A method and device for determining an abnormal behavior recognition model

Abstract

The present invention provides a method and device for determining an abnormal behavior recognition model, the method comprising: converting a predetermined amount of acquired business data into graph structure data, and extracting classification labels corresponding to the predetermined amount of business data; performing aggregation processing on the graph structure data to obtain a dense vector of the graph structure data; training an original graph neural network model through the dense vector and the classification label to obtain a trained target graph neural network model, the target graph neural network model is used for abnormal behavior recognition, and can solve the problem that the abnormal behavior recognition model in the related technology is not effective and the aggregation in the model has certain deficiencies. Through the graph neural network model, various relationships and attributes can be well represented in graph data, and combined with deep learning, the ability to approximate complex functions and learn the essential characteristics of data is stronger, and the model effect is better.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a method and device for determining an abnormal behavior recognition model. Background Art

[0002] Existing anti-fraud technologies mostly use machine learning models or rule models. It is difficult to describe the relationship between large amounts of data using existing data. The model does not work well when approximating complex functions and learning the essential characteristics of data. In addition, the GraphSage algorithm has certain shortcomings when it comes to aggregation.

[0003] There is no solution yet for the problem that the abnormal behavior recognition model in related technologies is not effective and the aggregation in the model has certain deficiencies. Summary of the invention

[0004] The embodiments of the present invention provide a method and device for determining an abnormal behavior recognition model, so as to at least solve the problem in the related art that the abnormal behavior recognition model has a poor effect and the aggregation in the model has certain deficiencies.

[0005] According to an embodiment of the present invention, a method for determining an abnormal behavior recognition model is provided, comprising:

[0006] Converting the acquired predetermined amount of business data into graph structure data, and extracting classification labels corresponding to the predetermined amount of business data;

[0007] Performing aggregation processing on the graph structure data to obtain a dense vector of the graph structure data;

[0008] The original graph neural network model is trained by using the dense vector and the classification label to obtain a trained target graph neural network model, wherein the target graph neural network model is used for abnormal behavior recognition.

[0009] Optionally, converting the acquired predetermined amount of business data into graph structure data, and extracting classification labels corresponding to the predetermined amount of business data includes:

[0010] Allocate node IDs for the predetermined number of service data respectively, wherein one service data corresponds to one node;

[0011] Extract the relationship of the predetermined number of nodes as the adjacency list of the graph structure data, define a variable of dictionary type, the key of the dictionary stores the node ID, and the corresponding value is all the corresponding neighbor nodes;

[0012] Extracting a feature matrix (N, M) of the predetermined number of nodes, the feature matrix of the graph structure data, wherein M is the size of the constructed feature dimension and N is the number of nodes;

[0013] The labels Y of the predetermined number of nodes are extracted to form a label matrix of the graph structure data.

[0014] Optionally, performing aggregation processing on the graph structure data to obtain a dense vector of the graph structure data includes:

[0015] Determine the similarity between the central node and the adjacent nodes according to the adjacency table, and obtain n nodes whose similarity is greater than a preset threshold;

[0016] The center point and neighbor nodes among the n nodes are aggregated according to an aggregation function to form a dense vector of the graph structure data.

[0017] Optionally, determining the similarity between the central node and the adjacent nodes according to the adjacency table, and obtaining n nodes whose similarity is greater than a preset threshold comprises:

[0018] Training a single-layer perception network according to the adjacency list, the label matrix of the graph structure data, and the feature vectors of the predetermined number of nodes;

[0019] Calculating the predicted values ​​of the predetermined number of nodes through the single-layer perception network, and determining the L1 distance between the predicted values ​​of every two nodes;

[0020] Determine the similarity between the central node and the adjacent nodes using the L1 distance;

[0021] Sorting the similarities in descending order;

[0022] The n nodes whose similarity is greater than the preset threshold are obtained.

[0023] Optionally, aggregating the center point and neighbor nodes among the n nodes according to an aggregation function to form a dense vector of the graph structure data includes:

[0024] Determine the center node vector and neighbor node vectors of the n nodes;

[0025] Splicing the central node vector and the neighbor node vector to obtain a spliced ​​target vector;

[0026] Aggregating the target vector using an aggregation function to obtain an aggregated vector;

[0027] The aggregated vector is filtered to obtain a dense vector of the graph structure data.

