A method and apparatus for detecting anomalies in dynamic graph community offset data access with classification and hierarchical semantic enhancement.

Abstract

This invention discloses a method and apparatus for detecting abnormal data access in dynamic graph community offsets using a classification and hierarchical semantic enhancement approach. The method slices internal access logs by time windows, constructs a bipartite graph snapshot composed of user nodes and data asset nodes, and classifies and categorizes asset associations with sensitivity semantics. Based on access statistics and sensitivity, edge risk weights are calculated, and risk weighting is introduced into the graph neural network message passing to learn node embeddings. Based on the embeddings, communities are divided in each time slice, and a stable community evolution trajectory is obtained through temporal smoothing. Community offset and node-community consistency deviation are calculated to form a node anomaly score, and an alarm is output. This scheme can identify structural anomalies such as collusive access, abnormal cross-community access, and community migration, and provides interpretable clues at the community level.

Description

Technical Field

[0001] This invention relates to the field of network and information security, specifically to data access anomaly detection technology based on graph data modeling, and more particularly to a dynamic graph community offset data access anomaly detection method and apparatus with classification and hierarchical semantic enhancement. Background Technology

[0002] In real-world enterprise and institutional production environments, internal users' access behaviors to data assets such as databases, data warehouses, object storage, and data interfaces manifest both as the evolving operational trajectories of individual users over time and as stable collaborative relationships formed by user groups around similar data assets. Using "user-data asset" as the core object, a business-constrained relationship network can be abstracted: users in the same department or position often share access to a certain type of business data asset; specific highly sensitive assets are typically accessed only by a small group of authorized positions; cross-departmental collaborative access exhibits a relatively stable structural pattern within a certain period. These structural patterns can be represented in a graph structure as a subset of nodes with closer connections and more similar behaviors—i.e., communities.

[0003] Internal data access risks have the following significant characteristics at the graph structure level:

[0004] (1) Collaborative behavior and collusion risk: Abnormal behavior does not always appear as isolated individuals, but may manifest as multiple accounts forming abnormally dense connections around the same sensitive asset in a short period of time, or multiple users from different positions / departments who originally had no stable intersections having synchronous access edges to highly sensitive assets in the same time window, leading to structural mutation.

[0005] (2) Community Shift and Structural Access Anomalies: For most users, community affiliation and access focus remain relatively stable over a considerable period. When situations such as permission abuse, account sharing, unauthorized cross-departmental access, or abnormal cross-system access occur, users may significantly deviate from their historical community center within the embedded space, or exhibit structural evolution anomalies such as "a sudden increase in cross-community access, a shift in the focus of access within the community towards highly sensitive assets, abnormal interconnections between communities around sensitive assets, and community mergers / splits." Such anomalies often cannot be reliably identified solely by relying on single-point frequency or single-user temporal fluctuations.

[0006] (3) Business semantics have a decisive impact on structural evolution: business semantics such as data classification and grading, asset types, user departments and positions, and system permission policies determine "which users should access which assets". If these semantic constraints are not reflected in graph construction and graph computation, the graph model is prone to misjudging "normal business changes" as abnormalities, or weakening "abnormal structural changes around highly sensitive assets" as general structural fluctuations.

[0007] In existing technologies, detection methods for internal threats mostly focus on:

[0008] (1) Rule-based and threshold-based auditing scheme: alarms are triggered by rules such as access frequency, time period, terminal / IP whitelist, etc., which are difficult to cover unknown patterns and are not sensitive to low-frequency slow evolution and structural collaborative behavior.

[0009] (2) Anomaly detection based on individual time series models: User behavior is treated as a time series, and models such as LSTM and Transformer are used to predict or reconstruct anomalies. This type of method can characterize individual trajectories, but it lacks direct representation capabilities for structural anomalies such as "rearrangement of relationships between users, community migration, and cross-community abnormal interconnection".

[0010] (3) Graph analysis methods based on static graphs or single snapshots: Embedding or clustering on a single snapshot can reflect structural characteristics to a certain extent, but it is difficult to depict the trajectory of the community structure shifting over time. It is easily disturbed by short-term fluctuations and it is also difficult to distinguish between "gradual abnormal shifts" and "short-term noise". In addition, some graph methods do not integrate business semantic systems such as data classification and grading into edge weights, node features and message passing processes, and cannot reflect the amplification effect of accessing highly sensitive assets on risk assessment.

