Anomaly identification method on dynamic heterogeneous graph

Abstract

The application discloses an abnormality recognition method on a dynamic heterogeneous graph. The method comprises the following steps: acquiring a dynamic heterogeneous graph of different time slices, wherein the dynamic heterogeneous graph comprises nodes, edges between the nodes and the nodes; acquiring a target edge in the dynamic heterogeneous graph, sampling and processing the dynamic heterogeneous graph of different time slices based on the nodes corresponding to the target edge, and obtaining a sampled heterogeneous subgraph of different time slices; processing the heterogeneous subgraph of different time slices based on two types of relations, obtaining the embedding of the heterogeneous subgraph of each relation, inputting the embedding of the heterogeneous subgraph of each relation into a gated recurrent unit, and obtaining the target value corresponding to the embedding of the heterogeneous subgraph of each relation. The application solves the technical problem that the existing method for recognizing abnormal detection in a dynamic graph cannot accurately capture the dynamic structure evolution of the relations in the heterogeneous graph because the nodes and edge types are not the same, thereby leading to inaccurate recognition of abnormal edges on the dynamic heterogeneous graph.

Description

Technical Field

[0001] The present invention relates to determining abnormal edge areas in a dynamic graph, and in particular to a method for identifying anomalies on a dynamic heterogeneous graph. Background Art

[0002] Anomaly detection is crucial in various real-world applications, including identifying suspicious user activity in social networks, detecting fraud in financial transactions, and detecting network intrusions in cybersecurity. In particular, detecting anomalous behavior (at the edge) is crucial because it can reveal potentially harmful or fraudulent activity that might otherwise go unnoticed. For example, in social networks, identifying anomalies in user interactions can reveal malicious activity, such as those aimed at manipulating public opinion or spreading misinformation.

[0003] Since anomalies may change over time, many methods have proposed methods to detect abnormal behaviors in dynamic graphs. They adopt temporal and structural patterns to identify abnormal edges in evolving graphs. The most advanced method THGNN [LiY, ZhuJ, ZhangC, et al. THGNN: An Embedding-based Model for Anomaly Detection in Dynamic Heterogeneous Social Networks [C] / / Proceedings of the 32nd ACM International Conference on Information and Knowledge Management. 2023: 1368-1378.] further integrates the heterogeneous information of edges, because for most scenarios, the types of nodes and edges are not the same. However, THGNN cannot capture the dynamic structural evolution of relationships in heterogeneous graphs. It mainly focuses on the representation of a single relationship and may ignore the temporal structural changes of relationships between nodes. In contrast, capturing the dynamic evolution of structural relationships can provide a more comprehensive understanding of how the relationships between nodes change over time, which is crucial for accurate anomaly detection. Specifically, Figure 2 Here is a schematic diagram of two relationships in the heterogeneous subgraph of the target edge e: Figure 2 This figure shows two relationships in the heterogeneous subgraph for the target edge e (red at snapshot t): vote (r1) and follow (r2). For the vote (r1) relationship in "User votes story," the anomalous user (red) initially voted normally at snapshot t-2, continued to vote normally at snapshot t-1, and finally voted abnormally for a story at snapshot t, influencing other normal users to vote in the same way. For the follow (r2) relationship in "User follows user," the anomalous user followed the normal user from t-2 to t, gradually disguising himself.

[0004] To address this issue, we propose a new method, ExpGraph, that captures the evolution of relational structures and reveals underlying behaviors. Furthermore, THGNN lacks interpretability for understanding abnormal behaviors because it lacks a mechanism to provide clear insights into the reasons why specific abnormal behaviors were detected, making it difficult to interpret the detected abnormal behaviors. To address this issue, the proposed ExpGraph method adopts a new prototype-based approach that aligns normal behaviors with representative prototypes, thereby improving the model's interpretability. Summary of the Invention

[0005] An embodiment of the present invention provides a method for identifying anomalies in a dynamic heterogeneous graph, so as to at least solve the technical problem that the existing method for identifying anomaly detection in a dynamic graph has different node and edge types and cannot accurately capture the dynamic structural evolution of the relationship in the heterogeneous graph, resulting in inaccurate identification of abnormal edges in the dynamic heterogeneous graph.

