Abnormal object recognition method and device, electronic equipment and storage medium

Abstract

The present disclosure provides an abnormal object identification method and device, electronic equipment and storage medium, and relates to the technical fields of data mining, data processing and knowledge graph. The specific implementation scheme is: an object association graph between candidate objects is obtained, the object association graph includes multiple nodes, and different nodes represent different candidate objects; according to the object association graph, an object proximity feature and an object closeness feature of the nodes are obtained; the object proximity feature and the object closeness feature are fused to obtain a fusion feature of the nodes; based on the fusion feature of the nodes, an abnormal identification is performed on a target candidate object represented by the nodes to obtain an object identification result. The present disclosure can perform abnormal identification on unknown objects through the association relationship between known abnormal objects and unknown objects, and improve the accuracy of identification.

Description

Technical Field

[0001] This disclosure relates to the technical fields of data mining, data processing, and knowledge graphs, and in particular to a method, apparatus, electronic device, and storage medium for identifying abnormal objects. Background Technology

[0002] In big data analytics, it is often necessary to identify anomalous objects. Current techniques for identifying anomalous objects focus solely on the object's inherent characteristics. However, this approach often suffers from poor accuracy when dealing with objects with limited features. Therefore, improving the accuracy of identifying such objects is a crucial issue that needs to be addressed. Summary of the Invention

[0003] This disclosure provides a method, apparatus, electronic device, and storage medium for identifying abnormal objects.

[0004] Obtain an object association graph among candidate objects, wherein the object association graph includes multiple nodes, and different nodes represent different candidate objects;

[0005] Based on the object association graph, obtain the object proximity features and object density features of the nodes;

[0006] The proximity feature and the density feature of the object are fused to obtain the fused feature of the node;

[0007] Based on the fusion features of the nodes, anomaly identification is performed on the target candidate objects represented by the nodes to obtain object identification results.

[0008] This disclosure can identify anomalies in unknown objects by using the relationship between known anomaly objects and unknown objects, and improves the accuracy of identification.

[0009] According to another aspect of this disclosure, an anomalous object identification device is provided, comprising:

[0010] The first acquisition module is used to acquire an object association graph among candidate objects. The object association graph includes multiple nodes, and different nodes represent different candidate objects.

[0011] The second acquisition module is used to acquire the object proximity features and object density features of the nodes based on the object association graph;

[0012] The feature fusion module is used to fuse the object proximity feature and the object density feature to obtain the fused feature of the node;

[0013] An anomaly detection module is used to perform anomaly detection on the target candidate object represented by the node based on the fusion features of the node, and obtain the object detection result.

[0014] According to another aspect of this disclosure, an electronic device is provided, including at least one processor, and

[0015] A memory that is communicatively connected to at least one processor; wherein,

[0016] The memory stores instructions that can be executed by at least one processor to enable the at least one processor to perform the method for identifying abnormal objects according to the first aspect of this disclosure.

[0017] According to another aspect of this disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause a computer to execute an abnormal object identification method according to an embodiment of a first aspect of this disclosure.

[0018] According to another aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the method for identifying abnormal objects according to the first aspect of this disclosure.

[0019] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0020] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0021] Figure 1 This is a flowchart illustrating a method for identifying abnormal objects according to an embodiment of the present disclosure;

[0022] Figure 2 It is a schematic diagram of the object association graph;

[0023] Figure 3 This is a flowchart of a method for identifying abnormal objects according to another embodiment of the present disclosure;

[0024] Figure 4 This is an example diagram of an object association graph;

[0025] Figure 5 This is a schematic diagram of a method for identifying abnormal objects according to another embodiment of the present disclosure;

[0026] Figure 6 This is a diagram showing the nearest neighbor distance.

[0027] Figure 7 This is a flowchart of a method for identifying abnormal objects according to another embodiment of the present disclosure;

[0028] Figure 8 This is a schematic diagram of the structure of the abnormal object identification model;

[0029] Figure 9 This is a flowchart of a method for identifying abnormal objects according to another embodiment of the present disclosure.

[0030] Figure 10 This is a structural diagram of an abnormal object identification device according to an embodiment of the present disclosure;

[0031] Figure 11 This is a block diagram of an electronic device used to implement the abnormal object identification method of the embodiments of this disclosure. Detailed Implementation

[0032] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0033] Data processing refers to the process of processing data. Data is a form of expression of facts, concepts, or instructions, which can be processed manually or automatically. After data is interpreted and given meaning, it becomes information. Data processing encompasses the acquisition, storage, retrieval, processing, transformation, and transmission of data.

[0034] The fundamental purpose of data processing is to extract and deduce data that is valuable and meaningful to certain specific people from large amounts of data that may be messy and difficult to understand.