[0011] Therefore, existing technologies generally have the following shortcomings for internal "user-data asset" access scenarios: First, they lack unified modeling for dynamic graph evolution, making it difficult to capture the continuous shift of community structure over time; second, they lack mechanisms for characterizing and quantifying structural anomalies such as community shifts and cross-community abnormal interconnections; and third, they fail to integrate business semantics such as data classification and grading into the entire process of graph construction, message passing, and anomaly scoring, resulting in the weakening of the impact of high-risk access relationships on the graph.

[0012] In summary, existing technologies lack a unified modeling and detection method that can simultaneously consider dynamic graph evolution, community shift and collaborative behavior characteristics, and deeply integrate business semantics such as data classification and grading. Summary of the Invention

[0013] To address the above shortcomings, the present invention mainly solves the following technical problems:

[0014] (1) How to construct a dynamic graph model that reflects business semantics such as data classification and grading, asset type, and job department in the internal "user-data asset" access scenario, and abstract the access behavior into a user-asset relationship network that evolves over time, so as to depict the stable community structure and its evolution over time.

[0015] (2) How to use graph neural networks to perform deep feature extraction on dynamic graphs, and inject factors such as data classification and grading sensitivity, access operation risk, access intensity and time distribution into the message passing and node update process, so that the node and community representation not only reflects the connection structure, but also explicitly reflects the risk weight of "related relationship with high-sensitivity assets".

[0016] (3) How to quantify the degree of deviation of community structure and identify the types of structural access anomalies in the time dimension, including but not limited to: collusive access, abnormal cross-community access, migration of access focus within the community to high-sensitivity assets, migration of users from low-risk communities to high-risk communities, abnormal interconnection of multiple communities around sensitive assets, and community mergers / splits, so as to form calculable community-level and node-level anomaly indicators.

[0017] By addressing the aforementioned technical challenges, this invention aims to achieve the following engineering goals: At the same alarm threshold level, compared to methods relying solely on rules or individual time-series modeling, it enhances the detection capabilities for collaborative behavior, community shifts, and structural anomalies; by integrating data classification and hierarchical semantics into graph construction, message passing, and scoring processes, it assigns higher risk weights to structural shifts involving highly sensitive assets, thereby increasing the hit rate of high-risk alarms and reducing alarm fatigue among operational staff; simultaneously, it outputs interpretable clues regarding "who and whom around which sensitive assets undergo structural changes within what time window," assisting in risk assessment across accounts and departments.

[0018] To address the aforementioned technical problems, this invention proposes a method and apparatus for detecting abnormal data access in dynamic graph communities with enhanced semantics based on classification and grading. Within the same technical framework, the user-data asset access relationship is modeled as a time-series graph. The method utilizes business semantic enhancement graph construction and message passing processes, including data classification and grading, and quantifies the degree of abnormal offset at the community level. Specific technical solutions include:

[0019] (1) Construction of a dynamic user-data asset graph with enhanced business semantics. This invention uses internal access logs as the data source, models user accounts and data assets as two types of nodes in the graph, and establishes edges between user nodes and asset nodes based on access behavior. Edge features include access type, access frequency, time statistics, etc. At the same time, according to the enterprise's data classification and grading system, sensitivity levels are assigned to asset nodes, and sensitivity is mapped to weights to adjust edge weights or node features. By slicing the access logs with a fixed time window as the granularity, a series of time-ordered graph snapshots can be constructed, thereby forming a dynamic user-asset graph that evolves over time.

[0020] (2) Risk-weighted graph neural network message passing. This invention employs a graph neural network to embed user nodes and asset nodes on each graph snapshot. During message passing, for edges connecting highly sensitive assets, sensitivity weights are used to amplify or attenuate messages, i.e., "risk-weighted message passing". Updates of user nodes consider both messages from associated asset nodes and their own historical state, while updates of asset nodes consider aggregated information from visiting user nodes, thus explicitly encoding the "relationship strength with highly sensitive assets" and its evolution in node embedding.