[0006] According to one aspect of an embodiment of the present invention, a method for identifying anomalies on a dynamic heterogeneous graph is provided. The method may include: obtaining dynamic heterogeneous graphs of different time slices, wherein the dynamic heterogeneous graph includes nodes, nodes, and edges between nodes; obtaining target edges in the dynamic heterogeneous graph, sampling and processing the dynamic heterogeneous graphs of different time slices based on the nodes corresponding to the target edges, and obtaining heterogeneous subgraphs of different time slices after sampling; processing the heterogeneous subgraphs of different time slices based on two types of relationships, and obtaining the embedding of the heterogeneous subgraph of each relationship, wherein the embedding of the heterogeneous subgraph of each relationship includes the embedding of the subgraphs of different time slices; inputting the embedding of the heterogeneous subgraph of each relationship into a gated recursive unit, and obtaining a target value corresponding to the embedding of the heterogeneous subgraph of each relationship; updating the prototype based on the target value corresponding to the embedding of the heterogeneous subgraph of each relationship, and obtaining the updated prototype corresponding to the heterogeneous subgraph of each relationship; processing the updated prototype based on the updated prototype corresponding to the heterogeneous subgraph of each relationship. The prototype and the target value of the embedding of the heterogeneous subgraph of each relationship are used to obtain the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship; based on the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship, the evolutionary representation of the target edge with enhanced capture relationship is obtained; the heterogeneous subgraphs of different time slices after sampling are input into the inductive model to obtain the embedding of all nodes of the heterogeneous subgraphs of different time slices after sampling; the embedding of all nodes is pooled to obtain the node embedding of the heterogeneous subgraph of each time slice after sampling; the node embedding of the heterogeneous subgraph of each time slice after sampling is aggregated to obtain the semantic representation of the meta-path of the target edge; based on the evolutionary representation enhanced with captured relationship and the semantic representation of meta-path of the target edge, the predicted anomaly score of the target edge is obtained; based on the predicted anomaly score of the target edge, it is determined whether the target edge is abnormal.

[0007] Optionally, the sampling processing of the dynamic heterogeneous graphs of different time slices based on the nodes corresponding to the target edge to obtain heterogeneous subgraphs of different time slices after sampling includes: based on the nodes corresponding to the target edge, sampling processing of the dynamic heterogeneous graphs of different time slices by three sampling strategies to obtain heterogeneous subgraphs of different time slices after sampling, wherein the three sampling strategies are meta-path, k-hop neighborhood and sampling based on node importance.

[0008] Optionally, the prototype is updated based on the target value corresponding to the embedding of the heterogeneous subgraph of each relationship to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship, including: inputting the target value corresponding to the embedding of the heterogeneous subgraph of each relationship into the target mechanism to obtain the first weight of the target value corresponding to the embedding of the heterogeneous subgraph of each relationship; multiplying the first weight of the target value corresponding to the embedding of the heterogeneous subgraph of each relationship by the prototype and then adding the result to the prototype to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship.

[0009] Optionally, the method obtains the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship based on the updated prototype corresponding to the heterogeneous subgraph of each relationship and the embedded target value of the heterogeneous subgraph of each relationship, including: inputting the embedded target value of the heterogeneous subgraph of each relationship into the target mechanism to obtain the second weight of the embedded target value of the heterogeneous subgraph of each relationship; and determining the product of the updated prototype corresponding to the heterogeneous subgraph of each relationship and the second weight as the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship.

[0010] Optionally, the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship is based on, and the evolutionary representation of the target edge with enhanced capture relationship is obtained, including: aggregating the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship to obtain the evolutionary representation of the target edge with enhanced capture relationship.

[0011] Optionally, the expression for the predicted anomaly score of the target edge obtained based on the enhanced evolutionary representation of the capture relationship of the target edge and the semantic representation of the meta-path is:

[0012]

[0013] in, is the predicted anomaly score of the target edge, An evolutionary representation enhanced by the capture relationship of the target edge, is the semantic representation of the meta-path, represents the sigmoid activation function, Represents a linear function.

[0014] Beneficial effects of the present invention:

[0015] This paper proposes a method for anomaly identification in dynamic heterogeneous graphs. This paper explores the challenges of interpretable anomalous behavior (edges) detection in dynamic heterogeneous graphs and introduces ExpGraph, a novel model that tracks the evolution of relation-aware structures to thoroughly capture behavior-related features. To improve interpretability, we further propose keeping the representation of normal relational heterogeneous subgraphs consistent with their prototypes. Thus, anomalies can be explained as deviations from the prototype. Evaluation results demonstrate that the proposed model outperforms state-of-the-art models in terms of effectiveness. Furthermore, our method provides a more comprehensive understanding of anomalous behaviors (edges) in dynamic heterogeneous graphs. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0017] Figure 1 is a flow chart of a method for identifying anomalies on a dynamic heterogeneous graph according to an embodiment of the present invention;

[0018] Figure 2 is a schematic diagram of two relations in the heterogeneous subgraph of the target edge e;

[0019] Figure 3 is a schematic diagram of the overall architecture of the ExpGraph model according to an embodiment of the present invention;

[0020] Figure 4 is a schematic diagram of parameter sensitivity of ExpGraph according to an embodiment of the present invention;

[0021] Figure 5 is a schematic diagram of an ablation experiment of ExpGraph according to an embodiment of the present invention;

[0022] Figure 6 2 is a schematic diagram of example analysis on the Digg dataset according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0024] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and to describe a specific order or precedence. It should be understood that the terms used in this way are interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or inherent to these processes, methods, products or devices.