[0028] Optionally, the original graph neural network model is trained by using the dense vector and the classification label to obtain a trained target graph neural network model, including:

[0029] The original graph neural network model is trained using the dense vector and the classification label to obtain the target graph neural network model, wherein the dense vector is the input of the original graph neural network model, and the label result corresponding to the dense vector output by the trained target graph neural network model and the classification result actually corresponding to the dense vector satisfy the following loss function:

[0030] Among them, y v is the actual label result of node v, σ(z v ) is the probability predicted by the target graph neural network, σ is the activation function, z v is the dense vector of node v, and λ||θ||2 is the constraint condition.

[0031] Optionally, after the original graph neural network model is trained by using the dense vector and the classification label to obtain a trained target graph neural network model, the method further includes:

[0032] Obtain target business data;

[0033] The target business data is input into a pre-trained target graph neural network model to obtain the probability of the target business data input into the target graph neural network model corresponding to different classification results, wherein the classification result with the probability greater than a preset threshold is the abnormal behavior identification result corresponding to the target business data.

[0034] According to another embodiment of the present invention, there is also provided an abnormal behavior recognition model determination device, comprising:

[0035] An extraction module, used to convert the acquired predetermined amount of business data into graph structure data, and extract classification labels corresponding to the predetermined amount of business data;

[0036] An aggregation module, used for performing aggregation processing on the graph structure data to obtain a dense vector of the graph structure data;

[0037] A training module is used to train the original graph neural network model through the dense vector and the classification label to obtain a trained target graph neural network model, wherein the target graph neural network model is used for abnormal behavior recognition.

[0038] Optionally, the extraction module is further used to:

[0039] Allocate node IDs for the predetermined number of service data respectively, wherein one service data corresponds to one node;

[0040] Extract the relationship of the predetermined number of nodes as the adjacency list of the graph structure data, define a variable of dictionary type, the key of the dictionary stores the node ID, and the corresponding value is all the corresponding neighbor nodes;

[0041] Extracting a feature matrix (N, M) of the predetermined number of nodes, the feature matrix of the graph structure data, wherein M is the size of the constructed feature dimension and N is the number of nodes;

[0042] The labels Y of the predetermined number of nodes are extracted to form a label matrix of the graph structure data.

[0043] Optionally, the aggregation module includes:

[0044] An acquisition submodule, used to determine the similarity between the central node and the adjacent nodes according to the adjacency table, and acquire n nodes whose similarity is greater than a preset threshold;

[0045] The aggregation submodule is used to aggregate the center point and neighbor nodes among the n nodes according to the aggregation function, and form a dense vector of the graph structure data.

[0046] Optionally, the acquisition submodule is further used to:

[0047] Training a single-layer perception network according to the adjacency list, the label matrix of the graph structure data, and the feature vectors of the predetermined number of nodes;

[0048] Calculating the predicted values ​​of the predetermined number of nodes through the single-layer perception network, and determining the L1 distance between the predicted values ​​of every two nodes;

[0049] Determine the similarity between the central node and the adjacent nodes using the L1 distance;

[0050] Sorting the similarities in descending order;

[0051] The n nodes whose similarity is greater than the preset threshold are obtained.

[0052] Optionally, the aggregation submodule is further used to:

[0053] Determine the center node vector and neighbor node vectors of the n nodes;

[0054] Splicing the central node vector and the neighbor node vector to obtain a spliced ​​target vector;

[0055] Aggregating the target vector using an aggregation function to obtain an aggregated vector;

[0056] The aggregated vector is filtered to obtain a dense vector of the graph structure data.

[0057] Optionally, the training module is further used to:

[0058] The original graph neural network model is trained using the dense vector and the classification label to obtain the target graph neural network model, wherein the dense vector is the input of the original graph neural network model, and the label result corresponding to the dense vector output by the trained target graph neural network model and the classification result actually corresponding to the dense vector satisfy the following loss function:

[0059] Among them, y v is the actual label result of node v, σ(z v ) is the probability predicted by the target graph neural network, σ is the activation function, z v is the dense vector of node v, and λ||θ||2 is the constraint condition.

[0060] Optionally, the device further comprises:

[0061] An acquisition module is used to acquire target business data;

[0062] An input module is used to input the target business data into a pre-trained target graph neural network model to obtain the probability that the target business data input by the target graph neural network model corresponds to different classification results, wherein the classification result with a probability greater than a preset threshold is the abnormal behavior identification result corresponding to the target business data.

[0063] According to yet another embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when run.