[0021] (3) Dynamic community discovery and temporal smoothing. In this invention, clustering or community discovery algorithms are used to divide user communities in the user embedding space of each time snapshot to obtain the community structure at that time point. To reduce the interference of short-term fluctuations on community division, a temporal smoothing mechanism is introduced, such as by performing joint clustering on the user embeddings of adjacent snapshots and applying a penalty term to the community division results to encourage "consistency with the community division of the previous time step", thereby obtaining a smoothly evolving community trajectory.

[0022] (4) Community Shift and Collaborative Anomaly Scoring Based on Business Semantics. This invention constructs and designs a community anomaly scoring function by comparing the community structure and access distribution around sensitive assets in the current time window with those in historical normal windows. The function comprehensively considers the following factors: whether users access non-standard asset sets across communities, whether there is abnormal concentrated overload of access to highly sensitive assets within a community, and whether there are abnormal interconnections between communities around sensitive assets. A classification and grading sensitivity weight is introduced into the scoring function to give higher scores to community shifts involving highly sensitive assets. Finally, anomaly scores can be output at both the community and user levels, achieving joint detection of community shifts, collusive access, and collaborative anomaly behaviors.

[0023] (5) Device Implementation. To implement the above method, the present invention also provides a structural anomaly detection device, which includes: a log collection and preprocessing module, a time slicing and dynamic graph construction module, a business semantic encoding module, a risk weight calculation module, a risk weighted graph neural network embedding calculation module, a dynamic community discovery and time-series smoothing module, a node and community anomaly scoring module, and an alarm and interpretable output module; each module is connected through data stream or interface call, and can form a dynamic graph snapshot sequence of the input internal access log and output structural anomaly alarm results.

[0024] (6) Deployment and Expansion. The method of this invention can be integrated into a data security management platform as a software module, or it can be deployed as an independent risk analysis service. The graph construction method, graph neural network structure, and community detection algorithm can all be replaced with equivalent implementations according to actual needs, such as using different GNN variants or different clustering methods, which are still within the scope of protection of this invention.

[0025] Through the above technical solution, the present invention realizes integrated modeling of "graph structure + dynamic community + business semantics" in the internal data access scenario, which can effectively identify community shift and collaborative behavior risks that are difficult to detect by traditional single-point time series analysis methods. Attached Figure Description

[0026] Figure 1 is a schematic diagram of the overall architecture of the classification and hierarchical semantic enhancement dynamic graph community offset data access anomaly detection method and device provided by the present invention. As shown in Figure 1, the overall implementation of the present invention includes modules such as log collection, preprocessing (including time slicing and dynamic graph construction), business semantic embedding, risk-weighted GNN graph neural network embedding calculation, dynamic community discovery and time-series smoothing, and node and community anomaly scoring and alarm output. Each module processes the data flow sequentially to output structural anomaly alarm results.

[0027] Figure 2 is a schematic diagram of the core process of dynamic graph community offset data access anomaly detection with classification and hierarchical semantic enhancement in this invention. As shown in Figure 2, the core process of this invention includes constructing a user-asset bipartite graph and calculating edge risk weights within a time slice, performing embedding calculations based on a risk-weighted graph neural network, performing dynamic community discovery and temporal smoothing, then performing community partitioning and offset measurement, and outputting node and community anomaly scores. Detailed Implementation

[0028] The technical solution of the present invention will be described in detail below with reference to embodiments. Those skilled in the art can implement the present invention based on this description without any creative effort.

[0029] Example 1: An Internal Data Access Anomaly Detection Method Based on Dynamic Community-Aware GNN

[0030] Step S1: Access Log Collection and Time Slicing

[0031] (1) Collect internal user access records of data assets from multiple sources such as database audit system, data access agent, and application server logs. The main fields include: user ID, asset ID, operation type, access time, access source, access result, and number of returned records.

[0032] (2) Divide the continuous timeline into discrete time slices according to business needs, such as by day, hour or fixed time window. Assign access records within each time slice to the corresponding time slice to construct the graph structure of that time slice.

[0033] Step S2: Semantically Enhanced Dynamic Graph Construction

[0034] (1) At each time slice t, a user-asset bipartite graph is constructed based on the access records within that time slice. The user set and the data asset set are collectively denoted as the node set, and the edge set consists of user-asset pairs with access behavior. The dynamic graph snapshot corresponding to the time slice can be abstractly represented as graph g. (t) As shown in formula (1).