[0035] Data processing is a fundamental component of systems engineering and automatic control. It permeates all areas of social production and life. The development of data processing technology and the breadth and depth of its applications have profoundly influenced the progress of human society.

[0036] A knowledge graph is a series of different graphics that display the development process and structural relationships of knowledge. It uses visualization technology to describe knowledge resources and their carriers, and to mine, analyze, construct, draw and display knowledge and the interrelationships between them.

[0037] Knowledge graphs are a modern theory that combines theories and methods from applied mathematics, computer graphics, information visualization, and information science with methods such as bibliometric citation analysis and co-occurrence analysis. It uses visualized graphs to vividly display the core structure, development history, cutting-edge fields, and overall knowledge architecture of a discipline, thereby achieving the goal of multidisciplinary integration.

[0038] The acquisition, storage, and application of personal information of the subjects involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0039] The present disclosure describes, with reference to the accompanying drawings, a method, apparatus, electronic device, and storage medium for identifying abnormal objects.

[0040] Figure 1 This is a flowchart of an abnormal object identification method according to an embodiment of the present disclosure, such as... Figure 1 As shown, it includes the following steps:

[0041] S101, obtain the object association graph between candidate objects. The object association graph includes multiple nodes, and different nodes represent different candidate objects.

[0042] The objects in this embodiment of the disclosure may include users and things, etc. Accordingly, the object association graph includes people association graphs and things association graphs, etc., without any limitation. It should be noted that if the object is a user, the object association graph is a people association graph; if the object is a thing, the object association graph is a thing association graph.

[0043] It can obtain the basic information of candidate objects and the relationships between them, and generate an object relationship graph between candidate objects based on the basic information of candidate objects and the relationships between them.

[0044] Using candidate objects as an example, such as... Figure 2 As shown, personal information data and relationship data of candidate users are obtained, and a relationship graph is generated based on the personal information data and relationship data of the users.

[0045] S102, Based on the object association graph, obtain the object proximity feature and object density feature of the node.

[0046] The object association graph includes known nodes and unknown nodes. Correspondingly, the candidate objects include known objects and unknown objects. In this embodiment of the disclosure, the unknown nodes are nodes of interest. That is to say, the nodes in this embodiment of the disclosure are unknown nodes. Based on the object association graph, the object proximity features and object density features of the unknown nodes can be obtained.

[0047] Object proximity features are vector representations of the proximity relationships between candidate objects, used to characterize these relationships. Object association graphs reflect the proximity relationships between nodes; therefore, the proximity relationships between nodes and other nodes can be determined based on the object association graph. Based on these proximity relationships and the node features of other nodes, the object proximity features of a node can be obtained. Here, node features are vector representations of the basic information of candidate objects.

[0048] Object density feature is a vector representation of the degree of density between candidate objects, used to characterize the density between candidate objects. In some embodiments, the object density feature of a node can be obtained based on the proximity relationship between nodes and node features.

[0049] Using an object association graph as an example to illustrate a person association graph: the object proximity feature can be the user proximity feature, the object density feature can be the user density feature, the user proximity feature is a vector expression of the proximity relationship between candidate users, used to characterize the proximity relationship between candidate users, and the node feature is a vector expression of the candidate user data, which can characterize the basic information of the candidate user.

[0050] S103, fuse the object proximity feature and the object density feature to obtain the fused feature of the node.

[0051] Optionally, the object proximity feature and the object density feature are weighted and summed to obtain the fusion feature of the node.

[0052] In some embodiments, object proximity features and object density features are input into a fusion network, which then fuses the object proximity features and object density features and outputs the fused features of the nodes.

[0053] S104, based on the fusion features of nodes, performs anomaly identification on the target candidate objects represented by the nodes and obtains the object identification results.

[0054] In some embodiments, the fused features of the nodes are input into a classifier, which classifies the fused features to identify anomalies in the target candidate object and outputs the identification result. Optionally, the identification result may include the anomaly probability of the target candidate object.

[0055] This embodiment of the disclosure obtains an object association graph among candidate objects, the object association graph including multiple nodes, different nodes representing different candidate objects; based on the object association graph, it obtains the object proximity features and object density features of the nodes; it fuses the object proximity features and object density features to obtain the fused features of the nodes; based on the fused features of the nodes, it performs anomaly identification on the target candidate objects represented by the nodes to obtain the object identification results. In this embodiment of the disclosure, the fusion of object proximity features and object density features, while simultaneously focusing on the proximity and density relationships between objects, enables the identification of unknown objects through known abnormal objects, thereby improving the accuracy of abnormal object identification.

[0056] Figure 3 This is a flowchart of an abnormal object identification method according to an embodiment of the present disclosure, such as... Figure 3 As shown, it includes the following steps:

[0057] S301, Obtain the object association graph between candidate objects.

