Abnormity identification method on dynamic heterogeneous graph

Abstract

The invention discloses an anomaly identification method on a dynamic heterogeneous graph. The method comprises the steps that dynamic heterogeneous graphs of different time slices are obtained, and each dynamic heterogeneous graph comprises nodes and edges between the nodes; obtaining a target edge in the dynamic heterogeneous graph, and carrying out sampling processing on the dynamic heterogeneous graph of the different time slices based on nodes corresponding to the target edge to obtain heterogeneous sub-graphs of the different time slices after sampling; and processing the heterogeneous sub-graphs of different time slices based on the two types of relationships to obtain the embedding of the heterogeneous sub-graphs of each relationship, and inputting the embedding of the heterogeneous sub-graphs of each relationship into a gating recursion unit to obtain a target value corresponding to the embedding of the heterogeneous sub-graphs of each relationship. According to the method, the technical problem that the abnormal edge on the dynamic heterogeneous graph is inaccurately identified due to the fact that the node and edge types are different and the dynamic structure evolution of the relationship in the heterogeneous graph cannot be accurately captured in the existing method for identifying the abnormal detection in the dynamic graph is solved.

Description

Technical Field

[0001] The present invention relates to determining abnormal edge areas in a dynamic graph, and in particular to an abnormality identification method on a dynamic heterogeneous graph. Background Art

[0002] Anomaly detection is crucial in various real-world domains, including identifying suspicious user activities in social networks, detecting fraud in financial transactions, and discovering network intrusions in network security. In particular, detecting anomalous behavior (at the edge) is crucial because it can reveal potentially harmful or fraudulent activities that might otherwise go unnoticed. For example, in social networks, identifying anomalies in user interactions can reveal malicious activities, such as those aimed at manipulating public opinion or spreading misinformation.

[0003] Since anomalies may change over time, many methods have proposed methods to detect abnormal behaviors in dynamic graphs. They adopt temporal and structural patterns to identify abnormal edges in evolving graphs. The most advanced method THGNN [LiY, ZhuJ, ZhangC, et al. THGNN: An Embedding-based Model for Anomaly Detection in Dynamic Heterogeneous Social Networks [C] / / Proceedings of the 32nd ACM International Conference on Information and Knowledge Management. 2023: 1368-1378.] further integrates the heterogeneous information of edges, because for most scenarios, the types of nodes and edges are not the same. However, THGNN does not capture the dynamic structural evolution of relationships in heterogeneous graphs. It mainly focuses on the representation of a single relationship and may ignore the temporal structural changes of relationships between nodes. In contrast, capturing the dynamic evolution of structural relationships can provide a more comprehensive understanding of how the relationships between nodes change over time, which is crucial for accurate anomaly detection. Specifically, Figure 2 Here is a schematic diagram of two relationships in the heterogeneous subgraph of the target edge e: Figure 2 Two relationships in the heterogeneous subgraph of the target edge e (red at snapshot t) are shown: vote (r1) and follow (r2). For the vote (r1) relationship in "user votes story", the abnormal user (red) initially voted normally at snapshot t-2, continued to vote normally at snapshot t-1, and finally voted abnormally for a story at snapshot t, influencing other normal users to vote in the same way. For the follow (r2) relationship in "user follows user", the abnormal user followed the normal user from t-2 to t, gradually disguising himself.

[0004] To address this issue, a new method, ExpGraph, is proposed, which can capture the evolution of relational structures and reveal underlying behaviors. In addition, THGNN lacks interpretability in understanding abnormal behaviors because it lacks a mechanism to provide clear insights into why a specific abnormal behavior is detected, which makes it difficult to interpret the detected abnormal behaviors. To address this issue, the proposed ExpGraph method adopts a new prototype-based approach to align normal behaviors with representative prototypes, thereby improving the interpretability of the model. Summary of the invention

[0005] An embodiment of the present invention provides a method for identifying anomalies on a dynamic heterogeneous graph, so as to at least solve the technical problem that the existing method for identifying anomaly detection in a dynamic graph has different node and edge types and cannot accurately capture the dynamic structural evolution of the relationship in the heterogeneous graph, resulting in inaccurate identification of abnormal edges on the dynamic heterogeneous graph.