[0064] According to yet another embodiment of the present invention, there is provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0065] Through the present invention, a predetermined amount of acquired business data is converted into graph structure data, and classification labels corresponding to the predetermined amount of business data are extracted; the graph structure data is aggregated to obtain a dense vector of the graph structure data; the original graph neural network model is trained by the dense vector and the classification label to obtain a trained target graph neural network model, wherein the target graph neural network model is used for abnormal behavior recognition, which can solve the problem that the abnormal behavior recognition model in the related technology is not effective and the aggregation in the model is insufficient. Through the graph neural network model, various relationships and attributes can be well represented in graph data, and combined with deep learning, the ability to approximate complex functions and learn the essential characteristics of data is stronger, and the model effect is better. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0067] Figure 1 1 is a hardware structure block diagram of a mobile terminal of the abnormal behavior identification model determination method according to an embodiment of the present invention;

[0068] Figure 2 is a flow chart of a method for determining an abnormal behavior identification model according to an embodiment of the present invention;

[0069] Figure 3 is a schematic diagram of a graph neural network according to an embodiment of the present invention;

[0070] Figure 4 is a schematic diagram of aggregation in a graph neural network according to an embodiment of the present invention Figure 1 ;

[0071] Figure 5 is a schematic diagram of aggregation in a graph neural network according to an embodiment of the present invention Figure 2 ;

[0072] Figure 6 4 is a block diagram of an abnormal behavior recognition model determination device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0073] The present invention will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict.

[0074] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0075] Example 1

[0076] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 is a hardware structure block diagram of a mobile terminal of the abnormal behavior identification model determination method according to an embodiment of the present invention, such as Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data. Optionally, the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0077] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the abnormal behavior identification model determination method in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0078] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0079] In this embodiment, a method for determining an abnormal behavior recognition model running on the above mobile terminal or network architecture is provided. Figure 2 is a flow chart of a method for determining an abnormal behavior identification model according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0080] Step S202, converting the acquired predetermined amount of business data into graph structure data, and extracting classification labels corresponding to the predetermined amount of business data;

[0081] Step S204, performing aggregation processing on the graph structure data to obtain a dense vector of the graph structure data;

[0082] Step S206, training the original graph neural network model using the dense vector and the classification label to obtain a trained target graph neural network model, wherein the target graph neural network model is used for abnormal behavior recognition.

[0083] Through the above steps S202 to S206, the problem that the abnormal behavior recognition model in the related technology is not effective and the aggregation in the model has certain deficiencies can be solved. Through the graph neural network model, various relationships and attributes can be well represented in graph data. Combined with deep learning, the ability to approximate complex functions and learn the essential characteristics of data is stronger, and the model effect is better.

[0084] The embodiment of the present invention has been improved from the business application level, using graph neural network to replace the original technology. Graph neural network is a deep learning method based on graph. Graph structure has advantages in describing data such as social networks and object relationships. Especially in financial payment or credit scenarios, such businesses themselves have many relationship attributes. It is difficult to describe a certain connection between a large amount of data with existing data, and graph structure has a natural advantage in describing these relationships. Various relationships and attributes can be well represented in graph data. At the same time, combined with deep learning, it has a stronger ability to realize complex function approximation and learn the essential characteristics of data, and its model effect is also better than traditional machine learning or rule models. The existing GraphSage algorithm has certain deficiencies in aggregation, so the embodiment of the present invention has made adjustments to the existing graph neural network in terms of technical framework, mainly including:

[0085] In graph algorithms, it is necessary to aggregate the neighbor nodes of the center point, and the aggregation method determines the performance of the model. The present invention designs a perception network model to measure the similarity of neighbor nodes and selectively aggregates the neighbor node information based on the similarity. However, the existing methods do not have a module for measuring node similarity.

[0086] Based on the calculated similarity of neighbor nodes, an optimized sampling method is designed, that is, neighbor nodes are selected according to the optimized threshold, and the top N neighbor nodes with high similarity are aggregated together. The existing method is random sampling, which is difficult to achieve good results.

[0087] Existing methods often use attention mechanisms for node aggregation, which consumes a lot of computing time. The present invention takes into account that neighbor nodes have already aggregated similar nodes, so there is no need to use the attention mechanism. When aggregating the center point, the splicing method can be directly used to aggregate the center point and neighbor node information.