[0058] For a description of step S301, please refer to the relevant content of the above embodiments, which will not be repeated here.

[0059] S302, obtain the adjacency matrix of the object association graph.

[0060] The adjacency matrix can represent the graph structure of the object association graph.

[0061] For example, suppose the object association graph is as follows: Figure 4 Then the corresponding adjacency matrix A is:

[0062]

[0063] S303, based on the adjacency matrix, obtain the object proximity feature and object density feature of the node.

[0064] Optionally, based on the adjacency matrix, the neighboring nodes of a node are determined, and the first node feature of the node and the second node feature of the neighboring nodes are aggregated to obtain the object proximity feature of the node.

[0065] It should be noted that, in this embodiment of the disclosure, the object proximity features of neighboring nodes can be obtained in the same way, so as to further obtain the object density features of the nodes based on the object proximity features of the neighboring nodes.

[0066] Further, optionally, based on the adjacency matrix, the neighboring nodes of a node are determined, and based on the object proximity features of the node and the object proximity features of the neighboring nodes, the correlation degree between the node and the neighboring nodes is obtained. Based on the correlation degree, the object proximity features of the neighboring nodes are aggregated to obtain the object density features of the node.

[0067] Among them, the degree of correlation represents the closeness between nodes.

[0068] The correlation between a node and its neighboring nodes can be used as the weight of the object proximity feature of the neighboring nodes. Based on this weight, the object proximity features of the neighboring nodes are aggregated to obtain the object density feature of the node.

[0069] S304, fuse the object proximity feature and the object density feature to obtain the fused feature of the node.

[0070] S305, based on the fusion features of nodes, performs anomaly identification on the target candidate objects represented by the nodes and obtains the object identification results.

[0071] For a description of steps S304 to S305, please refer to the relevant content of the above embodiments, which will not be repeated here.

[0072] In this embodiment, an object association graph among candidate objects is obtained, and an adjacency matrix of the object association graph is obtained. Based on the adjacency matrix, object proximity features and object density features of nodes are obtained. The object proximity features and object density features are fused to obtain the fused features of nodes. Based on the fused features of nodes, anomaly identification is performed on the target candidate objects represented by the nodes to obtain object identification results. In this embodiment, the adjacency matrix is ​​used to represent the graph structure of the object association graph, which facilitates the acquisition of object proximity features and object density features, and can fully explore the proximity and association relationships between nodes in the object association graph.

[0073] Figure 5 This is a flowchart of an abnormal object identification method according to an embodiment of the present disclosure, such as... Figure 5 As shown, it includes the following steps:

[0074] S501, Obtain the object association graph between candidate objects.

[0075] S502, obtain the adjacency matrix of the object association graph.

[0076] For a description of steps S501 to S502, please refer to the relevant content of the above embodiments, which will not be repeated here.

[0077] S503 performs matrix transformation on the adjacency matrix to obtain the degree matrix.

[0078] For example, it will be as follows Figure 4 After the object association graph shown is converted into the neighbor matrix A, the corresponding degree matrix can be obtained by performing matrix transformation on the neighbor matrix A using the following formula (1).

[0079] D ii =∑ j A ij (1)

[0080] Where i represents the center node, j represents the neighboring node, and D ii Depth matrix, A ij This represents the adjacency matrix.

[0081] S504 performs matrix transformation on the adjacency matrix and degree matrix to obtain the target matrix.

[0082] Optionally, the target matrix can be a Laplace matrix.

[0083] In some embodiments, the adjacency matrix and degree matrix can be converted into the target matrix using the following formula (2).

[0084]

[0085] Where B represents the target matrix, D represents the degree matrix, and A represents the adjacency matrix.

[0086] S505: Input the target matrix and node features into the graph convolutional network in the abnormal object recognition model. The graph convolutional network then obtains the object proximity features of the nodes based on the target matrix and node features.

[0087] Optionally, after inputting the target matrix and node features into the graph convolutional network in the abnormal object recognition model, the graph convolutional neural network can determine the nodes and their neighboring nodes based on the target matrix.

[0088] The graph convolutional network includes M first hidden layers.

[0089] In this embodiment of the disclosure, the l-th first hidden layer of the graph convolutional network performs weighted aggregation on the first node features of the node and the second node features of the neighboring nodes according to the maximum proximity distance, and outputs weighted first node features and weighted second node features. The weighted first node features and weighted second node features are input into the (l+1)-th first hidden layer, and the (l+1)-th first hidden layer performs weighted aggregation on the weighted first node features and weighted second node features until the M-th first hidden layer outputs the object proximity features.