[0006] According to one aspect of an embodiment of the present invention, a method for identifying anomalies on a dynamic heterogeneous graph is provided. The method may include: obtaining a dynamic heterogeneous graph of different time slices, wherein the dynamic heterogeneous graph includes nodes, nodes, and edges between nodes; obtaining a target edge in the dynamic heterogeneous graph, sampling and processing the dynamic heterogeneous graph of different time slices based on the nodes corresponding to the target edge, and obtaining heterogeneous subgraphs of different time slices after sampling; processing the heterogeneous subgraphs of different time slices based on two types of relationships, and obtaining the embedding of the heterogeneous subgraph of each relationship, wherein the embedding of the heterogeneous subgraph of each relationship includes the embedding of the subgraphs of different time slices; inputting the embedding of the heterogeneous subgraph of each relationship into a gated recursive unit, and obtaining a target value corresponding to the embedding of the heterogeneous subgraph of each relationship; updating the prototype based on the target value corresponding to the embedding of the heterogeneous subgraph of each relationship, and obtaining an updated prototype corresponding to the heterogeneous subgraph of each relationship; updating the prototype based on the updated prototype corresponding to the heterogeneous subgraph of each relationship; The prototype and the target value of the embedding of the heterogeneous subgraph of each relationship are used to obtain the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship; based on the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship, the evolutionary representation enhanced by the capture relationship of the target edge is obtained; the heterogeneous subgraphs of different time slices after sampling are input into the induction model to obtain the embedding of all nodes of the heterogeneous subgraphs of different time slices after sampling; the embeddings of all nodes are pooled to obtain the node embedding of the heterogeneous subgraph of each time slice after sampling; the node embeddings of the heterogeneous subgraph of each time slice after sampling are aggregated to obtain the semantic representation of the meta-path of the target edge; based on the evolutionary representation enhanced by the capture relationship of the target edge and the semantic representation of the meta-path, the predicted anomaly score of the target edge is obtained; based on the predicted anomaly score of the target edge, it is determined whether the target edge is abnormal.

[0007] Optionally, the sampling and processing of the dynamic heterogeneous graphs of different time slices based on the nodes corresponding to the target edges to obtain heterogeneous subgraphs of the different time slices after sampling includes: based on the nodes corresponding to the target edges, sampling and processing of the dynamic heterogeneous graphs of different time slices are performed by three sampling strategies respectively to obtain heterogeneous subgraphs of the different time slices after sampling, wherein the three sampling strategies are meta-path, k-hop neighborhood and sampling based on node importance.

[0008] Optionally, the prototype is updated based on the target value corresponding to the embedding of the heterogeneous subgraph of each relationship to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship, including: inputting the target value corresponding to the embedding of the heterogeneous subgraph of each relationship into the target mechanism to obtain the first weight of the target value corresponding to the embedding of the heterogeneous subgraph of each relationship; multiplying the first weight of the target value corresponding to the embedding of the heterogeneous subgraph of each relationship by the prototype and then adding the result to the prototype to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship.

[0009] Optionally, the method obtains the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship based on the updated prototype corresponding to the heterogeneous subgraph of each relationship and the embedded target value of the heterogeneous subgraph of each relationship, including: inputting the embedded target value of the heterogeneous subgraph of each relationship into the target mechanism to obtain the second weight of the embedded target value of the heterogeneous subgraph of each relationship; and determining the product of the updated prototype corresponding to the heterogeneous subgraph of each relationship and the second weight as the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship.

[0010] Optionally, the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship is based on obtaining the evolutionary representation enhanced by the capture relationship of the target edge, including: aggregating the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship to obtain the evolutionary representation enhanced by the capture relationship of the target edge.

[0011] Optionally, the expression for the predicted anomaly score of the target edge is obtained based on the evolutionary representation enhanced by the capture relationship of the target edge and the semantic representation of the meta-path:

[0012] in, is the predicted anomaly score of the target edge, The evolutionary representation enhanced by the capture relation of the target edge, is the semantic representation of the meta-path, represents the sigmoid activation function, Represents a linear function.

[0013] Beneficial effects of the present invention: This paper proposes a method for anomaly identification on dynamic heterogeneous graphs. In this paper, the challenges of interpretable abnormal behavior (edge) detection on dynamic heterogeneous graphs are explored, and ExpGraph, a new model that tracks the evolution of relation-aware structures, is introduced to thoroughly capture behavior-related features. To improve interpretability, it is further suggested to keep the representation of normal relational heterogeneous subgraphs consistent with the prototype. Therefore, anomalies can be explained as behaviors that deviate from the prototype. Evaluation results show that the model proposed by this paper outperforms the current state-of-the-art models in terms of effectiveness. In addition, the method of this paper can provide a more comprehensive understanding of abnormal behaviors (edges) in dynamic heterogeneous graphs. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings: Figure 1 is a flow chart of a method for identifying anomalies on a dynamic heterogeneous graph according to an embodiment of the present invention; Figure 2 It is a schematic diagram of two relations in the heterogeneous subgraph of the target edge e; Figure 3 is a schematic diagram of the overall architecture of the ExpGraph model according to an embodiment of the present invention; Figure 4 is a schematic diagram of parameter sensitivity of ExpGraph according to an embodiment of the present invention; Figure 5 is a schematic diagram of an ablation experiment of ExpGraph according to an embodiment of the present invention; Figure 6 is a schematic diagram of an example analysis on a Digg dataset according to an embodiment of the present invention. DETAILED DESCRIPTION