[0025] Example 1

[0026] According to an embodiment of the present invention, a method for identifying anomalies on a dynamic heterogeneous graph is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system containing at least one set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0027] Figure 1 is a flow chart of a method for identifying anomalies on a dynamic heterogeneous graph according to an embodiment of the present invention. Figure 1 As shown, the method may include the following steps:

[0028] Step S101 : obtaining a dynamic heterogeneous graph of different time slices, wherein the dynamic heterogeneous graph includes nodes, nodes, and edges between nodes.

[0029] In the technical solution provided in the above step S101 of the present invention, Figure 3 is a schematic diagram of the overall architecture of the ExpGraph model according to an embodiment of the present invention, for example, Figure 3 In (a), the dynamic heterogeneous graph is defined as ,in : Will Mapped to node types, : Mapping Maps to edge types (relationships), where or . Edge Set It is an evolving edge stream ,in, Each edge in Each consists of a 5-tuple Here, , , represent the source node and the target node respectively, yes The edge types (relationships) in represents edge attributes (this is optional, as some edge types may not have attributes), It's the edge A snapshot of each edge type There is a reverse edge type , the reverse edge type of the symmetric edge is .For example, Figure 3 (a) in the figure has a heterogeneous graph with three time slices at t-2, t-1, and t, where the nodes are dots or squares and the edges are real or imaginary.

[0030] Step S102 , obtaining a target edge in the dynamic heterogeneous graph, and performing sampling processing on the dynamic heterogeneous graph of different time slices based on the nodes corresponding to the target edge to obtain heterogeneous subgraphs of different time slices after sampling.

[0031] In the technical solution provided in step S102 of the present invention, according to Figure 3 The target edge of the heterogeneous subgraph in time slice t in (a) is sampled on the dynamic heterogeneous graph of different time slices according to the node corresponding to the target edge, and the heterogeneous subgraphs of different time slices after sampling are obtained, as shown in Figure 3 Heterogeneous subgraphs at time t-2, t-1, and t after sampling in (a).

[0032] Step S103: Process the heterogeneous subgraphs of different time slices based on the two types of relationships to obtain the embedding of the heterogeneous subgraph of each relationship, input the embedding of the heterogeneous subgraph of each relationship into the gated recursive unit, and obtain the target value corresponding to the embedding of the heterogeneous subgraph of each relationship; wherein the embedding of the heterogeneous subgraph of each relationship includes the embedding of subgraphs of different time slices.

[0033] In the technical solution provided in step S103 of the present invention, Figure 3 (b) in the figure processes the heterogeneous subgraphs of different time slices through r1 and r2 to obtain the embedding of the heterogeneous subgraph of each relationship, and inputs the embedding of the heterogeneous subgraph of each relationship into the gated recurrent unit to obtain the target value corresponding to the embedding of the heterogeneous subgraph of each relationship.

[0034] For example, in Figure 3 In (b), there are two types of relationships: (indicated by solid arrows) and (Indicated by dotted arrows). By extracting the nodes connected by each relationship, a heterogeneous subgraph can be created. First, the expression for propagating information between nodes in each heterogeneous subgraph is:

[0035] (1)

[0036] (2)

[0037] in, , , Indicates that in the relationship Next node Neighbor nodes of Indicates that in the relationship The trainable weights under Indicates that in the relationship Next node The embedding representation of Represents the node embedding representation after information is propagated between nodes.

[0038] The expression of relation-level information fusion between different relational heterogeneous subgraphs is:

[0039] (3)

[0040] in, represents the trainable parameters, Representation node The embedding representation of Represents trainable weights.

[0041] Embedding Representation of Relational Heterogeneous Subgraphs By embedding all nodes in the relational heterogeneous subgraph The average pooling is calculated. And if the message passing function and activation function is Lipschitz continuous and the graph is connected, then the relational heterogeneous subgraph representation learning will converge to a stable representation.

