Attention-Based Heterogeneous Information Network User Abnormal Behavior Detection Method and System

Abstract

The present invention relates to a method and system for detecting abnormal user behavior in a heterogeneous information network based on attention. First, the historical interaction data of a heterogeneous information network over a certain period of time is converted into graph data, where each node in the graph data represents a constituent object of the heterogeneous information network, and the edges in the graph data reflect the connections between the constituent objects of the heterogeneous information network. Then, based on a graph neural network, an objective function of the user abnormal behavior detection model is constructed. The model aggregates the neighbor information of nodes through attention and derives an inter-layer propagation formula for node attribute representations. Finally, the gradient of each node attribute representation is updated until all node attribute representations converge to obtain each node attribute representation. The node attribute representations are compressed by a multi-layer perceptron into a one-dimensional column vector vertically stacked by the prediction labels of each node, which is the user abnormal behavior detection result. This method uses the attention mechanism to automatically capture all meta-path information in the network during the message propagation process, improving the accuracy of user abnormal behavior detection.

Description

Technical Field

[0001] The present invention belongs to the technical field of network anomaly detection, and specifically relates to a method and system for detecting abnormal user behavior in a heterogeneous information network based on attention. Background Art

[0002] A heterogeneous information network refers to a relational network formed by different constituent objects due to a certain connection, such as a citation network, a shopping network, etc. Among them, a citation network is formed by the citation and being cited relationships between documents, and includes four types of nodes: papers, authors, conferences, and keywords, including four relationships: the citation relationship between papers, the writing relationship between authors and papers, the publication relationship between papers and conferences, and the inclusion relationship between papers and keywords. In a shopping network, there are two types of constituent objects: users and items. There are relationships such as friends and relatives between users, and relationships such as purchase, browsing, and recommendation between users and commodities. While online shopping brings great convenience to people's lives, it also faces the problem of merchant dishonesty. Some merchants, in order to attract users to purchase goods, engage in malicious brushing behavior, that is, the same user frequently purchases goods or a large number of users purchase the same good. In order to protect the legitimate rights and interests of consumers, detecting user behavior can timely detect malicious brushing operations and false positive reviews, which is of great significance for realizing network consumption security.

[0003] Since the types of constituent objects and the relationships between constituent objects are diverse, a heterogeneous information network can be abstracted into heterogeneous graph data. Each node of the heterogeneous graph data corresponds to a constituent object of the heterogeneous information network, and the edges of the heterogeneous graph data reflect the relationships or connections between the constituent objects. Graph neural networks have excellent performance in processing non-Euclidean data and have been widely applied in many fields from computer vision to natural language processing. Usually, classical heterogeneous graph neural networks learn the representation of the target node by aggregating the information of its neighbor nodes along the meta-path. This method transforms the heterogeneous graph into a homogeneous graph, which can effectively extract the low-frequency information in the heterogeneous graph, that is, the similar part between the node and the neighbor node attribute information, but ignores the high-frequency information in the heterogeneous graph, that is, the different part between the node and the neighbor node attribute information. For shopping network data, the high-frequency information in the graph data plays an important role in predicting user behavior anomalies. Therefore, classical graph neural networks based on meta-path operations cannot achieve the desired effect in network anomaly detection. In addition, existing classical heterogeneous graph neural network models perform message propagation by predefining meta-paths, and the performance of the model is affected by the predefining meta-paths to a certain extent, and can only capture part of the information in the graph data, resulting in the inability to discover the abnormal purchase behavior of users on goods in the network and the inability to efficiently detect the abnormal behavior of users. Summary of the Invention

[0004] Aiming at the deficiencies of the prior art, the technical problem to be solved by the present invention is to propose a method and system for detecting abnormal user behaviors in a heterogeneous information network based on attention.

