Dynamic access behavior analysis method based on dynamic interaction diagram

Abstract

The invention belongs to the technical field of data, and particularly relates to a dynamic access behavior analysis method based on a dynamic interaction graph. The method comprises the following steps: constructing a dynamic interaction diagram to accurately characterize a dynamic access behavior; constructing a dynamic access behavior feature representation learning model for learning noise-oriented dynamic access behaviors; through model training, model parameter optimization and noise reduction processing on noise in dynamic access behavior data, the influence of noise data on the model effect is weakened, the contribution of normal data is enhanced, the ability of the model to distinguish abnormal behavior characteristics is enhanced, and the model robustness is improved; according to the method, the analysis accuracy and efficiency of dynamic access behavior data can be improved, behaviors of illegal access data are analyzed and mined, and illegal access operation is prevented.

Description

Technical Field

[0001] The invention belongs to the field of data technology, and in particular relates to a dynamic access behavior analysis method. Background Art

[0002] In the digital age, data has become the core element to promote intelligent decision-making in various fields. The ability to collect and utilize data resources reflects competitive advantages, and open sharing of data is seen as an important way to release the value of data resources. In order to effectively solve the problem of cross-domain data sharing management and reduce the risk of data leakage and data abuse, a data autonomous security modeling method based on data boxes can be used. In this method framework, the data box is used as the smallest unit of data sharing, which supports the modeling of basic elements such as data description, data operation, and data constraints of shared data, and encapsulates the data protection mechanism. For data access and operation, external software or data users only need to call the interface provided by the data box to complete it.

[0003] Although the data box encapsulates some shared data, data users may still implicitly perform illegal data operations by exploiting loopholes in the authorized data analysis method. Therefore, it is necessary to accurately characterize highly dynamic and fine-grained access behaviors, establish dynamic access behavior monitoring strategies, and integrate access monitoring programs in the data box. In recent years, with the emergence of deep learning methods and dynamic graph neural networks (Temporal Graph Networks, TGNs), many corresponding methods have been applied to abnormal behavior detection research and have made certain progress in recognition accuracy. The access behavior data of data users in the data box can be modeled as a sequence of interactive behavior events. The behavior objects and access objects are regarded as nodes, and the interactive behaviors are dynamic edges, forming a dynamic interaction graph. The dynamic graph network framework is further used to model the dynamic interaction graph to capture the characteristics of data access dynamic behavior. Based on these characteristics, illegal data access behaviors are identified and related access operations are alarmed in the data box access monitoring program. In order to prevent redundant behavior data from introducing unnecessary noise, the dynamic graph structure learning method is used to achieve dynamic graph denoising and enhance the model's ability to distinguish abnormal behavior characteristics. Summary of the invention

[0004] The purpose of the present invention is to provide a dynamic access behavior analysis method based on a dynamic interaction graph for dynamic access behavior data, so as to improve the analysis accuracy and efficiency of dynamic access behavior data, analyze and mine the behavior of illegal access data, and prevent illegal access operations.

[0005] The dynamic access behavior analysis method based on the dynamic interaction graph provided by the present invention comprises: constructing a dynamic interaction graph to accurately characterize the dynamic access behavior; constructing a dynamic access behavior feature representation learning model to learn the noise-oriented dynamic access behavior; and through model training and optimization, reducing the noise in the dynamic access behavior data to enhance the model and improve the robustness; the specific steps are as follows:

[0006] Step S1: construct a dynamic interaction graph; for a given set of access behavior event sequence data, construct a dynamic interaction graph; wherein the access behavior object and the access object are regarded as nodes, the access behavior is the dynamic edge, and the edge contains a timestamp attribute to reflect the time when the access behavior occurs; a dynamic interaction graph node set is recorded as The edge set is denoted as where e ij (t) represents the behavior event between nodes i and j at time t∈[0,T]. Both nodes and edges may be associated with a set of attribute vectors. According to the timestamp attribute, the access behavior data can be divided into three parts according to the time sequence, namely training data, verification data and test data. The ratio is usually 7:1.5:1.5.