[0042] A temporal learning algorithm is used to capture the dynamic evolution of relation-aware structures over time. For different relational heterogeneous subgraphs in a snapshot, the expression for modeling their dynamic evolution through gated recurrent units (GRUs) is:

[0043] (4)

[0044] (5)

[0045] (6)

[0046] (7)

[0047] in, represents the element-wise product operation, These are all trainable parameters. Represents the dimension of the hidden unit in GRU. The output of the last snapshot It is used to encode the changing trend of relational heterogeneous subgraphs over time. For all relational heterogeneous subgraphs, their temporal outputs are composed of The GRU-based sequence learning algorithm converges to a stable state if the following conditions are met: the weight matrix 、 、 、 、 and Is a bounded, activation function and is Lipschitz continuous, the input sequence It is bounded. represents the output of the update gate, represents the hidden state at the previous time step, The hidden state at the current time step, represents the candidate hidden state at the current time step, Represents the output of the reset gate.

[0048] Step S104: Update the prototype based on the target value corresponding to the embedding of the heterogeneous subgraph of each relationship to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship; obtain the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship based on the updated prototype corresponding to the heterogeneous subgraph of each relationship and the target value of the embedding of the heterogeneous subgraph of each relationship; obtain the enhanced evolutionary representation of the capture relationship of the target edge based on the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship.

[0049] In the technical solution provided in the above step S104 of the present invention, the prototype is updated according to the target value corresponding to the embedding of the heterogeneous subgraph of each relationship to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship, and the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship is obtained according to the updated prototype corresponding to the heterogeneous subgraph of each relationship and the target value of the embedding of the heterogeneous subgraph of each relationship. According to the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship, the enhanced evolutionary representation of the capture relationship of the target edge is obtained.

[0050] Step S105: Input the heterogeneous subgraphs of different time slices after sampling into the inductive model to obtain the embeddings of all nodes of the heterogeneous subgraphs of different time slices after sampling, perform pooling operation on the embeddings of all nodes to obtain the node embeddings of the heterogeneous subgraph of each time slice after sampling, perform aggregation operation on the node embeddings of the heterogeneous subgraph of each time slice after sampling, and obtain the semantic representation of the meta-path of the target edge.

[0051] In the technical solution provided in step S105 of the present invention, the metapath After node-level propagation, the snapshot The node representation at The updated expression is:

[0052] (8)

[0053] (9)

[0054] in, Representation node In the snapshot Metapath Neighbor nodes of , , Representation node and The weight between Represents a trainable weight vector. The expression of the presentation model after meta-path level aggregation is:

[0055] (10)

[0056] (11)

[0057] in, Represents the number of meta-paths, , is a learnable parameter, It's a snapshot Metapath The specific node embedding under Represents a meta path The corresponding weight. , , is the hidden layer dimension. The final presentation after snapshot-level fusion The expression is:

[0058] (12)

[0059] (13)

[0060] in, Indicates the number of snapshots, , , is a learnable parameter. It is achieved by embedding all nodes in a snapshot Finding the average value yields, The goal is to pass the following contrast loss, Represents the weight corresponding to the snapshot at time t, so that the same node in adjacent snapshots The nodes are close to:

[0061] (14)

[0062] in, , By calculating the time Node The average edge representation of the surrounding edges The average value is obtained from the node The order of , Indicates the node under the slice corresponding to time* The weight of Indicates the node under the slice corresponding to time* The weight of is a hyperparameter called the temperature variable.

[0063] Step S106 : obtaining a predicted anomaly score of the target edge based on the enhanced evolutionary representation of the capture relationship of the target edge and the semantic representation of the meta-path, and determining whether the target edge is abnormal based on the predicted anomaly score of the target edge.

[0064] In the technical solution provided in step S106 of the present invention, the enhanced evolutionary representation of the capture relationship of the target edge and the semantic representation of the meta-path are calculated to obtain the predicted anomaly score of the target edge, and whether the target edge is abnormal is determined based on the predicted anomaly score of the target edge.

[0065] The above method of this embodiment is further introduced below.

[0066] As an optional implementation method, step S102, the dynamic heterogeneous graphs of different time slices are sampled based on the nodes corresponding to the target edge to obtain heterogeneous subgraphs of different time slices after sampling, including: based on the nodes corresponding to the target edge, the dynamic heterogeneous graphs of different time slices are sampled by three sampling strategies to obtain heterogeneous subgraphs of different time slices after sampling, wherein the three sampling strategies are meta-path, k-hop neighborhood and sampling based on node importance.

[0067] In this embodiment, for a given target edge , the sampling based on the meta-path will explore the connection to the specified meta-path and The sampling based on node importance is performed by calculating the importance score of personalized PageRank:

[0068] (15)

[0069] in, represents the adjacency matrix, is a diagonal degree matrix, , represents the random jump probability.