[0005] The technical solution adopted by the present invention to solve the above technical problem is as follows:

[0006] On the one hand, the present invention provides a method for detecting abnormal user behaviors in a heterogeneous information network based on attention, including the following steps:

[0007] Step 1: Obtain the historical interaction data of a heterogeneous information network in a certain period, convert the historical interaction data into graph data, each node of the graph data represents a constituent object of the heterogeneous information network, and the edges of the graph data reflect the connections between the constituent objects; obtain the node attribute information and graph topology information from the graph data;

[0008] Step 2: Construct a user abnormal behavior detection model based on a graph neural network, and the objective function of the user abnormal behavior detection model is:

[0009]

[0010] In the formula, is the identifier of the objective function, k(.) represents the kernel function of the graph neural network, k(x i ,h i ) represents the attribute characterization fitting term, x i represents the attribute information of node i, h i represents the attribute characterization of node i, k(h i ,h j ) represents the similarity between node i and node j, h j represents the attribute characterization of node j, α ij represents the attention coefficient between node i and node j learned by the model, λ is a hyperparameter, G represents the number of nodes, (i,j) represents the edge between node i and node j, and E represents the set of edges of the graph data;

[0011] If a Gaussian kernel function is selected, the objective function is expressed as:

[0012]

[0013] In the formula, is the symbolic representation of the Gaussian kernel function, T represents vector transpose, ||.|| 2 represents the two-norm of the vector, and σ represents the variance of the Gaussian kernel function;

[0014] Take the derivative of h i in formula (3) and set the derivative equal to 0 to obtain the expression of the attribute characterization h i of any node i as:

[0015]

[0016] In Equation (4), N(i) represents the set of neighbor nodes of node i;

[0017] From Equation (4), the inter-layer propagation formula of the node attribute representation h i is as follows:

[0018]

[0019] In Equation (5), node j represents the neighbor node of node i, j ∈ N(i); represents the attribute representation of node i in the (l + 1)-th layer, represents the attribute representation of node j in the l-th layer, represents the attention coefficient between adjacent nodes in the l-th layer;

[0020] The attention calculation includes the attention of node and edge types, and the calculation formula of the attention coefficient is:

[0021]

[0022] In Equation (6), b represents the parameter vector, W represents the parameter matrix, || represents the concatenation operation, W r represents the parameter matrix of the edge type in the heterogeneous information network, r φiφj represents the one-hot encoding vector of the edge type in the heterogeneous information network, and φ(.) represents the mapping function of the edge type;

[0023] The propagation formulas of node attention and edge type attention are respectively:

[0024]

[0025]

[0026] In the formula, respectively represent the attention coefficients between neighbor nodes in the l-th and (l - 1)-th layers after inter-layer propagation, β is a hyperparameter, represents the information of the edge in the l-th layer of the heterogeneous information network, respectively represent the information of the edges in the l-th and (l - 1)-th layers of the heterogeneous information network after inter-layer propagation;

[0027] After each layer of propagation, layer normalization is performed on the obtained node attribute representation, and the specific representation formula is:

[0028]

[0029] In the formula, represents the attribute representation of node i in the l-th layer after layer normalization, It represents the attribute representation of node $i$ in the $l$-th layer after inter-layer propagation, and $\|\cdot\|$ represents the matrix norm;

[0030] Multiple attention heads are used to perform multi-angle learning on the node attribute representation, and its expression is:

[0031]

[0032] In the formula, It represents the attribute representation of the $s$-th attention head of node $i$ in the $l$-th layer after layer normalization, It represents the attention coefficient of the $s$-th attention head between adjacent nodes in the $l$-th layer, $W$ l represents the parameter matrix, is the attribute representation of node $j$ in the $(l - 1)$-th layer;

[0033] According to formulas (5) and (12), the gradient of each node attribute representation is updated until all node attribute representations converge, and the attribute representations of all attention heads of each node are obtained. The attribute representations of all attention heads of each node are concatenated to obtain the attribute representation of the node; the output of the abnormal behavior detection model is the attribute representation of each node; among them, the attribute representation of the $i$-th node is expressed as:

[0034]

[0035] The attribute representations of each node are compressed by a multi-layer perceptron into a one-dimensional column vector vertically stacked by the predicted labels of each node, that is, the user abnormal behavior detection result; the predicted labels are the probabilities of normal behavior and abnormal behavior.