[0007] Taking the downstream task of link prediction as an example, assuming that the edge set of the data is ε, it is sorted from front to back in chronological order and distributed in order and proportion, dividing it into four parts:

[0008] ε=ε 训练 ∪ε 验证 ∪v 测试

[0009] Step S2: construct a dynamic access behavior feature representation learning model; the model specifically includes: a double-layer memory module for recording historical access behaviors; an information generation module for generating node information; a state update module for updating memory information; and a node dynamic representation module for node representation. Specifically:

[0010] Step S2-1: Construct a double-layer memory module. Assume that at time t, an access behavior event occurs between node i and node j, denoted as e ij (t), assuming that node i and node j have two representations at this moment (here we take node i as an example, and do the same for node j): h i (t-) is the representation before the event, h i (t+) is the representation after the event. The former can be used to predict whether the event will occur, while the latter reflects the impact of the event. From this perspective, embedding h i As a function of t, then we have or e i(τ)∈ε} is the discontinuity point of the function. h(t-) and h(t+) are called the representations before and after the jump, respectively. Two memory units are introduced and Store the representation h of each node i separately i (t+) and h i (t-). For each node, its memory value and is initialized to the zero vector and then updated as new events involving this node arrive.

[0011] Step S2-2: Construct an information generation module. For an event involving node i at time t, first generate information m i (t) is represented by the node after the calculation event, that is, h(t+).

[0012] Assume event e ij (t) occurs between nodes i and j and has the feature vector e ij (t). First, get the previous state of the node from the memory unit and in If it is from Get the value from , then there is s i (t) = h i (t i ' + ), that is, node i at the previous event time t i 'After the state. Another option is to use Then there are i (t) = h i (t-), represents the state of node i before the current event. By default, Because it not only considers the impact of the last event t', but also captures the evolution of the node within the time window (t', t), and then generates two pieces of information:

[0013] m i (t) = msg.s i (t),s j (t),e ij (t),Φ(tt i ′) / , (1)

[0014] m j (t) = msg.s j (t),s i (t),e ij (t),Φ(tt j ′) / , (2)

[0015] Among them, msg is the message function, ti ' is the timestamp of the most recent event involving node j. Φ is a time encoding function that maps time intervals to a d-dimensional vector. For simplicity, the identity message function is often used, which directly returns the concatenation of the input vectors.

[0016] Step S2-3: Construct a state update module. As mentioned above, the state h(t+) of a node reflects the impact of an event. The following formula is used to calculate the state of a node after receiving an event e ij (t) The new representation of node i:

[0017]

[0018] h i (t+) = upd.h′ i (t),m i (t) / , (4)

[0019] Among them, upd is a learnable update function, and GRU is used in practice [1] Similarly, for the previous state h' i (t), that is If you use h' i (t) = h i (t-), then it can be regarded as simulating the immediate impact of the event and simulating the jump at time t [2] On the other hand, when h' i (t) = h i (t i ' + ), it is a traditional recurrent unit with h(t'+) as the final hidden state and m(t) as the input. The latter is used by default because it is more compatible with the GRU update function. When computing the new embedding h for node i i After (t+), the corresponding value is assigned To update memory

[0020] Step S2-4: Construct a node dynamic representation module. The node dynamic representation module aims to generate a pre-jump representation h(t-) before any time t to be used before the next event arrives. Specifically, an L-layer temporal graph attention network is used. [3] To aggregate neighborhood information:

[0021] First, get the data from the memory unit For all neighbor nodes k involved in L-hops of node i, combine them with their node features: in is the input of the first layer of temporal graph attention layer. Stores the last occurrence at time tk 's characterization of the events after the jump.

[0022] Then, for each layer 1≤l≤L, use multi-head attention [4] Aggregate neighborhood information. The specific formula is as follows:

[0023]

[0024] where || represents vector concatenation, mlp(·) is a two-layer feedforward neural network with hidden and output dimensions d, mha(·) is a multi-head attention function, and the query key value The receptive field is limited to the most recent n events of each node k, given by Here π is a permutation, π k (·) is the temporal neighborhood of node k. The annotations here are omitted. The subscript k in the k (·) event or π k (·) to events k.

