Detection method, device, equipment and storage medium

Abstract

The present disclosure provides a detection method, device, equipment and storage medium, which relate to the field of computer technology. The method includes obtaining node attribute information of a target node at a preset time point and node attribute information of a node associated with the target node within a preset time period, wherein the preset time period includes the preset time point, inputting the node attribute information of the target node at the preset time point and the node attribute information of the node associated with the target node within the preset time period into a trained prediction model, and obtaining a prediction result of the target node. The present disclosure can detect network entities in a dynamic network.

Description

Background Art

[0002] In order to maintain the security of the Internet, it may be necessary to detect different network nodes at different times. However, since there may be no access relationship between different network nodes at different times, it is difficult to detect the above network using commonly used detection methods. Summary of the invention

[0003] The present disclosure provides a detection method, system, apparatus, device and storage medium, which at least to some extent overcome the problem of difficulty in detecting network entities in a dynamic network.

[0004] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0005] According to one aspect of the present disclosure, a detection method is provided, comprising:

[0006] Obtaining node attribute information of a target node at a preset time point and node attribute information of nodes associated with the target node within a preset time period, wherein the preset time period includes the preset time point;

[0007] The node attribute information of the target node at a preset time point and the node attribute information of the nodes associated with the target node within a preset time period are input into the trained prediction model to obtain the prediction result of the target node.

[0008] In one embodiment of the present disclosure, before acquiring the node attribute information of the target node at a preset time point and the node attribute information of the node associated with the target node within a preset time period, the method further includes:

[0009] Determine a network access dynamic graph according to network entities and access relationships between network entities, the network entities are nodes of the network access dynamic graph, the access relationships between network entities are edges connecting nodes of the network access dynamic graph, and the access time of the network entities is the establishment time of the edges of the nodes;

[0010] Obtaining node attribute information of a target node at a preset time point and node attribute information of nodes associated with the target node within a preset time period, including:

[0011] The node attribute information of the target node at a preset time point and the node attribute information of the nodes associated with the target node within a preset time period are obtained according to the network access dynamic graph.

[0012] In one embodiment of the present disclosure, before inputting the node attribute information of the target node at a preset time point and the node attribute information of the nodes associated with the target node within a preset time period into the trained prediction model to obtain the prediction result of the target node, the method further includes:

[0013] The prediction model is trained according to the training samples, and a trained prediction model is obtained after the preset training stop condition is met, wherein the training samples include node attribute information of historical normal nodes and nodes associated with historical normal nodes at historical time points, and node attribute information of historical abnormal nodes and nodes associated with historical abnormal nodes in historical time periods.

[0014] In one embodiment of the present disclosure, training a prediction model according to training samples includes:

[0015] Obtain the embedding information corresponding to the historical normal nodes, the positive contrast embedding information, and the negative contrast embedding information corresponding to the historical abnormal nodes in the training samples respectively;

[0016] Determine a contrast loss function value according to the embedding information, the positive contrast embedding information, the negative contrast embedding information, and the first formula, and obtain a trained prediction model after the contrast loss function value satisfies a preset training stop condition;

[0017] The first formula is:

[0018]

[0019] Among them, loss is the loss function value, sim is the cosine similarity, τ is the hyperparameter, For positive comparison, embedding information is is the negative contrast embedding information, batch represents the total number of normal nodes and abnormal nodes, h c,out is the embedded information, c is a normal node, and d is an abnormal node.

[0020] In one embodiment of the present disclosure, the contrast loss function value is determined according to the embedding information, the positive contrast embedding information, the negative contrast embedding information and the first formula, and after the contrast loss function value satisfies the preset training stop condition, a trained prediction model is obtained, including:

[0021] Determine a contrast loss function value according to the embedding information, the positive contrast embedding information, the negative contrast embedding information and the first formula;

[0022] Among the multiple loss function values ​​obtained continuously, when the difference between any two loss function values ​​meets the preset threshold, it is determined that the preset training stop condition is met, and a prediction model that has completed the training is obtained.

[0023] In one embodiment of the present disclosure, respectively acquiring embedding information corresponding to normal nodes in training samples, positive contrast embedding information, and negative contrast embedding information corresponding to abnormal nodes includes:

[0024] Determine the timing embedding information corresponding to the historical normal nodes, the timing embedding information corresponding to the historical abnormal nodes, the timing embedding information corresponding to the historical normal nodes, and the timing embedding information corresponding to the nodes associated with the historical abnormal nodes according to the node attribute information of the historical normal nodes, the node attribute information of the historical abnormal nodes, the node attribute information of the nodes associated with the historical normal nodes, and the node attribute information of the nodes associated with the historical abnormal nodes;

[0025] Determine the embedding information corresponding to the historical normal node according to the feedforward neural network, the time series embedding information corresponding to the historical normal node, and the time series embedding information corresponding to the node associated with the historical normal node;

[0026] Determine the forward comparison embedding information corresponding to the normal node according to the node attribute information of the historical normal node at a preset time point, the node attribute information of the node associated with the historical normal node within a preset time period, and the graph translation matrix;

[0027] Determine the embedding information corresponding to the historical abnormal node according to the feedforward neural network, the time series embedding information corresponding to the historical abnormal node, and the time series embedding information corresponding to the node associated with the historical abnormal node;

[0028] The negative contrast embedding information corresponding to the historical abnormal node is determined according to the node attribute information of the historical abnormal node at a preset time point, the node attribute information of the nodes associated with the historical abnormal node within a preset time period, and the graph translation matrix.