[0088] In the embodiment of the present invention, the above step S202 may specifically include:

[0089] S2021, respectively allocating node IDs for the predetermined number of service data, wherein one service data corresponds to one node;

[0090] S2022, extracting the relationship of the predetermined number of nodes as an adjacency list of the graph structure data, defining a variable of dictionary type, wherein the key of the dictionary stores the node ID, and the corresponding value is all corresponding neighbor nodes;

[0091] S2023, extracting a feature matrix (N, M) of the predetermined number of nodes, the feature matrix of the graph structure data, wherein M is the size of the constructed feature dimension, and N is the number of nodes;

[0092] S2024, extracting labels Y of the predetermined number of nodes to form a label matrix of the graph structure data.

[0093] In the embodiment of the present invention, the above step S204 may specifically include:

[0094] S2041, determining the similarity between the central node and the adjacent nodes according to the adjacency list, obtaining n nodes whose similarity is greater than a preset threshold, and further, training a single-layer perception network according to the adjacency list, the label matrix of the graph structure data, and the feature vectors of the predetermined number of nodes; calculating the predicted values ​​of the predetermined number of nodes through the single-layer perception network, and determining the L1 distance between the predicted values ​​of every two nodes; determining the similarity between the central node and the adjacent nodes using the L1 distance; sorting the similarities in descending order; and obtaining the n nodes whose similarity is greater than the preset threshold;

[0095] S2042, aggregate the center points and neighbor nodes of the n nodes according to the aggregation function to form a dense vector of the graph structure data, further determine the center node vector and the neighbor node vector of the n nodes; splice the center node vector and the neighbor node vector to obtain a spliced ​​target vector; aggregate the target vector through the aggregation function to obtain an aggregated vector; filter the aggregated vector to obtain a dense vector of the graph structure data, specifically, the ReLU function can be used for filtering.

[0096] In an embodiment of the present invention, the above step S206 may specifically include: using the dense vector and the classification label to train the original graph neural network model to obtain the target graph neural network model, wherein the dense vector is the input of the original graph neural network model, and the label result corresponding to the dense vector output by the trained target graph neural network model and the classification result actually corresponding to the dense vector satisfy the following loss function:

[0097] Among them, y v is the actual label result of node v, σ(z v ) is the probability predicted by the target graph neural network, σ is the activation function, z v is the dense vector of node v, and λ||θ||2 is the constraint condition.

[0098] In an optional embodiment, after the above-mentioned step S206, the method further includes: obtaining target business data; inputting the target business data into a pre-trained target graph neural network model to obtain the probability that the target business data input by the target graph neural network model corresponds to different classification results, wherein the classification result with the probability greater than a preset threshold is the abnormal behavior identification result corresponding to the target business data.

[0099] The embodiment of the present invention is mainly based on the graph neural network algorithm. Combined with the actual business situation, the key modules in the algorithm are optimized and improved and applied to specific fraud scenarios. Data such as social relationship networks, payment transactions, and device hardware relationships are represented using graph structures. At the same time, the node aggregation method and sampling method in the existing graph neural network algorithm are optimized and improved to improve the effect of the model. In addition, the use of methods such as attention mechanisms is avoided, saving computing overhead. The following will first introduce the overall algorithm framework, and then elaborate on the technical details of the main innovations.

[0100] Figure 3 is a schematic diagram of a graph neural network according to an embodiment of the present invention, such as Figure 3As shown, Graph Neural Network is a deep learning method based on graph structure, which mainly consists of two parts: "graph structure" and neural network. In the present invention, the graph neural network mainly solves the fraud problem of binary classification. Through the input graph data features and labels, the model is trained using supervised learning, which mainly includes: data preprocessing, aggregate sampling, graph neural network structure, and loss optimization.

[0101] Among them, the main function of data preprocessing is to convert business data into graph structured data, and define relevant vertices, connection relationships, and adjacency lists according to specific scenarios to represent corresponding network relationships. Aggregation sampling includes the aggregation function and node aggregation method of graph neural networks, as well as how to convert nodes into dense vectors and put them into the model for training. The graph neural network structure defines the number of network layers, network parameters, and target value types for input and output. Loss optimization defines the specific loss calculation function, optimization algorithm, and number of iterations.

[0102] Business data usually contains a variety of complex information. Here we need to extract the corresponding relationships according to the goal and convert them into graph-structured data, because graphs provide a data structure that better describes the relationships between real-world objects.