[0070] In the heterogeneous subgraph using these three node set sampling strategies, node embeddings are initially determined by their importance, spatial distance to the target edge, , the attention function of time distance and node type information determines the expression of node embedding:

[0071] (16)

[0072] (17)

[0073] Among them, the importance of Calculated, the spatial distance to the target edge is given by Get, time of occurrence With the current time The time distance calculation formula is: , the node type information is , is a node type. ,in , , is calculated by multiplying the learnable parameters by the connection vector, and is the hidden dimension. Then, the pooling operation is performed to obtain the final node representation .

[0074] As an optional implementation method, step S104, the prototype is updated based on the target value corresponding to the embedding of the heterogeneous subgraph of each relationship to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship, including: inputting the target value corresponding to the embedding of the heterogeneous subgraph of each relationship into the target mechanism to obtain the first weight of the target value corresponding to the embedding of the heterogeneous subgraph of each relationship; multiplying the first weight of the target value corresponding to the embedding of the heterogeneous subgraph of each relationship by the prototype and then adding the result to the prototype to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship.

[0075] In this embodiment, the representation of the prototype can be updated as follows:

[0076] (18)

[0077] in, , , , , , , , . Initialized with random values, Represents the hidden layer dimension. Indicates the number of edges in a snapshot. Indicates the number of prototypes. represents the dimension of prototype embedding, This is the prototype before the update. For the updated prototype, The first weight of the target value corresponding to the embedding of the heterogeneous subgraph of each relationship is multiplied by the prototype.

[0078] As an optional implementation method, step S104, based on the updated prototype corresponding to the heterogeneous subgraph of each relationship and the embedded target value of the heterogeneous subgraph of each relationship, obtains the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship, including: inputting the embedded target value of the heterogeneous subgraph of each relationship into the target mechanism to obtain the second weight of the embedded target value of the heterogeneous subgraph of each relationship; and determining the product between the updated prototype corresponding to the heterogeneous subgraph of each relationship and the second weight as the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship.

[0079] In this embodiment, the target mechanism is Figure 3 The Attention mechanism in (d) determines the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship as the product of the updated prototype and the second weight corresponding to the heterogeneous subgraph of each relationship:

[0080] (19)

[0081] (20)

[0082] in, , is the sum of all edges in the snapshot Got, , , , represents the prototype representation after layer l, , The dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship, is the second weight, Next, the representations of all heterogeneous subgraphs are aggregated at the relation level to form edge The relational perception representation of In order to make the edge The hidden features of the relationship change are aligned with their nearest prototypes, and their distance is defined as:

[0083] (twenty one)

[0084] in, express Specify the relationship below The dynamic structural evolution representation of Indicates a specified relationship below The latest prototype. express paradigm. Indicates the number of relationship types, Represents a set of edges.

[0085] As an optional implementation method, step S104, the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship is based on, and the evolutionary representation of the target edge with enhanced capture relationship is obtained, including: aggregating the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship to obtain the evolutionary representation of the target edge with enhanced capture relationship.

[0086] In this embodiment, as shown in module (d) in Figure (3), the dynamic structural evolution of the prototype representation corresponding to the heterogeneous subgraph of each relationship is aggregated to obtain an evolutionary representation of the target edge that captures the enhanced relationship.

[0087] As an optional embodiment, in step S106, the expression for the predicted anomaly score of the target edge obtained based on the enhanced evolutionary representation of the capture relationship of the target edge and the semantic representation of the meta-path is:

[0088] (twenty two)

[0089] in, is the predicted anomaly score of the target edge, An evolutionary representation enhanced by the capture relationship of the target edge, is the semantic representation of the meta-path, represents the sigmoid activation function, Represents a linear function.

[0090] In this embodiment, the overall problem of optimizing the predicted anomaly score of the target edge is solved by minimizing the loss function. The specific method is shown in the following formula:

[0091] (twenty three)

[0092] (twenty four)

[0093] (25)

[0094] in, , , Represent construction loss, regularization loss, cross entropy loss and prototype matching loss respectively. The purpose is to reconstruct the adjacency matrix midpoint and The connectivity between For normal edges The score is 0, which is equal to 1. The overall complexity of ExpGraph is , and Represents each target edge The number of nodes and edges in the sampled heterogeneous subgraph.

[0095] Experimental part:

[0096] The performance of the proposed model was evaluated on datasets from three real-world rating platforms. A summary of the different datasets is shown in Table 1.