[0025] use As a dynamic representation of node i, and through Update memory

[0026] Step S3: Design a noise-oriented dynamic access behavior representation learning method, train the model, and optimize the model parameters:

[0027] For dynamic graphs (such as Figure 2 (a)) Given an interaction edge e ij The edge weight w of (t) ij (t), modify the edge weights to weaken the influence of noise edges, reduce their values, and increase the edge weights of normal edges to strengthen their contributions (e.g. Figure 2 (b)). However, directly using the edge (an interactive behavior event) itself only focuses on the event participants and ignores the importance of non-participants. To solve this problem and control the computational cost, the present invention introduces negative sampling

[15] : for each incoming edge e ij (t), from the node set Randomly select Q nodes n1,n2,…,n Q , and from time Randomly select the same number of time points t n1 ,t n2 ,…,t nQ , as negative samples to construct negative events (i,n1,t n1 ),…,(i,n Q ,tnQ ), these events did not actually occur.

[0028] Therefore, positive and negative events are reweighted according to the following supervisory signals. For a positive sample pair i of node i,

[0029]

[0030] will be minimized, where S ij (t) is a dynamic noise function, ∈∈R + is a hyperparameter, σ(·) is the sigmoid function. If two nodes are similar, they are more likely to share a normal edge, and will be large, which will force w ij (t) approaches 1 by minimizing this signal. Conversely, if two nodes are dissimilar, they tend to connect to a noisy edge, and will be small, which will have an impact on w ij (t) has little impact. Similarly, for the negative sample n of node i q :

[0031]

[0032] will be minimized. If two nodes are not similar, will be huge, which will force By minimizing this signal close to 0. Combining the two optimization objectives, the corresponding optimization function is proposed

[0033]

[0034] Among them, n q ~P n (i) is the negative sample distribution of node i. The above steps can be used to adjust the edge weights in the dynamic graph (such as Figure 2 (c)), and a dynamic graph with weight adjustment and data denoising can be obtained (e.g. Figure 2 (d)).

[0035] By adding this optimization function with the optimization function in the original dynamic access behavior feature representation learning model with learnable weights, the new optimization function is trained to resist the noise of structural learning in the dynamic graph.

[0036] The overall optimization process of the model is as follows: the input of the model is the interaction behavior sequence in the noisy data set, as well as its associated node feature vector, edge feature vector and timestamp, and a dynamic graph is constructed through step S1. For each historical interaction behavior, the dynamic node representation of the interaction behavior node at a certain point in the future is calculated through the constructed dynamic access behavior feature representation learning model (step S2), and the noise-oriented dynamic access behavior representation learning method is inserted under the dynamic interaction graph training framework, the negative sampling mentioned in step S3 is introduced and the weight of the edge is adjusted to reduce the influence of the noise edge and enhance the contribution of the normal edge, and the corresponding objective function is constructed to obtain the denoised dynamic graph, so that the above process can be optimized and the model is sensitive to data noise and performs noise reduction. Through the self-supervisory signal, that is, whether there is an edge at a future time point in the data set as a supervisory signal, the dynamic node representation of different nodes generated by the model is used, and the similarity of the representations between the nodes is calculated (high similarity means that there is a high possibility of an edge between the two nodes), and the dynamic edge prediction training is performed in advance. In this process, the optimization function of the dynamic access behavior feature representation learning is the cross entropy function. For the above overall objective function, multiple rounds of iterative optimization will be performed to update the model parameters. Gradient descent can be used [5] The optimization method calculates the gradient at each iteration and updates the parameters in the negative gradient direction until the algorithm converges or reaches the set maximum number of iterations. At this point, the model training is completed on the training data.

[0037] S3 is a pluggable supplementary method for S2: S2 can be used alone, and inserting S3 can enhance the model mentioned in S2.

