Abnormal behavior detection method and device for networked device, and computer program product

Abstract

The invention provides an abnormal behavior detection method and device of a networked device and a computer program product. The abnormal behavior detection method for the networked device comprises the steps of constructing a causal graph generation model, and constructing a weighted graph neural network prediction model; inputting the multivariable time series data of the networking equipment into a causal graph generation model to obtain a causal graph and an adjacent matrix of the causal graph; wherein the multivariable time series data is related to the network behavior of the networking device; inputting the adjacency matrix and the multivariable time sequence data into a weighted graph neural network prediction model to obtain an abnormal behavior prediction value; and calculating an abnormal score according to the abnormal behavior predicted value. According to the invention, the accuracy of abnormal behavior detection of the networking device can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of satellite communications, and in particular to an abnormal behavior detection method for a networked device, an abnormal behavior detection device for a networked device, a computing device, a non-transitory computer-readable storage medium, a computer program product, and a chip system. Background Art

[0002] Networking devices used for satellite communications (such as satellite Internet terminals) may exhibit various abnormal behaviors, such as abnormal network traffic, abnormal connections, abnormal resource usage, abnormal access, etc. These abnormal behaviors are usually manifestations or signs of security threats. Actively detecting abnormal behaviors through algorithm models plays an important role in equipment status monitoring and threat warning.

[0003] Currently, deep learning methods can be used to detect abnormal behavior of networked devices, but the existing abnormal behavior detection methods are not mature and have the problem of low detection accuracy. Summary of the invention

[0004] It would be advantageous to provide a mechanism that mitigates, alleviates or eliminates at least one of the problems discussed above.

[0005] In a first aspect, a method for detecting abnormal behavior of a networked device is provided. The method comprises: constructing a causal graph generation model and a weighted graph neural network prediction model; inputting multivariate time series data of the networked device into the causal graph generation model to obtain a causal graph and an adjacency matrix of the causal graph; wherein the multivariate time series data is related to the network behavior of the networked device; inputting the adjacency matrix and the multivariate time series data into the weighted graph neural network prediction model to obtain an abnormal behavior prediction value; and calculating an abnormal score according to the abnormal behavior prediction value.

[0006] In a second aspect, a device for detecting abnormal behavior of a networked device is provided, wherein the device includes a device for executing the above-mentioned method for detecting abnormal behavior of a networked device.

[0007] In a third aspect, a computing device is provided, comprising: at least one processor; and at least one memory storing instructions, wherein when the instructions are executed by the at least one processor individually or collectively, the computing device executes the above-mentioned abnormal behavior detection method of a networked device.

[0008] In a fourth aspect, a non-transitory computer-readable storage medium storing machine-executable instructions is provided. The machine-executable instructions, when executed individually or collectively by one or more processors of a machine, cause the machine to execute the above-mentioned abnormal behavior detection method for networked devices.

[0009] In a fifth aspect, a computer program product is provided that includes machine executable instructions, which, when executed individually or collectively by one or more processors of a machine, cause the machine to perform the above-mentioned abnormal behavior detection method for networked devices.

[0010] In a sixth aspect, a chip system is provided, which includes a circuit system configured to execute the above-mentioned abnormal behavior detection method of a networked device.

[0011] It should be understood that the invention summary is not intended to identify the key or essential features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other objects, features and advantages of the present disclosure will become more apparent through a more detailed description of some embodiments of the present disclosure in the accompanying drawings, in which: Figure 1 An exemplary flow chart showing a method for detecting abnormal behavior of a networked device according to an embodiment of the present disclosure is shown; Figure 2 An exemplary flow chart showing an abnormal behavior detection method of a networked device according to another embodiment of the present disclosure; Figure 3 A schematic diagram of an overall framework for group-level graph anomaly detection using causal relationships according to some embodiments of the present disclosure is shown; Figure 4 A schematic diagram of an entropy causal graph multivariate time series anomaly detection framework according to some embodiments of the present disclosure is shown; Figure 5 A schematic diagram showing a topology pattern enhanced group level graph framework according to some embodiments of the present disclosure; and Figure 6 A simplified block diagram of a device suitable for implementing the exemplary embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0013] The principle of the present disclosure will now be described with reference to some embodiments. It should be understood that the description of these embodiments is only for illustrative purposes, and helps those skilled in the art to understand and implement the present disclosure, without any limitation to the scope of the present disclosure. The disclosure described herein can be implemented in a manner different from that described below.