[0029] In one embodiment of the present disclosure, the forward comparison embedding information corresponding to the normal node is determined according to the node attribute information of the normal node at a preset time point, the node attribute information of the node associated with the normal node within a preset time period, and the graph translation matrix, including:

[0030] Determine the translation weight between each normal node-associated node and the normal node according to the node attribute information of the normal node at a preset time point, the node attribute information of the normal node-associated node within a preset time period, and the graph translation matrix;

[0031] Deleting a preset number of normal node-associated nodes with relatively high translation weights to obtain deleted normal node-associated nodes;

[0032] The forward contrast embedding information corresponding to the normal node is determined according to the feedforward neural network, the temporal embedding information corresponding to the normal node, and the temporal embedding information corresponding to the normal node associated node.

[0033] According to another aspect of the present disclosure, a detection device is provided, the device comprising:

[0034] An acquisition module, used to acquire node attribute information of a target node at a preset time point and node attribute information of nodes associated with the target node within a preset time period, wherein the preset time period includes a preset time point;

[0035] The input module is used to input the node attribute information of the target node at a preset time point and the node attribute information of the target node associated nodes within a preset time period into the trained prediction model to obtain the prediction result of the target node.

[0036] In one embodiment of the present disclosure, the detection device further includes:

[0037] A determination module, before obtaining the node attribute information of the target node at a preset time point and the node attribute information of the node associated with the target node within a preset time period, is used to determine the network access dynamic graph according to the network entities and the access relationships between the network entities, the network entities are the nodes of the network access dynamic graph, the access relationships between the network entities are the edges connecting the nodes of the network access dynamic graph, and the access moments of the network entities are the establishment times of the edges of the nodes;

[0038] Get modules, including:

[0039] The first acquisition unit is used to acquire node attribute information of the target node at a preset time point and node attribute information of nodes associated with the target node within a preset time period according to the network access dynamic graph.

[0040] In one embodiment of the present disclosure, the detection device further includes:

[0041] The training module is used to train the prediction model according to the training samples before inputting the node attribute information of the target node at a preset time point and the node attribute information of the target node associated nodes within a preset time period into the trained prediction model to obtain the prediction result of the target node, and obtain the trained prediction model after the preset training stop condition is met, wherein the training samples include the node attribute information of the historical normal nodes and the nodes associated with the historical normal nodes at the historical time points, and the node attribute information of the historical abnormal nodes and the nodes associated with the historical abnormal nodes in the historical time period.

[0042] In one embodiment of the present disclosure, the training module includes:

[0043] The second acquisition unit is used to respectively acquire the embedding information corresponding to the historical normal nodes, the positive contrast embedding information, and the negative contrast embedding information corresponding to the historical abnormal nodes in the training sample;

[0044] A determination unit, configured to determine a contrast loss function value according to the embedding information, the positive contrast embedding information, the negative contrast embedding information, and the first formula, and obtain a trained prediction model after the contrast loss function value satisfies a preset training stop condition;

[0045] The first formula is:

[0046]

[0047] Among them, loss is the loss function value, sim is the cosine similarity, τ is the hyperparameter, For positive comparison, embedding information is is the negative contrast embedding information, batch represents the total number of normal nodes and abnormal nodes, h c,out is the embedded information, c is a normal node, and d is an abnormal node.

[0048] In one embodiment of the present disclosure, the determining unit includes:

[0049] A first determination subunit, configured to determine a contrast loss function value according to the embedding information, the positive contrast embedding information, the negative contrast embedding information, and the first formula;

[0050] The second determination subunit is used to determine that a preset training stop condition is met when the difference between any two loss function values ​​among the multiple loss function values ​​obtained continuously meets a preset threshold, so as to obtain a prediction model that has completed training.