[0090] The calculation formula (3) for each first hidden layer of the graph convolutional network is as follows:

[0091]

[0092] Where l is a positive integer greater than 0 and less than M, K represents the maximum nearest neighbor distance, k is the nearest neighbor distance (hop), and B l This represents the degree matrix corresponding to the l-th hidden layer. This represents the second node feature output by the (l-1)th hidden layer of the neighboring nodes at a distance of k from node i. Let represent the first node feature of the first hidden layer of node i (l-1), i.e., the first node feature of the node of interest, where 'a' represents the decay coefficient, a = 1 / K. It is the object proximity feature of node i output by the l-th first hidden layer.

[0093] The following is combined with Figure 6 Explanation of k (hop): Figure 6 As shown, k=0 represents the central node, i.e. the point of interest; k=1 represents the neighboring node that is 1 distance from the central node; k=2 represents the neighboring node that is 2 distance from the central node; and k=3 represents the neighboring node that is 3 distance from the central node.

[0094] The graph convolutional network can iteratively calculate from the first hidden layer to the Mth hidden layer according to the above formula (3) until the calculation of the Mth hidden layer is completed, and then obtain the object proximity feature. The specific iterative process is as follows: the output of the first hidden layer is used as the input of the second hidden layer for calculation, the output of the second hidden layer is used as the input of the third hidden layer for calculation, ..., the output of the (M-1)th hidden layer is used as the input of the Mth hidden layer for calculation, and finally the Mth hidden layer calculates and outputs the object proximity feature.

[0095] S506 uses the graph attention network in the abnormal object recognition model to perform self-attention processing on the object proximity features of neighboring nodes, thereby obtaining the object density features of the nodes.

[0096] In this embodiment of the disclosure, the graph attention network obtains the correlation between a node and its neighboring nodes based on the object proximity feature. Through multiple second hidden layers in the graph attention network, the object proximity features of neighboring nodes are aggregated layer by layer according to the correlation to output the object density feature of the node.

[0097] In some implementations, graph attention networks can calculate the degree of association between a node and its neighboring nodes using the following formula (4).

[0098]

[0099] Where, α i，jσ represents the correlation between node i and node j, where node i is the focus and node j is a neighboring node. σ is the activation function, Θ is the projection matrix, and || denotes the concatenation operation. It is the transpose of the attention vector, N i It is the set of neighboring nodes of node i, exp() is an exponential function with the natural constant e as its base, H i H is the object proximity feature of node i. j The object proximity feature of node j, H k It is the proximity feature of the object k that is a distance k from node i.

[0100] The graph attention network includes M second hidden layers.

[0101] Furthermore, the l-th second hidden layer of the graph attention network performs weighted aggregation on the object proximity features and outputs weighted object proximity features. The weighted object proximity features are then input into the (l+1)-th second hidden layer, which performs weighted aggregation on the object proximity features until the object density features are output by the M-th second hidden layer.

[0102] The calculation formula (5) for each second hidden layer of the graph attention network is as follows:

[0103]

[0104] Where V is the number of multi-heads, and v is a positive integer less than V. The object proximity feature is the output of the (l-1)th hidden layer of node j, and W is a shared parameter. It is the object density feature of node i output by the l-th second hidden layer.

[0105] The graph attention network can iteratively calculate from the first second hidden layer to the Mth second hidden layer according to the above formula (5) until the calculation of the Mth second hidden layer is completed, thus obtaining the object density feature. The specific iterative process is as follows: the output of the first second hidden layer is used as the input of the second second hidden layer for calculation, the output of the second second hidden layer is used as the input of the third second hidden layer for calculation, ..., the output of the (M-1)th second hidden layer is used as the input of the Mth second hidden layer for calculation, and finally the Mth second hidden layer calculates and outputs the object density feature.

[0106] S507, fuse the object proximity feature and the object density feature to obtain the fused feature of the node.

[0107] In some implementations, the object proximity feature and the object density feature can be fused using the following formula (6) to obtain the fused feature of the node.

[0108]

[0109] Among them, H i is the fusion feature of node i, and w1 and w2 are the weight coefficients. This is the object density feature of node i output by the Mth second hidden layer of the graph attention network. It is the object proximity feature of node i output by the first hidden layer of the Mth layer of the graph convolutional network.

[0110] S508, based on the fusion features of nodes, performs anomaly identification on the target candidate objects represented by the nodes and obtains the object identification results.

[0111] For a description of step S508, please refer to the relevant content of the above embodiments, which will not be repeated here.