[0036] Step 3: Randomly select some nodes or edges in the graph data to train the user abnormal behavior detection model to obtain the trained user abnormal behavior detection model; convert the historical interaction data of the heterogeneous information network to be detected into graph data, and input the node attribute information and graph topology information of the graph data into the trained user abnormal behavior detection model to detect the user behavior.

[0037] Furthermore, the user abnormal behavior detection model is used to handle the link prediction task, that is, to predict whether the user will show abnormal behavior in the future in the heterogeneous information network; the user abnormal behavior detection model is trained using the node attribute information, and the trained user abnormal behavior detection model is used for the link prediction task, and the model output is multiplied by its transpose matrix to obtain the prediction result of the link prediction task.

[0038] On the other hand, the present invention also provides a heterogeneous information network user abnormal behavior detection system, including a processor, a memory, and a computer program; the processor is connected to the memory, the computer program is stored in the memory, and when the system runs, the processor executes the computer program in the memory to enable the system to execute the above method.

[0039] A computer-readable storage medium is used to store computer instructions; when the computer instructions are executed by a processor, the above method is completed.

[0040] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0041] 1. The present invention converts the historical interaction data of the heterogeneous information network into graph data. At the same time, aiming at the linear aggregation characteristics of the classical graph neural network, the classical graph neural network is improved, and a non-linear Gaussian kernel function is used to capture the potential information in the network, and a user abnormal behavior detection model is established. An attention mechanism is introduced into the model to automatically capture all meta-path information in the network during the message propagation process, which can effectively avoid the problem of low model performance caused by insufficient prior information of predefined meta-paths. On the basis of fully extracting the potential meta-path information in the heterogeneous information network graph data, it can also fully extract the difference information between different meta-paths, making it more suitable for network user abnormal behavior detection, and contributing to the realization of personal information security and privacy protection and the creation of a safe and harmonious network environment.

[0042] 2. Starting from the perspective of objective function optimization, the present invention explains and optimizes the network user abnormal behavior detection model, making the model more interpretable, general, and extensible.

[0043] 3. The user abnormal behavior detection model of the present invention is also applicable to processing link prediction tasks, and the test results are generally better than traditional network embedding methods. This proves that for such tasks, it is crucial to be able to discover potential abnormal links as much as possible. The attention mechanism adopted by the present invention automatically discovers potential meta-path information during the propagation process, which is the reason why the present invention can achieve good results in link prediction tasks. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 is a relational graph of a shopping network;

[0045] Figure 2 is a flowchart of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0046] The following specifically explains the specific embodiments of the present invention with reference to the drawings. The specific embodiments are only used to further explain the technical solutions of the present invention and do not limit the protection scope of the present application.

[0047] Taking a shopping network as an example, this paper illustrates the method for detecting abnormal user behavior in heterogeneous information networks based on attention (hereinafter referred to as the method, see Figure 1 and Figure 2 ), and the specific steps are as follows:

[0048] Step 1: Obtain the historical interaction data of a shopping network during a certain period, including data records such as user purchases, browsing, and recommended products; convert the historical interaction data into graph data G=(V, E), where V represents the set of nodes and E represents the set of edges. The nodes of the graph data are divided into two categories: user nodes and product nodes, and the edges are also divided into two categories. The edges between user nodes reflect the relationships between users, such as relatives and friends; the edges between user nodes and product nodes reflect the purchase, browsing, recommendation, etc. relationships between users and products; therefore, the graph data is an abstraction of the purchase, browsing, recommendation, etc. records between users and products during a certain period;