[0103] A graph is a structure used to represent entities and their relationships, denoted by G = (V, E). A graph consists of two sets, one is the node set V, and the other is the edge set E. In the edge set E, an edge (u, v) connects a pair of nodes u and v, indicating that there is a relationship between the two nodes. The relationship between nodes is represented by an adjacency list. Each node contains a list, and each element in this list is connected to the node. Array or HashMap can be used as an adjacency list container to represent a graph. The elements in the container are graph nodes. And each node entity contains a list (array, linked list, set, etc.) to contain the nodes adjacent to the node. Node a is connected to nodes b and c, node b is connected to nodes a and g, and so on. The adjacency list is as follows:

[0104] a->{bc}

[0105] b->{ag}

[0106] c->{ae}

[0107] …

[0108] The embodiment of the present invention is implemented through the pytorch deep learning framework. It is assumed here that the total number of data samples is N, and each sample is unique. The data processing method includes: assigning a unique node ID to each sample, and the node ID is a unique primary key, that is, there are N IDs in total, and the ID value range is from 0 to N-1. The relationship between the nodes is extracted as an adjacency table, and a variable of dictionary type is defined. The key of the dictionary stores the node ID, and the corresponding value is all its neighboring nodes. According to each node, its corresponding feature matrix is ​​extracted, such as a dummy variable or a one-hot encoding. The matrix size is (N, M), and M is the size of the constructed feature dimension. Finally, the label Y corresponding to each node is extracted, Y~(0, 1).

[0109] Finally, we get three matrices about the graph structure (feature matrix, adjacency list, label matrix). In this way, we need to represent the entire graph structure as computable data so that it can be put into the neural network for learning and training.

[0110] Aggregate sampling is based on GraphSage, a graph neural network. On this basis, the algorithm itself has been greatly improved to improve the model effect. The improvements are mainly in three parts: Figure 4 is a schematic diagram of aggregation in a graph neural network according to an embodiment of the present invention Figure 1 ,like Figure 4 As shown, including:

[0111] For the center point, we first calculate the similarity of its neighboring nodes, then filter out dissimilar nodes based on the neighboring node sampling method, select the top n nodes with high similarity, and then aggregate the center point and neighboring nodes according to the aggregation function to form a dense vector. The technical implementation of each process is introduced in turn below.

[0112] 2.1 Node similarity measurement function;

[0113] In fraud scenarios, the black market usually disguises itself as normal users, which causes the black market nodes to be connected to normal nodes in the graph data. This causes the corresponding central node to sample the black market behavior features, which adds noise to the features. If the disguised black market nodes can be filtered out during sampling, the model effect can be improved. A single-layer perception network can be designed to predict the node labels and use the L1 distance to measure the similarity between two nodes. Define nodes v, v', and the L1 distance between the two nodes is calculated as follows:

[0114]

[0115] Among them, MLP is a single-layer perception network function, is the node vector of the l-1th layer, that is, the prediction score at the lth layer is calculated by the node vector of the l-1th layer (here, the vector features of the node itself are used to save calculations), and then the similarity of the two nodes is calculated. The similarity of the nodes is calculated as follows:

[0116] S(v,v')=1-D(v,v')

[0117] Here, the similarity between each central node and its neighboring nodes can be calculated through a single-layer perception network.

[0118] 2.2 Neighbor node sampling;

[0119] After calculating the similarity between the central node and its neighboring nodes, it is necessary to decide which neighboring nodes should be sampled. The principle of sampling is to select nodes with high similarity, which can improve the prediction ability of the graph neural network. Since a central point may be connected to hundreds of neighboring nodes, it is difficult to calculate the appropriate number of sampling nodes for each relationship. Existing graph neural networks use random sampling methods for sampling, which can easily sample nodes containing noise information, affecting the performance of the model.

[0120] The embodiment of the present invention has made an optimization in this regard, that is, using the calculated node similarity, for the central node v, a threshold threshold is set, for the neighboring nodes of the central node v, the similarities of the neighboring nodes are sorted from high to low, and only the first n nodes with similarity greater than the threshold threshold are sampled (n is defined by the developer according to the characteristics of the data). This ensures that the sampled information contains less noise or no noise, and also saves a certain amount of computing time.

[0121] 2.3 Node aggregation function.