[0035] Formula (1):

[0036] Where V is the set of nodes, E (t) Let A be the set of edges for time slice (t). (t) The corresponding weighted adjacency matrix is ​​given by the edge risk weights within time slice t.

[0037] (2) Based on the enterprise data classification and grading directory, assign classification labels and sensitivity levels to each asset node, and quantify the sensitivity levels to obtain s. a This is used for subsequent risk weight calculations.

[0038] (3) For each user-asset access edge, statistically analyze relevant characteristics within time slice t, such as access frequency, access type distribution, access time period distribution, and number of returned records. Then, correlate these statistics with the asset sensitivity s. a Combine and calculate the risk weight r of the edge. ua (t) As shown in formula (2). The function g(·) can be a linear combination or other monotonically increasing function, used to integrate multiple factors.

[0039] Formula (2):

[0040] Among them, s a For the sensitivity level of asset a, o ua (t) This represents the statistical characteristics of the types of operations performed by user (u) on asset (a) within time slice (t), v ua (t) The values ​​represent statistical characteristics such as access frequency and number of returned records, and g(·) is a function that maps the above characteristics to risk weights.

[0041] (4) The risk weight r ua (t) As the weights of edge (u,a) in time slice t, a weighted adjacency matrix is ​​formed, which is used for subsequent graph neural network message passing.

[0042] Step S3: Node Feature Construction

[0043] (1) Construct feature vectors for user nodes, including but not limited to: department, job role, historical access statistics (such as long-term average access frequency, long-term high-sensitivity access ratio), login method, terminal type, etc.

[0044] (2) Construct feature vectors for asset nodes, including but not limited to: asset type (table / view / interface, etc.), system to which it belongs, category label, sensitivity level, access control policy summary, etc.

[0045] (3) Map user node features and asset node features to a vector space of the same dimension, denoted as the initial node representation h. v (0,t) , used as input to the GNN model.

[0046] Step S4: Graph Neural Network Modeling Based on Risk-Weighted Message Passing

[0047] (1) At each time slice t, take a snapshot of the dynamic graph g. (t) Applying a graph neural network. For the l-th layer GNN, the embedding representation h of node u in time slice t. u (l,t) A new representation h is obtained by aggregating self-representation and neighbor messages. u (l +1,t) .

[0048] (2) To reflect the impact of edge risk weights on message passing, we first define the attention score e received by node u from its neighbor v. uv (l,t) The score consists of a structural similarity term and a risk weight term, as shown in formula (3).

[0049] Formula (3):

[0050] Among them, W q (l) With W k (l) h is the linear transformation matrix for query and key. u (l,t) h represents the embedding vector of node u at the l-th layer in time slice t. v (l,t) This represents the embedding vector of node v at the l-th layer in time slice t, where φ(·,·) is the similarity function (e.g., inner product or bilinear function), γ is a learnable coefficient that controls the influence of risk weights, and r uv (t) The edge risk weights obtained in step S2.

[0051] (3) e uv (l,t) The attention coefficient α is obtained after softmax normalization. uv (l,t) As shown in formula (4).

[0052] Formula (4):

[0053] Where, α uv (l,t) This represents the attention coefficient of node u aggregating its neighbor v in the l-th layer of time slice t; e uv (l,t) This represents the attention score given by node u when it receives a message from its neighbor v; e uw (l,t) Let N(u) represent the attention score of node u when it receives a message from its neighbor w; N(u) represent the set of neighbors of node u; exp(·) is an exponential function, and softmax normalization is used to convert the attention score into probabilistic weights.

[0054] (4) Message aggregation is performed based on the attention coefficient to obtain the representation h of node u at layer l+1. u (l+1,t) As shown in formula (5).

[0055] Formula (5):

[0056] Among them, h u (l+1,t) W represents the embedding vector of node u after the (l+1)th layer update in time slice t. self (l) With W neigh (l) Let α be the linear transformation parameter matrix of the self-feature and the neighbor features. uv (l,t) σ is the attention coefficient obtained from formula (4), and σ(·) is the nonlinear activation function.