[0015] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only embodiments of a part of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0016] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0017] Example 1 According to an embodiment of the present invention, a method for identifying anomalies on a dynamic heterogeneous graph is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system comprising at least one set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0018] Figure 1 is a flow chart of a method for identifying anomalies on a dynamic heterogeneous graph according to an embodiment of the present invention. Figure 1 As shown, the method may include the following steps: Step S101, obtaining a dynamic heterogeneous graph of different time slices, wherein the dynamic heterogeneous graph includes nodes, nodes, and edges between nodes.

[0019] In the technical solution provided in the above step S101 of the present invention, Figure 3 is a schematic diagram of the overall architecture of the ExpGraph model according to an embodiment of the present invention, for example, Figure 3 In (a), the dynamic heterogeneous graph is defined as ,in : Will Mapped to node types, : Mapping Maps to edge types (relationships), where or . Edge Set It is an evolving edge stream ,in, Each edge in Each consists of a 5-tuple Here, , , represent the source node and the target node respectively, yes The edge types (relationships) in represents edge attributes (this is optional, as some edge types may not have attributes), It's the edge Each edge type There is a reverse edge type , the reverse edge type of the symmetric edge is .For example, Figure 3 (a) in the figure has a heterogeneous graph with three time slices: t-2, t-1, and t. The nodes are circles or squares, and the edges are real or imaginary.

[0020] Step S102, obtaining a target edge in the dynamic heterogeneous graph, and performing sampling processing on the dynamic heterogeneous graph of different time slices based on the nodes corresponding to the target edge to obtain heterogeneous subgraphs of different time slices after sampling.

[0021] In the technical solution provided in step S102 of the present invention, according to Figure 3 The target edge of the heterogeneous subgraph in time slice t in (a) is sampled on the dynamic heterogeneous graphs of different time slices according to the nodes corresponding to the target edge, and the heterogeneous subgraphs of different time slices after sampling are obtained, as shown in Figure 3 Heterogeneous subgraphs at time t-2, t-1 and t after sampling in (a).

[0022] Step S103, processing the heterogeneous subgraphs of different time slices based on the two types of relations, obtaining the embedding of the heterogeneous subgraph of each relation, inputting the embedding of the heterogeneous subgraph of each relation into the gated recursive unit, and obtaining the target value corresponding to the embedding of the heterogeneous subgraph of each relation; wherein the embedding of the heterogeneous subgraph of each relation includes the embedding of subgraphs of different time slices.

[0023] In the technical solution provided in step S103 of the present invention, Figure 3 (b) in the figure processes heterogeneous subgraphs of different time slices through r1 and r2 to obtain the embedding of the heterogeneous subgraph of each relationship, and inputs the embedding of the heterogeneous subgraph of each relationship into the gated recurrent unit to obtain the target value corresponding to the embedding of the heterogeneous subgraph of each relationship.

[0024] For example, in Figure 3 In (b), there are two types of relationships: (indicated by solid arrows) and (Indicated by dotted arrows). By extracting the nodes connected by each relationship, a heterogeneous subgraph can be created. First, the expression for propagating information between nodes in each heterogeneous subgraph is: (1) (2) in, , , Indicates in relationship Next Node The neighbor nodes of Indicates in relationship The trainable weights under Indicates in relationship Next Node The embedding representation of Represents the node embedding representation after propagating information between nodes.

[0025] The expression of relation-level information fusion between different relational heterogeneous subgraphs is: (3) in, represents the trainable parameters, Representation Node The embedding representation of Represents trainable weights.

[0026] Embedding Representation of Relational Heterogeneous Subgraphs By embedding all nodes in the relational heterogeneous subgraph The average pooling is calculated. And if the message passing function And the activation function is Lipschitz continuous and the graph is connected, then the relational heterogeneous subgraph representation learning will converge to a stable representation.