[0122] After determining the selected neighbor nodes, the next step is to aggregate the information of the center point and neighbor nodes to form a dense vector. Existing methods often use the attention mechanism for node aggregation. The purpose of this mechanism is also to select node information that contributes more to the model, but this will consume a lot of computing time. The present invention takes into account that the neighbor nodes have aggregated similar nodes and no longer needs to use the attention mechanism. Here, a function is used for aggregation. When aggregating nodes, the center point and neighbor node information are spliced, and the aggregation function is used for calculation. Finally, the ReLU function is used for output. Figure 5 is a schematic diagram of aggregation in a graph neural network according to an embodiment of the present invention Figure 2 ,like Figure 5 As shown, at the lth level of aggregation, the aggregation expression is as follows:

[0123]

[0124] is the center node vector, is the neighbor node vector, represents the concatenation and summation of two vectors, AGG is the aggregation function, where the aggregation function can be the average method or the weight method.

[0125] For the averaging method, after concatenating the neighbor node vector and the center node vector, they are divided by the total number of used nodes in the concatenated vector.

[0126] For the weighted method, when concatenating neighbor node vectors, the neighbor node vector is multiplied by a weight, which is equal to the threshold used when filtering neighbor nodes.

[0127] Through the above method, a dense vector is obtained, which is then filtered by the ReLU function and output. The ReLU function is a linear rectification function, that is, a ramp function, and the function expression is:

[0128] f(x)=max(0,x), this function helps to make gradient descent and back propagation more efficient, while avoiding the problems of gradient explosion and gradient vanishing, and also reducing the overall computational cost of the neural network.

[0129] The graph neural network structure defines the number of network layers, network parameters, and target value types for input and output. The embodiment of the present invention uses a two-layer neural network for training, and the framework supports more network layers. The input of the network layer includes:

[0130] Input dimension: The input size needs to be defined according to the dimension and size of the specific data to be used;

[0131] Number of categories: the number of categories of the predicted label Y;

[0132] Adjacency list: a matrix representing the connection relationship between each vertex in the graph. The input is in dictionary format, with the key value being the center node number and the value value being the node number connected to it.

[0133] Aggregation function: the aggregation function defined in the aggregation layer;

[0134] Aggregation function method: average method or weight method, the default value is average method;

[0135] Cuda: Whether to use cuda for calculation. The framework supports CPU calculation.

[0136] In the embodiment of the present invention, the output of the graph neural network is a binary classification label.

[0137] Loss optimization defines the specific loss calculation function, optimization algorithm, number of iterations, etc.

[0138] The loss function used in this invention is cross entropy, which is mainly used to determine the closeness between the actual output and the expected output. The loss expression is defined as:

[0139]

[0140] Among them, y v is the actual label result of the target node, σ(z v ) is the probability predicted by the target graph neural network, σ is the activation function, z v is the dense vector of node v. λ||θ||2 is an additional constraint, the main purpose of which is to avoid overfitting. Here, l2-norm is used for regularization.

[0141] The optimization algorithm uses the Adam optimizer, an algorithm that performs first-order gradient optimization on a random objective function based on adaptive low-order moment estimates. The Adam algorithm is easy to implement and has high computational efficiency and low memory requirements. The Adam algorithm is different from the traditional stochastic gradient descent. Stochastic gradient descent maintains a single learning rate (i.e., alpha) to update all weights, and the learning rate does not change during training. Adam, on the other hand, designs independent adaptive learning rates for different parameters by calculating the first-order moment estimate and the second-order moment estimate of the gradient. Adam is a first-order optimization algorithm that can replace the traditional stochastic gradient descent process. It can iteratively update the weights of a neural network based on the training data. Adam is a very popular algorithm in the field of deep learning because it can quickly achieve excellent results. Empirical results show that the Adam algorithm performs well in practice and has great advantages over other types of random optimization algorithms.

[0142] The Adam optimizer in the framework has the following parameters:

[0143] params: iterable of parameters to be optimized or a dict defining parameter groups;

[0144] lr: learning rate (default value: 1e-3);

[0145] betas: coefficients used to calculate the running average of the gradient and the square of the gradient (default value: 0.999);

[0146] eps: term added to the denominator to increase numerical stability (default value: 1e-8);

[0147] weight_decay: Weight decay (L2 penalty) (default: 0).

[0148] According to another embodiment of the present invention, a device for determining an abnormal behavior recognition model is provided. Figure 6is a block diagram of an abnormal behavior recognition model determination device according to an embodiment of the present invention. Figure 6 As shown, including:

[0149] An extraction module 62, configured to convert the acquired predetermined amount of business data into graph structure data, and extract classification labels corresponding to the predetermined amount of business data;

[0150] Aggregation module 64, used to perform aggregation processing on the graph structure data to obtain a dense vector of the graph structure data;

[0151] The training module 66 is used to train the original graph neural network model through the dense vector and the classification label to obtain a trained target graph neural network model, wherein the target graph neural network model is used for abnormal behavior recognition.

