Social Network Anomaly Event Detection Method Based on Persistent Subgraph Pattern Mining

Abstract

The present application relates to a method for detecting abnormal events in a social network based on persistent subgraph pattern mining, including: extracting a new set of k-edge subgraphs in the social network graph at the current timestamp and obtaining an auxiliary data structure; the auxiliary data structure consists of d arrays; each array consists of l buckets; one bucket corresponds to a key-value pair; the key corresponds to a k-edge subgraph pattern, and the value corresponds to the persistent cumulative value of the k-edge subgraph pattern; mapping each new k-edge subgraph to the bucket of the corresponding array using the currently numbered hash function. If the bucket is a non-empty bucket and the non-empty bucket has not participated in the persistent value counting within the current time window and the new k-edge subgraph is isomorphic to the k-edge subgraph pattern of the non-empty bucket, the non-empty bucket participates in the persistent value counting and updates the persistent cumulative value of the corresponding k-edge subgraph pattern; if there is a persistent cumulative value exceeding the threshold after passing through the current time window, it is determined that the event corresponding to the corresponding k-edge subgraph pattern is an abnormal event. This method can balance the accuracy and real-time performance of detection.

Description

Technical Field

[0001] The present application relates to the technical field of data mining, and in particular, to a method for detecting abnormal events in a social network based on persistent subgraph pattern mining. Background Art

[0002] Graph stream analysis is becoming increasingly important in various fields because many practical graph applications have natural dynamics. In the past, the problem of subgraph discovery in graph streams has mainly focused on features such as frequency and burstiness. Persistence, as a new feature, is receiving increasing attention. Persistent subgraph discovery highlights the behavior of subgraphs recurring in many time windows, which is crucial for many practical applications (such as anomaly detection). Although persistent subgraph discovery has many interesting applications in real life, there is no ready-made solution to effectively mine persistent patterns.

[0003] One recent development is the proliferation of high-throughput, dynamically graph-structured data organized in the form of graph streams. For example, consider the knowledge graph DBpedia, which is updated daily according to the change log stream in Wikipedia. Graph stream analysis is becoming increasingly important in various fields such as subgraph matching, frequent pattern mining, and burst pattern mining. In addition to the above features, another important feature - persistence - is also receiving increasing attention. Given a subgraph pattern P and a graph stream with T tumbling windows, the persistence of P is defined as the number of time windows in which P appears. If the persistence of P is greater than a user-defined threshold, then P is said to be a persistent pattern. Persistent patterns usually indicate the occurrence of abnormal or notable events. Next, an example of detecting abnormal behavior in a computer network is used to illustrate the basic idea.

[0004] The abnormal behavior has pattern 1. Security analysts can identify abnormal behavior by monitoring the occurrence of abnormal subgraph patterns in network traffic (based on the semantics of subgraph isomorphism). As Figure 1 shown, some abnormal behaviors attempt to hide by spreading their communications across multiple time windows. As a result, these patterns cannot be detected by finding frequent subgraph patterns. To detect such threats, we should use persistence instead of frequency as an indicator. Figure 1 Shows two communication patterns and their matching results within the corresponding time windows. P1 is the pattern detected by finding frequent subgraph patterns, which is just a general broadcast mechanism and does not provide valuable information. P2 is the pattern detected by using persistence, indicating an attack pattern. P2 describes an information leak where the compromised host receives commands from a bot and exchanges data with a compromised website that leads to data leakage.

[0005] Formally, given a graph stream G, a persistence threshold δ, and an integer k, the continuous persistent pattern discovery problem is to find k-edge subgraph patterns that appear in at least δ flip windows. Although important, the continuous persistent pattern discovery problem lacks dedicated techniques for handling. A simple approach is to enumerate all possible k-edge subgraphs in each time window and then calculate the corresponding patterns of these subgraphs to verify the existence of each pattern in the current window. This method requires calculating and storing all k-edge subgraphs of each time window. In addition, it is necessary to re-execute subgraph isomorphism calculations to verify the existence of each k-edge pattern in each window, which consumes a large amount of time and memory. Therefore, advanced techniques are needed to effectively discover event persistent patterns in order to detect abnormal behaviors in social networks in a timely and accurate manner. Summary of the Invention

[0006] Based on this, it is necessary to provide a method for detecting abnormal events in social networks based on persistent subgraph pattern mining that can reduce the computational and storage costs for the above technical problems.

[0007] A method for detecting abnormal events in social networks based on persistent subgraph pattern mining includes:

[0008] Obtain a snapshot graph of the social network at the current timestamp, and extract a new set of k-edge subgraphs containing the newly inserted edges at the current timestamp from the snapshot graph of the social network; the new set of k-edge subgraphs includes multiple new k-edge subgraphs; the snapshot graph of the social network is an induced graph containing all the edges within the historical time window, all the edges with historical timestamps within the current time window, and the newly inserted edges at the current timestamp; each edge is formed by connecting 2 vertices, where the vertices represent users and the edges represent events formed by interactions between users.