[0051] In one embodiment of the present disclosure, the second acquisition unit includes:

[0052] A third determination subunit is used to determine the timing embedding information corresponding to the historical normal nodes, the timing embedding information corresponding to the historical abnormal nodes, the timing embedding information corresponding to the historical normal nodes, and the timing embedding information corresponding to the nodes associated with the historical abnormal nodes according to the node attribute information of the historical normal nodes, the node attribute information of the historical abnormal nodes, the node attribute information of the nodes associated with the historical normal nodes, and the node attribute information of the nodes associated with the historical abnormal nodes;

[0053] A fourth determination subunit is used to determine the embedding information corresponding to the historical normal node according to the feedforward neural network, the time series embedding information corresponding to the historical normal node, and the time series embedding information corresponding to the node associated with the historical normal node;

[0054] A fifth determination subunit is used to determine the positive comparison embedding information corresponding to the normal node according to the node attribute information of the historical normal node at a preset time point, the node attribute information of the node associated with the historical normal node within a preset time period, and the graph translation matrix;

[0055] A sixth determination subunit, configured to determine the embedding information corresponding to the historical abnormal node according to the feedforward neural network, the time series embedding information corresponding to the historical abnormal node, and the time series embedding information corresponding to the node associated with the historical abnormal node;

[0056] The seventh determination subunit is used to determine the negative comparison embedding information corresponding to the historical abnormal node according to the node attribute information of the historical abnormal node at a preset time point, the node attribute information of the node associated with the historical abnormal node within a preset time period, and the graph translation matrix.

[0057] In one embodiment of the present disclosure, the fifth determining subunit includes:

[0058] Determine a node, for determining a translation weight between each normal node-associated node and the normal node according to node attribute information of the normal node at a preset time point, node attribute information of the normal node-associated node within a preset time period, and a graph translation matrix;

[0059] Deleting nodes, used to delete a preset number of normal node-associated nodes with higher translation weights to obtain deleted normal node-associated nodes;

[0060] Determine a node, and determine the forward comparison embedding information corresponding to the normal node according to the feedforward neural network, the temporal embedding information corresponding to the normal node, and the temporal embedding information corresponding to the normal node associated node.

[0061] According to another aspect of the present disclosure, an electronic device is provided, including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the above-mentioned detection method by executing the executable instructions.

[0062] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned detection method is implemented.

[0063] The detection method provided by the embodiment of the present disclosure obtains the node attribute information of the target node at a preset time point and the node attribute information of the node associated with the target node within a preset time period, and then inputs the node attribute information of the target node within the preset time period and the node attribute information of the node associated with the target node within the preset time period into the trained prediction model to obtain the prediction result of the target node. Since the attribute information of the associated node associated with the target node within the preset time period is obtained, the prediction result obtained based on the prediction model can meet the needs of spatiotemporal dynamics and can detect the dynamic network.

[0064] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0066] Figure 1 A flow chart of a detection method in an embodiment of the present disclosure is shown;

[0067] Figure 2 Another detection method flow chart in the embodiment of the present disclosure is shown;

[0068] Figure 3 A flow chart of another detection method in an embodiment of the present disclosure is shown;

[0069] Figure 4 A flow chart of another detection method in an embodiment of the present disclosure is shown;

[0070] Figure 5 A flow chart of another detection method in an embodiment of the present disclosure is shown;

[0071] Figure 6 A schematic diagram of a detection device in an embodiment of the present disclosure is shown; and

[0072] Figure 7 A structural block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0073] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0074] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0075] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0076] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0077] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0078] The behavior of a network access entity has the characteristic of time-series variation. At different time sequences, an entity may suddenly establish access relations with another entity, or disconnect from another entity. Currently, there are usually two methods for detecting the above network access entity.

[0079] One method is to establish subgraphs according to time intervals, learn subgraph embeddings, and obtain abnormal classification of samples by learning the temporal connections of these subgraph embeddings.

[0080] One is to add time-step embedding information and time-step attention to the domain embedding of the graph to improve the abnormal classification effect of graph entities.

[0081] However, the above two methods may cause information loss in the segmentation of time series subgraphs, and there is ambiguity in the classification edge of positive and negative samples in the embedding space.

[0082] In order to solve the above problems, the embodiments of the present disclosure provide a detection method, an apparatus, a device and a storage medium.

[0083] Figure 1 A flow chart of a detection method in an embodiment of the present disclosure is shown.

[0084] like Figure 1As shown, the detection method provided by the embodiment of the present disclosure may include:

[0085] S102, obtaining node attribute information of a target node at a preset time point and node attribute information of nodes associated with the target node within a preset time period, wherein the preset time period includes a preset time point.

[0086] It should be noted that the target node may include a node to be detected. The preset time point may include a time point corresponding to a future moment.

[0087] Node attribute information may include the number of nodes associated with the node, the parameters of the node, the number of times the node visits its other nodes, and the number of times the node is visited by other nodes.

[0088] The target node associated nodes may include nodes that have had access behaviors with the node within a preset time period.

[0089] The preset time period may include a historical time period. It is understandable that the preset time point may be any time point within the preset time period.

[0090] S104, inputting the node attribute information of the target node at a preset time point and the node attribute information of the nodes associated with the target node within a preset time period into the trained prediction model to obtain a prediction result of the target node.