[0014] In the following description and claims, unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs.

[0015] References in this disclosure to "one embodiment," "an embodiment," "an exemplary embodiment," etc. indicate that the described embodiment may include a particular feature, structure, or characteristic, but not every embodiment necessarily includes the particular feature, structure, or characteristic. Moreover, such phrases do not necessarily refer to the same embodiment. In addition, when a particular feature, structure, or characteristic is described in conjunction with an exemplary embodiment, whether or not explicitly described, those skilled in the art will recognize that such feature, structure, or characteristic affects incorporation into other embodiments.

[0016] It should be understood that although the terms "first" and "second" etc. may be used to describe various elements herein, these elements should not be limited by these terms. These terms are only used to distinguish one element from another element. For example, without departing from the scope of the exemplary embodiments, a first element may be referred to as a second element, and similarly, a second element may be referred to as a first element. The term "and / or" as used herein includes any and all combinations of one or more of the listed terms.

[0017] The terms used herein are only for describing specific embodiments, rather than for limiting exemplary embodiments. The singular forms "one", "an", and "the" used herein also include plural forms, unless the context clearly indicates otherwise. "A group of elements" or "element set" used herein is intended to include one or more elements. It should also be understood that the terms "include", "comprise", "have", "have", "include" and / or "include", when used herein, specify the presence of the features, elements and / or parts, etc., but do not exclude the presence or addition of one or more other features, elements, parts and / or combinations thereof.

[0018] As used in this application, the term "circuitry" may refer to one or more or all of the following: (a) Hardware circuit implementation only (e.g., implementation only in analog and / or digital circuits) (b) a combination of hardware circuitry and software, such as (where applicable): (i) a combination of analog and / or digital hardware circuitry and software / firmware; and (ii) any part of a hardware processor (including a digital signal processor) with software, software and memory that work together to enable a device such as a mobile phone or server to perform various functions, and (c) A hardware circuit and / or processor, such as a microprocessor or portion of a microprocessor, that requires software (eg, firmware) to operate, but where software is not required for operation, the software may not be present.

[0019] This definition of circuitry applies to all uses of this term in this application, including in any claims. As another example, as used in this application, the term circuitry also includes an implementation of merely a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term circuitry also includes, for example, if applicable to the particular claim element, a baseband integrated circuit or processor integrated circuit for a mobile device, or a similar integrated circuit in a server, cellular network device, or other computing network device.

[0020] The networked devices mentioned in this article can exchange data through a communication network. As used herein, the term "communication network" refers to a network that complies with any appropriate communication standard, such as long-term evolution (LTE), LTE-Advanced (LTE-A), wideband code division multiple access (WCDMA), high-speed packet access (HSPA), narrowband Internet of Things (NB-IOT), new radio (NR), non-terrestrial network (NTN), etc. In addition, the networked device can be a terminal device, a network device, etc. The communication between the terminal device and the network device in the communication network can be performed according to any appropriate generation of communication protocols, including but not limited to the first generation (1G), second generation (2G), 2.5G, 2.75G, third generation (3G), fourth generation (4G), 4.5G, fifth generation (5G), future sixth generation (6G) communication protocols, and / or any other protocols currently known or to be developed in the future. The embodiments of the present disclosure can be applied to satellite communication systems. Considering the rapid development in communication, there will certainly be future types of communication technologies and systems, and the present disclosure can be implemented with these technologies and systems. It should not be considered that the scope of the present disclosure is limited to the aforementioned system.

[0021] The term "networking device" used in this article can be a node set on a satellite in a communication network, or a node set on the ground.

[0022] The networking equipment on the satellite may refer to a base station (BS) or access point (AP) as a satellite payload, such as a NodeB (NodeB or NB), an evolved NodeB (eNodeB or eNB), a NR NB (also known as a gNB), a remote radio unit (RRU), a radio head (RH), a remote radio head (RRH), a relay node. An example of a relay node may be an integrated access and backhaul (IAB) node. The distributed unit (DU) part of the IAB node may perform the functions of a "networking device" and may therefore operate as a network device. In the following description, the terms "networking device" and "node" may be used interchangeably.