[0009] Obtain the auxiliary data structure at the current timestamp; the auxiliary data structure consists of d arrays; each array consists of l buckets; each bucket includes a key-value pair; the key in each key-value pair corresponds to a k-edge subgraph pattern, and the value corresponds to the persistent cumulative value of the k-edge subgraph pattern; within a time window, a bucket participates in persistent value counting at most once; each k-edge subgraph pattern corresponds to an event.

[0010] Obtain the pre-constructed set of hash functions; in the set of hash functions, one hash function corresponds to one array, and the hash functions and arrays are arranged according to their numbers.

[0011] Use the hash function with the current number to map each new k-edge subgraph to the bucket of the corresponding numbered array. When the bucket is a non-empty bucket and the non-empty bucket has not participated in persistent value counting within the current time window, if the new k-edge subgraph is isomorphic to the k-edge subgraph pattern corresponding to the non-empty bucket, the non-empty bucket participates in persistent value counting and updates the persistent cumulative value of the corresponding k-edge subgraph pattern.

[0012] If there is a persistent cumulative value exceeding the preset persistent threshold after the current time window, determine that the event corresponding to the k-edge subgraph pattern is an abnormal event.

[0013] In the above social network abnormal event detection method based on persistent subgraph pattern mining, for each newly generated k-edge subgraph, a hash function is used to map it to a fixed position in the data auxiliary structure to calculate the persistence of the pattern, rather than calculating and storing all k-edge subgraphs in each time window. This significantly reduces the memory cost and time cost. Once the corresponding bucket has been counted in the current time window, the counter will no longer count. That is to say, regardless of the number of subgraphs mapped to a bucket in a time window, due to the property of persistence, the bucket can only be counted once. Therefore, this solution can directly calculate the persistence of the corresponding pattern in each time window, thus avoiding storing all subgraphs in the current time window and repeated subgraph isomorphism calculations, thereby greatly reducing the calculation and storage costs and ensuring the accuracy and real-time performance of abnormal event detection. Description of the Drawings

[0014] Figure 1 For two communication modes and their matching results within the corresponding time window;

[0015] Figure 2 For the flowchart of the social network abnormal event detection method based on persistent subgraph pattern mining in an embodiment;

[0016] Figure 3 For the schematic diagram of the graph stream G;

[0017] Figure 4 For the example diagram of the auxiliary data structure;

[0018] Figure 5 For the algorithm flowchart of the social network abnormal event detection method based on persistent subgraph pattern mining;

[0019] Figure 6 For the algorithm flowchart of the prior art findPP;

[0020] Figure 7 For the internal structure diagram of a computer device in an embodiment. Detailed Embodiments ]

[0021] In order to make the objectives, technical solutions, and advantages of the present application clearer, the following further details the present application in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0022] With the development of the Internet, Internet applications have developed rapidly, and social media has also developed rapidly. With the development of technology, topic hype has also become a tool for making huge profits. Topic hype is to hype a certain topic by forwarding information to each other, so as to achieve the purposes of obtaining public opinion influence, publicity and promotion, etc. Graphs have become a common data applied to many sciences and engineering. A graph can be represented as a structure, that is, a graph G=(V, E) is a pair of sets: a set of vertices V represents entities and a set of edges E represents the relationships or connections between entities. In computer science, a network contains nodes and edges; while in social science, the corresponding terms are actors and relationships, and these two terms have the same meaning in the present invention. If the vertices in the graph are used to represent the people participating in the activity, and the edges are used to represent the messages or the associations between people. Then when a media hype is initiated, in a specific time or specific scenario, multiple k-edge subgraphs are generated among the people participating in the activity. The mutual attention relationship between users constitutes a social network graph. Monitoring the persistence of k-edge subgraphs according to the dynamic changes of the social network graph helps to timely discover the occurrence of abnormal events in the social network and make corresponding countermeasures in time.

[0023] In one embodiment, as Figure 2 shown, a method for detecting abnormal events in a social network based on persistent subgraph pattern mining is provided, including the following steps:

[0024] Step 202, obtain a snapshot graph of the social network at the current timestamp, and extract a new set of k-edge subgraphs containing the newly inserted edges at the current timestamp from the snapshot graph of the social network.

[0025] The new set of k-edge subgraphs includes multiple new k-edge subgraphs; the snapshot graph of the social network is a derived graph containing all the edges within the historical time window, all the edges with historical timestamps within the current time window, and the newly inserted edges at the current timestamp. Each edge is formed by connecting 2 vertices, the vertices represent users, and the edges represent the events formed by the interactions between users.