[0038] The present invention provides a dynamic access behavior analysis method based on an interaction graph for dynamic access behavior data. The method adopts a dynamic access behavior feature representation learning model to characterize and learn the dynamic interaction graph composed of the access behavior data, and adopts a double-layer memory module to effectively model the dynamic representation of nodes. At the same time, the dynamic graph structure learning method is used to realize dynamic graph denoising, and the noise data in the dynamic interaction graph is processed to weaken the influence of the noise data on the model effect, and the contribution of normal data is enhanced, thereby enhancing the ability of the model to distinguish abnormal behavior characteristics. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 Illustration of the structure of the dynamic access behavior feature representation learning model.

[0040] Figure 2 Illustration of the dynamic graph denoising process based on the noise-oriented dynamic access behavior representation learning method. DETAILED DESCRIPTION

[0041] The following is a specific implementation method of the prompt learning enhancement method for interactive behavior data. The specific steps are:

[0042] (1) Data preprocessing: We selected a data set of access behavior event sequence for the experiment. The data set contains a series of interactive behavior entity nodes, access behavior records, timestamps, entity attributes, access behavior attributes, dynamic labels, etc. The data preprocessing process first constructs the access behavior data into a dynamic interaction graph, in which the access behavior entity nodes are associated with behavior entity attributes as node feature vectors; the access behavior records are the edges of the nodes, and the timestamp information and interactive behavior attributes are associated as timestamp information and edge feature vectors. At the same time, the data is sorted by time in the form of behavior sequences and divided into training data, verification data, and test data in a ratio of 7:1.5:1.5.

[0043] (2) Model training: The design of the model is as described above. The input of the model is the sequence of interaction behaviors in the dataset, as well as its associated node feature vectors, edge feature vectors, and timestamps. For each historical interaction behavior, the dynamic access behavior feature representation learning model is constructed to calculate the dynamic node representation of the interaction behavior node at a certain point in the future. In the dynamic interaction graph training framework, a noise-oriented dynamic access behavior representation learning method is inserted to enable the model to reduce data noise. Dynamic edge prediction training is performed through self-supervisory signals, that is, whether there are edges in the dataset at future time points as supervisory signals. In this process, the optimization function for the dynamic access behavior feature representation learning is the cross-entropy function. For the above objective function, multiple rounds of iterative optimization will be performed to update the model parameters. Gradient descent can be used. [5] The optimization method calculates the gradient at each iteration and updates the parameters in the negative gradient direction until the algorithm converges or reaches the set maximum number of iterations. At this point, the model training is completed on the training data.

[0044] (3) Verification and testing: Use verification data to verify the effectiveness of the model, store the model parameters that perform best on the verification data, and perform a final test of the model using test data.

[0045] (4) Encapsulation into data box: Encapsulate the model into the data box for identification of access behavior data in the data box, issue an alarm for identified abnormal behavior, and block access behavior that is determined to be illegal. Specifically, after the model is encapsulated into the data box, when a user accesses the data in the data box, the access behavior is recorded, with different users as different source nodes and the accessed data objects as target nodes; the user's characteristics are described by the user's inherent attributes, and the data's characteristics are described by the data's inherent attributes. Different access behaviors are modeled and distinguished by edge features, for example, data read and write operations are distinguished in edge features; similarly, information such as access time is also recorded. Thus, a dynamic interaction graph corresponding to the user's access behavior to the data in the data box can be constructed, and the model encapsulated in the data box can be used to determine whether the user's access behavior is reasonable. If it is unreasonable, an alarm is issued for abnormal behavior or access is blocked.

[0046] The method of the present invention provides a new representation learning method for access behavior data analysis and effectively reduces the noise of access behavior data through a noise-oriented dynamic access behavior representation learning method. The model theory is combined and encapsulated into the data box to form a real-time monitoring method for data access behavior, and timely alarms and interventions are carried out when abnormal situations occur, thereby improving the security of the data box for access behavior.