[0097] Table 1 Summary of different datasets

[0098]

[0099] Digg Dataset: This dataset includes users and stories, with nodes representing users and stories. Edges between users represent follow relationships, while edges between users and stories represent vote relationships. The meta-paths "USU" and "UU" are selected, where 'U' represents users and 'S' represents stories. These relationships include "Follow" and "Vote," as well as their respective inverse relationships. Yelp Dataset: This dataset collects user reviews of various hotels. Nodes represent users and hotels, and directed edges represent user reviews of hotels. Each edge is labeled as normal or abnormal. The meta-path selected is "UHU," where 'U' represents users and 'H' represents hotels. Relationships include "Review" and its inverse relationship. 10.27% of the edges in this dataset are labeled abnormal. Amazon Dataset: This dataset contains user reviews of products on the Amazon platform. Nodes represent users and products, and directed edges represent user reviews of products. The meta-path "UIU" is used, where 'U' represents users and 'I' represents items. Relationships include "Review" and its inverse relationship.

[0100] Regarding the preprocessing of the dataset, since the Digg and Amazon datasets do not contain labels for anomalous edges, 10% of the anomalous edge labels were randomly injected into these two datasets as training sets according to the method outlined in ([2] Li Y, Zhu J, Zhang C, et al. THGNN: An Embedding-based Model for Anomaly Detection in Dynamic Heterogeneous Social Networks [C] / / Proceedings of the 32nd ACM International Conference on Information and Knowledge Management. 2023: 1368-1378). Given that anomalies are relatively rare in the real world, the remaining edges in these datasets are considered normal edges. However, the Yelp dataset already contains annotated anomalous edges, so no additional injection was performed. For evaluation purposes, the original anomalies in the training set were retained, while the anomaly ratio in the test set was adjusted to 5% according to the method of [2]. To achieve this goal in the Yelp dataset, some of the originally annotated anomalous edges were randomly removed to adjust the anomaly ratio in the test set to 5%.

[0101] The proposed ExpGraph model is also compared with three other types of baseline models. Static heterogeneous graph embedding model: HAN uses meta-paths to propagate and aggregate information between nodes in heterogeneous graphs, and RGCN applies specific relational transformations to capture multi-relational data in heterogeneous graphs. Since these methods are not specifically used for abnormal edge detection, the anomaly score is obtained by averaging the embedding values ​​of the nodes at both ends of the target edge. Abnormal edge detection in dynamic isomorphic graphs: TADDY detects anomalies through spatiotemporal pattern encoding and contrastive learning, MIDAS can identify abnormal edge groups that suddenly appear in dynamic graphs, and RustGraph captures topological and temporal dynamic changes to detect abnormal edges. Abnormal edge detection in dynamic heterogeneous graphs: THGNN propagates information around the target edge according to the edge type, thereby performing time-continuous anomaly detection.

[0102] In the experiments, we used AUC (area under the ROC curve) as the performance metric, which is consistent with the latest methods [2]. AUC values ​​range from 0 to 1, with larger values ​​indicating better model performance. This metric is particularly effective for anomaly detection tasks, as it can measure the accuracy of the model even when the number of anomalies is unknown. Table 2 shows the effectiveness of all baselines compared to our model.

[0103] Table 2 Validity results of all baselines compared with the proposed model

[0104]

[0105] As shown in Table 2, (1) when the percentage of abnormal edges is 10% or 10.27%, the ExpGraph model always has the highest AUC value on the Digg, Yelp, and Amazon datasets. In particular, on the real-world Yelp dataset, the anomaly rate of the ExpGraph model is 7.39% higher than that of all other models, highlighting its excellent anomaly detection ability. (2) When the anomaly rate is reduced to 5%, the ExpGraph model maintains the best and most stable performance on the Digg and Amazon datasets. On the Yelp dataset, it obtains the second best AUC value. (3) Among the first category of baseline models, RGCN performs best on the Digg and Yelp datasets. On the Yelp dataset, when the percentage of abnormal edges is 5%, it even achieves the highest AUC among all models. This highlights the effectiveness of relational learning in detecting abnormal edges and its key role in edge anomaly detection.

[0106] In the sensitivity analysis, the Yelp dataset was used to explore the impact of hyperparameters on model performance. Figure 4 is a schematic diagram of parameter sensitivity of ExpGraph according to an embodiment of the present invention,

[0107] Figure 4 (a) shows that the AUC value increases with This shows that although additional prototypes can improve performance, too many prototypes also bring additional noise. Regarding the number of layers in the prototype part, Figure 4 (b) shows that the best performance of the model in the prototype part is 4 layers. Adding more layers on this basis will lead to overfitting of the training data. , Figure 4 (c) shows that the model performs best when there are 5 nodes in the sampled subgraph. Increasing the number of nodes may include less relevant nodes, thus reducing performance. Regarding the size of the snapshot: each unit on the x-axis corresponds to 500 edges (for example, 2 on the x-axis represents 1000 edges). Figure 4 (d) shows that the model performs best when the snapshot size is 1000 edges. May obscure observations that change dynamically in the time dimension. Figure 4 (e) shows that the number of snapshots affects the model’s ability to observe dynamic changes, and the performance is best when the number of snapshots is set to 4.