[0112] In this embodiment, an object association graph among candidate objects is obtained, and an adjacency matrix of the object association graph is obtained. The adjacency matrix is ​​then transformed to obtain a degree matrix. The adjacency matrix and degree matrix are further transformed to obtain a target matrix. The target matrix and node features are input into a graph convolutional network in the abnormal object recognition model. Based on the target matrix and node features, the graph convolutional network obtains the object proximity features of the nodes. The graph attention network in the abnormal object recognition model performs self-attention processing on the object proximity features of neighboring nodes to obtain the object density features of the nodes. The object proximity features and object density features are fused to obtain the fused features of the nodes. Based on the fused features of the nodes, anomaly recognition is performed on the target candidate objects represented by the nodes, and the object recognition result is obtained. In this embodiment, the features output by the graph convolutional network and the graph attention network are fused, and anomaly recognition is performed using the fused features. This approach simultaneously considers the proximity and association relationships between objects, thereby enabling anomaly recognition of unknown objects through the proximity and association relationships between unknown objects and known abnormal objects, and improving the accuracy of the recognition.

[0113] Figure 7 This is a flowchart illustrating an abnormal object identification method provided in one embodiment of the present disclosure. Based on the above embodiment, it further incorporates... Figure 7 The training process of the abnormal object recognition model is explained, including the following steps:

[0114] S701 trains the initial abnormal object recognition model based on the sample object association graph to obtain the first loss function of the graph convolutional network and the second loss function of the graph self-attention network.

[0115] Optionally, the first loss function of the graph convolutional network can be the Dice loss function, and the second loss function of the graph self-attention network can be the cross-entropy loss function.

[0116] The process involves obtaining the sample adjacency matrix of the sample object association graph, converting it into a sample degree matrix, and then transforming both the sample adjacency matrix and the sample degree matrix into a sample target matrix. The sample target matrix and sample node features are then input into the graph convolutional network (GCNN) of the initial anomaly detection model. Based on the sample target matrix and sample node features, the GCNN obtains the predicted object proximity features of unknown nodes. A graph attention network then performs self-attention processing on the predicted object proximity features of the unknown node's neighboring nodes to obtain the predicted object density features of the unknown node. Finally, the first loss function of the GCNN is obtained using the predicted object proximity features and the true object proximity features, and the second loss function of the graph self-attention network is obtained using the predicted object density features and the true object density features.

[0117] S702, the first loss function and the second loss function are weighted to obtain the target loss function.

[0118] Alternatively, the target loss function can be calculated using the following formula.

[0119] L CDL =w Dice exp(L Dice )+w Cross L Cross

[0120] Among them, L CDL It is the target loss function, L Dice It is the Dice loss function, L Cross It is the cross-entropy loss function, w Dice These are the weighting coefficients of the Dice loss function, w Cross These are the weighting coefficients of the cross-entropy loss function.

[0121] In some embodiments, the first loss function and the second loss function can be weighted according to the number of sample categories in the training samples, that is, the weight coefficients of the Dice loss function and the weight coefficients of the cross-entropy loss function can be adjusted according to the number of sample categories in the training samples.

[0122] The Dice loss function allows the model to focus more on samples with a small percentage of total samples, but its stability is poor. The occurrence of a few outliers can cause significant fluctuations in the Dice loss function. In contrast, the cross-entropy loss function has strong stability. Combining the Dice loss function and the cross-entropy loss function can achieve better training results for the model.

[0123] S703, based on the objective loss function, adjusts the initial abnormal object recognition model and continues training until the abnormal object recognition model is obtained after training is completed.

[0124] After obtaining the target loss function, the initial abnormal object recognition model can be adjusted based on the target loss function. After adjustment, the target loss function can be obtained again, and the model can be trained again using the newly obtained target loss function until the abnormal object recognition model is obtained after training.

[0125] In this embodiment, an initial abnormal object recognition model is trained based on a sample object association graph to obtain a first loss function of a graph convolutional network and a second loss function of a graph self-attention network. The first and second loss functions are weighted to obtain a target loss function. Based on the target loss function, the initial abnormal object recognition model is adjusted and training continues until the abnormal object recognition model is obtained after training. In this embodiment, training the model using a weighted loss function derived from the loss functions of the graph convolutional network and the graph attention network can solve the problem of imbalanced training samples, resulting in better training effects and thus improving the accuracy of the abnormal object recognition model.

[0126] Figure 8 A schematic diagram of the structure of the abnormal object identification model, as shown below. Figure 8 As shown, the abnormal object recognition model includes a graph convolutional network, a graph attention network, and a classifier. The target matrix and node features are input into the graph convolutional network of the abnormal object recognition model. The graph convolutional network processes the data and outputs object proximity features. These object proximity features are then input into the graph attention network, which processes the data and outputs object density features. The object proximity and object density features are then fused to obtain a fused feature, which is input into the classifier. The classifier uses the fused feature to identify unknown objects as anomalies and outputs the recognition result.

[0127] Figure 9 A flowchart illustrating the method for identifying abnormal objects, as shown below. Figure 9 As shown, an object association graph is obtained, an adjacency matrix is ​​generated based on the object association graph, and the adjacency matrix is ​​converted into a degree matrix. Then, the adjacency matrix and the degree matrix are converted into a target matrix. The target matrix and node features are input into an abnormal object recognition model. The abnormal object recognition model is used to identify unknown abnormal objects based on known abnormal objects and output the recognition results.