[0047] This method is applied to a dynamic graph dataset with more than 10,000 nodes and 1 million edges to perform node classification tasks for abnormal node identification. Compared with previous methods (using AUC-ROC as the measurement indicator), the method of the present invention improves the performance by more than 3.5% in the unprocessed original dataset compared with the best previous method, by more than 9.6% in the dataset with added noise in time, by more than 11.3% in the dataset with added noise in features, and by more than 15.8% in the dataset with added noise in dynamic graph structure. This shows the effectiveness of the method of the present invention in node representation and noise reduction in interactive behavior data. The comparison methods include GraphSage[6], Pro-GCN[7], SimP-GCN[8], RSGNN[9], CTDNE

[10] , DyRep

[11] , JODIE

[12] , TGAT

[13] , TGN

[14] , and PINT

[15] .

[0048] The parameters used in this embodiment are as follows:

[0049] parameter value Node Dimension 172 Edge Dimension 172 Batch Size 200 Learning Rate 0.0001 Optimizer Adam Dropout Random drop ratio 0.1 Memory module dimensions 172 .

[0050] References:

[0051] [1]Kyunghyun Cho,Bart Van Caglar Gulcehre,DzmitryBahdanau,Fethi Bougares,Holger Schwenk,and Yoshua Bengio.Learning phraserepresentations using RNN encoder-decoder for statistical machinetranslation.EMNLP.2014.

[0052] [2]Yao Zhang,Yun Xiong,Dongsheng Li,Caihua Shan,Kan Ren,and YangyongZhu.CoPE:Modeling Continuous Propagation and Evolution on InteractionGraph.CIKM.2021.[3]Da Xu,Chuanwei Ruan,Evren Korpeoglu,Sushant Kumar,andKannan Achan.Inductive representation learning on temporal graphs.ICLR.2020.

[0053] [4]Ashish Vaswani,Noam Shazeer,Niki Parmar,Jakob Uszkoreit,LlionJones,Aidan N Gomez, Kaiser,and Illia Polosukhin.Attention is all youneed.NeurIPS.2017.

[0054] [5]Rakhlin,Alexander,Ohad Shamir,and Karthik Sridharan.Makinggradient descent optimal for strongly convex stochasticoptimization.ICML.2012.

[0055] [6]William L.Hamilton,Rex Ying,and Jure Leskovec.2017.InductiveRepresentation Learning on Large Graphs.In NIPS.

[0056] [7]Wei Jin,Yao Ma,Xiaorui Liu,Xianfeng Tang,Suhang Wang,and JiliangTang.2020.Graph structure learning for robust graph neural networks.InProceedings of the 26th ACM SIGKDD international conference on knowledgediscovery&data mining.66–74.[8]Wei Jin,Tyler Derr,Yiqi Wang,Yao Ma,Zitao Liu,and Jiliang Tang.2021.NodeSimilarity Preserving Graph ConvolutionalNetworks.In Proceedings of the 14th ACMInternational Conference on Web Searchand Data Mining.ACM.

[0057] [9]Enyan Dai,Wei Jin,Hui Liu,and Suhang Wang.2022.Towards robustgraph neuralnetworks for noisy graphs with sparse labels.In Proceedings ofthe Fifteenth ACMInternational Conference on Web Search and Data Mining.181–191.

[0058]

[10] Giang Hoang Nguyen,John Boaz Lee,Ryan A Rossi,Nesreen K Ahmed,Eunyee Koh,and Sungchul Kim.2018.Continuous-time dynamic networkembeddings.In Companionproceedings of the the web conference 2018.969–976.

[0059]

[11] Rakshit Trivedi,Mehrdad Farajtabar,Prasenjeet Biswal,and HongyuanZha.2019.Dyrep:Learning representations over dynamic graphs.InInternationalconference on learning representations.

[0060]

[12] Srijan Kumar,Xikun Zhang,and Jure Leskovec.2019.Predictingdynamic embeddingtrajectory in temporal interaction networks.In Proceedingsof the 25th ACM SIGKDDinternational conference on knowledge discovery&datamining.1269–1278.