[0091] It should be noted that the attribute information of the target node associated node is of the same type as the attribute information of the target node, which will not be described in detail here.

[0092] The detection method provided by the embodiment of the present disclosure obtains the node attribute information of the target node at a preset time point and the node attribute information of the node associated with the target node within a preset time period, and then inputs the node attribute information of the target node within the preset time period and the node attribute information of the node associated with the target node within the preset time period into the trained prediction model to obtain the prediction result of the target node. Since the attribute information of the associated node associated with the target node within the preset time period is obtained, the prediction result obtained based on the prediction model can meet the needs of spatiotemporal dynamics and can detect the dynamic network.

[0093] Based on the same inventive concept, the embodiment of the present disclosure provides another detection method, which can be executed by any electronic device with computing and processing capabilities.

[0094] Figure 2 A flow chart of another detection method in an embodiment of the present disclosure is shown.

[0095] like Figure 2 As shown, the difference between the detection method and the detection method in the above embodiment is that before S102, it can also include:

[0096] S202, determining a network access dynamic graph according to network entities and access relationships between network entities, wherein network entities are nodes of the network access dynamic graph, access relationships between network entities are edges connecting nodes of the network access dynamic graph, and access times of network entities are establishment times of edges of nodes.

[0097] It should be noted that network entities may include users, interfaces, applications and servers.

[0098] In establishing a network access dynamic graph, network entities can be used as nodes of the network access dynamic graph. Then the access relationship between network entities can be used as the edge connecting the above nodes, and the access time between nodes can be used as the establishment time of the edge.

[0099] It is understandable that after the network access dynamic graph is established, the node attribute information of the target node at a preset time point and the node attribute information of the target node associated nodes within a preset time period can be obtained according to the network access dynamic graph.

[0100] Specifically, the node attribute information at a preset time point and the node attribute information of the target node associated nodes within a preset time period can be obtained in the above network access dynamic graph according to deep learning.

[0101] The user can also independently access the dynamic graph based on the network to obtain the node attribute information at a preset time point and the node attribute information of the target node and the associated nodes within a preset time period.

[0102] In the disclosed embodiment, by pre-establishing a network access dynamic graph and then obtaining the node attribute information of the target node and the node attribute information of the target node associated nodes based on the network access dynamic graph, obtaining the node attribute information of the target node and the node attribute information of the target node associated nodes can be made more intuitive.

[0103] Based on the same inventive concept, the embodiment of the present disclosure provides another detection method, which can be executed by any electronic device with computing and processing capabilities.

[0104] Figure 3 A flow chart of another detection method in an embodiment of the present disclosure is shown.

[0105] like Figure 3 As shown, the difference between this detection method and the detection method in the above embodiment is that before S104, it can also include:

[0106] S302, training the prediction model according to the training samples, and obtaining a trained prediction model after the preset training stop condition is met, wherein the training samples include node attribute information of historical normal nodes and nodes associated with historical normal nodes at historical time points, and node attribute information of historical abnormal nodes and nodes associated with historical abnormal nodes in historical time periods.

[0107] It should be noted that the historical normal nodes and historical normal node-related nodes at the historical time points can be obtained by the user.

[0108] Node attribute information of historical abnormal nodes and nodes associated with historical abnormal nodes in the historical time period.

[0109] The historical time point may be any node within the historical time period.

[0110] In the disclosed embodiment, by training the prediction model and then obtaining the trained prediction model, the target node is detected based on the trained prediction model, so that the detection result can be made more accurate.

[0111] Based on the same inventive concept, the embodiment of the present disclosure provides another detection method, which can be executed by any electronic device with computing and processing capabilities.

[0112] Figure 4 A flow chart of another detection method in an embodiment of the present disclosure is shown.

[0113] like Figure 4 As shown, the difference between this detection method and the detection method in the above embodiment is that S302 may include:

[0114] S402, respectively obtaining embedding information corresponding to historical normal nodes, positive contrast embedding information, and negative contrast embedding information corresponding to historical abnormal nodes in the training sample;

[0115] S404, determining a contrast loss function value according to the embedding information, the positive contrast embedding information, the negative contrast embedding information, and the first formula, and obtaining a trained prediction model after the contrast loss function value satisfies a preset training stop condition;

[0116] The first formula is:

[0117]

[0118] Among them, loss is the loss function value, sim is the cosine similarity, τ is the hyperparameter, For positive comparison, embedding information is is the negative contrast embedding information, batch represents the total number of normal nodes and abnormal nodes, h c,outis the embedded information, c is a normal node, and d is an abnormal node.

[0119] It should be noted that S404 may specifically include:

[0120] Determine a contrast loss function value according to the embedding information, the positive contrast embedding information, the negative contrast embedding information and the first formula;

[0121] Among the multiple loss function values ​​obtained continuously, when the difference between any two loss function values ​​meets the preset threshold, it is determined that the preset training stop condition is met, and a prediction model that has completed the training is obtained.