[0108] An ablation experiment is conducted to evaluate the impact of key components in ExpGraph. The first variant ignores the meta-path enhanced semantic learning, denoted as ExpGraphnm The second variant excludes all losses except the cross entropy loss and is represented as ExpGraph nl The last variant ignores the dynamic structural evolution and uses ExpGraph ne The fourth variant excludes the prototype arrangement and uses ExpGraph np express.

[0109] Figure 5 is a schematic diagram of an ablation experiment of ExpGraph according to an embodiment of the present invention, Figure 5 In the figure, we can see that: (1) On both datasets, ExpGraph is significantly better than ExpGraph nm More effective. This shows that semantic learning of meta-paths is necessary in the model. (2) On the Yelp dataset, ExpGraph performs better than ExpGraph nl ; On the Amazon dataset, ExpGraph performs comparable to ExpGraphnl. This suggests that including additional losses can enhance anomaly detection. (3) ExpGraph outperforms ExpGraph ne , and the effect is significant on the Yelp dataset. This shows that dynamic structural evolution plays an important role. (4) ExpGraph’s results are better than ExpGraph np , which indicates that the prototype alignment part also plays an important role in the model.

[0110] Figure 6 The following is a schematic diagram of an example analysis on the Digg dataset according to an embodiment of the present invention, which illustrates the interpretability of the proposed ExpGraph through a case study. Using the PCA method [Abdi H, Williams LJ. Principal component analysis [J]. Wiley interdisciplinary reviews: computational statistics, 2010, 2 (4): 433-459.], the high-dimensional embedding of edges and prototypes is mapped to three dimensions, such as Figure 6 As shown in the visualization, blue points represent the embedding of the prototype, red points represent the embedding of abnormal edges, and green points correspond to the embedding of normal edges. The visualization results show that the embedding of normal edges is generally closer to the prototype, while the embedding of abnormal edges is farther away. This shows that abnormal edge detection can be effectively guided by the prototype.

[0111] In an embodiment of the present invention, a dynamic heterogeneous graph of different time slices is obtained, wherein the dynamic heterogeneous graph includes nodes, nodes, and edges between nodes; a target edge in the dynamic heterogeneous graph is obtained, and the dynamic heterogeneous graph of different time slices is sampled based on the node corresponding to the target edge to obtain the sampled heterogeneous subgraphs of the different time slices; the heterogeneous subgraphs of different time slices are processed based on two types of relationships to obtain the embedding of the heterogeneous subgraph of each relationship, and the embedding of the heterogeneous subgraph of each relationship is input into a gated recursive unit to obtain the target value corresponding to the embedding of the heterogeneous subgraph of each relationship; wherein the embedding of the heterogeneous subgraph of each relationship includes the embedding of the subgraphs of different time slices; the prototype is updated based on the target value corresponding to the embedding of the heterogeneous subgraph of each relationship to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship, based on the updated prototype corresponding to the heterogeneous subgraph of each relationship and the target value of the embedding of the heterogeneous subgraph of each relationship, the dynamic structural evolution represented by the prototype corresponding to the heterogeneous subgraph of each relationship is obtained, and based on the dynamic structural evolution represented by the prototype corresponding to the heterogeneous subgraph of each relationship, the capture relationship increase of the target edge is obtained. Strong evolutionary representation; the heterogeneous subgraphs of different time slices after sampling are input into the inductive model to obtain the embeddings of all nodes of the heterogeneous subgraphs of different time slices after sampling, and the embeddings of all nodes are pooled to obtain the node embeddings of the heterogeneous subgraphs of each time slice after sampling, and the node embeddings of the heterogeneous subgraphs of each time slice after sampling are aggregated to obtain the semantic representation of the meta-path of the target edge; based on the capture relationship enhanced evolutionary representation of the target edge and the semantic representation of the meta-path, the predicted anomaly score of the target edge is obtained, and based on the predicted anomaly score of the target edge, whether the target edge is abnormal is determined, which solves the technical problem that the existing method for identifying anomaly detection in dynamic graphs has different node and edge types and cannot accurately capture the dynamic structural evolution of relations in heterogeneous graphs, resulting in inaccurate identification of abnormal edges on dynamic heterogeneous graphs. According to the new method ExpGraph, the evolution of relational structure is captured, potential behavior is revealed, normal behavior is aligned with representative prototypes, the dynamic structural evolution of relations in heterogeneous graphs is accurately captured, and the technical effect of accurately identifying abnormal edges on dynamic heterogeneous graphs is improved.