[0061]

[13] Da Xu,Chuanwei Ruan,Evren Korpeoglu,Sushant Kumar,and KannanAchan.2020.Inductive representation learning on temporal graphs.arXivpreprintarXiv:2002.07962(2020).

[0062]

[14] Emanuele Rossi,Ben Chamberlain,Fabrizio Frasca,Davide Eynard,Federico Monti,and Michael Bronstein.2020.Temporal graph networks for deeplearning on dynamicgraphs.arXiv preprint arXiv:2006.10637(2020).

[0063]

[15] Amauri Souza,Diego Mesquita,Samuel Kaski,and VikasGarg.2022.Provablyexpressive temporal graph networks.Advances in NeuralInformation ProcessingSystems 35(2022),32257–32269。

Claims

1. A dynamic access behavior analysis method based on a dynamic interaction graph, characterized in that: include: Construct dynamic interaction graphs to accurately characterize dynamic access behaviors; A dynamic access behavior feature representation learning model is constructed to learn noise-oriented dynamic access behaviors. Through model training, model parameters are optimized to reduce noise in dynamic access behavior data to enhance the model. The specific steps are as follows: Step S1: construct a dynamic interaction graph; For a given set of access behavior event sequence data, a dynamic interaction graph is constructed; wherein the access behavior object and the access object are regarded as nodes, the access behavior is the dynamic edge, and the edge contains a timestamp attribute to reflect the time when the access behavior occurs; a dynamic interaction graph node set is recorded as The edge set is denoted as where e ij (t) represents the behavior event that occurs between nodes i and j at time t∈[0,T]. According to the timestamp attribute, the access behavior data is divided into three parts according to the time sequence, namely training data, verification data and test data. Step S2: construct a dynamic access behavior feature representation learning model; The model specifically includes: a double-layer memory module for recording historical access behaviors; an information generation module for generating node information; a state update module for updating memory information; and a node dynamic representation module for node representation; specifically: Step S2-1: constructing a double-layer memory module; Assume that at time t, an access behavior event occurs between node i and node j, denoted as e ij (t), suppose that node i and node j have two representations at this moment respectively; For node i: h i (t-) is the representation before the event, h i (t+) is the representation after the event; the former is used to predict whether the event will occur, and the latter reflects the impact of the event; embedding h i As a function of t, then we have or e i (τ)∈ε} is the discontinuity point of the function; h(t-) and h(t+) are called the representations before and after the jump respectively; and two memory units are introduced and Store the representation h of each node i separately i (t+) and h i (t-); For each node, its memory value and , is initialized to the zero vector and then updated as new events involving the node arrive; For node j, do the same processing as node i; Step S2-2: constructing an information generation module; For an event involving node i at time t, first generate information m i (t) is represented by the node after the calculation event, i.e. h(t+); Assume event e ij (t) occurs between nodes i and j and has the feature vector e ij (t); Get the previous state of the node from the memory unit and in If it is from Get the value from , then there is s i (t) = h i (t i ' + ), that is, node i at the previous event time t i 'After the state; another option is to use Then there are i (t) = h i (t-), represents the state of node i before the current event; by default, Then two pieces of information are generated: m i (t)=msg.s i (t),s j (t),e ij (t),Φ(t-t i ′) / , (1) m j (t)=msg.s j (t),s i (t),e ij (t),Φ(t-t j ′) / , (2) Among them, msg is the message function, t i ' is the timestamp of the most recent event involving node j; Φ is the time encoding function, Φ maps the time interval to a d-dimensional vector; Step S2-3: construct a status update module; The node state h(t+) reflects the impact of the event and is calculated by the following formula after receiving the event e ij (t) The new representation of node i: h i (t+)=upd.h′ i (t),m i (t) / , (4) where upd is a learnable update function; similarly, for the previous state h' i (t), that is If you use h' i (t) = h i (t-), then it is regarded as simulating the immediate impact of the event and simulating the jump at time t. On the other hand, when h' i (t) = h i (t i ' + ), it is a traditional recurrent unit with h(t'+) as the final hidden state and m(t) as the input; the latter is used by default, which is more compatible with the GRU update function; when computing the new embedding h for node i i After (t+), the corresponding value is assigned To update memory Step S2-4: construct a node dynamic representation module; The node dynamic representation module aims to generate a pre-jump representation h(t-) before any time t for use before the next event arrives; specifically, an L-layer temporal graph attention network is used to aggregate neighborhood information: First, get the data from the memory unit For all neighbor nodes k involved in L-hops of node i, combine them with their node features: in is the input of the first temporal graph attention layer; at this time Stores the last occurrence at time t k 'The representation of the event after the jump; Then, for each layer 1≤l≤L, multi-head attention is used to aggregate neighborhood information. The specific formula is as follows: where || represents vector concatenation, mlp(·) is a two-layer feedforward neural network with hidden and output dimensions d, mha(·) is a multi-head attention function, and the query key value The receptive field is limited to the most recent n events of each node k, given by Here π is a permutation, π k (·) is the temporal neighborhood of node k; the notation is omitted here. The subscript k in the k (·) events or π k (·) events up to k; use As a dynamic representation of node i, and through Update memory Step S3: Train the model and optimize model parameters: For a given interaction edge e in a dynamic interaction graph ij The edge weight w of (t) ij (t), modify the edge weights to weaken the influence of noise edges, reduce their values, and increase the edge weights of normal edges to strengthen their contributions; for this purpose, negative sampling is introduced: for each incoming edge e ij (t), from the node set Randomly select Q nodes n1,n2,…,n Q , and from time Randomly select the same number of time points t n1 ,t n2 ,…,t nQ , as negative samples to construct negative events (i,n1,t n1 ),…,(i,n Q ,t nQ ), these events did not actually occur; Therefore, positive and negative events are reweighted according to the following supervisory signals; for the positive sample pair of node i will be minimized, where S ij (t) is a dynamic noise function, ∈∈R + is a hyperparameter, σ(·) is the sigmoid function; similarly, for the negative sample n of node i q : will be minimized; Combining the two optimization objectives, the corresponding optimization function Among them, n q ~P n (i) is the negative sample distribution of node i. The edge weights in the dynamic graph are adjusted through the above steps, and a dynamic graph after weight adjustment and data denoising is obtained. This optimization function is added to the optimization function in the original dynamic access behavior feature representation learning model with learnable weights, and the new optimization function is trained to resist the noise of structural learning in the dynamic graph.