[0122] It should be noted that the preset threshold can be set by the user.

[0123] When the difference between any two loss function values ​​among the multiple loss function values ​​obtained continuously meets the preset threshold, determining that the preset training stop condition is met and obtaining the trained prediction model may specifically include:

[0124] The above prediction model is iterated multiple times to obtain the loss function value corresponding to each iteration. When the loss function values ​​obtained by multiple consecutive iterations converge, a trained prediction model is obtained, wherein the convergence may include that the difference between any two loss function values ​​obtained in the multiple consecutive loss function values ​​satisfies a preset threshold.

[0125] Based on the same inventive concept, the embodiment of the present disclosure provides another detection method, which can be executed by any electronic device with computing and processing capabilities.

[0126] Figure 5 A flow chart of another detection method in an embodiment of the present disclosure is shown.

[0127] like Figure 5 As shown, the difference between this detection method and the detection method in the above embodiment is that S402 may include:

[0128] S502, determining the timing embedding information corresponding to the historical normal nodes, the timing embedding information corresponding to the historical abnormal nodes, the timing embedding information corresponding to the historical normal nodes, and the timing embedding information corresponding to the historical abnormal nodes, according to the node attribute information of the historical normal nodes, the node attribute information of the historical abnormal nodes, the node attribute information of the nodes associated with the historical normal nodes, and the node attribute information of the nodes associated with the historical abnormal nodes;

[0129] It should be noted that the above method for obtaining timing embedding information may include a method commonly used in the art.

[0130] S504, determining the embedding information corresponding to the historical normal node according to the feedforward neural network, the time series embedding information corresponding to the historical normal node, and the time series embedding information corresponding to the node associated with the historical normal node;

[0131] S506, determining the forward comparison embedding information corresponding to the normal node according to the node attribute information of the historical normal node at a preset time point, the node attribute information of the node associated with the historical normal node within a preset time period, and the graph translation matrix;

[0132] In some implementations, S506 may include:

[0133] Determine the translation weight between each normal node-associated node and the normal node according to the node attribute information of the normal node at a preset time point, the node attribute information of the normal node-associated node within a preset time period, and the graph translation matrix;

[0134] Deleting a preset number of normal node-associated nodes with relatively high translation weights to obtain deleted normal node-associated nodes;

[0135] The forward contrast embedding information corresponding to the normal node is determined according to the feedforward neural network, the temporal embedding information corresponding to the normal node, and the temporal embedding information corresponding to the normal node associated node.

[0136] S508, determining the embedding information corresponding to the historical abnormal node according to the feedforward neural network, the time series embedding information corresponding to the historical abnormal node, and the time series embedding information corresponding to the node associated with the historical abnormal node;

[0137] S510, determining negative comparison embedding information corresponding to the historical abnormal node according to the node attribute information of the historical abnormal node at a preset time point, the node attribute information of the node associated with the historical abnormal node within a preset time period, and the graph translation matrix.

[0138] The method for obtaining time series embedded information may also include the following method. In the present disclosure, determining the time series embedded information corresponding to the historical normal node associated node according to the node attribute information of the historical normal node and the attribute information of the historical normal node associated node is taken as an example:

[0139] First, the feature vector corresponding to the historical normal node is determined according to the node attribute information of the historical normal node.

[0140] Among them, the feature vector can be:

[0141] V={v ij |i=1,…,m;j=1,…,k i}

[0142] Among them, V is the historical normal node, i and j are the categories of different node attribute information. m is the attribute data of the node attribute information of category i, k i The attribute data of the node attribute is class j.

[0143] For any historical normal node v at time t t , with an embedding vector l represents the lth temporal embedding layer. t Has neighbors:

[0144] U={v t-s,ij |s=1,…,n;},

[0145] Among them, v t-s,ij represents the historical normal node associated node at time ts, and n represents the time step of forward tracing. t-s,ij , with an embedding vector Perform graph propagation information convolution on the historical normal node-related nodes at time ts to obtain the convolution embedding of the historical normal node-related nodes at time ts

[0146]

[0147]

[0148] in, represents the mapping weight of the i-th type node, A U,t-s Represents the adjacency matrix between the historical normal node associated nodes at time ts in the historical normal node associated nodes, represents the convolution weight of the historical normal node associated nodes at time ts in the historical normal node associated nodes, Flatten(·) represents the concatenation of the embedded information of the historical normal node associated nodes at time ts in the historical normal node associated nodes after convolution propagation, Represents the linear mapping weight after convolution of the historical normal node associated nodes at time ts in the historical normal node associated nodes. Represents the bias. For the initial layer, That is, the initial attribute vector x of the node t-s,ij TS t-s Represents the time ts, and Time2Vec represents the time code.