[0112] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0113] In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0114] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0115] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected to achieve the purpose of the present embodiment according to actual needs.

[0116] In addition, the functional units in various embodiments of the present invention may be integrated into a first processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0117] The above are only preferred embodiments of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for identifying anomalies on a dynamic heterogeneous graph, characterized in that: include: Obtaining a dynamic heterogeneous graph of different time slices, wherein the dynamic heterogeneous graph includes nodes, nodes, and edges between nodes; Obtain the target edge in the dynamic heterogeneous graph, sample the dynamic heterogeneous graph at different time slices based on the nodes corresponding to the target edge, and obtain the heterogeneous subgraphs at different time slices after sampling; Based on the two types of relations, the heterogeneous subgraphs of different time slices are processed to obtain the embedding of the heterogeneous subgraph of each relation. The embedding of the heterogeneous subgraph of each relation is input into the gated recursive unit to obtain the target value corresponding to the embedding of the heterogeneous subgraph of each relation. The embedding of the heterogeneous subgraph of each relation includes the embedding of the subgraphs of different time slices. The prototype is updated based on the target value corresponding to the embedding of the heterogeneous subgraph of each relationship to obtain an updated prototype corresponding to the heterogeneous subgraph of each relationship, the target value of the embedding of the heterogeneous subgraph of each relationship is input into the target mechanism to obtain a second weight of the target value of the embedding of the heterogeneous subgraph of each relationship, and the product of the updated prototype corresponding to the heterogeneous subgraph of each relationship and the second weight is determined as the dynamic structural evolution represented by the prototype corresponding to the heterogeneous subgraph of each relationship; Aggregate the dynamic structural evolution of the prototype representation corresponding to each heterogeneous subgraph of each relationship to obtain the enhanced evolutionary representation of the target edge capturing relationship; Input the heterogeneous subgraphs of different time slices after sampling into the inductive model to obtain the embeddings of all nodes in the heterogeneous subgraphs of different time slices after sampling. Perform a pooling operation on the embeddings of all nodes to obtain the node embeddings of the heterogeneous subgraphs of each time slice after sampling. Aggregate the node embeddings of the heterogeneous subgraphs of each time slice after sampling to obtain the semantic representation of the meta-path of the target edge. Based on the enhanced evolutionary representation of the target edge's capture relationship and the semantic representation of the meta-path, the predicted anomaly score of the target edge is obtained. Based on the predicted anomaly score of the target edge, whether the target edge is abnormal is determined. The expression of the predicted anomaly score of the target edge is: , is the predicted anomaly score of the target edge, An evolutionary representation enhanced by the capture relationship of the target edge, is the semantic representation of the meta-path, represents the sigmoid activation function, Represents a linear function.

2. The method according to claim 1, characterized in that The sampling process of the dynamic heterogeneous graph of different time slices based on the nodes corresponding to the target edge to obtain the heterogeneous subgraphs of different time slices after sampling includes: Based on the nodes corresponding to the target edges, three sampling strategies are used to sample the dynamic heterogeneous graphs at different time slices to obtain the heterogeneous subgraphs at different time slices after sampling. Among them, the three sampling strategies are meta-path, k-hop neighborhood and node importance-based sampling.

3. The method according to claim 1, characterized in that The updating of the prototype based on the target value corresponding to the embedding of the heterogeneous subgraph of each relationship to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship includes: Inputting the target value corresponding to the embedding of the heterogeneous subgraph of each relationship into the target mechanism to obtain a first weight of the target value corresponding to the embedding of the heterogeneous subgraph of each relationship; The first weight of the target value corresponding to the embedding of the heterogeneous subgraph of each relationship is multiplied by the prototype and then added to the prototype to obtain the updated prototype corresponding to the heterogeneous subgraph of each relationship.

4. A computer system, characterized in that include: One or more processors, a computer-readable storage medium for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 3.

5. A computer-readable storage medium, characterized in that Computer-executable instructions are stored, and when the instructions are executed, they are used to implement the method according to any one of claims 1 to 3.

6. A computer program product, characterized in that The method comprises computer executable instructions, which are used to implement the method according to any one of claims 1 to 3 when the instructions are executed.

Images