[0026] Given a graph stream G and a positive integer k, a k-edge subgraph refers to a derived subgraph that exactly has k edges existing in the graph stream G. The graph stream G refers to a continuously growing sequence of directed edges {σ1, σ2,..., σ n}, where each represents a directed edge from vertex to with an arrival time of t(σ i ), and the superscript of the vertex is the introduced vertex ID, which is used to distinguish two vertices with the same label. It should be noted that the throughput of the graph stream is constantly changing. For simplicity of representation, only graphs with vertex labels are considered.

[0027] A time window is a series of fixed, non-overlapping, and continuous time intervals. The time window (denoted as Wi )A time interval with a fixed duration τ in G, where the time intervals do not overlap. Specifically, the time window W i is a set of edges whose timestamps are within [t0+(i - 1)*τ, t0 + i*τ), where t0 is the start time and i > 0.

[0028] A schematic diagram of the graph stream G is as Figure 3 shown. Specifically, for the edge σ2 in G, it shows that σ2 has two vertices b 2 and c 3 , where "b" and "c" are vertex labels and the superscripts are vertex IDs. For example: Xiaohong (b 1 ) is a student (b), Xiaoming (b 2 ) is a student (b), and the label of student (b) is Xiaohong and Xiaoming. To distinguish between Xiaohong and Xiaoming, vertex IDs are introduced for differentiation. In addition, the timestamp of σ2 is shown below. The graph stream is divided into three time windows, starting from the start timestamp t0 = 0, with each time window having a size τ = 3 and no overlap.

[0029] The snapshot graph at timestamp t, denoted as G t , is the graph derived from all the edges in W i observed before (including) time t, where t ∈ W i .

[0030] For any t ∈ W i , at time t + 1, a newly inserted edge e is obtained and added to G t to obtain G t+1 . For each newly inserted edge e in G t+1 , the symbol E k (e) is used to represent the set of new k - edge subgraphs in G t+1 that contain e. In addition, G i represents the snapshot graph of the time window W i , where G i is the graph derived from all the edges within W i .

[0031] If the subgraph g k =(V g , E g ) is derived from k edges in G t , it is called a k - edge subgraph, and P k is defined as the set of all derived subgraphs in G i that have k edges.

[0032] Step 204, obtain the auxiliary data structure of the current timestamp.

[0033] The auxiliary data structure consists of d arrays; each array consists of l buckets; each bucket contains a key-value pair; the key in each key-value pair corresponds to a k-edge subgraph pattern, and the value corresponds to the persistent cumulative value of the k-edge subgraph pattern; within a time window, a bucket participates in persistent value counting at most once; each k-edge subgraph pattern corresponds to an event.

[0034] The semantic isomorphism relationship divides the set of subgraphs P k into m equivalence classes, denoted by . Each equivalence class is called a subgraph pattern. Note that can be obtained by deleting the ID (or timestamp) of the vertex (or edge) corresponding to the k-edge subgraph in . For simplicity, the abbreviation P i is used to represent the general pattern We define the frequency fre(P i , G i ) in each time window as i the number of k-edge subgraphs in . Use the symbol PS to represent the different k-edge patterns in G. Each item in PS is a binary tuple (P, per(P)), where P is a k-edge pattern and per(P) is the persistence value of pattern P.

[0035] Persistence refers to a specific pattern of occurrence behavior based on the number of windows in which a k-edge subgraph pattern appears in the graph stream. The persistence measure of pattern P is the number of time windows in which P appears. Note that we do not consider that a persistent pattern must appear in all time windows, as this is a very special case. Therefore, the persistence measure of a persistent pattern should exceed the user-defined threshold δ. The formal definition of a persistent pattern is as follows: Given a graph stream G, a k-edge pattern P, and a persistence threshold δ. If per(P) ≥ δ, then P is a persistent pattern.

[0036] Step 206, obtain the pre-constructed set of hash functions.

[0037] In the set of hash functions, one hash function corresponds to one array, and both the hash functions and the arrays are arranged according to their numbers.

[0038] Step 208, use the hash function with the current number to map each new k-edge subgraph to the bucket of the corresponding numbered array. When the bucket is a non-empty bucket and the non-empty bucket has not participated in persistent value counting within the current time window, if the new k-edge subgraph is isomorphic to the k-edge subgraph pattern corresponding to the non-empty bucket, the non-empty bucket participates in persistent value counting and updates the persistent cumulative value of the corresponding k-edge subgraph pattern.