[0049] Obtain the node attribute information X=[X u ||X m and the graph topology information from the graph data; X u ∈R N×d1 , X m ∈R M×d2 represent the user node attribute information and the product node attribute information respectively, R represents the matrix space, N represents the number of user nodes, d1 represents the attribute dimension of user nodes, M represents the number of product nodes, and d2 represents the attribute dimension of product nodes; the user node attribute information includes user personal information such as user name, phone number, age, hobbies, and user id, and the product node attribute information includes product information such as number, name, price, type, and inventory; the edges of the graph data reflect the graph topology information, which is represented by the adjacency matrix A∈R N×N . If there is an edge connection between nodes i and j, then the element A ij =1 in the adjacency matrix corresponding to nodes i and j, otherwise A ij =0; denote D∈R N×N as the degree matrix of the adjacency matrix A. The degree matrix is a diagonal matrix, and the elements on the diagonal correspond to the row sums of the adjacency matrix;

[0050] Step 2: Build a user abnormal behavior detection model based on the graph neural network. The objective function of the user abnormal behavior detection model is:

[0051]

[0052] In the formula, h represents the model input, that is, the attribute representation extracted by the model from the node attribute information; k(.) represents the kernel function of the graph neural network, and k(x i , h i ) represents the attribute representation fitting term, x iRepresents the attribute information of node i, h i Represents the attribute representation of node i, that is, the attribute representation extracted by the model from the attribute information of node i, k(h i ,h j ), is the graph regularization term, representing the similarity between node i and node j, h j Represents the attribute representation of node j, α ij Represents the attention coefficient learned by the model between node i and node j; λ is a hyperparameter, a manually set value, that is, the balance factor between the attribute representation fitting term and the graph regularization term; G = N + M represents the number of nodes, and (i, j) represents the edge between node i and node j;

[0053] In Equation (1), the kernel function is given as the Gaussian kernel function, and the Gaussian kernel function represents the Euclidean distance between points x and x′, defined as:

[0054]

[0055] In the formula, ||.|| 2 Represents the two-norm of the vector, and σ represents the variance of the Gaussian kernel function;

[0056] According to Equation (2), the objective function can be expressed as:

[0057]

[0058] In the formula, Is the symbolic representation of the Gaussian kernel function, and T represents the vector transpose;

[0059] For the variable h in Equation (3) i Take the derivative and set the derivative equal to 0 to obtain the expression of the attribute representation h i of any node i as:

[0060]

[0061] In Equation (4), N(i) represents the set of neighbor nodes of node i, Represents the inverse function of the Gaussian kernel function, Represents aggregating the neighbor information of nodes through attention; "+x i " is equivalent to a residual connection, which ensures the expressive power of the model and avoids the over-smoothing problem; based on Equation (4), after adding the propagation layer number l, the inter-layer propagation formula of the node attribute representation h i is:

[0062]

[0063] In Equation (5), node j represents the neighbor node of node i, j ∈ N(i); Denotes the attention coefficient between adjacent nodes in the l-th layer;

[0064] Different from the attention calculation method of classical convolutional neural networks, considering the characteristics of heterogeneous information networks, the calculation of the attention coefficient in the present invention includes the attention values of node and edge types, and the calculation formula is expressed as:

[0065]

[0066] In formula (6), b represents the parameter vector, W represents the parameter matrix, || represents the concatenation operation, W r Represents the parameter matrix of the edge type in the heterogeneous information network, r φiφj Represents the one-hot encoding vector of the edge type in the heterogeneous information network, and φ(.) represents the mapping function of the edge type;

[0067] According to formula (5), the node attribute representation extracted from the heterogeneous information network is mapped into the non-linear kernel space, which is specifically expressed as:

[0068]

[0069] Applying the kernel function to all nodes of the graph data, the mapping formula of the node attribute representation is obtained as:

[0070]

[0071] Adding residual connections to the attention of nodes and edge types respectively is beneficial for the model to maintain the original attribute representation of nodes during training and avoid the over-smoothing problem; the specific formula is expressed as follows:

[0072]

[0073]

[0074] In formulas (9) and (10), Respectively represent the attention coefficients between the l-th and l-1-th layer neighbor nodes after inter-layer propagation, β is a hyperparameter, Represents the information of the edges in the l-th layer of the heterogeneous information network, Respectively represent the information of the edges in the l-th and l-1-th layers of the heterogeneous information network after inter-layer propagation;