[0152] Optionally, the extraction module 62 is further used for:

[0153] Allocate node IDs for the predetermined number of service data respectively, wherein one service data corresponds to one node;

[0154] Extract the relationship of the predetermined number of nodes as the adjacency list of the graph structure data, define a variable of dictionary type, the key of the dictionary stores the node ID, and the corresponding value is all the corresponding neighbor nodes;

[0155] Extracting a feature matrix (N, M) of the predetermined number of nodes, the feature matrix of the graph structure data, wherein M is the size of the constructed feature dimension and N is the number of nodes;

[0156] The labels Y of the predetermined number of nodes are extracted to form a label matrix of the graph structure data.

[0157] Optionally, the aggregation module 64 includes:

[0158] An acquisition submodule, used to determine the similarity between the central node and the adjacent nodes according to the adjacency table, and acquire n nodes whose similarity is greater than a preset threshold;

[0159] The aggregation submodule is used to aggregate the center point and neighbor nodes among the n nodes according to the aggregation function, and form a dense vector of the graph structure data.

[0160] Optionally, the acquisition submodule is further used to:

[0161] Training a single-layer perception network according to the adjacency list, the label matrix of the graph structure data, and the feature vectors of the predetermined number of nodes;

[0162] Calculating the predicted values ​​of the predetermined number of nodes through the single-layer perception network, and determining the L1 distance between the predicted values ​​of every two nodes;

[0163] Using L1 distance to determine the similarity between the central node and the adjacent nodes;

[0164] Sorting the similarities in descending order;

[0165] The n nodes whose similarity is greater than the preset threshold are obtained.

[0166] Optionally, the aggregation submodule is further used to:

[0167] Determine the center node vector and neighbor node vectors of the n nodes;

[0168] Splicing the central node vector and the neighbor node vector to obtain a spliced ​​target vector;

[0169] Aggregating the target vector using an aggregation function to obtain an aggregated vector;

[0170] The aggregated vector is filtered to obtain a dense vector of the graph structure data.

[0171] Optionally, the training module 66 is further used to:

[0172] The original graph neural network model is trained using the dense vector and the classification label to obtain the target graph neural network model, wherein the dense vector is the input of the original graph neural network model, and the label result corresponding to the dense vector output by the trained target graph neural network model and the classification result actually corresponding to the dense vector satisfy the following loss function:

[0173] Among them, y v is the actual label result of node v, σ(z v ) is the probability predicted by the target graph neural network, σ is the activation function, z v is the dense vector of node v, and λ||θ||2 is the constraint condition.

[0174] Optionally, the device further comprises:

[0175] An acquisition module is used to acquire target business data;

[0176] An input module is used to input the target business data into a pre-trained target graph neural network model to obtain the probability that the target business data input by the target graph neural network model corresponds to different classification results, wherein the classification result with a probability greater than a preset threshold is the abnormal behavior identification result corresponding to the target business data.

[0177] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0178] Example 3

[0179] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0180] Optionally, in this embodiment, the storage medium may be configured to store a computer program for performing the following steps:

[0181] S1, converting the acquired predetermined amount of business data into graph structure data, and extracting classification labels corresponding to the predetermined amount of business data;

[0182] S2, performing aggregation processing on the graph structure data to obtain a dense vector of the graph structure data;

[0183] S3, training the original graph neural network model through the dense vector and the classification label to obtain a trained target graph neural network model, wherein the target graph neural network model is used for abnormal behavior recognition.

[0184] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store computer programs.

[0185] Example 4

[0186] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0187] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0188] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0189] S1, converting the acquired predetermined amount of business data into graph structure data, and extracting classification labels corresponding to the predetermined amount of business data;

[0190] S2, performing aggregation processing on the graph structure data to obtain a dense vector of the graph structure data;

[0191] S3, training the original graph neural network model through the dense vector and the classification label to obtain a trained target graph neural network model, wherein the target graph neural network model is used for abnormal behavior recognition.

[0192] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments and optional implementation modes, and this embodiment will not be described in detail here.