[0023] The networking device on the ground may refer to any terminal device capable of wireless communication. As an example and not limitation, the terminal device may also be referred to as a communication device, user equipment (UE), user station (SS), portable user station, mobile station (MS) or access terminal (AT). The terminal device may include, but is not limited to, a mobile phone, a cellular phone, a smart phone, a voice over IP (VoIP) phone, a wireless local loop phone, a tablet computer, a wearable terminal device, a personal digital assistant (PDA), a portable computer, a desktop computer, an image capture terminal device such as a digital camera, a game terminal device, a music storage and playback device, a vehicle-mounted wireless terminal device, a wireless endpoint, a mobile station, a notebook embedded device (LEE), a laptop computer installation device (LME), a USB dongle, a smart device, a wireless user equipment (CPE), an Internet of Things (Lot) device, a watch or other wearable device, a head-mounted display (HMD), a vehicle, a drone, medical equipment and applications (e.g., remote surgery), industrial equipment and applications (e.g., robots and / or other wireless devices operating in the context of industrial and / or automated processing chains), consumer electronic devices, relay nodes, devices operating on commercial and / or industrial wireless networks, etc. The mobile terminal (MT) portion of the IAB node may perform the functions of a "terminal device" and may therefore operate as a terminal device.

[0024] Although the functions described herein may be performed in fixed and / or wireless network nodes in various exemplary embodiments, in other exemplary embodiments, the functions may be implemented in a user equipment device (such as a cellular phone, or a tablet computer, or a laptop computer, or a desktop computer, or a mobile Internet of Things device, or a fixed Internet of Things device). For example, the user equipment device may appropriately have the corresponding capabilities described in relation to fixed and / or wireless network nodes. The user equipment device may be a user device and / or a control device, such as a chipset or a processor, which is configured to control the user device when the user device is installed therein. Examples of these functions include boot server functions and / or home user servers, which may be implemented in a user equipment device by providing the user equipment device with software configured to cause the user equipment device to execute from the perspective of these functions / nodes.

[0025] The following first introduces the prior art related to the present disclosure, the present disclosure's analysis of possible problems with the prior art, and the technical concepts adopted by the present disclosure to alleviate the technical problems with the prior art.

[0026] 1. Graph Anomaly Detection (GAD) Graph anomaly detection refers to finding anomalous nodes, edges, subgraphs, or graphs in graph data. Graph anomaly detection aims to identify anomalies in graph data. Due to recent advances in graph representation learning, graph anomaly detection has found applications in various application areas such as fraud detection, cybersecurity, finance, and the Internet of Things.

[0027] 2. Transfer Entropy (TF) Transfer entropy is a concept in information theory that is used to describe the information transfer or causal relationship between two random processes. It quantifies the ability of a variable in one random process to predict the future state of another random process, beyond the known historical information. Transfer entropy can be used to analyze causal relationships in time series data. It measures how information from one random process (source process) is transferred to another random process (target process) and provides a quantitative way to measure the strength of this information transfer. Transfer entropy can be used to discover causal relationships, estimate causal delays, and analyze the dynamic behavior of complex systems.

[0028] Compared with the classic mutual information, transfer entropy takes into account the time factor and is therefore more accurate in analyzing causal relationships. Mutual information can only measure the interdependence between two random variables, while transfer entropy can capture the predictive power of one process on the future state of another process. Transfer entropy has a wide range of applications in many fields, including neuroscience, financial market analysis, climate prediction, and complex network analysis. It provides a tool to quantify causal relationships and information transfer, which helps to understand and explain interactions and influences in dynamic systems.

[0029] 3. Graph Autoencoder (GAE) Graph autoencoder is an unsupervised learning model for graph data. It is based on the idea of ​​autoencoder and aims to learn low-dimensional representations of graph data and reconstruct graph data. Autoencoder is an unsupervised learning model consisting of an encoder and a decoder. The encoder maps the input data to a low-dimensional representation, while the decoder maps the low-dimensional representation back to the original data space. The goal of the autoencoder is to learn a compact representation of the data by minimizing the reconstruction error so that the input data can be reconstructed in the decoder. In a graph autoencoder, both the input and output of the encoder and decoder are graph data. The encoder maps the input graph to a low-dimensional vector representation, usually called a graph embedding. The decoder maps the graph embedding back to the representation of the original graph data.