[0039] For example Figure 4As shown, an example diagram of an auxiliary data structure is provided. In Figure 4 , the auxiliary data structure consists of d arrays, and each array consists of l buckets. Let B i [j] be the j-th bucket in the i-th array. Each bucket contains a key-value pair, where the key is a k-edge pattern and the value can be regarded as a counter for calculating the persistence of the k-edge pattern. The d arrays are respectively associated with d pairwise-independent hash functions h1(·), …, h d (·). Each hash function maps a k-edge subgraph to a bucket in the corresponding array. If two subgraphs are isomorphic, they will be mapped to the same bucket. Since within a time window, the key-value pair in a bucket participates in the persistent value counting at most once, a counting status field True or False can be set in the key-value pair to indicate whether the key-value pair has participated in the persistent value counting within the current time window: when the key-value pair has not participated in the persistent value counting within the current time window, the corresponding counting status field is True; when the key-value pair has participated in the persistent value counting once within the current time window, the corresponding counting status field is False. When a new time window arrives, the status of each counter is set to True. Whenever a k-edge subgraph g k is mapped to a bucket, the counter in the bucket can be incremented by 1 only when the status of the counter is True, and then the status is changed to False. It should be noted that the status field can be designed according to requirements, and only an example is given here.

[0040] Step 210, if there is a persistent cumulative value exceeding the preset persistence threshold after the current time window, determine that the event corresponding to the k-edge subgraph pattern is an abnormal event.

[0041] In the above social network abnormal event detection method based on persistent subgraph pattern mining, for each newly generated k-edge subgraph, a hash function is used to map it to a fixed position in the data auxiliary structure. Once the status of the counter indicates that the corresponding bucket has been counted in the current time window, the counter will no longer count. That is to say, regardless of the number of subgraphs mapped to a bucket in a time window, due to the property of persistence, the counter in this bucket can only be incremented once. Therefore, we can directly calculate the persistence of the corresponding pattern in each time window, thus avoiding storing all subgraphs in the current time window and repeated subgraph isomorphism calculations, greatly reducing the computational and storage costs, and ensuring the accuracy and real-time performance of abnormal event detection.

[0042] In one embodiment, each new k-edge subgraph is mapped to a bucket of an array with the current numbered hash function. When the bucket is a non-empty bucket and the non-empty bucket has participated in a persistent value count within the current time window, the next numbered hash function is used to map the new k-edge subgraph to a bucket of the corresponding numbered array.

[0043] In one embodiment, each new k-edge subgraph is mapped to a bucket of an array with the current numbered hash function. When the bucket is a non-empty bucket and the non-empty bucket has not participated in a persistent value count within the current time window, if the new k-edge subgraph is not isomorphic to the k-edge subgraph pattern corresponding to the non-empty bucket, the next numbered hash function is used to map the new k-edge subgraph to a bucket of the corresponding numbered array.

[0044] Although two subgraphs are not isomorphic, due to hash collisions, they are mapped to the same bucket. In this case, another hash function is used to map one subgraph to a bucket in the corresponding array.

[0045] In one embodiment, each new k-edge subgraph is mapped to a bucket of the corresponding array with the current numbered hash function. When the bucket is an empty bucket, the pattern of the new k-edge subgraph is calculated and inserted into the empty bucket to obtain an updated auxiliary data structure. That is, a new bucket is constructed, and the key in the key-value pair of the new bucket is the pattern of the new k-edge subgraph, the value is 1, and the count status field is False, indicating that it has participated in a persistent value count within the current time window.

[0046] As Figure 5 shown, an algorithm flow of a social network anomaly event detection method based on persistent subgraph pattern mining is provided. First, initializePer is called to initialize the data auxiliary structure TFD (line 1). Then, TFD is updated by calling updateTFD to calculate the persistence of each pattern P in TFD when a new time window arrives (lines 2 - 3). After processing the current time window, the status of the counter in TFD is set to True (lines 4–5). Then, for each non-empty bucket B i [j] in TFD, check whether B i [j].value satisfies the persistence threshold δ (lines 6–7). Finally, all persistent patterns are returned (line 8).

[0047] Function updateTFD. updateTFD processes the snapshot graphs in W in ascending order (line 1). Whenever an edge insertion e occurs at timestamp t (t ∈ W i ), updateTFD calls findSubgraph to calculate E i ). k(e) (lines 2–3). For each subgraph g k ∈ E k (e), TFD first selects a hash function h1(·) to map g k to a bucket B i in the array B i [h i (g k )], and then checks whether the state of B i [h i (g k )].state is True to avoid overestimation (lines 4–6). If so, there are two cases: (1) g k is isomorphic to the pattern P in the bucket B i [h i (g k ). updateTFD increments the persistence of P by 1 and sets B i [h i (g k )].state to B i [h i (g k ).state (lines 7–9). (2) g k is not isomorphic to the pattern P and the bucket is empty. updateTFD first calculates the pattern of g k by removing the vertex IDs and edge timestamps of g k , and then inserts (P, (state = False, per(P) = 1)) into the bucket (lines 10–12). Finally, updateTFD returns the updated TFD (line 13).