[0057] Through the aforementioned risk-weighted message passing mechanism, edges involving highly sensitive assets or high-risk operations will have a greater impact on node representations during the aggregation process, thus amplifying these relationships in the node embedding space.

[0058] Step S5: Dynamic Community Discovery and Temporal Smoothing

[0059] (1) After completing the L-layer GNN computation, the final embedding representation set H of the nodes at each time slice t can be obtained. (t) = h v (L,t)Based on H (t) Cluster the nodes (e.g., using K-means or spectral clustering) to obtain the community partitioning C for time slice t. (t) And calculate the center vector μ for each community. k (t) As shown in formula (6).

[0060] Formula (6):

[0061] Where, μ k (t) C represents the center vector of the k-th community in time slice t; k (t) |C represents the set of nodes contained in the k-th community in time slice t; k (t) | Indicates the number of nodes in this community; h v (L,t) The embedding vector of node v in the Lth layer (i.e., the last layer) of time slice t is represented by the summation symbol, which represents the summation and averaging of the embedding vectors of all nodes in the community to obtain the community center.

[0062] (2) To characterize the evolution of the community over time, the offset d between the community centers of adjacent time slices is introduced. k (t) For example, Euclidean distance or cosine distance can be used as a metric, refer to formula (7). A larger offset value usually means that the overall access pattern of the community has changed significantly relative to the historical baseline.

[0063] Formula (7):

[0064] Where, d k (t) μ represents the center offset of community k in time slice t. k (t) With μ k (t-1) Let ||t||t-1 represent the community center vectors of adjacent time slices t and t-1, respectively; ||·||2 represents the L2 norm, used to measure the Euclidean distance or equivalent distance between two vectors.

[0065] (3) To avoid drastic fluctuations in community divisions between time slices, the following strategies can be used for time-series smoothing:

[0066] (a) In the cluster initialization of time slice t, introduce the community center μ of time slice t-1. k (t-1) As initial cluster centers or references;

[0067] (b) Add a penalty to the community segmentation objective to suppress excessive shifts in community centers between adjacent time slices;

[0068] (c) Merge or filter small-scale, short-lived communities to avoid noise interfering with subsequent anomaly detection.

[0069] The above methods can be used to obtain a relatively stable and business-interpretive community evolution trajectory.

[0070] Step S6: Node and Community Anomaly Scoring

[0071] (1) Node-level risk score.

[0072] Embed h in the nodes output by the GNN u (L,t) Based on this, the node-level risk score 'a' of a node can be estimated using a simple feedforward network or distance metric. u (t) For example, the distance between it and the center vector of the historical normal pattern can be mapped to a risk score, or it can be mapped to an anomaly probability using supervised training.

[0073] (2) Community offset.

[0074] The community center offset d obtained using formula (7) k (t) This is considered a community-level risk indicator, reflecting the degree of overall behavioral change of community k relative to the historical baseline in time slice t.

[0075] (3) Node-community consistency deviation.

[0076] For any node u in time slice t, let its community be C(u). (t) Let δ denote the distance between the node embedding and the community center vector. u (t) Euclidean distance or cosine distance can be used as a metric.

[0077] (4) Standardize anomaly scoring.

[0078] Taking into account the node-level risk score a u (t) Community offset d C(u) (t) and node-community consensus bias δ u (t) Define the final anomaly score s of the node. u (t) As shown in formula (8).

[0079] Formula (8):

[0080] Among them, s u (t) a represents the final anomaly score of user node u in time slice t. u (t) C(u) represents the node-level risk score, used to characterize the degree of deviation of node u from its own embedding relative to the historical normal pattern. (t) d represents the community ID to which node u belongs in time slice t. C(u) (t) This represents the community center offset of the community to which node u belongs in time slice t (i.e., the community's d). k (t) ), δ u (t) λ1, λ2, and λ3 represent node-community consistency bias, used to measure the distance between a node embedding and the center vector of its community. These are adjustable weights used to balance different risk sources and can be determined in the following ways: in supervised or semi-supervised scenarios, they are learned automatically through training as learnable parameters; in unsupervised scenarios, they can be determined using an adaptive calibration strategy after normalizing various indicators based on historical normal windows, thus avoiding instability caused by subjective human settings. To enhance sensitivity to structural anomalies related to highly sensitive assets, classification and grading sensitivity can also be introduced as a weight term into a. u (t) and δ u (t) The calculation process amplifies the bias contribution of highly sensitive assets in the scoring.