[0030] Through the training process, the graph autoencoder can learn a low-dimensional representation of the data and how to reconstruct it using this representation. The goal of the graph autoencoder is to minimize the reconstruction error, which is the difference between the input graph data and the decoded graph data. Through this process, the graph autoencoder can learn the structure and features in the data and generate graph embeddings that can retain important information. Graph autoencoders have a wide range of applications in tasks such as dimensionality reduction, feature learning, and graph generation of graph data. It can be used for tasks such as visualization, clustering, classification, and anomaly detection of graph data. Through the learned low-dimensional representation, the graph autoencoder can provide an effective way to process and analyze complex graph structured data.

[0031] 4. Graph Contrastive Learning (GCL) Graph contrastive learning is an unsupervised learning method for graph data that aims to learn the representation of graph data and map similar graph samples to adjacent embedding spaces. In graph contrastive learning, by constructing positive and negative sample pairs, the model is required to map the same graph samples to adjacent embedding spaces and different graph samples to distant embedding spaces.

[0032] The core idea of ​​graph contrastive learning is to capture the structure and features of graphs by learning the similarities between graph samples. Common graph contrastive learning methods include graph autoencoders and graph convolutional networks. In graph contrastive learning, a common training process is to define the contrastive loss function by constructing positive and negative sample pairs. The positive sample pairs are composed of the same graph samples, while the negative sample pairs are composed of different graph samples. The model is required to embed the positive sample pairs as close as possible and embed the negative sample pairs as far apart as possible. Such a training process can prompt the model to learn the shared features and distinguishing features of graph samples, thereby obtaining a more discriminative graph representation.

[0033] 5. Graph Information Bottleneck (GIB) The graph information bottleneck is an information-theoretic framework for graph data that aims to learn a compact representation of graph data by minimizing the mutual information between the input graph and the graph embedding. The information bottleneck theory is widely used in deep learning to learn low-dimensional representations of data. It argues that the learning process should find an embedding space that can maximize the compression of redundant information of the input while preserving the important information of the input data.

[0034] In the existing technology solutions: Graph Anomaly Detection (GAD) aims to identify anomalies in graph data. GAD has been applied in various fields such as network security, finance, and the Internet of Things. GAD methods based on deep learning can be roughly divided into three levels according to the type of anomaly studied: node-level Graph Anomaly Detection (N-GAD), subgraph-level Graph Anomaly Detection (Sub-GAD), and graph-level Graph Anomaly Detection (G-GAD). Specifically, N-GAD and Sub-GAD focus on identifying a single node or subgraph from a single graph, while G-GAD aims to distinguish abnormal graphs from a given set of graphs. In addition, in anomaly detection in distributed systems, while graphs can provide the ability to capture complex dependencies and deal with scalability and robustness, federated learning can be a solution for improved privacy, model generalization, and more efficient learning. The combination of graphs and federated learning is suitable for anomaly detection in distributed systems.

[0035] Multivariate time series data analysis is a way to identify historical patterns and trends. It plays an important role in a range of applications. It helps detect atypical observations that may be due to system failures, cyber attacks or errors, thereby avoiding potential system failures. This critical process is called multivariate time series anomaly detection and is of great significance in network security, where timely identification and handling of these anomalies is crucial to maintaining system integrity and security. It has a wide range of applications, covering critical infrastructure protection, monitoring, computer networks, finance, healthcare and other fields, showing its versatility and key role in various fields.

[0036] In the field of multivariate time series anomaly detection, deep learning techniques have been widely used, often surpassing traditional statistical methods in terms of accuracy and effectiveness. Deep learning models can be trained using unsupervised techniques.

[0037] The problem with existing technologies is that although current deep learning methods offer some advantages, they mainly focus on anomaly identification at the node or graph level, which often does not produce good results for groups with different topological patterns formed by different nodes. Existing graph anomaly detection algorithms focus on identifying single entities (nodes or graphs) and ignore the possibility of abnormal groups in the graph. In particular, N-GAD and Sub-GAD have their own limitations and therefore cannot detect abnormal groups with specific topological patterns.