[0048] Take Figure 4 as an example. In the current time window, the subgraph is hashed to the bucket . However, the state of the counter of is False, so TFD does nothing. When considering the subgraph , although the state of the counter of is True, is not isomorphic to P2. Therefore, we hash it to Since the state of the counter of is True, TFD increments the counter by 1 and changes the state to False. Note that the pattern P5 of the subgraph is empty, so this method will insert the key-value pair (P5, (False, 1)) into . Note that this method will set the status of the counter in the TFD to True after processing the current time window.

[0049] This method directly maps each newly generated k-edge subgraph to a fixed bucket in the TFD to calculate the persistence of the pattern, rather than calculating and storing all k-edge subgraphs in each time window, which significantly reduces the memory cost and time cost. More importantly, once the status of the counter indicates that the corresponding bucket has been counted in the current time window, there is no need to verify the existence of the pattern in the bucket in the window, avoiding repeated subgraph matching calculations.

[0050] In one embodiment, the step of using a hash function to map the new k-edge subgraph to the corresponding bucket includes:

[0051] Encoding each newly generated k-edge subgraph into a string representation using graph invariants, so that isomorphic subgraphs are mapped to the corresponding buckets;

[0052] Among them, encoding each newly generated k-edge subgraph into a string representation using graph invariants specifically includes:

[0053] Connecting the degree and label of each vertex of each newly generated k-edge subgraph e = (v i , v j , t(e)) together as the new label l(v) of the corresponding vertex; where, v i , v j are the vertices in the new k-edge subgraph e, and t(e) is the edge formed by the corresponding vertices in the new k-edge subgraph e;

[0054] Obtaining the new label l(e) = (l(v i ), l(v j )) of each edge in the new k-edge subgraph according to the new label of the vertex;

[0055] Assigning a weight w(e) to each edge according to the order in which the single-edge pattern corresponding to the edge appears in the snapshot graph; the single-edge pattern is the subgraph pattern when k = 1, where the earlier the single-edge pattern appears for the first time, the smaller the corresponding weight. For example: if the single-edge pattern A->B is the first edge to appear in the graph stream, then the weights of all edges isomorphic to the single-edge pattern A->B are 1; then the single-edge pattern B->C appears, and the weight is 2; and so on. The purpose of doing this is to ensure that isomorphic subgraphs are encoded the same, that is, the graph invariant, so that the encodings of two isomorphic subgraphs are the same.

[0056] If w(e i ) < w(e j ), then e i < e j; that is, e i The corresponding unilateral mode appears earlier than e j ;

[0057] If w(e i ) = w(e j ) ∪ l(e i ) < l(e j ), then e i < e j ; where l(e i ) < l(e j ) indicates that the vertex degree of e i is smaller; the vertex degree is equal to the number of edges that the vertex participates in forming;

[0058] If w(e i ) > w(e j ), then e i > e j ;

[0059] According to the weights of each edge of the new k-edge subgraph, obtain the corresponding encoded string representation {l(e1), …, l(e n )}, where e i < e i+1 .

[0060] In one embodiment, the steps of determining whether the new k-edge subgraph is isomorphic to the k-edge subgraph pattern of the key-value pair of the bucket include:

[0061] Obtain the new k-edge subgraph and the k-edge subgraph pattern of the key-value pair of the bucket where, represents the vertices in the new k-edge subgraph, represents the edges formed by the corresponding vertices in the new k-edge subgraph; represents the vertices of the k-edge subgraph pattern of the key-value pair, represents the edges formed by the corresponding vertices of the k-edge subgraph pattern of the key-value pair;

[0062] When there exists a bijective function f(·) from to , and it satisfies 1) and 2) , the new k-edge subgraph is isomorphic to the k-edge subgraph pattern of the key-value pair of the bucket, otherwise it is not isomorphic; where the function L(·) is used to maintain the labels of the vertices.

[0063] It should be understood that although Figure 1The steps in the flowchart are shown sequentially according to the arrows, but these steps are not necessarily executed sequentially in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 1 at least a portion of the steps may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily sequential, but can be executed alternately or in turn with at least a portion of other steps or sub-steps or stages of other steps.