[0081] (5) Set a threshold based on the anomaly score for s u (t) Nodes exceeding a preset threshold trigger an alarm. The alarm information may include the community to which the node belongs and the community offset, in order to indicate potential collusion risks or abnormal overall community behavior.

[0082] Step S7: Model Training and Deployment Methods

[0083] (1) In supervised or semi-supervised scenarios, historical alarm analysis results or manually labeled data can be used to assign anomaly labels y to some nodes. u (t) By s u (t) Mapped to anomaly probability P u (t) (The value range is 0 to 1), construct the loss function to train the model parameters, as shown in formula (9):

[0084] Formula (9):

[0085] Among them, V label (t) y represents the set of nodes with labeled nodes in time slice t; u (t) This represents the anomaly label for node u at time slice t. The anomaly label value can be 0 or 1. u (t) Indicates the abnormal score s u (t) The abnormal predicted value or abnormal probability obtained after mapping, l(·,·) represents the loss function, which is used to measure the difference between the predicted value and the true label. The loss function can be cross-entropy loss or other equivalent loss applicable to class imbalance scenarios.

[0086] (2) In the absence of explicit labels, unsupervised training methods can also be used. For example, embeddings and community partitioning can be learned by maximizing the similarity of nodes within a community and minimizing the similarity between communities, and the community offset d can be used as the basis for the learning. k (t) And node – community bias δ u (t) It can be directly used as an anomaly indicator. In this case, formula (8) can still be used to construct a comprehensive anomaly score.

[0087] (3) Since the dynamic graph construction and GNN inference of the present invention mainly rely on batch access log statistics, they can run in offline or near real-time mode. For scenarios with high real-time requirements, a sliding window and incremental update method can be used to update only the graph structure and embedding representation of the most recent time slices after new logs arrive.

[0088] Through the above embodiments, the present invention achieves unified modeling and detection of various types of access anomalies on a dynamic user-asset graph, combining business semantics and community structure evolution. It is particularly suitable for identifying community behavior deviations and potential collusion risks involving highly sensitive assets.

[0089] Other implementation methods

[0090] Without altering the core idea of ​​this invention, the following alternative implementations of the technical solution in Part Four can also achieve similar technical effects:

[0091] (1) Replacement of graph construction method.

[0092] In addition to the user-asset bipartite graph, a user-user similarity graph can be constructed based on similar access behaviors between users, or an asset-asset similarity edge can be introduced to form a heterogeneous graph structure. As long as the graph structure can reflect the relationship between users and highly sensitive assets, it falls within the scope of protection of this invention.

[0093] (2) Replacement of graph neural network structure.

[0094] GNNs can employ GCN, GAT, GraphSAGE, or other graph neural network variants. Risk weights can be injected into the message passing process through various methods such as attention mechanisms, additive bias, and edge feature encoding. This invention is not limited to specific network structure forms.

[0095] (3) Alternatives to community detection algorithms.

[0096] Community detection can employ K-means, spectral clustering, graph-based partitioning algorithms, or other methods suitable for embedding space clustering; it can also utilize end-to-end graph clustering networks, learning embeddings and clustering results simultaneously during training. As long as the community partitions at time slices can be obtained and community centers calculated, it can be used in conjunction with the offset metric and anomaly scoring mechanism of this invention.

[0097] (4) Replacement of the anomaly scoring function.

[0098] Comprehensive anomaly score s u (t) The form can be adjusted according to actual business needs. For example, non-linear combination, hierarchical scoring or multi-task learning framework can be used to output multi-dimensional risk indicators. As long as node-level risk, community offset and node-community bias are considered at the same time, they are all considered equivalent substitutions of the present invention.