[0038] Specifically: N-GAD methods process nodes independently and ignore topological pattern information. N-GAD methods cannot detect abnormal nodes deeply embedded in the group. In essence, N-GAD is based on the assumption that abnormal nodes are different from their one-hop neighbors. Some emerging Sub-GAD methods can detect abnormal subgraphs in a given graph. However, these methods usually use N-GAD as the main component for detecting abnormal nodes and assume that the detected nodes constitute an abnormal subgraph. Therefore, Sub-GAD has similar limitations as N-GAD.

[0039] The enhancement of anomaly detection performance often suffers from a common limitation of deep learning methods: they tend to treat time series data in isolation without considering the inter-variable relationships inherent in multivariate datasets. Some methods introduce methods to generate graph structures to address the challenge of hidden relationships in multivariate time series data. These methods learn the optimal structure as an integral part of the model training process. However, some methods do not fully utilize the actual domain knowledge available in multivariate time series data, which can introduce sampling bias. When building graph structures for new multivariate time series data samples, it can also lead to overfitting of training data and reduced generalization ability.

[0040] An important aspect that existing methods ignore is the causal relationships between variables in multivariate time series data. These causal relationships provide valuable insights that help the present disclosure determine whether one sensor affects the changes in other sensors, thereby providing more informative knowledge, which is important for adaptation. Previous correlation or similarity calculations only examine bivariate covariances and do not provide insight into the causal relationships between time series or their direction.

[0041] The present invention discloses a technical concept adopted to alleviate the technical problems existing in the prior art: combining multivariate time series anomaly detection with group-level graph anomaly detection, effectively applying topological pattern information for group detection, and applying the causal relationship between variables in multivariate time series data for more effective anomaly detection.

[0042] Specifically, in order to consider the causal relationship between variables in multivariate time series data, a new framework called Entropy Causal Graph Multivariate Time Series Anomaly Detection CGAD is introduced, which is the combined application of the causal graph generation model and the weighted graph neural network prediction model mentioned later in this disclosure. CGAD uses transfer entropy to construct a graph structure to reveal the potential causal relationship between time series data. The weighted graph convolutional network is combined with the causal convolution to model the causal graph structure and temporal pattern in multivariate time series data. In addition, CGAD applies anomaly scoring and uses normalization based on the median absolute deviation to improve the robustness of the anomaly identification process.

[0043] In order to consider the possibility of abnormal groups in the graph, the present disclosure also introduces a new unsupervised framework called Group-level Graph Anomaly Detection (Gr-GAD), which is the topological pattern enhanced group-level graph model mentioned later in the present disclosure. The framework first adopts a variant of the graph autoencoder (GAE) to locate the anchor nodes belonging to potential abnormal groups by capturing remote inconsistencies. Subsequently, group sampling is used to sample candidate groups and input them into the introduced Topology Pattern-based Graph Contrastive Learning (TPGCL) method. TPGCL uses the topological pattern of the group as a clue to generate an embedding (that is, the embedded data mentioned later) for each candidate group, thereby generating different abnormal groups.

[0044] The embodiments of the present disclosure propose an abnormal behavior detection scheme for networked devices, which can improve the accuracy of abnormal behavior detection of networked devices. Specifically, the present disclosure is equivalent to a group-level graph abnormality detection scheme using causal relationships, which comprehensively uses the group-level graph enhanced by topological patterns and the entropy causal graph of multivariate time series data, and can more comprehensively detect abnormal behaviors of networked devices (such as satellite Internet terminal devices). The present disclosure can not only improve the security of networked devices, but also avoid potential data leakage and information security risks.