[0064] A direct method for finding persistent patterns in a graph stream currently is: when a new time window arrives, enumerate all possible k-edge subgraphs, then partition the set of k-edge subgraphs into different equivalence classes to verify the occurrence of each k-edge pattern. If the persistence measure of a k-edge pattern exceeds a user-defined threshold, it is returned as a persistent pattern. More details are described below. As Figure 6 shown, the algorithm flow of the prior art findPP is provided. Use the set PS to store different k-edge patterns in G, and each item in PS is a binary tuple (P, per(P)), where P is a k-edge pattern and per(P) is the persistence value of pattern P. Whenever a new window W i appears, findPP updates PS by calling computePer (lines 2-3). Then, for each pattern P in PS, findPP verifies whether the persistence value of P satisfies the persistence threshold δ (lines 4-5). Finally, it returns all persistent patterns (line 6). The function computePer. computePer first calls findSubgraph(·) to compute the set of k-edge subgraphs P i in G k (line 1). Specifically, whenever an edge insertion e occurs at timestamp t (t ∈ W i ), findSubgraph explores a candidate subgraph space in G t in a tree-like manner to compute E k (e), where each node represents a candidate subgraph, and the child nodes are extended from their parent nodes by one edge. To avoid duplicate enumeration of subgraphs, findSubgraph checks whether two subgraphs are composed of the same edges at each layer in the tree space. After processing all edge insertions in W i , the set of k-edge subgraphs P i in G can be obtained. k . To compute the corresponding k-edge patterns, computePer calls evaluateFre(·) to process P kThe subgraphs in it are divided into equivalence classes according to subgraph isomorphism calculation, and each equivalence class can represent a pattern P (line 2). If fre(P, G i ) ≥ 1, computePer further checks whether P ∈ PS through subgraph isomorphism calculation; if so, set per(P) ← per(P) + 1, otherwise, it adds (P, per(P) = 1) to the set PS (lines 3 - 6). Among them, the tree space is a data structure used to assist in gradually expanding a newly inserted edge into a k-edge subgraph. Being in the same layer means that the number of edges of the k-edge subgraph is the same.

[0065] There are three main steps in findPP. (1) During the k-edge subgraph enumeration process, given an inserted edge e in G t , let n be the average number of vertices of the subgraph with a radius of k expanded from e. findSubgraph spends O(2 n2 ) to explore all k-edge subgraphs containing e. (2) During the PS update process, let σ be the average unit time to check whether two k-edge subgraphs are isomorphic. evaluateFre uses O(N·(N 2 - 1)·σ) time to partition the k-edge subgraph set into m equivalence classes. Let M be the number of patterns in PS. computerper takes O(m·M·σ) to update PS. (3) findPP spends O(1) to return the persistent patterns.

[0066] The scalability of the findPP algorithm is insufficient to handle large graph streams. First, to find the k-edge patterns in each time window, findPP needs to calculate and store all k-edge subgraphs in each time window, which consumes a large amount of time and memory. Second, during the PS update process, findPP needs to re-execute the subgraph isomorphism calculation for each pattern in the current window to check whether it exists in PS. That is to say, its memory cost and calculation cost are relatively high.

[0067] And this solution exactly proposes a solution to the shortcomings of findPP. In fact, the large scale and high dynamics of the graph stream make it very time-consuming to accurately discover persistent patterns. Efficiently calculating approximations with limited memory is a natural choice. The main idea of this solution is as follows: To avoid mapping each newly generated subgraph to all existing candidate subgraph patterns, an auxiliary data structure is designed, which consists of d arrays. Each newly generated subgraph will be mapped to a bucket in the array through hash functions h1(·), …, h d (·) to calculate the existence of patterns in each time window. In this way, two isomorphic subgraphs will be mapped to the same bucket. Based on the auxiliary data structure, it is possible to avoid storing any k-edge subgraphs and duplicate subgraph matching.

[0068] In one embodiment, a social network anomaly event detection device based on persistent subgraph pattern mining is provided, where:

[0069] A social network snapshot graph acquisition module, configured to acquire a social network snapshot graph at the current timestamp, and extract a new k-edge subgraph set containing newly inserted edges at the current timestamp from the social network snapshot graph; the new k-edge subgraph set includes multiple new k-edge subgraphs; the social network snapshot graph is a derived graph including all edges within a historical time window, all edges at historical timestamps within the current time window, and newly inserted edges at the current timestamp; each edge is formed by connecting 2 vertices, where the vertices represent users and the edges represent events formed by interactions between users.

[0070] An auxiliary data structure acquisition module, configured to acquire an auxiliary data structure at the current timestamp; the auxiliary data structure consists of d arrays; each array consists of l buckets; each bucket includes a key-value pair; the key in each key-value pair corresponds to a k-edge subgraph pattern, and the value corresponds to the persistent cumulative value of the k-edge subgraph pattern; within a time window, a bucket participates in persistent value counting at most once; each k-edge subgraph pattern corresponds to an event.

[0071] A hash function set acquisition module, configured to acquire a pre-constructed hash function set; in the hash function set, one hash function corresponds to one array, and the hash functions and arrays are arranged according to numbers.