[0149] Time2Vec(TS t-s )=cos(TS t-s w t-s +phase)

[0150] Among them, cos(·) represents the cosine function, w t-srepresents the time embedding weight, and phase represents the phase.

[0151] The convolution embedding of the historical normal node associated nodes at different times is then used for temporal embedding. Multiple GRU layers can be used to capture the connection between the information at different times in the historical normal node associated nodes:

[0152]

[0153] in, Represents the historical normal node-associated node temporal convolution embedding sequence, that is, Represents the GRU hidden layer matrix. Perform mean pooling on the GRU hidden layer matrix to obtain the time series embedding information corresponding to the historical normal nodes

[0154]

[0155] It should be noted that the acquisition of timing embedded information is not limited to the above method, and other conventional methods that can achieve the above-mentioned acquisition of timing embedded information are also applicable to the present disclosure.

[0156] In a specific example, the method for obtaining the forward comparison embedding information is as follows:

[0157] The calculation graph transfer matrix T is

[0158] T=AD -1

[0159] Where A is the adjacency matrix of the graph and D is the degree matrix of the graph. Extract the target node v t The transfer vector The embedding vectors of the neighborhood nodes corresponding to the highest θ transfer weights are set to 0. After setting to 0, the embedding information corresponding to the historical normal nodes is re-obtained according to the above steps, and the obtained embedding information is the forward comparison embedding information.

[0160] The method for obtaining negative contrast embedding information in the present disclosure is similar to the method for obtaining positive contrast embedding information, and will not be described in detail here.

[0161] Based on the same inventive concept, the present disclosure also provides a detection device in the following embodiments. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0162] Figure 6 A schematic diagram of a detection device in an embodiment of the present disclosure is shown. Figure 6 As shown, the device 600 includes:

[0163] An acquisition module 602 is used to acquire node attribute information of a target node at a preset time point and node attribute information of nodes associated with the target node within a preset time period, where the preset time period includes a preset time point;

[0164] The input module 604 is used to input the node attribute information of the target node at a preset time point and the node attribute information of the nodes associated with the target node within a preset time period into the trained prediction model to obtain the prediction result of the target node.

[0165] In one embodiment of the present disclosure, the detection device 600 further includes:

[0166] Determination module 606, before obtaining the node attribute information of the target node at a preset time point and the node attribute information of the node associated with the target node within a preset time period, is used to determine the network access dynamic graph according to the network entities and the access relationships between the network entities, the network entities are the nodes of the network access dynamic graph, the access relationships between the network entities are the edges connecting the nodes of the network access dynamic graph, and the access moments of the network entities are the establishment times of the edges of the nodes;

[0167] The acquisition module 602 includes:

[0168] The first acquisition unit is used to acquire node attribute information of the target node at a preset time point and node attribute information of nodes associated with the target node within a preset time period according to the network access dynamic graph.

[0169] In one embodiment of the present disclosure, the detection device 600 further includes:

[0170] The training module 608 is used to train the prediction model according to the training samples before inputting the node attribute information of the target node at a preset time point and the node attribute information of the target node associated nodes within a preset time period into the trained prediction model to obtain the prediction result of the target node, and obtain the trained prediction model after the preset training stop condition is met, wherein the training samples include the node attribute information of historical normal nodes and nodes associated with historical normal nodes at historical time points, and the node attribute information of historical abnormal nodes and nodes associated with historical abnormal nodes in historical time periods.

[0171] In one embodiment of the present disclosure, the training module 608 includes:

[0172] The second acquisition unit is used to respectively acquire the embedding information corresponding to the historical normal nodes, the positive contrast embedding information, and the negative contrast embedding information corresponding to the historical abnormal nodes in the training sample;

[0173] A determination unit, configured to determine a contrast loss function value according to the embedding information, the positive contrast embedding information, the negative contrast embedding information, and the first formula, and obtain a trained prediction model after the contrast loss function value satisfies a preset training stop condition;

[0174] The first formula is:

[0175]

[0176] Among them, loss is the loss function value, sim is the cosine similarity, τ is the hyperparameter, For positive comparison, embedding information is is the negative contrast embedding information, batch represents the total number of normal nodes and abnormal nodes, h c,out is the embedded information, c is a normal node, and d is an abnormal node.

[0177] In one embodiment of the present disclosure, the determining unit includes:

[0178] A first determination subunit, configured to determine a contrast loss function value according to the embedding information, the positive contrast embedding information, the negative contrast embedding information, and the first formula;

[0179] The second determination subunit is used to determine that a preset training stop condition is met when the difference between any two loss function values ​​among the multiple loss function values ​​obtained continuously meets a preset threshold, so as to obtain a prediction model that has completed training.