[0027] A temporal learning algorithm is used to capture the dynamic evolution of relation-aware structures over time. For different relational heterogeneous subgraphs in a snapshot, the expression for modeling their dynamic evolution through gated recurrent units (GRUs) is: (4) (5) (6) (7) in, represents the element-wise multiplication operation, These are all trainable parameters. Represents the dimension of the hidden unit in GRU. The output of the last snapshot It is used to encode the changing trend of heterogeneous subgraphs over time. For all heterogeneous subgraphs, their time series outputs are composed of The GRU-based sequence learning algorithm converges to a stable state if the following conditions are met: the weight matrix , , , , and Is a bounded, activation function and is Lipschitz continuous, the input sequence is bounded, represents the output of the update gate, represents the hidden state at the previous time step, The hidden state at the current time step, represents the candidate hidden state at the current time step, Represents the output of the reset gate.

[0028] Step S104, based on the target value corresponding to the embedding of the heterogeneous subgraph of each relationship, the prototype is updated to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship, based on the updated prototype corresponding to the heterogeneous subgraph of each relationship and the target value of the embedding of the heterogeneous subgraph of each relationship, the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship is obtained, based on the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship, the evolutionary representation enhanced by the capture relationship of the target edge is obtained.

[0029] In the technical solution provided in the above step S104 of the present invention, the prototype is updated according to the target value corresponding to the embedding of the heterogeneous subgraph of each relationship to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship, and the dynamic structural evolution represented by the prototype corresponding to the heterogeneous subgraph of each relationship is obtained according to the updated prototype corresponding to the heterogeneous subgraph of each relationship and the target value of the embedding of the heterogeneous subgraph of each relationship. According to the dynamic structural evolution represented by the prototype corresponding to the heterogeneous subgraph of each relationship, the enhanced evolutionary representation of the capture relationship of the target edge is obtained.

[0030] Step S105, input the heterogeneous subgraphs of different time slices after sampling into the inductive model, obtain the embeddings of all nodes of the heterogeneous subgraphs of different time slices after sampling, perform pooling operation on the embeddings of all nodes to obtain the node embeddings of the heterogeneous subgraph of each time slice after sampling, perform aggregation operation on the node embeddings of the heterogeneous subgraph of each time slice after sampling, and obtain the semantic representation of the meta-path of the target edge.

[0031] In the technical solution provided in step S105 of the present invention, the metapath After node-level propagation, the snapshot The node representation at The updated expression is: (8) (9) in, Representation Node In the snapshot Metapath The neighbor nodes of , , Representation Node and The weight between Represents a trainable weight vector. The expression of the presentation model after meta-path level aggregation is: (10) (11) in, Represents the number of meta-paths, , is a learnable parameter, Is a snapshot Metapath The specific node embedding under Represents a meta path The corresponding weight. , , is the hidden layer dimension. The final presentation after snapshot-level fusion The expression is: (12) (13) in, Indicates the number of snapshots. , , is a learnable parameter. It is achieved by embedding all nodes in a snapshot Taking the average value, we get The goal is to use the following contrast loss, Represents the weight corresponding to the snapshot at time t, so that the same node in adjacent snapshots The nodes are close to: (14) in, , By calculating the time Node The average edge representation of the surrounding edges The average value is obtained from the node The order of , Indicates the node under the slice corresponding to time* The weight of Indicates the node under the slice corresponding to time* The weight of is a hyperparameter called the temperature variable.

[0032] Step S106, obtaining a predicted anomaly score of the target edge based on the enhanced evolutionary representation of the capture relationship of the target edge and the semantic representation of the meta-path, and determining whether the target edge is abnormal based on the predicted anomaly score of the target edge.

[0033] In the technical solution provided in the above step S106 of the present invention, the enhanced evolutionary representation of the capture relationship of the target edge and the semantic representation of the meta-path are calculated to obtain the predicted anomaly score of the target edge, and whether the target edge is abnormal is determined based on the predicted anomaly score of the target edge.

[0034] The above method of this embodiment is further introduced below.

[0035] As an optional implementation method, step S102, the sampling and processing of the dynamic heterogeneous graphs of different time slices based on the nodes corresponding to the target edge to obtain the heterogeneous subgraphs of the different time slices after sampling, includes: based on the nodes corresponding to the target edge, sampling and processing of the dynamic heterogeneous graphs of different time slices by three sampling strategies respectively, to obtain the heterogeneous subgraphs of the different time slices after sampling, wherein the three sampling strategies are meta-path, k-hop neighborhood and sampling based on node importance.

[0036] In this embodiment, for a given target edge , meta-path based sampling will explore the connections to and The sampling based on node importance is performed by calculating the importance score through personalized PageRank: (15) in, represents the adjacency matrix, is a diagonal degree matrix, , Represents the random jump probability.