2. The dynamic access behavior analysis method based on dynamic interaction graph according to claim 1 is characterized in that: The overall optimization process of the model in step (3) is: The input of the model is the interaction behavior sequence in the noisy data set, as well as its associated node feature vectors, edge feature vectors and timestamps; a dynamic graph is constructed through step S1, and for each historical interaction behavior, the dynamic access behavior feature representation learning model constructed in step S2 is used to calculate the dynamic node representation of the interaction behavior node at a certain point in the future, and in the dynamic interaction graph training framework, a noise-oriented dynamic access behavior representation learning method is inserted, negative sampling is introduced and the weights of the edges are adjusted to reduce the impact of the noise edges and enhance the contribution of the normal edges, and a corresponding objective function is constructed to obtain a denoised dynamic graph, and the above process is optimized and the model is made sensitive to data noise and performs noise reduction processing; Through self-supervision signals, that is, whether there are edges in the data set at future time points as supervision signals, the dynamic node representations of different nodes generated by the model are used, and the representation similarities between the nodes are calculated to perform dynamic edge prediction training; in this process, the optimization function for learning the dynamic access behavior feature representation is the cross-entropy function; for the above-mentioned overall objective function, multiple rounds of iterative optimization are performed to update the parameters of the model. Specifically, the gradient descent optimization method is used to calculate the gradient for each iteration, and the parameters are updated in the direction of the negative gradient until the algorithm converges or reaches the set maximum number of iterations, and the model training is completed on the training data.

Images