[0193] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0194] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for determining an abnormal behavior recognition model, characterized in that: include: Converting the acquired predetermined amount of business data into graph structure data, and extracting classification labels corresponding to the predetermined amount of business data; Performing aggregation processing on the graph structure data to obtain a dense vector of the graph structure data; The original graph neural network model is trained by the dense vector and the classification label to obtain a trained target graph neural network model, including: using the dense vector and the classification label to train the original graph neural network model to obtain the target graph neural network model, wherein the dense vector is the input of the original graph neural network model, and the label result corresponding to the dense vector output by the trained target graph neural network model and the classification result actually corresponding to the dense vector satisfy the following loss function: in, y v is the actual label result of node v, σ(z v ) is the probability predicted by the target graph neural network, σ is the activation function, z v is a dense vector of node v, λ∥θ∥2 is a constraint condition, V is a set of nodes, and the target graph neural network model is used for abnormal behavior recognition.

2. The method according to claim 1, characterized in that Converting the acquired predetermined amount of business data into graph structure data, and extracting classification labels corresponding to the predetermined amount of business data includes: Allocate node IDs for the predetermined number of service data respectively, wherein one service data corresponds to one node; Extract the relationship of the predetermined number of nodes as the adjacency list of the graph structure data, define a variable of dictionary type, the key of the dictionary stores the node ID, and the corresponding value is all the corresponding neighbor nodes; Extracting a feature matrix (N, M) of the predetermined number of nodes, the feature matrix of the graph structure data, wherein M is the size of the constructed feature dimension and N is the number of nodes; The labels Y of the predetermined number of nodes are extracted to form a label matrix of the graph structure data.

3. The method according to claim 2, characterized in that Aggregating the graph structure data to obtain a dense vector of the graph structure data includes: Determine the similarity between the central node and the adjacent nodes according to the adjacency table, and obtain n nodes whose similarity is greater than a preset threshold; The center point and neighbor nodes among the n nodes are aggregated according to an aggregation function to form a dense vector of the graph structure data.

4. The method according to claim 3, characterized in that Determining the similarity between the central node and the adjacent nodes according to the adjacency table, and obtaining n nodes whose similarity is greater than a preset threshold comprises: Training a single-layer perception network according to the adjacency list, the label matrix of the graph structure data, and the feature vectors of the predetermined number of nodes; Calculating the predicted values ​​of the predetermined number of nodes through the single-layer perception network, and determining the L1 distance between the predicted values ​​of every two nodes; Determine the similarity between the central node and the adjacent nodes using the L1 distance; Sorting the similarities in descending order; The n nodes whose similarity is greater than the preset threshold are obtained.

5. The method according to claim 3, characterized in that: Aggregating the center point and neighbor nodes of the n nodes according to the aggregation function to form a dense vector of the graph structure data includes: Determine the center node vector and neighbor node vectors of the n nodes; Splicing the central node vector and the neighbor node vector to obtain a spliced ​​target vector; Aggregating the target vector using an aggregation function to obtain an aggregated vector; The aggregated vector is filtered to obtain a dense vector of the graph structure data.

6. The method according to any one of claims 1 to 5, characterized in that After the original graph neural network model is trained by using the dense vector and the classification label to obtain a trained target graph neural network model, the method further includes: Obtain target business data; The target business data is input into a pre-trained target graph neural network model to obtain the probability of the target business data input into the target graph neural network model corresponding to different classification results, wherein the classification result with the probability greater than a preset threshold is the abnormal behavior identification result corresponding to the target business data.

7. A device for determining an abnormal behavior recognition model, characterized in that: include: An extraction module, used to convert the acquired predetermined amount of business data into graph structure data, and extract classification labels corresponding to the predetermined amount of business data; An aggregation module, used for performing aggregation processing on the graph structure data to obtain a dense vector of the graph structure data; A training module, used to train the original graph neural network model through the dense vector and the classification label to obtain a trained target graph neural network model, including: using the dense vector and the classification label to train the original graph neural network model to obtain the target graph neural network model, wherein the dense vector is the input of the original graph neural network model, and the label result corresponding to the dense vector output by the trained target graph neural network model and the classification result actually corresponding to the dense vector satisfy the following loss function: in, y v is the actual label result of node v, σ(z v ) is the probability predicted by the target graph neural network, σ is the activation function, z v is a dense vector of node v, λ∥θ∥2 is a constraint condition, V is a set of nodes, and the target graph neural network model is used for abnormal behavior recognition.

8. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 6 when executed.

9. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 6.

Images