[0072] A persistent cumulative value calculation module, configured to map each new k-edge subgraph to a bucket of the corresponding numbered array by using the hash function of the current number. When the bucket is a non-empty bucket and the non-empty bucket has not participated in persistent value counting within the current time window, if the new k-edge subgraph is isomorphic to the k-edge subgraph pattern corresponding to the non-empty bucket, the non-empty bucket participates in persistent value counting and updates the persistent cumulative value of the corresponding k-edge subgraph pattern.

[0073] An anomaly event determination module, configured to determine that the event corresponding to the k-edge subgraph pattern is an anomaly event if there is a persistent cumulative value exceeding a preset persistent threshold after the current time window.

[0074] For specific limitations on the social network anomaly event detection device based on persistent subgraph pattern mining, reference can be made to the limitations on the social network anomaly event detection method based on persistent subgraph pattern mining in the above text, which will not be elaborated here. Each module in the above social network anomaly event detection device based on persistent subgraph pattern mining can be implemented in whole or in part by software, hardware, and their combination. The above modules can be embedded in the processor of a computer device in hardware form or be independent of it, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to the above modules.

[0075] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in Figure 5 . The computer device includes a processor, a memory, a network interface, and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store graph stream data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, it implements a method for detecting abnormal events in a social network based on persistent subgraph pattern mining.

[0076] Those skilled in the art can understand that Figure 5 the structure shown in is only a block diagram of some structures related to the solution of this application, and does not constitute a limitation on the computer device to which the solution of this application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0077] In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the method in the above embodiment.

[0078] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by the processor, it implements the steps of the method in the above embodiment.

[0079] Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to a memory, storage, database, or other medium used in the embodiments provided in the present application can include non-volatile and / or volatile memories. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and Rambus dynamic RAM (RDRAM), etc.

[0080] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity of description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered as the scope described in this specification.

[0081] The above-described embodiments merely represent several implementation manners of the present application. The description thereof is relatively specific and detailed, but it should not be construed as a limitation on the scope of the invention patent. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present application, several modifications and improvements can still be made, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the appended claims.

Claims

1. A method for detecting abnormal events in social networks based on persistent subgraph pattern mining, characterized in that, The method includes: Obtaining a snapshot graph of a social network at the current timestamp, and extracting a new set of k-edge subgraphs containing the newly inserted edges at the current timestamp from the snapshot graph of the social network; the new set of k-edge subgraphs includes multiple new k-edge subgraphs; the snapshot graph of the social network is a derived graph containing all edges within a historical time window, all edges with historical timestamps within the current time window, and the newly inserted edges at the current timestamp; each edge is formed by connecting two vertices, where the vertices represent users and the edges represent events formed by interactions between users. Obtaining an auxiliary data structure at the current timestamp; the auxiliary data structure consists of d arrays; each array consists of l buckets; each bucket includes a key-value pair; the key in each key-value pair corresponds to a k-edge subgraph pattern, and the value corresponds to the persistent cumulative value of the k-edge subgraph pattern; within a time window, a bucket participates in persistent value counting at most once; each k-edge subgraph pattern corresponds to an event. Obtaining a pre-constructed set of hash functions; in the set of hash functions, one hash function corresponds to one array, and both the hash function and the array are arranged according to their numbers. Using the hash function with the current number to map each new k-edge subgraph to a bucket in the array with the corresponding number. When the bucket is non-empty and has not participated in persistent value counting within the current time window, if the new k-edge subgraph is isomorphic to the k-edge subgraph pattern corresponding to the non-empty bucket, the non-empty bucket participates in persistent value counting and updates the persistent cumulative value of the corresponding k-edge subgraph pattern. If there is a persistent cumulative value exceeding a preset persistent threshold after the current time window, determine that the event corresponding to the k-edge subgraph pattern is an abnormal event.

2. The method according to claim 1, wherein The bucket also includes a counting status field; the counting status field is True or False. When the bucket has not participated in persistent value counting within the current time window, the corresponding counting status field is True. When the bucket has participated in persistent value counting once within the current time window, the corresponding counting status field is False.

3. The method according to claim 1, characterized in that, The method further includes: Using the hash function with the current number to map each new k-edge subgraph to a bucket in the array with the corresponding number. When the bucket is non-empty and has participated in persistent value counting once within the current time window, continue to use the hash function with the next number to map the new k-edge subgraph to a bucket in the array with the corresponding number.

4. The method according to claim 1, wherein The method further includes: Using the hash function with the current number to map each new k-edge subgraph to a bucket in the array with the corresponding number. When the bucket is non-empty and has not participated in persistent value counting within the current time window, if the new k-edge subgraph is not isomorphic to the k-edge subgraph pattern corresponding to the non-empty bucket, use the hash function with the next number to map the new k-edge subgraph to a bucket in the array with the corresponding number.