[0037] In the heterogeneous subgraph using these three node set sampling strategies, node embeddings are initially determined by their importance, spatial distance to the target edge, , time distance and node type information, the expression of node embedding is: (16) (17) Among them, the importance of Calculated, the spatial distance to the target edge is given by Get, time of occurrence With current time The time distance calculation formula is: , the node type information is , Is a node Type. ,in , , is calculated by multiplying the learnable parameters by the connection vector, and is the hidden dimension. Then, a pooling operation is performed to obtain the final node representation .

[0038] As an optional implementation method, step S104, the prototype is updated based on the target value corresponding to the embedding of the heterogeneous subgraph of each relationship to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship, including: inputting the target value corresponding to the embedding of the heterogeneous subgraph of each relationship into the target mechanism to obtain the first weight of the target value corresponding to the embedding of the heterogeneous subgraph of each relationship; multiplying the first weight of the target value corresponding to the embedding of the heterogeneous subgraph of each relationship by the prototype and then adding the result to the prototype to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship.

[0039] In this embodiment, the representation of the prototype can be updated as follows: (18) in, , , , , , , , . Initialized by random values, Represents the hidden layer dimension. Indicates the number of edges in a snapshot. Indicates the number of prototypes. represents the dimension of prototype embedding, This is the prototype before the update. For the updated prototype, The first weight of the target value corresponding to the embedding of the heterogeneous subgraph of each relationship is multiplied by the prototype.

[0040] As an optional implementation method, step S104, based on the updated prototype corresponding to the heterogeneous subgraph of each relationship and the embedded target value of the heterogeneous subgraph of each relationship, obtains the dynamic structural evolution represented by the prototype corresponding to the heterogeneous subgraph of each relationship, including: inputting the embedded target value of the heterogeneous subgraph of each relationship into the target mechanism to obtain the second weight of the embedded target value of the heterogeneous subgraph of each relationship; and determining the product of the updated prototype corresponding to the heterogeneous subgraph of each relationship and the second weight as the dynamic structural evolution represented by the prototype corresponding to the heterogeneous subgraph of each relationship.

[0041] In this example, the target mechanism is Figure 3 The Attention mechanism in (d) determines the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship as the product of the updated prototype and the second weight corresponding to the heterogeneous subgraph of each relationship: (19) (20) in, , is the sum of all edges in the snapshot Got it, , , , represents the prototype representation after layer l, , The dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship, is the second weight, Next, the representations of all heterogeneous subgraphs are aggregated at the relation level to form edge , named In order to make the edge The hidden features of the relationship change are aligned with their nearest prototypes, and their distance is defined as: (twenty one) in, express Specify the relationship below The dynamic structural evolution of Indicates a specified relationship below The latest prototype. express paradigm. Indicates the number of relationship types, Represents a collection of edges.

[0042] As an optional implementation method, step S104, based on the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship, obtains the enhanced evolutionary representation of the capture relationship of the target edge, including: aggregating the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship to obtain the enhanced evolutionary representation of the capture relationship of the target edge.

[0043] In this embodiment, as shown in module (d) in Figure (3), the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship is aggregated to obtain an evolutionary representation of the target edge that captures the enhanced relationship.

[0044] As an optional implementation manner, in step S106, the expression of the predicted anomaly score of the target edge is obtained based on the evolutionary representation enhanced by the capture relationship of the target edge and the semantic representation of the meta-path: (twenty two) in, is the predicted anomaly score of the target edge, The evolutionary representation enhanced by the capture relation of the target edge, is the semantic representation of the meta-path, represents the sigmoid activation function, Represents a linear function.

[0045] In this embodiment, the problem of optimizing the overall predicted anomaly score of the target edge is solved by minimizing the loss function. The specific method is shown in the following formula: (twenty three) (twenty four) (25) in, , , They represent construction loss, regularization loss, cross entropy loss, and prototype matching loss respectively. The purpose is to reconstruct the adjacency matrix Midpoint and The connectivity between For normal edges The score is 0, which is equal to 1. The overall complexity of ExpGraph is , and Represents each target edge The number of nodes and edges in the sampled heterogeneous subgraph.

[0046] Experimental part: The performance of the proposed model is evaluated on datasets from three real-world rating platforms. A summary of the different datasets is shown in Table 1.