[0128] Figure 10 This is a structural diagram of an abnormal object identification device according to an embodiment of the present disclosure, such as... Figure 10 As shown, the abnormal object identification device 1000 includes:

[0129] The first acquisition module 1010 is used to acquire an object association graph among candidate objects. The object association graph includes multiple nodes, and different nodes represent different candidate objects.

[0130] The second acquisition module 1020 is used to acquire the object proximity features and object density features of nodes based on the object association graph;

[0131] The feature fusion module 1030 is used to fuse object proximity features and object density features to obtain the fused features of nodes;

[0132] The anomaly detection module 1040 is used to perform anomaly detection on the target candidate objects represented by the nodes based on the fusion features of the nodes, and obtain the object detection results.

[0133] In some implementations, the second acquisition module 1020 is also used for:

[0134] Obtain the adjacency matrix of the object relationship graph;

[0135] Based on the adjacency matrix, obtain the object proximity feature and object density feature of the node.

[0136] In some implementations, the second acquisition module 1020 is also used for:

[0137] Determine the neighboring nodes of a node based on the adjacency matrix;

[0138] The object proximity feature of a node is obtained by aggregating the first node feature of a node and the second node feature of its neighboring nodes.

[0139] In some implementations, the second acquisition module 1020 is also used for:

[0140] Determine the neighboring nodes of a node based on the adjacency matrix;

[0141] Based on the object proximity features of the node and the object proximity features of the neighboring nodes, obtain the correlation degree between the node and the neighboring nodes of the node;

[0142] Based on the correlation degree, feature aggregation is performed on the object proximity features of neighboring nodes to obtain the object density features of the nodes.

[0143] In some implementations, the second acquisition module 1020 is also used for:

[0144] Perform matrix transformation on the adjacency matrix to obtain the degree matrix;

[0145] Perform matrix transformation on the adjacency matrix and degree matrix to obtain the target matrix;

[0146] The target matrix and node features are input into the graph convolutional network in the abnormal object recognition model. The graph convolutional network then obtains the object proximity features of the nodes based on the target matrix and node features.

[0147] The graph attention network in the abnormal object recognition model performs self-attention processing on the object proximity features of neighboring nodes to obtain the object density features of the nodes.

[0148] In some implementations, the second acquisition module 1020 is also used for:

[0149] The graph convolutional network determines the nodes and their neighboring nodes based on the target matrix;

[0150] The graph convolutional network includes M first hidden layers. The l-th first hidden layer of the graph convolutional network performs feature weighting and aggregation on the first node features and the second node features respectively based on the maximum neighbor distance, and outputs weighted first node features and weighted second node features.

[0151] The weighted first node features and weighted second node features are input into the (l+1)th first hidden layer. The (l+1)th first hidden layer performs weighted aggregation on the weighted first node features and weighted second node features until the Mth first hidden layer outputs the object proximity features.

[0152] In some implementations, the second acquisition module 1020 is also used for:

[0153] The graph attention network obtains the correlation between nodes and their neighboring nodes based on the object proximity feature;

[0154] By using multiple second hidden layers in the graph attention network, the object proximity features of neighboring nodes are aggregated layer by layer according to the degree of association, so as to output the object density features of the nodes.

[0155] In some implementations, the second acquisition module 1020 is also used for:

[0156] The graph attention network includes M second hidden layers. The (l+1)th second hidden layer of the graph attention network performs feature weighting and aggregation on the object proximity features and outputs weighted object proximity features.

[0157] The weighted object proximity features are input into the (l+1)th second hidden layer, and the (l+1)th second hidden layer performs weighted aggregation on the object proximity features until the Mth second hidden layer outputs the object density features.

[0158] In some implementations, the abnormal object identification device 1000 further includes a training model 1050, which is used for:

[0159] Based on the sample object relationship graph, the initial abnormal object recognition model is trained to obtain the first loss function of the graph convolutional network and the second loss function of the graph self-attention network.

[0160] By weighting the first loss function and the second loss function, the target loss function is obtained.

[0161] Based on the objective loss function, the initial abnormal object recognition model is adjusted and trained again until the abnormal object recognition model is obtained after training is completed.

[0162] In this embodiment of the disclosure, object proximity features and object density features are fused together, and both proximity and density relationships between objects are considered. This enables the identification of unknown objects through known abnormal objects, thereby improving the accuracy of abnormal object identification.