5. The method according to claim 1, wherein The method further includes: Using the hash function with the current number to map each new k-edge subgraph to a bucket in the array with the corresponding number. When the bucket is empty, calculate the pattern of the new k-edge subgraph and insert it into the empty bucket to obtain an updated auxiliary data structure.

6. The method according to claim 1, characterized in that, The steps of mapping the new k-edge subgraphs to the corresponding buckets by using a hash function include: Encoding each new k-edge subgraph into a string representation by using graph invariants, so that isomorphic subgraphs are mapped to the corresponding buckets; Among them, encoding each new k-edge subgraph into a string representation by using graph invariants specifically includes: Connect the degrees and labels of each vertex of each new k-edge subgraph e = (v i , v j , t(e)) together as the new label l(v) of the corresponding vertex; where v i , v j are the vertices in the new k-edge subgraph e, and t(e) is the edge formed by the corresponding vertices in the new k-edge subgraph e; Obtain the new label l(e) of each edge in the new k-edge subgraph according to the new label of the vertex, where l(e) = (l(v i ), l(v j )); Specifying a weight w(e) for each edge according to the order in which the single-edge patterns corresponding to the edges of the social network snapshot graph appear; among them, the earlier the single-edge pattern appears for the first time, the smaller the corresponding weight; If w(e i ) < w(e j ), then e i < e j ; If w(e i ) = w(e j ) ∪ l(e i ) < l(e j ), then e i < e j ; where l(e i ) < l(e j ) means that the vertex degree of e i is smaller; the vertex degree is equal to the number of edges formed by the vertex; If w(e i ) > w(e j ), then e i > e j ; Obtain the corresponding encoded string representation {l(e1), …, l(e n )} according to the weights of each edge of the new k-edge subgraph, where e i <e i+1 .

7. The method according to any one of claims 1 to 4, characterized in that, The steps of determining whether the new k-edge subgraph is isomorphic to the k-edge subgraph pattern of the key-value pair of the bucket include: Obtain a new k-edge subgraph and the k-edge subgraph pattern of the key-value pairs of the bucket where represents the vertices in the new k-edge subgraph represents the edges formed by the corresponding vertices in the new k-edge subgraph; represents the vertices of the k-edge subgraph pattern of the key-value pairs represents the edges formed by the corresponding vertices of the k-edge subgraph pattern of the key-value pairs; When there exists a bijective function f(·) from to and satisfies 1) and 2) then the new k-edge subgraph is isomorphic to the k-edge subgraph pattern of the key-value pairs in the bucket; otherwise, it is not isomorphic. The function L(·) is used to maintain the labels of the vertices.

8. A social network abnormal event detection device based on persistent subgraph pattern mining, characterized in that, The device includes: A social network snapshot graph acquisition module, configured to acquire a social network snapshot graph at the current timestamp, and extract a set of new k-edge subgraphs including newly inserted edges at the current timestamp from the social network snapshot graph; the set of new k-edge subgraphs includes multiple new k-edge subgraphs; the social network snapshot graph is a derived graph including all edges within a historical time window, all edges at historical timestamps within the current time window, and newly inserted edges at the current timestamp; each edge is formed by connecting 2 vertices, the vertices represent users, and the edges represent events formed by interactions between users; An auxiliary data structure acquisition module, configured to acquire an auxiliary data structure at the current timestamp; the auxiliary data structure consists of d arrays; each array consists of l buckets; each bucket includes a key-value pair; the key in each key-value pair corresponds to a k-edge subgraph pattern, and the value corresponds to the persistent cumulative value of the k-edge subgraph pattern; within a time window, a bucket participates in persistent value counting at most once; each k-edge subgraph pattern corresponds to an event; A hash function set acquisition module, configured to acquire a pre-constructed hash function set; in the hash function set, one hash function corresponds to one array, and the hash functions and arrays are arranged according to numbers; A persistent cumulative value calculation module, configured to map each new k-edge subgraph to the bucket of the corresponding numbered array by using the hash function of the current number. When the bucket is a non-empty bucket and the non-empty bucket has not participated in persistent value counting within the current time window, if the new k-edge subgraph is isomorphic to the k-edge subgraph pattern corresponding to the non-empty bucket, the non-empty bucket participates in persistent value counting and updates the persistent cumulative value of the corresponding k-edge subgraph pattern; An abnormal event determination module, configured to determine that the event corresponding to the k-edge subgraph pattern is an abnormal event if there is a persistent cumulative value exceeding a preset persistent threshold after passing through the current time window.

9. A computer device, comprising a memory and a processor, the memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the method according to any one of claims 1 to 7.

Images