[0047] Table 1 Summary of different datasets

[0048] Digg Dataset: This dataset includes users and stories, with nodes representing users and stories. Edges between users represent follow relationships, while edges between users and stories represent vote relationships. The meta-paths "USU" and "UU" are selected, where 'U' represents users and 'S' represents stories. The relationships include "follow" and "vote", as well as their respective reverse relationships. Yelp Dataset: This dataset collects user reviews of various hotels. Nodes represent users and hotels, and directed edges represent user reviews of hotels. Each edge is labeled as normal or abnormal. The meta-path selected is "UHU", where 'U' represents users and 'H' represents hotels. Relationships include "review" and its reverse relationship. 10.27% of the edges in this dataset are labeled as abnormal. Amazon Dataset: This dataset contains user reviews of products on the Amazon platform. Nodes represent users and products, and directed edges represent user reviews of products. The meta-path "UIU" is used, where 'U' represents users and 'I' represents items. Relationships include "review" and its reverse relationship.

[0049] Regarding the preprocessing of the dataset, since the Digg and Amazon datasets do not contain labels for anomalous edges, 10% of the anomalous edge labels are randomly injected into these two datasets as training sets according to the method outlined in ([2] Li Y, Zhu J, Zhang C, et al. THGNN: An Embedding-based Model for Anomaly Detection in Dynamic Heterogeneous Social Networks [C] / / Proceedings of the 32nd ACM International Conference on Information and Knowledge Management. 2023: 1368-1378). Given that anomalies in the real world are relatively rare, the remaining edges in these datasets are considered normal edges. However, the Yelp dataset already contains annotated anomalous edges, so no additional injection is performed. For evaluation purposes, the original anomalies in the training set are retained, while the anomaly ratio in the test set is adjusted to 5% according to the method of [2]. To achieve this goal in the Yelp dataset, some of the original annotated anomalous edges are randomly removed to adjust the anomaly ratio in the test to 5%.

[0050] The proposed ExpGraph model is also compared with three other types of baseline models. Static heterogeneous graph embedding models: HAN uses meta-paths to propagate and aggregate information between nodes in heterogeneous graphs, and RGCN applies specific relational transformations to capture multi-relational data in heterogeneous graphs. Since these methods are not specifically used for abnormal edge detection, the anomaly score is obtained by averaging the embedding values ​​of the nodes at both ends of the target edge. Abnormal edge detection in dynamic isomorphic graphs: TADDY detects anomalies through spatiotemporal pattern encoding and contrastive learning, MIDAS can identify abnormal edge groups that suddenly appear in dynamic graphs, and RustGraph captures topological and temporal dynamic changes to detect abnormal edges. Abnormal edge detection in dynamic heterogeneous graphs: THGNN propagates information around the target edge according to the edge type, thereby performing time-continuous anomaly detection.

[0051] In the experiment, AUC (area under the ROC curve) is used as the performance metric, which is consistent with the latest methods [2]. The AUC value ranges from 0 to 1, and the larger the value, the better the model performance. This metric is particularly effective for anomaly detection tasks, and it can measure the accuracy of the model even when the number of anomalies is unknown. Table 2 shows the effectiveness results of all baselines compared with the proposed model.

[0052] Table 2 Validity results of all baselines compared with the proposed model

[0053] As can be seen from Table 2, (1) when the percentage of abnormal edges is 10% or 10.27%, the ExpGraph model always has the highest AUC value on the Digg, Yelp, and Amazon datasets. In particular, on the real-world Yelp dataset, the anomaly rate of the ExpGraph model is 7.39% higher than all other models, highlighting its excellent anomaly detection ability. (2) When the anomaly rate is reduced to 5%, the ExpGraph model maintains the best and most stable performance on the Digg and Amazon datasets. On the Yelp dataset, it achieves the second best AUC value. (3) Among the first category of baseline models, RGCN performs best on the Digg and Yelp datasets. On the Yelp dataset, when the percentage of abnormal edges is 5%, it even achieves the highest AUC among all models. This highlights the effectiveness of relational learning in detecting abnormal edges and its key role in edge anomaly detection.

[0054] In the sensitivity analysis, the Yelp dataset was used to explore the impact of hyperparameters on model performance. Figure 4 is a schematic diagram of parameter sensitivity of ExpGraph according to an embodiment of the present invention, Figure 4 (a) shows that the AUC value increases with This shows that although additional prototypes can improve performance, too many prototypes also bring additional noise. Regarding the number of layers in the prototype part, Figure 4 (b) shows that the best performance of the model on the prototype part is 4 layers. Adding more layers on this basis will lead to overfitting of the training data. , Figure 4 (c) shows that the model performs best when there are 5 nodes in the sampled subgraph. If the number of nodes is increased, less relevant nodes may be included, thus reducing performance. Regarding the size of the snapshot: each unit on the x-axis corresponds to 500 edges (e.g., 2 on the x-axis represents 1000 edges). Figure 4 (d) shows that the model performs best when the snapshot size is 1000 edges. May obscure observations that change dynamically in the time dimension. Figure 4 (e) shows that the number of snapshots affects the model’s ability to observe dynamic changes, and the performance is best when the number of snapshots is set to 4.