[0180] In one embodiment of the present disclosure, the second acquisition unit includes:

[0181] A third determination subunit is used to determine the timing embedding information corresponding to the historical normal nodes, the timing embedding information corresponding to the historical abnormal nodes, the timing embedding information corresponding to the historical normal nodes, and the timing embedding information corresponding to the nodes associated with the historical abnormal nodes according to the node attribute information of the historical normal nodes, the node attribute information of the historical abnormal nodes, the node attribute information of the nodes associated with the historical normal nodes, and the node attribute information of the nodes associated with the historical abnormal nodes;

[0182] A fourth determination subunit is used to determine the embedding information corresponding to the historical normal node according to the feedforward neural network, the time series embedding information corresponding to the historical normal node, and the time series embedding information corresponding to the node associated with the historical normal node;

[0183] A fifth determination subunit is used to determine the positive comparison embedding information corresponding to the normal node according to the node attribute information of the historical normal node at a preset time point, the node attribute information of the node associated with the historical normal node within a preset time period, and the graph translation matrix;

[0184] A sixth determination subunit, configured to determine the embedding information corresponding to the historical abnormal node according to the feedforward neural network, the time series embedding information corresponding to the historical abnormal node, and the time series embedding information corresponding to the node associated with the historical abnormal node;

[0185] The seventh determination subunit is used to determine the negative comparison embedding information corresponding to the historical abnormal node according to the node attribute information of the historical abnormal node at a preset time point, the node attribute information of the node associated with the historical abnormal node within a preset time period, and the graph translation matrix.

[0186] In one embodiment of the present disclosure, the fifth determining subunit includes:

[0187] Determine a node, for determining a translation weight between each normal node-associated node and the normal node according to node attribute information of the normal node at a preset time point, node attribute information of the normal node-associated node within a preset time period, and a graph translation matrix;

[0188] Deleting nodes, used to delete a preset number of normal node-associated nodes with higher translation weights to obtain deleted normal node-associated nodes;

[0189] Determine a node, and determine the forward comparison embedding information corresponding to the normal node according to the feedforward neural network, the temporal embedding information corresponding to the normal node, and the temporal embedding information corresponding to the normal node associated node.

[0190] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0191] Refer to the following Figure 7 An electronic device 700 according to this embodiment of the present disclosure is described. Figure 7 The electronic device 700 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0192] like Figure 7 As shown, the electronic device 700 is in the form of a general computing device. The components of the electronic device 700 may include but are not limited to: at least one processing unit 710, at least one storage unit 720, and a bus 730 connecting different system components (including the storage unit 720 and the processing unit 710).

[0193] The storage unit stores program codes, which can be executed by the processing unit 710, so that the processing unit 710 performs the steps of various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification. For example, the processing unit 710 can perform the following steps of the above method embodiment:

[0194] Obtaining node attribute information of a target node at a preset time point and node attribute information of nodes associated with the target node within a preset time period, wherein the preset time period includes the preset time point;

[0195] The node attribute information of the target node at a preset time point and the node attribute information of the nodes associated with the target node within a preset time period are input into the trained prediction model to obtain the prediction result of the target node.

[0196] The storage unit 720 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 7201 and / or a cache storage unit 7202 , and may further include a read-only storage unit (ROM) 7203 .

[0197] The storage unit 720 may also include a program / utility 7204 having a set (at least one) of program modules 7205, such program modules 7205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0198] Bus 730 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0199] The electronic device 700 may also communicate with one or more external devices 740 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 700, and / or communicate with any device that enables the electronic device 700 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 750. Furthermore, the electronic device 700 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 760. As shown, the network adapter 760 communicates with other modules of the electronic device 700 via a bus 730. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0200] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0201] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. A program product capable of implementing the above method of the present disclosure is stored thereon. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary implementations of the present disclosure described in the above “Exemplary Method” section of this specification.

[0202] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0203] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0204] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0205] In a specific implementation, the program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0206] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0207] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0208] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0209] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A detection method, characterized in that: The method comprises: Acquire node attribute information of the target node at a preset time point and node attribute information of nodes associated with the target node within a preset time period, wherein the preset time period includes the preset time point; Input the node attribute information of the target node at a preset time point and the node attribute information of the nodes associated with the target node within a preset time period into the trained prediction model to obtain a prediction result of the target node; Obtain the embedding information corresponding to the historical normal nodes, the positive contrast embedding information, and the negative contrast embedding information corresponding to the historical abnormal nodes in the training samples respectively; Determine a contrast loss function value according to the embedding information, the positive contrast embedding information, the negative contrast embedding information, and the first formula, and obtain a trained prediction model after the contrast loss function value satisfies a preset training stop condition; The first formula is: Among them, loss is the loss function value, sim is the cosine similarity, τ is the hyperparameter, For positive comparison, embedding information is is the negative contrast embedding information, batch represents the total number of normal nodes and abnormal nodes, h c,out is the embedded information, c is a normal node, and d is an abnormal node.