[0163] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0164] Figure 11 A schematic block diagram of an example electronic device 1100 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0165] like Figure 11 As shown, device 1100 includes a computing unit 1101, which can perform various appropriate actions and processes according to a computer program stored in read-only memory (ROM) 1102 or a computer program loaded from storage unit 1108 into random access memory (RAM) 1103. The RAM 1103 may also store various programs and data required for the operation of device 1100. The computing unit 1101, ROM 1102, and RAM 1103 are interconnected via bus 1104. Input / output (I / O) interface 1105 is also connected to bus 1104.

[0166] Multiple components in device 1100 are connected to I / O interface 1105, including: input unit 1106, such as keyboard, mouse, etc.; output unit 1107, such as various types of monitors, speakers, etc.; storage unit 1108, such as disk, optical disk, etc.; and communication unit 1109, such as network card, modem, wireless transceiver, etc. Communication unit 1109 allows device 1100 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0167] The computing unit 1101 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 1101 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 1101 performs the various methods and processes described above, such as the method for identifying anomalous objects. For example, in some embodiments, the method for identifying anomalous objects may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 1108. In some embodiments, part or all of the computer program may be loaded and / or installed on device 1100 via ROM 1102 and / or communication unit 1109. When the computer program is loaded into RAM 1103 and executed by the computing unit 1101, one or more steps of the method for identifying anomalous objects described above may be performed. Alternatively, in other embodiments, the computing unit 1101 may be configured to perform an abnormal object identification method by any other suitable means (e.g., by means of firmware).

[0168] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0169] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0170] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0171] To provide interaction with an object, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor for displaying information to the object; and a keyboard and pointing device (e.g., a mouse or trackball) through which the object provides input to the computer. Other types of devices can also be used to provide interaction with the object; for example, feedback provided to the object can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the object can be received in any form (including sound input, voice input, or tactile input).

[0172] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., an object computer with a graphical object interface or web browser through which an object can interact with the implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0173] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0174] It should be understood that the various forms of processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0175] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for identifying abnormal objects, comprising: Obtain a person relationship graph among candidate objects. The person relationship graph includes multiple nodes, and different nodes represent different candidate objects. The candidate objects are candidate users. The person relationship graph is generated based on the user's personal information data and person relationship data. Obtain the adjacency matrix of the character association graph; Based on the adjacency matrix, the object proximity feature and object density feature of the node are obtained; wherein, the object proximity feature is a vector expression of the proximity relationship between candidate objects, used to characterize the proximity relationship between candidate objects; the object density feature is a vector expression of the density between candidate objects, used to characterize the density between candidate objects. The proximity feature and the density feature of the object are fused to obtain the fused feature of the node; Based on the fusion features of the nodes, anomaly identification is performed on the target candidate objects represented by the nodes to obtain object identification results; The step of obtaining the object proximity feature and object density feature of the node based on the adjacency matrix includes: Perform matrix transformation on the adjacency matrix to obtain the degree matrix; Perform matrix transformation on the adjacency matrix and the degree matrix to obtain the target matrix; The target matrix and node features are input into the graph convolutional network in the abnormal object recognition model. The graph convolutional network then obtains the object proximity features of the nodes based on the target matrix and the node features. The graph attention network in the abnormal object recognition model performs self-attention processing on the object proximity features of the neighboring nodes to obtain the object density features of the nodes. The step of obtaining the object proximity feature and object density feature of the node based on the adjacency matrix further includes: Based on the adjacency matrix, determine the neighboring nodes of the node; The object proximity feature of the node is obtained by performing feature aggregation on the first node feature of the node and the second node feature of the neighboring nodes. Based on the object proximity features of the node and the object proximity features of the neighboring nodes, the correlation degree between the node and its neighboring nodes is obtained; Based on the correlation degree, feature aggregation is performed on the object proximity features of the neighboring nodes to obtain the object density features of the nodes.

2. The method according to claim 1, wherein, The method further includes: The graph convolutional network determines the node and its neighboring nodes based on the target matrix; The graph convolutional network includes M The first hidden layer is formed by the first hidden layer of the graph convolutional network. l The first hidden layer performs feature weighting and aggregation on the features of the first node and the second node based on the maximum nearest neighbor distance, and outputs the weighted first node features and the weighted second node features. Input the weighted first node features and the weighted second node features into the first node. l +1 in the first hidden layer, by the first l +1 first hidden layers perform weighted aggregation on the weighted first node features and the weighted second node features until the first hidden layer... M The first hidden layer outputs the object proximity feature.

3. The method according to claim 1, wherein, The method further includes: The graph attention network obtains the correlation degree between the node and its neighboring nodes based on the object proximity feature; Through multiple second hidden layers in the graph attention network, the object proximity features of the neighboring nodes are aggregated layer by layer according to the correlation degree to output the object density features of the nodes.