[0045] In the solution disclosed in the present invention: by constructing (1) a causal graph generation model, (2) a weighted graph neural network prediction model, and (3) a group-level graph model enhanced by a topological pattern, the group-level graph, topological pattern, graph autoencoder, graph contrast learning, causal relationship, transfer entropy, etc. are effectively integrated, and the causal discovery of multivariate time series is used to construct a causal graph, which provides enhanced visual interpretability and is conducive to abnormal diagnosis. By using a causal graph generation model to generate a causal graph and an adjacency matrix of the causal graph, and using a weighted graph neural network prediction model to generate abnormal behavior prediction values, the causal relationship between variables in multivariate time series data is effectively utilized for better anomaly detection. By using the median absolute deviation to standardize the anomaly score, the accuracy of abnormal behavior detection can be improved. The abnormal behaviors that can be detected by this application include abnormal network traffic, abnormal connections, abnormal resource usage, abnormal access, etc.

[0046] Figure 3 A schematic diagram 300 of an overall framework for group-level graph anomaly detection using causal relationships according to some embodiments of the present disclosure is shown. Figure 3 Describe the overall process of this solution, refer to Figure 3 , this disclosure includes the following parts: 1. Data collection: Based on the defined abnormal behavior, first collect data from networked devices (such as satellite Internet terminal devices), including log files, network traffic, applications, and sensor data, and ensure that the collected data contains timestamp information for time series analysis. For example, the collected data of different types can be sorted according to the timestamp to obtain multivariate time series data.

[0047] 2. Data preprocessing: Perform data preprocessing on the collected data, including missing value and outlier processing, timestamp format conversion, data aggregation and other operations.

[0048] 3. Causal graph generation (corresponding to the causal graph generation model 310 introduced later in this disclosure): the preprocessed time series data is used to generate a causal graph, and based on causal discovery calculations, an adjacency matrix representing the graph relationship is obtained.

[0049] 4. Topology pattern enhanced group-level graph anomaly detection (corresponding to the topology pattern enhanced group-level graph model 330 introduced later in this disclosure): the preprocessed time series data and the causal graph are input into the TP-GrGAD model. The model includes three parts: multi-hop GAE positioning anchor nodes, candidate group sampling, and candidate group identification, and outputs embedded data.

[0050] 5. Weighted Graph Neural Network (GNN) prediction (corresponding to the weighted graph neural network prediction model 320 introduced later in this disclosure): weighted GNN prediction is performed using the adjacency matrix and embedded data. The weighted graph neural network prediction model 320 includes: a weighted graph convolution module, a temporal convolution module, a skip connection and an output module.

[0051] 6. Median deviation score: Finally, the median deviation score is performed, and the weighted GNN prediction results are compared with The actual observed value at the time is compared to calculate the anomaly score, and it can be determined whether there is an anomaly in the networked device based on the anomaly score.

[0052] Here, we first explain the multivariate time series data of the networked devices disclosed in the present invention. Figure 3 The specific technical details of each model will be introduced later.

[0053] The data collection process is described below.

[0054] The present invention detects abnormal behaviors of satellite Internet terminal devices (such as abnormal network traffic, abnormal connection, abnormal resource occupation, abnormal access, etc.) and collects data from satellite Internet terminal devices.

[0055] Based on the defined abnormal behavior, determine which data sources to collect data from. Possible data sources include log files, network traffic monitoring, application monitoring, sensor data, etc. It is necessary to ensure that the collected data contains timestamp information for subsequent time series analysis. When recording data, you can use log files, databases, or specialized data collection tools.

[0056] Logging: Satellite Internet terminals usually generate log files to record the device's operating status, connection information, and event records. System logs can contain indicators related to abnormal behavior, such as access volume, network traffic, resource usage, etc. The device may also record security-related events and behaviors, such as login attempts, access control events, abnormal access behavior, etc. You can use log management tools or monitoring software to collect system logs and security logs.

[0057] Network traffic monitoring: Use network traffic monitoring tools to capture network traffic data from satellite Internet terminal devices. These tools can record information such as network connections, data packet transmissions, transmission rates, etc. Collecting network traffic data can help detect abnormal network behavior.

[0058] Application monitoring: monitor and record the behavior of applications running on satellite Internet terminal devices. Specialized application monitoring tools or performance monitoring tools can be used to collect information such as application access volume, data read and write operations, and resource usage.

[0059] Sensor data collection: For specific types of sensor data, corresponding sensor devices can be used to collect data. For example, an accelerometer can be used to detect the motion behavior of a device. Sensor data can provide auxiliary information related to abnormal behavior.