[0055] An ablation experiment is conducted to evaluate the impact of key components in ExpGraph. The first variant ignores the meta-path enhanced semantic learning, denoted as ExpGraph nm The second variant excludes all losses except the cross entropy loss and is represented as ExpGraph nl The last variant ignores the dynamic structural evolution and uses ExpGraph ne The fourth variant excludes the prototype arrangement and uses ExpGraph np express.

[0056] Figure 5 is a schematic diagram of an ablation experiment of ExpGraph according to an embodiment of the present invention, Figure 5 In the figure, we can see that: (1) On both datasets, ExpGraph is significantly better than ExpGraph nm More effective. This shows that semantic learning of meta-paths is necessary in the model. (2) On the Yelp dataset, ExpGraph performs better than ExpGraph nl ; On the Amazon dataset, ExpGraph performs comparable to ExpGraphnl. This suggests that including additional losses can enhance anomaly detection. (3) ExpGraph outperforms ExpGraph ne , and the effect is significant on the Yelp dataset. This shows that dynamic structural evolution plays an important role. (4) The results of ExpGraph are better than those of ExpGraph np, which indicates that the prototype alignment part also plays an important role in the model.

[0057] Figure 6 Schematic diagram of example analysis on the Digg dataset according to an embodiment of the present invention, using a case study to illustrate the interpretability of the proposed ExpGraph. Using the PCA method [Abdi H, Williams LJ. Principal component analysis [J]. Wiley interdisciplinary reviews: computational statistics, 2010, 2 (4): 433-459.], the high-dimensional embedding of edges and prototypes is mapped to three dimensions, such as Figure 6 As shown in the visualization, the blue points represent the embedding of the prototype, the red points represent the embedding of the abnormal edge, and the green points correspond to the embedding of the normal edge. The visualization results show that the embedding of the normal edge is generally closer to the prototype, while the embedding of the abnormal edge is farther away. This shows that abnormal edge detection can be effectively guided by the prototype.

[0058] In an embodiment of the present invention, a dynamic heterogeneous graph of different time slices is obtained, wherein the dynamic heterogeneous graph includes nodes, nodes and edges between nodes; a target edge in the dynamic heterogeneous graph is obtained, and the dynamic heterogeneous graph of different time slices is sampled based on the node corresponding to the target edge to obtain the sampled heterogeneous subgraphs of different time slices; the heterogeneous subgraphs of different time slices are processed based on two types of relationships to obtain the embedding of the heterogeneous subgraph of each relationship, and the embedding of the heterogeneous subgraph of each relationship is input into a gated recursive unit to obtain the target value corresponding to the embedding of the heterogeneous subgraph of each relationship; wherein the embedding of the heterogeneous subgraph of each relationship includes the embedding of the subgraph of different time slices; the prototype is updated based on the target value corresponding to the embedding of the heterogeneous subgraph of each relationship to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship, based on the updated prototype corresponding to the heterogeneous subgraph of each relationship and the target value of the embedding of the heterogeneous subgraph of each relationship, the dynamic structural evolution represented by the prototype corresponding to the heterogeneous subgraph of each relationship is obtained, and based on the dynamic structural evolution represented by the prototype corresponding to the heterogeneous subgraph of each relationship, the capture relationship increase of the target edge is obtained. Strong evolutionary representation; the heterogeneous subgraphs of different time slices after sampling are input into the induction model to obtain the embeddings of all nodes of the heterogeneous subgraphs of different time slices after sampling, the embeddings of all nodes are pooled to obtain the node embeddings of the heterogeneous subgraphs of each time slice after sampling, and the node embeddings of the heterogeneous subgraphs of each time slice after sampling are aggregated to obtain the semantic representation of the meta-path of the target edge; based on the capture relationship enhanced evolutionary representation of the target edge and the semantic representation of the meta-path, the predicted anomaly score of the target edge is obtained, and based on the predicted anomaly score of the target edge, whether the target edge is abnormal is determined, which solves the technical problem that the existing method for identifying anomaly detection in dynamic graphs has different node and edge types and cannot accurately capture the dynamic structural evolution of relations in heterogeneous graphs, resulting in inaccurate identification of abnormal edges on dynamic heterogeneous graphs, and achieves the new method ExpGraph, capturing the evolution of relational structure, revealing potential behaviors, aligning normal behaviors with representative prototypes, accurately capturing the dynamic structural evolution of relations in heterogeneous graphs, and improving the technical effect of accurately identifying abnormal edges on dynamic heterogeneous graphs.