[0075] After each layer of propagation, layer normalization is performed on the obtained node attribute representation, and the specific formula is expressed as:

[0076]

[0077] In the formula, Represents the attribute representation of node i in the l-th layer after layer normalization, It represents the attribute representation of node i in the l-th layer after inter-layer propagation, and ||.|| represents the matrix norm;

[0078] Further expanding Equation (5), multiple attention heads are used to learn the node attribute representation from multiple perspectives, and its expression is:

[0079]

[0080] In the formula, It represents the attribute representation of the s-th attention head of node i in the l-th layer after layer normalization, It represents the attention coefficient of the s-th attention head between adjacent nodes in the l-th layer, and W l represents the parameter matrix;

[0081] According to Equation (5) and (12), the gradient of each node attribute representation is updated until all node attribute representations converge, and the attribute representations of all attention heads of each node are obtained. The attribute representations of all attention heads of each node are concatenated to obtain the attribute representation of the node; the output of the abnormal behavior detection model is the attribute representations of each node; among them, the attribute representation of the i-th node is expressed as:

[0082]

[0083] The attribute representations of each node are compressed by a multi-layer perceptron into a one-dimensional column vector vertically stacked by the predicted labels of each node, that is, the user abnormal behavior detection result; the predicted labels are the probabilities of normal behavior and abnormal behavior;

[0084] Step 3: Randomly select some nodes or edges in the graph data to train the user abnormal behavior detection model, and obtain the trained user abnormal behavior detection model; the user abnormal behavior detection model is trained in a semi-supervised learning manner, and randomly select some nodes or edges in the graph data G for training. 60% of the nodes corresponding to each label are used as the training set, 20% of the nodes are used as the validation set, and 20% of the nodes are used as the test set; the training loss is calculated according to the loss function in Equation (14);

[0085]

[0086] Among them, q represents the user behavior, and Q represents all executable behaviors of users in the network, represents the probability of detecting the behavior of user n as behavior q, represents a one-dimensional column vector vertically stacked by the predicted labels of each node, and y nq represents the acceptable behavior category of user n.

[0087] The model of the present invention can also be used to process link prediction tasks, that is, to predict whether there will be abnormal purchase behaviors of users in the future in the shopping network, which is to predict whether there is an edge between two nodes in the graph data; input the node attribute information X into the user abnormal behavior detection model for training, and the model output is H; multiply the model output H by its transpose matrix according to Equation (15) to obtain the output result of the link prediction task

[0088]

[0089] During the training process, calculate the training loss according to the loss function of Equation (16);

[0090]

[0091] In the formula, represents the expectation, p(A|H) represents the probability of inversely inferring that the original adjacency matrix of the graph data is A based on the known model prediction value, p(H|X,A) represents the probability that the model output obtained by prediction is H when the attribute and topological information are known, p(H) represents the probability that the model prediction output is H, and KL[p(H|X,A)||p(H)] represents the relative entropy between the probabilities p(H|X,A) and p(H). When the trained model is used for link prediction, the larger the value of this loss function, the greater the probability that the target node is detected as an abnormal node.

[0092] The present invention also provides a heterogeneous information network user abnormal behavior detection system, including a processor, a memory, and a computer program; the processor is connected to the memory, the computer program is stored in the memory, and when the system runs, the processor executes the computer program in the memory to enable the system to execute the above method. The processor can be a central processing unit CPU, or other general-purpose processors, digital signal processors DSP, programmable gate arrays FPGA, etc.; the memory can be a read-only memory and a random access memory, and provides instructions and data to the processor. In the implementation process, each step of the above method can be completed by the integrated logic circuit in the processor or the instructions in the form of software.

[0093] The present invention also provides a computer-readable storage medium for storing computer instructions, and when the computer instructions are executed by a processor, the above method is completed.