Claims

1. A classification-level semantic-driven data access structure anomaly detection method based on a dynamic community-aware graph neural network, characterized in that, include: Retrieve internal access logs and slice them according to a preset time window; Within each time slice, a snapshot of the user-data asset bipartite graph consisting of user nodes and data asset nodes is constructed, and a classification label and sensitivity level are assigned to each asset node according to the enterprise data classification and grading directory; for each user-asset access edge, the number of accesses, operation type distribution, access time period distribution and / or number of returned records are counted within the corresponding time slice, and the statistics are combined with the asset sensitivity level to calculate the edge risk weight. Perform graph neural network message passing with edge risk weights on each graph snapshot to learn node embedding representations; Based on the node embedding in each time slice, community division is performed and community center representation is obtained. Temporal smoothing is then performed on the community results of adjacent time slices to obtain a stable community evolution trajectory. Node-level risk scores are obtained based on the node embedding. Calculate the Euclidean or cosine distance between the center vectors of the same community in adjacent time slices, and use it as the community offset. Calculate the Euclidean or cosine distance between the node embedding and the center vector of its community as the node-community consistency deviation; and generate a node anomaly score by weighting and combining the node-level risk score, the community offset, and the node-community consistency deviation. When the node anomaly score meets the alarm conditions, a structured access anomaly alarm result is output.

2. The method according to claim 1, characterized in that, The edge risk weight is obtained by mapping at least two of the following statistical characteristics: asset sensitivity level and access frequency, operation type distribution, and number of returned records, through a monotonic function, and is used to amplify the impact of message transmission involving highly sensitive assets.

3. The method according to claim 1, characterized in that, The graph neural network message passing adopts an attention aggregation mechanism, and the attention scoring includes additive or multiplicative terms generated by edge risk weights to improve the contribution of high-risk edges to node embedding.

4. The method according to claim 1, characterized in that, The time-series smoothing includes at least one of the following: using the community center of the previous time slice as the initialization for clustering in the current time slice, or adding a penalty term to the community partitioning objective to suppress excessive drift of community centers in adjacent time slices.

5. The method according to claim 1, characterized in that, The node-level risk score is obtained by mapping the distance between the node embedding and the center vector of the historical normal pattern to a risk score, or by mapping the node embedding to anomaly probability through a feedforward network.

6. The method according to claim 1, characterized in that, The node anomaly score is obtained by a weighted combination of the node-level risk score, the offset of the community to which it belongs, and the node-community consistency deviation. The weight parameters are adjustable parameters. In the preset configuration mode, the adjustable parameters are set by the configuration file or strategy parameters, and in the training mode, they are obtained by training with samples as learnable parameters.

7. A classification and hierarchical semantic-driven data access structure anomaly detection device based on a dynamic community-aware graph neural network, characterized in that, include: The log collection and preprocessing module is used to collect internal access logs and output preprocessed access records; The time slicing and dynamic graph construction module is used to slice the preprocessed access records according to a preset time window, and build a user-data asset bipartite graph snapshot composed of user nodes and data asset nodes in each time slice. The business semantic encoding module is used to assign classification labels and sensitivity levels to each asset node according to the enterprise data classification and hierarchical directory; The risk weight calculation module is used to count the number of accesses, operation type distribution, access time period distribution and / or number of returned records for each user-asset access edge within the corresponding time slice, and combine the statistics with the asset sensitivity level to calculate the edge risk weight. The risk-weighted graph neural network embedding computation module is used to perform graph neural network message passing with edge risk weights on each graph snapshot and output node embeddings. The Dynamic Community Discovery and Temporal Smoothing module is used to perform community partitioning based on node embedding, obtain community center representations, and perform temporal smoothing. The node and community anomaly scoring module is used to obtain node-level risk scores based on node embeddings, calculate the Euclidean or cosine distance between the center vectors of the same community in adjacent time slices as the community offset, calculate the Euclidean or cosine distance between the node embedding and the center vector of its community as the node-community consistency deviation, and generate a node anomaly score by weighting and combining the node-level risk score, the offset of its community, and the node-community consistency deviation. The alarm and interpretable output module is used to output a structured access anomaly alarm result when the node anomaly score meets the alarm conditions.

8. The apparatus according to claim 7, characterized in that, The alarm and explainable output module is further used to output explainable clues, which include at least one of the following: the community to which the abnormal node belongs, the degree of community offset, and an item from the list of associated highly sensitive assets.

9. The apparatus according to claim 7, characterized in that, The time-slicing and dynamic graph construction module supports generating graph snapshots by hourly or daily windows, and supports incremental updates of the graph structure and risk results of the most recent time slices using a sliding window.

Images