4. The method according to claim 3, wherein, The step of performing layer-by-layer feature aggregation on the object proximity features of the neighboring nodes based on the correlation degree to output the object density features of the nodes includes: The graph attention network includes M The second hidden layer is formed by the graph attention network. l A second hidden layer performs feature weighting and aggregation on the object proximity features and outputs weighted object proximity features; Input the weighted object proximity feature into the first... l +1 in the second hidden layer, by the first l +1 second hidden layer l The proximity features of the objects are weighted and aggregated until the nearest neighbor is determined by the first nearest neighbor. M The second hidden layer outputs the object's density feature.

5. The method according to claim 1, wherein, The training process of the abnormal object recognition model includes: Based on the sample person association graph, the initial abnormal object recognition model is trained to obtain the first loss function of the graph convolutional network and the second loss function of the graph self-attention network. By weighting the first loss function and the second loss function, the target loss function is obtained. Based on the target loss function, the initial abnormal object recognition model is adjusted and trained again until the abnormal object recognition model is obtained after training is completed.

6. A device for identifying abnormal objects, wherein, include: The first acquisition module is used to acquire a person relationship graph among candidate objects. The person relationship graph includes multiple nodes, and different nodes represent different candidate objects. The candidate objects are candidate users. The person relationship graph is generated based on the user's personal information data and person relationship data. The second acquisition module is used to acquire the adjacency matrix of the character association graph; and based on the adjacency matrix, acquire the object proximity feature and object density feature of the node; wherein, the object proximity feature is a vector expression of the proximity relationship between candidate objects, used to characterize the proximity relationship between candidate objects; and the object density feature is a vector expression of the density between candidate objects, used to characterize the density between candidate objects. The feature fusion module is used to fuse the object proximity feature and the object density feature to obtain the fused feature of the node; An anomaly detection module is used to perform anomaly detection on the target candidate object represented by the node based on the fusion features of the node, and obtain the object detection result; The second acquisition module is further configured to: Perform matrix transformation on the adjacency matrix to obtain the degree matrix; Perform matrix transformation on the adjacency matrix and the degree matrix to obtain the target matrix; The target matrix and node features are input into the graph convolutional network in the abnormal object recognition model. The graph convolutional network then obtains the object proximity features of the nodes based on the target matrix and the node features. The graph attention network in the abnormal object recognition model performs self-attention processing on the object proximity features of the neighboring nodes to obtain the object density features of the nodes. The second acquisition module is further configured to: Based on the adjacency matrix, determine the neighboring nodes of the node; The object proximity feature of the node is obtained by performing feature aggregation on the first node feature of the node and the second node feature of the neighboring nodes. Based on the object proximity features of the node and the object proximity features of the neighboring nodes, the correlation degree between the node and its neighboring nodes is obtained; Based on the correlation degree, feature aggregation is performed on the object proximity features of the neighboring nodes to obtain the object density features of the nodes.

7. The apparatus according to claim 6, wherein, The second acquisition module is further configured to: The graph convolutional network determines the node and its neighboring nodes based on the target matrix; The graph convolutional network includes M The first hidden layer is formed by the first hidden layer of the graph convolutional network. l The first hidden layer performs feature weighting and aggregation on the features of the first node and the second node based on the maximum nearest neighbor distance, and outputs the weighted first node features and the weighted second node features. Input the weighted first node features and the weighted second node features into the first node. l+ In the first hidden layer, the first... l+ A first hidden layer performs weighted aggregation on the weighted first node features and the weighted second node features until the first hidden layer performs weighted aggregation on the second hidden node features. M The first hidden layer outputs the object proximity feature.

8. The apparatus according to claim 7, wherein, The second acquisition module is further configured to: The graph attention network obtains the correlation degree between the node and its neighboring nodes based on the object proximity feature; Through multiple second hidden layers in the graph attention network, the object proximity features of the neighboring nodes are aggregated layer by layer according to the correlation degree to output the object density features of the nodes.

9. The apparatus according to claim 8, wherein, The second acquisition module is further configured to: The graph attention network includes M The second hidden layer is formed by the graph attention network. l A second hidden layer performs feature weighting and aggregation on the object proximity features and outputs weighted object proximity features; Input the weighted object proximity feature into the first... l +1 in the second hidden layer, by the first l +1 second hidden layer performs weighted aggregation of the object proximity features until the first... M The second hidden layer outputs the object's density feature.

10. The apparatus according to claim 6, wherein, The device further includes a training module, the training module being used for: Based on the sample object relationship graph, the initial abnormal object recognition model is trained to obtain the first loss function of the graph convolutional network and the second loss function of the graph self-attention network. By weighting the first loss function and the second loss function, the target loss function is obtained. Based on the target loss function, the initial abnormal object recognition model is adjusted and trained again until the abnormal object recognition model is obtained after training is completed.

11. An electronic device, comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-5.

12. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-5.

13. A computer program product comprising a computer program that, when executed by a processor, implements the steps of the method according to any one of claims 1-5.

Images