[0059] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0060] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0061] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0062] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0063] In addition, each functional unit in each embodiment of the present invention may be integrated into a first processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0064] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for identifying anomalies on a dynamic heterogeneous graph, characterized in that: include: Obtaining a dynamic heterogeneous graph of different time slices, wherein the dynamic heterogeneous graph includes nodes, nodes, and edges between nodes; Obtain the target edge in the dynamic heterogeneous graph, sample the dynamic heterogeneous graph of different time slices based on the nodes corresponding to the target edge, and obtain the heterogeneous subgraphs of different time slices after sampling; Based on the two types of relations, the heterogeneous subgraphs of different time slices are processed to obtain the embedding of the heterogeneous subgraph of each relation, and the embedding of the heterogeneous subgraph of each relation is input into the gated recursive unit to obtain the target value corresponding to the embedding of the heterogeneous subgraph of each relation; wherein the embedding of the heterogeneous subgraph of each relation includes the embedding of subgraphs of different time slices; Based on the target value corresponding to the embedding of the heterogeneous subgraph of each relationship, the prototype is updated to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship. Based on the updated prototype corresponding to the heterogeneous subgraph of each relationship and the target value of the embedding of the heterogeneous subgraph of each relationship, the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship is obtained. Based on the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship, the enhanced evolution representation of the capture relationship of the target edge is obtained. Input the heterogeneous subgraphs of different time slices after sampling into the induction model to obtain the embeddings of all nodes of the heterogeneous subgraphs of different time slices after sampling, perform pooling operation on the embeddings of all nodes to obtain the node embeddings of the heterogeneous subgraphs of each time slice after sampling, perform aggregation operation on the node embeddings of the heterogeneous subgraphs of each time slice after sampling, and obtain the semantic representation of the meta-path of the target edge; Based on the enhanced evolutionary representation of the capture relationship of the target edge and the semantic representation of the meta-path, the predicted anomaly score of the target edge is obtained, and based on the predicted anomaly score of the target edge, whether the target edge is abnormal is determined.

2. The method according to claim 1, characterized in that The sampling process of the dynamic heterogeneous graphs of different time slices based on the nodes corresponding to the target edge to obtain the heterogeneous subgraphs of different time slices after sampling includes: Based on the nodes corresponding to the target edges, three sampling strategies are used to sample the dynamic heterogeneous graphs of different time slices to obtain heterogeneous subgraphs of different time slices after sampling. The three sampling strategies are meta-path, k-hop neighborhood and sampling based on node importance.

3. The method according to claim 1, characterized in that The updating of the prototype based on the target value corresponding to the embedding of the heterogeneous subgraph of each relationship to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship includes: Inputting the target value corresponding to the embedding of the heterogeneous subgraph of each relationship into the target mechanism, and obtaining the first weight of the target value corresponding to the embedding of the heterogeneous subgraph of each relationship; The first weight of the target value corresponding to the embedding of the heterogeneous subgraph of each relationship is multiplied by the prototype and then added to the prototype to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship.

4. The method according to claim 1, characterized in that The method of obtaining the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship based on the updated prototype corresponding to the heterogeneous subgraph of each relationship and the embedded target value of the heterogeneous subgraph of each relationship includes: Inputting the embedded target value of the heterogeneous subgraph of each relationship into the target mechanism to obtain a second weight of the embedded target value of the heterogeneous subgraph of each relationship; The product of the updated prototype corresponding to the heterogeneous subgraph of each relationship and the second weight is determined as the dynamic structural evolution represented by the prototype corresponding to the heterogeneous subgraph of each relationship.

5. The method according to claim 1, characterized in that The dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph based on each relationship, obtaining the enhanced evolutionary representation of the capture relationship of the target edge, includes: The dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraphs of each relationship is aggregated to obtain the enhanced evolutionary representation of the capture relationship of the target edge.

6. The method according to claim 1, characterized in that Based on the evolutionary representation of the capture relationship enhancement of the target edge and the semantic representation of the meta-path, the expression of the predicted anomaly score of the target edge is obtained as follows: in, is the predicted anomaly score of the target edge, The evolutionary representation enhanced by the capture relation of the target edge, is the semantic representation of the meta-path, represents the sigmoid activation function, Represents a linear function.

7. A computer system, characterized in that include: One or more processors, and a computer-readable storage medium for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the method of claim 1.

8. A computer-readable storage medium, characterized in that Computer executable instructions are stored, and when the instructions are executed, they are used to implement the method of claim 1.

9. A computer program product, characterized in that The invention comprises computer executable instructions, which are used to implement the method of claim 1 when being executed.

Images