[0094] Simulation experiment:

[0095] The detection of abnormal behavior of users in heterogeneous information networks is essentially a node classification task, and its prediction result is the acceptable behavior interval of network users. To verify the effectiveness of the method of the present invention, on eleven real datasets, the node classification task is respectively carried out by using the user abnormal behavior detection model of the present invention and the common graph neural network models in the prior art. The user abnormal behavior detection model of the present invention adopts an attention mechanism to automatically mine user behavior characteristics and compare and predict its characteristics with acceptable behaviors.

[0096] Table 1 shows the accuracy statistics of each model for the node classification task on eleven real datasets. Among them, DBLP is a commonly used citation network, with a total of four types of nodes, including papers, authors, conferences, and keywords; there are a total of four types of edges, including the citation relationship between papers, the writing relationship between authors and papers, the publication relationship between papers and conferences, and the inclusion relationship between papers and keywords. IMDB is an Internet Movie Database, which is also an online database about movie actors, movies, TV shows, TV stars, and movie production, including many information about movies, actors, running time, content introduction, ratings, reviews, etc. Among them, the comments of users play a key role in the movie score. Therefore, the effective detection of malicious negative reviews is beneficial to ensuring the fairness of movie reviews. KDD1999 is a benchmark dataset for network anomaly detection, containing more than 7,000,000 network connection records, including various abnormal data simulated in a military network environment. Freebase is a large collaborative knowledge base composed of metadata, and its content mainly comes from the contributions of its community members. It integrates many online resources, including the content in some private wiki sites. Therefore, effectively detecting network abnormal behaviors can protect people's private information.

[0097] Table 1 Accuracy statistics of each model for the node classification task on real datasets

[0098]

[0099]

[0100] Using 60%, 20%, and 20% of the data as the training set, validation set, and test set respectively, the user abnormal behavior detection model of the present invention is compared with 4 existing classic embedding method models and 7 deep learning models based on graph neural networks. They are respectively carried out for the node classification task, and the model accuracy as shown in Table 1 is obtained. It can be seen from Table 1 that the user abnormal behavior detection model of the present invention has achieved good results on real datasets compared with the existing graph neural network models; for the graph neural network models that require predefined meta-paths, such as HAN [4] and HetSANN [9], the accuracy rate has been greatly improved. This is because the user abnormal behavior detection model of the present invention adopts an attention mechanism to automatically mine potential meta-path information during the information propagation process, thereby avoiding the negative impact brought by artificially defining meta-paths. Specifically, classical graph neural networks are trained on homogeneous graph data sets during the message propagation process. For heterogeneous information networks, it is necessary to consider various types of nodes and edges in the heterogeneous information network. The connection of different types of nodes represents different semantic information. Therefore, classical graph neural networks are not applicable to heterogeneous graph data. Existing models designed for heterogeneous networks, such as HetGNN [7] and HGT

[10] propagate messages based on meta-paths and require artificial definition of meta-paths, which will have a certain impact on the model performance. The user abnormal behavior detection model of the present invention can effectively solve this problem and detect the abnormal behavior of user nodes with high accuracy, timely avoiding the risk of damage to consumer rights and interests.

[0101] Under the same experimental conditions, the user abnormal behavior detection model of the present invention and ten common network models in the prior art were used to process the link prediction task and verified on three data sets respectively. Among them, Amazon is a commodity network data set that records user evaluations of Amazon website products, LastFM is a data set that records user song listening sequences, and PubMed is a large citation network data set, and the statistical results shown in Table 2 were obtained;

[0102] Table 2 Accuracy statistics of each model for link prediction tasks

[0103]

[0104] For each data set, 15% of the edges were randomly selected as test data, and the remaining 85% of the edges and the same number of additional sampled and non-existent edges were used to construct training data. From the experimental results, it can be seen that the user abnormal behavior detection model of the present invention has achieved better experimental results on several data sets compared with network embedding methods and graph neural network-based methods. This proves that the user abnormal behavior detection model of the present invention can effectively avoid the influence brought by meta-path predefined and can also efficiently and accurately detect the abnormal behavior of users.