2. The detection method according to claim 1, characterized in that: Before acquiring the node attribute information of the target node at a preset time point and the node attribute information of the node associated with the target node within a preset time period, the method further includes: Determine a network access dynamic graph according to network entities and access relationships between network entities, wherein the network entities are nodes of the network access dynamic graph, the access relationships between network entities are edges of the network access dynamic graph connecting the nodes, and the access moments of the network entities are establishment times of the edges of the nodes; Obtaining node attribute information of a target node at a preset time point and node attribute information of nodes associated with the target node within a preset time period, including: The node attribute information of the target node at a preset time point and the node attribute information of the nodes associated with the target node within a preset time period are obtained according to the network access dynamic graph.

3. The detection method according to claim 1, characterized in that: Before inputting the node attribute information of the target node at a preset time point and the node attribute information of the nodes associated with the target node within a preset time period into the trained prediction model to obtain the prediction result of the target node, the method further includes: The prediction model is trained according to the training samples, and a trained prediction model is obtained after the preset training stop condition is met, wherein the training samples include node attribute information of historical normal nodes and nodes associated with historical normal nodes at historical time points, and node attribute information of historical abnormal nodes and nodes associated with historical abnormal nodes in historical time periods.

4. The detection method according to claim 1, characterized in that: Determining a contrast loss function value according to the embedding information, the positive contrast embedding information, the negative contrast embedding information, and the first formula, and obtaining a trained prediction model after the contrast loss function value satisfies a preset training stop condition, including: Determine a contrast loss function value according to the embedding information, the positive contrast embedding information, the negative contrast embedding information and the first formula; Among the multiple loss function values ​​obtained continuously, when the difference between any two loss function values ​​meets the preset threshold, it is determined that the preset training stop condition is met, and a prediction model that has completed the training is obtained.

5. The detection method according to claim 1, characterized in that: The embedding information corresponding to the normal nodes in the training samples, the positive contrast embedding information, and the negative contrast embedding information corresponding to the abnormal nodes are obtained respectively, including: Determine the timing embedding information corresponding to the historical normal nodes, the timing embedding information corresponding to the historical abnormal nodes, the timing embedding information corresponding to the historical normal nodes, and the timing embedding information corresponding to the nodes associated with the historical abnormal nodes according to the node attribute information of the historical normal nodes, the node attribute information of the historical abnormal nodes, the node attribute information of the nodes associated with the historical normal nodes, and the node attribute information of the nodes associated with the historical abnormal nodes; Determine the embedding information corresponding to the historical normal node according to the feedforward neural network, the time series embedding information corresponding to the historical normal node, and the time series embedding information corresponding to the node associated with the historical normal node; Determine the forward comparison embedding information corresponding to the normal node according to the node attribute information of the historical normal node at a preset time point, the node attribute information of the node associated with the historical normal node within a preset time period, and the graph translation matrix; The negative contrast embedding information corresponding to the historical abnormal node is determined according to the node attribute information of the historical abnormal node at a preset time point, the node attribute information of the nodes associated with the historical abnormal node within a preset time period, and the graph translation matrix.

6. The detection method according to claim 5, characterized in that: Determine the forward comparison embedding information corresponding to the normal node according to the node attribute information of the normal node at a preset time point, the node attribute information of the node associated with the normal node within a preset time period, and the graph translation matrix, including: Determine the translation weight between each normal node-associated node and the normal node according to the node attribute information of the normal node at a preset time point, the node attribute information of the normal node-associated node within a preset time period, and the graph translation matrix; Deleting a preset number of normal node-associated nodes with relatively high translation weights to obtain deleted normal node-associated nodes; The forward contrast embedding information corresponding to the normal node is determined according to the feedforward neural network, the temporal embedding information corresponding to the normal node, and the temporal embedding information corresponding to the normal node associated node.

7. A detection device, characterized in that: The device comprises: An acquisition module, used to acquire node attribute information of a target node at a preset time point and node attribute information of nodes associated with the target node within a preset time period, wherein the preset time period includes the preset time point; An input module, used to input the node attribute information of the target node at a preset time point and the node attribute information of the nodes associated with the target node within a preset time period into the trained prediction model to obtain a prediction result of the target node; Obtain the embedding information corresponding to the historical normal nodes, the positive contrast embedding information, and the negative contrast embedding information corresponding to the historical abnormal nodes in the training samples respectively; Determine a contrast loss function value according to the embedding information, the positive contrast embedding information, the negative contrast embedding information, and the first formula, and obtain a trained prediction model after the contrast loss function value satisfies a preset training stop condition; The first formula is: Among them, loss is the loss function value, sim is the cosine similarity, τ is the hyperparameter, For positive comparison, embedding information is is the negative contrast embedding information, batch represents the total number of normal nodes and abnormal nodes, h c,out is the embedded information, c is a normal node, and d is an abnormal node.

8. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to perform the detection method according to any one of claims 1 to 6 by executing the executable instructions.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the detection method according to any one of claims 1 to 6 is implemented.

Images