networks, characterized in that, The method includes the following steps: S100, based on the behavioral data of each target monitoring object, construct a ternary behavioral graph containing object nodes, spatial nodes, and temporal nodes. The ternary behavioral graph includes spatial access edges between object nodes and spatial nodes, temporal association edges between object nodes and temporal nodes, and spatiotemporal activity edges between spatial nodes and temporal nodes, as well as the weights of each spatial access edge, temporal association edge, and spatiotemporal activity edge. The weight of the spatial access edge is determined based on the first behavior frequency of the corresponding target monitoring object in the corresponding behavior geographical location. The weight of the temporal association edge is determined based on the second behavior frequency of the corresponding target monitoring object in the corresponding time unit. The weight of the spatiotemporal activity edge is determined based on the third behavior frequency of the corresponding behavior geographical location in the corresponding time unit. S200: Based on the behavioral data, feature embedding is performed on each object node, spatial node and temporal node to obtain the corresponding object behavior feature vector, spatial semantic feature vector and temporal context feature vector; S300, based on the ternary behavior graph, the spatial semantic feature vector, and the temporal context feature vector, a preset spatiotemporal graph neural network is used to update the object behavior feature vector of each object node, thereby obtaining a spatiotemporal enhanced representation vector reflecting the behavior pattern of each target monitoring object in the corresponding spatiotemporal environment. The preset spatiotemporal graph neural network includes a spatial feature aggregation module, a temporal feature aggregation module, and a cross-modal fusion module. The spatial feature aggregation module is used to aggregate spatial semantic features based on the weights of the spatial access edges. The temporal feature aggregation module is used to aggregate temporal context features based on the weights of the temporal association edges. The cross-modal fusion module is used to perform attention-based weighted fusion based on the weights of the spatiotemporally active edges. S400: Based on the similarity between the spatiotemporal enhanced representation vector of each target monitoring object and the preset abnormal feature template vector, obtain the behavior recognition type and early warning mode corresponding to each target monitoring object, wherein the behavior recognition type is abnormal behavior or non-abnormal behavior, and the early warning mode is to issue an early warning or not issue an early warning.

2. The abnormal behavior monitoring and early warning method based on spatiotemporal graph neural network according to claim 1, characterized in that, S100 includes the following steps: S110, acquire behavioral data for each target monitoring object, wherein the behavioral data includes object identifier, geographical location of behavior occurrence, timestamp of behavior occurrence, and behavior type; S120 uses the target monitoring object as the object node, the geographical location where the behavior occurs as the spatial node, and the time unit to which the timestamp of the behavior occurs belongs as the time node; S130, based on the behavioral data of each target monitoring object, construct spatial access edges between object nodes and spatial nodes, temporal association edges between object nodes and time nodes, and spatiotemporal activity edges between spatial nodes and time nodes; S140, based on the behavior data of each target monitoring object, obtain the weights of each spatial access edge, temporal association edge, and spatiotemporal activity edge; S150, based on all object nodes, spatial nodes, and temporal nodes, as well as all spatial access edges, temporal association edges, and spatiotemporal active edges and their corresponding weights, the ternary behavior graph is constructed.

3. The abnormal behavior monitoring and early warning method based on spatiotemporal graph neural network according to claim 2, characterized in that, S140 includes the following steps: S141, For any spatial access edge, the weight of the current spatial access edge is obtained based on the frequency of the first behavior of the target monitored object in the corresponding geographical location where the behavior occurs; S142, For any time-related edge, the weight of the current time-related edge is obtained based on the frequency of the second behavior of the target monitoring object in the corresponding time unit; S143, For any spatiotemporal active edge, the weight of the current spatiotemporal active edge is obtained based on the frequency of the third behavior in the corresponding time unit of the geographical location where the behavior of the target monitoring object occurs.

4. The abnormal behavior monitoring and early warning method based on spatiotemporal graph neural network according to claim 1, characterized in that, S200 includes the following steps: S210, For each object node, extract the first feature data corresponding to each object node, and convert the first feature data into the corresponding object behavior feature vector. The first feature data includes at least the behavior type, the frequency of the fourth behavior, the duration of the behavior, and the association of historical behaviors. S220, extract the second feature data corresponding to each spatial node, and convert the second feature data into the corresponding spatial semantic feature vector. The second feature data includes at least geographic location coordinates, regional functional classification, historical risk labels and surrounding POI distribution. S230, extract the third feature data corresponding to each time node, and convert the third feature data into the corresponding time context feature vector. The third feature data includes at least the time period type, the average duration of the behavior within the time period, the frequency of the behavior, and the correlation with the behavior in adjacent time periods.

5. The abnormal behavior monitoring and early warning method based on spatiotemporal graph neural network according to claim 1, characterized in that, The spatial feature aggregation module employs a graph attention network, the temporal feature aggregation module employs a gated recurrent unit, and the cross-modal fusion module employs a spatiotemporal attention fusion network. S300 includes the following steps: S310, by using the spatial feature aggregation module and the weights of the spatial access edges in the ternary behavior graph, the object behavior feature vector of each object node and the spatial semantic feature vector of the connected spatial nodes are weighted and aggregated to obtain the object-space fusion feature vector corresponding to each object node. S320, by using the time feature aggregation module and the weights of the time-related edges in the ternary behavior graph, the object-space fusion feature vector corresponding to each object node and the time context feature vector of the connected time nodes are time-series aggregated to obtain the object-space-time fusion feature vector corresponding to each object node. S330, by using the weights of the spatiotemporal active edges in the cross-modal fusion module and the ternary behavior graph, the object-spatiotemporal fusion feature vector corresponding to each object node is weighted by an attention mechanism to obtain a spatiotemporal enhanced representation vector that reflects the behavior pattern of each target monitoring object in the corresponding spatiotemporal environment.

6. The abnormal behavior monitoring and early warning method based on spatiotemporal graph neural network according to claim 1, characterized in that, S400 includes the following steps: S410, cluster the spatiotemporal enhanced representation vectors of several historical abnormal behaviors to obtain several abnormal feature template vectors, where each abnormal feature template vector corresponds to an abnormal behavior pattern. S420: By comparing the spatiotemporal augmented representation vector of each target monitoring object with the template vector of each abnormal feature, the behavior recognition type corresponding to each target monitoring object is obtained.

7. The abnormal behavior monitoring and early warning method based on spatiotemporal graph neural network according to claim 6, characterized in that, S420 includes the following steps: S421, For any target monitoring object, calculate the similarity between the spatiotemporal enhanced representation vector of the current target monitoring object and each preset anomaly feature template vector; S422, if the similarity between the current target monitoring object and any preset abnormal feature template vector is greater than the preset similarity threshold, then the behavior identification type corresponding to the current target monitoring object is determined to be abnormal behavior, and the abnormal type corresponding to the current target monitoring object is determined to be the abnormal behavior pattern corresponding to the abnormal feature template vector. S423, if the similarity between the current target monitoring object and each preset abnormal feature template vector is less than or equal to the preset similarity threshold, then the behavior recognition type corresponding to the current target monitoring object is determined to be non-abnormal behavior.

8. A non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores at least one instruction or at least one program segment, characterized in that, The at least one instruction or the at least one program segment is loaded and executed by the processor to implement the abnormal behavior monitoring and early warning method based on spatiotemporal graph neural network as described in any one of claims 1-7.

9. An electronic device, characterized in that, Includes a processor and the non-transitory computer-readable storage medium as described in claim 8.

Images