[0105] The sources of each model are as follows:

[0106] [1]Thomas N.Kipf and Max Welling.Semi-supervised classification withgraph convolutional networks.In ICLR,2017.

[0107] [2] Petar Velickovic, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Liò, and Yoshua Bengio. Graph attention networks. In ICLR, 2018.

[0108] [3] Michael Schlichtkrull, Thomas N Kipf, Peter Bloem, Rianne Van Den Berg, Ivan Titov, and Max Welling. Modeling relational data with graph convolutional networks. In European semantic web conference, pages 593–607. Springer, 2018.

[0109] [4] Xiao Wang, Houye Ji, Chuan Shi, Bai Wang, Yanfang Ye, Peng Cui, and Philip S Yu. Heterogeneous graph attention network. In WWW, pages 2022–2032, 2019.

[0110] [5] Seongjun Yun, Minbyul Jeong, Raehyun Kim, Jaewoo Kang, and Hyunwoo J Kim. Graph transformer networks. NeurIPS, 32:11983–11993, 2019.

[0111] [6] Shichao Zhu, Chuan Zhou, Shirui Pan, Xingquan Zhu, and Bin Wang. Relation structure-aware heterogeneous graph neural network. In ICDM, pages 1534–1539. IEEE, 2019.

[0112] [7]Chuxu Zhang, Dongjin Song, Chao Huang, Ananthram Swami, and Nitesh V Chawla. Heterogeneous graph neural network. In SIGKDD, pages 793–803. ACM, 2019.

[0113] [8]Xinyu Fu, Jiani Zhang, Ziqiao Meng, and Irwin King. Magnn: Metapath-aggregated graph neural network for heterogeneous graph embedding. In WWW, pages 2331–2341, 2020.

[0114] [9]Huiting Hong, Hantao Guo, Yucheng Lin, Xiaoqing Yang, Zang Li, and Jieping Ye. An attention-based graph neural network for heterogeneous structural learning. In AAAI, number 04, pages 4132–4139, 2020.

[0115]

[10] Ziniu Hu, Yuxiao Dong, Kuansan Wang, and Yizhou Sun. Heterogeneous graph transformer. In WWW, pages 2704–2710, 2020.

[0116]

[11] Qingsong Lv, Ming Ding, Qiang Liu, Yuxiang Chen, Wenzheng Feng, Siming He, Chang Zhou, Jianguo Jiang, Yuxiao Dong, and Jie Tang. Are we really making much progress?: Revisiting, benchmarking and refining heterogeneous graph neural networks. In SIGKDD, pages 1150–1160, 2021.

[0117]

[12] Yukuo Cen,Xu Zou,Jianwei Zhang,Hongxia Yang,Jingren Zhou,and JieTang.Representation learning for attributed multiplex heterogeneous network.In SIGKDD,pages 1358–1368.ACM,2019.

[0118] Where the present invention is not described, it is applicable to the prior art.