[0060] The following is an introduction to the data preprocessing process. The collected data is preprocessed to facilitate subsequent analysis and calculation.

[0061] (1) Data cleaning: Check and process outliers, missing values, and noise in the data. Delete or correct outliers, interpolate or fill missing values, and smooth or filter noise.

[0062] (2) Data transformation: Transform the data to make it suitable for subsequent analysis and modeling. Operations such as standardization, normalization, and logarithmic transformation can be performed to eliminate the dimensional differences between different indicators, making the data easier to compare and model.

[0063] (3) Timestamp processing: Ensure that the data contains accurate timestamp information for time series analysis. Timestamp format conversion, sorting, and calibration can be performed.

[0064] (4) Feature extraction: Extract meaningful features from the raw data based on the definition of abnormal behavior. Features can be extracted using statistical features (such as mean, variance, maximum, minimum, etc.), frequency domain features, time domain features, time series patterns, and other methods.

[0065] (5) Data aggregation: Aggregate data into appropriate time intervals based on requirements. Data can be aggregated using time windows, sliding windows, or sampling methods to reduce the amount of data and retain sufficient information.

[0066] (6) Data standardization: Standardizing data can make it have zero mean and unit variance. Standardization can eliminate the dimensional differences between different features and help to better compare and analyze data.

[0067] (7) Data dimensionality reduction: If the data dimension is high, you can consider using dimensionality reduction methods to reduce the number of features. Common dimensionality reduction techniques include principal component analysis (PCA) and linear discriminant analysis (LDA).

[0068] The following will refer to Figure 1 The principles and implementations of the present disclosure are described in detail.

[0069] Figure 1 An exemplary flow chart 100 of a method for detecting abnormal behavior of a networked device according to an embodiment of the present disclosure is shown. Figure 1 As shown, the abnormal behavior detection method of the networked device of this embodiment includes the following steps: Step S110: construct a causal graph generation model and a weighted graph neural network prediction model.

[0070] Step S120: inputting the multivariate time series data of the networked devices into a causal graph generation model to obtain a causal graph and an adjacency matrix of the causal graph; wherein the multivariate time series data is related to the network behavior of the networked devices.

[0071] Step S130: Input the adjacency matrix and multivariate time series data into the weighted graph neural network prediction model to obtain abnormal behavior prediction values.

[0072] Step S140: Calculate an abnormality score according to the abnormal behavior prediction value.

[0073] Exemplarily, the above-mentioned steps S110 to S140 are equivalent to an entropy causal graph multivariate time series anomaly detection scheme. Figure 4 A schematic diagram 400 of an entropy causal graph multivariate time series anomaly detection framework according to some embodiments of the present disclosure is shown. Figure 3 and Figure 4 As shown, steps S110 to S140 are related to the causal graph generation model 310 and the weighted graph neural network prediction model 320 .

[0074] For example, reference Figure 4 As shown, in the overall framework of the model, for the collected multivariate time series data, the entropy causal graph framework can use transfer entropy to build a graph structure to reveal the potential causal relationship between time series data. The weighted graph convolutional network is combined with causal convolution to model the causal graph structure and temporal pattern in multivariate time series data. In addition, the present disclosure performs anomaly score calculation and uses normalization based on median absolute deviation to improve the robustness of the anomaly identification process.

[0075] Let's combine Figure 4 The specific process of entropy causal graph multivariate time series anomaly detection framework is introduced. The CGAD designed in this disclosure can use the causal relationship in multivariate time series data to form a causal graph. The overall framework of CGAD is as follows Figure 4 As shown, the present disclosure designs three modules for anomaly detection, including the following parts: 1. Causal graph generation (corresponding to causal graph generation model 310). The preprocessed data is input into this model, and the transfer entropy is first used to calculate the causal relationship factor between the two time series, and a weighted causal graph is generated, and the adjacency matrix of the graph is constructed.

[0076] In causal graph generation, transfer entropy (TE) is used to discover causal relationships in multivariate time series data. Based on causal discovery calculations, the present disclosure designs an adjacency matrix that represents graph relationships. The generated adjacency matrix can be used as input to the graph learning module in the weighted graph neural network prediction model 320.