Claims

1. An attention-based method for detecting abnormal user behaviors in heterogeneous information networks, characterized in that, The method includes the following steps: Step 1: Obtain the historical interaction data of a heterogeneous information network for a certain period, convert the historical interaction data into graph data, where each node of the graph data represents a constituent object of the heterogeneous information network. The nodes of the graph data are divided into user nodes and commodity nodes, and the edges of the graph data reflect the connections between the constituent objects; obtain the node attribute information and graph topology information from the graph data; Step 2: Construct a user abnormal behavior detection model based on a graph neural network. The objective function of the user abnormal behavior detection model is: In the formula, is the identifier of the objective function, k(.) represents the kernel function of the graph neural network, k(x i ,h i ) represents the attribute representation fitting term, x i represents the attribute information of node i, h i represents the attribute representation of node i, k(h i ,h j ) represents the similarity between node i and node j, h j represents the attribute representation of node j, α ij represents the attention coefficient between node i and node j learned by the model, λ is a hyperparameter, G represents the number of nodes, (i,j) represents the edge between node i and node j, and E represents the edge set of the graph data; If a Gaussian kernel function is selected, the objective function is expressed as: In the formula, is the symbolic representation of the Gaussian kernel function, T represents vector transpose, and ||.|| 2 represents the two-norm of the vector, and σ represents the variance of the Gaussian kernel function; Derive h in Equation (3) i Take the derivative and set the derivative equal to 0 to obtain the expression of the attribute representation h i for any node i as follows: In Equation (4), N(i) represents the set of neighbor nodes of node i; From equation (4), the inter-layer propagation formula of the node attribute characterization h i is as follows: In formula (5), node j represents the neighbor node of node i, where j ∈ N(i); represents the attribute representation of node i in the (l + 1)-th layer, represents the attribute representation of node j in the l-th layer, represents the attention coefficient between adjacent nodes in the l-th layer; The attention calculation includes the attention of nodes and edge types. The calculation formula for the attention coefficient is: In formula (6), b represents a parameter vector, W represents a parameter matrix, || represents a concatenation operation, and W r represents a parameter matrix of edge types in the heterogeneous information network, and r φiφj represents a one-hot encoded vector of edge types in the heterogeneous information network, and φ(.) represents a mapping function of edge types; The propagation formulas for node attention and edge type attention are respectively: wherein, respectively represent the attention coefficients between the neighbor nodes of the l-th and (l-1)-th layers after inter-layer propagation, β is a hyperparameter, represents the information of the edges in the l-th layer of the heterogeneous information network, respectively represent the information of the edges in the l-th and (l-1)-th layers of the heterogeneous information network after inter-layer propagation; After each layer of propagation, perform layer normalization on the obtained node attribute representations. The specific expression formula is: In the formula, represents the attribute representation of node i in the l-th layer after layer normalization, represents the attribute representation of node i in the l-th layer after inter-layer propagation, and ||.|| represents the matrix norm; Use multiple attention heads to perform multi-angle learning on the node attribute representations. Its expression is: In the formula, represents the attribute representation of the i-th node in the l-th layer and the s-th attention head after layer normalization, represents the attention coefficient of the s-th attention head between adjacent nodes in the l-th layer, and W l represents the parameter matrix, is the attribute representation of the j-th node in the (l - 1)-th layer; According to Equations (5) and (12), perform gradient updates on each node attribute representation until all node attribute representations converge, obtain the attribute representations of all attention heads for each node, splice the attribute representations of all attention heads for each node to obtain the attribute representation of the node; the output of the abnormal behavior detection model is the attribute representations of each node; among them, the attribute representation of the i-th node is expressed as: In the formula, || represents splicing; Pass each node attribute representation through a multi-layer perceptron to compress it into a one-dimensional column vector vertically stacked by the prediction labels of each node, that is, the user abnormal behavior detection result; the prediction label is the probability of normal behavior and abnormal behavior; Step 3: Randomly select some nodes or edges in the graph data to train the user abnormal behavior detection model to obtain a trained user abnormal behavior detection model; convert the historical interaction data of the heterogeneous information network to be detected into graph data, input the node attribute information and graph topology information of the graph data into the trained user abnormal behavior detection model to detect user behavior.

2. The attention-based method for detecting abnormal user behaviors in heterogeneous information networks according to claim 1, characterized in that, Use the user abnormal behavior detection model to handle the link prediction task, that is, predict whether users will exhibit abnormal behavior in the future in the heterogeneous information network; use the node attribute information to train the user abnormal behavior detection model, use the trained user abnormal behavior detection model for the link prediction task, and multiply the model output by its transpose matrix to obtain the prediction result of the link prediction task.

3. A heterogeneous information network user abnormal behavior detection system, comprising a processor, a memory, and a computer program; the processor is connected to the memory, the computer program is stored in the memory, and when the system runs, the processor executes the computer program in the memory to enable the system to execute the method of claim 1 or 2.

4. A computer-readable storage medium for storing computer instructions, which, when executed by a processor, complete the method of claim 1 or 2.

Images