[0077] 2. Weighted GNN prediction (corresponding to weighted graph neural network prediction model 320). The adjacency matrix and preprocessed data are input into the weighted GNN prediction module. The weighted GNN prediction consists of three main parts: weighted graph convolution module GCN (corresponding to Figure 4 Conv in), time convolution module (corresponding to Figure 4 TC modules in the ), jump connections, and output modules (corresponding to Figure 4The adjacency matrix or causal graph is input into GCN, then transformed by a linear layer and passed to the temporal convolution module. The causal convolution uses parallel computing to model temporal features in a non-recursive process. The skip connection module collects the results of each layer of the temporal convolution module and adds all the results of the skip connection layer together before passing them to the output module. The output module consists of two linear layers to convert the channel dimension to the required output dimension so that all nodes of the time series data can be predicted one time step ahead. Figure 4 The set of ReLU and Linear shown in Figure 1 counts as one linear layer.

[0078] The present disclosure uses time analysis to capture the time trend of each time series, and also uses the GNNs method based on the causal graph adjacency matrix to model the relationship between time series. The present disclosure can perform single-step prediction on multivariate time series.

[0079] 3. Median Deviation Score: Apply the established prediction model to test data containing abnormal samples. Compare the prediction results with the actual observations, calculate the anomaly score, and determine whether there is an anomaly in the networked device. Specifically, anomalies in multivariate time series data are identified by calculating the anomaly score based on the prediction error. If the prediction result deviates from the basic facts, it will be marked as an anomaly. This disclosure proposes an anomaly score normalization mechanism based on the Median Absolute Deviation (MAD), which converts the score into a common scale and enhances the robustness of identifying abnormal events.

[0080] The following is an introduction to the definition of some model parameters in this disclosure.

[0081] For example, the multivariate time series is where N is the number of variables and T is the length of each series. The value of a multivariate time series at a specific time step t is recorded as Alternatively, the univariate time series corresponding to variable i is recorded as .if The cumulative anomaly score of all N nodes in ) exceeds the threshold, the system is classified as an anomaly at time step t. Finally, based on the anomaly score The prediction result is expressed as: , where 0 indicates normal and 1 indicates abnormal.

[0082] Following unsupervised anomaly detection, assuming that the multivariate time series data in the training sample (represented by ) consists entirely of normal data, while the test sample (denoted ) contains some anomalies. Prediction-based methods better represent the anomaly-free training dataset The training process develops a model based on historical data of a given window size w , predict the next time step value in the training sample Then, in the inference phase, the trained model is used to Predict the values ​​in the test sample The prediction error is based on the difference between the prediction and the ground truth label, which is then used to determine The cumulative anomaly score of all N nodes in is denoted as to determine whether it is an abnormality.

[0083] Combine the following Figure 3 and Figure 4 The above steps S110 to S140 are described in detail: In step S110, a causal graph generation model 310 is constructed, and a weighted graph neural network prediction model 320 is constructed.

[0084] Here, the technical means related to the causal graph generation model 310 of the present disclosure are uniformly introduced to facilitate the understanding of the technical solutions in the following text.

[0085] Causal graph generation is introduced here.

[0086] The present disclosure uses transfer entropy (TE) to generate causal graphs. It quantifies the level of uncertainty or randomness in a system and relies on the basic principle of Shannon entropy. The present disclosure uses TE to calculate the causal relationship factors between two time series and generate weighted causal graphs.

[0087] In common multivariate time series data modeling, there is a first data preprocessing stage where the data is normalized, usually using min-max normalization. Then, to calculate the transfer entropy, the probability density function of each time series is estimated from its training data using the histogram method. To do this, the (univariate) time series The range of is divided into D bins, and then the normalized count of each bin estimates the probability that the time series measurement falls into that bin. Then the information entropy It can be calculated as: (1) in Representation variables The probability density function of the time series value Which bins of the D histogram does it belong to? Formula (1) only calculates the information of a single variable, and the joint entropy measures the uncertainty of the association of multiple variables. Consider another variable Corresponding to the time series . Joint Entropy By considering and The interaction between them is used to capture the total uncertainty in the system.

[0088] (2) Joint Entropy Quantifies the average amount of information needed to accurately specify the values ​​of two variables. Conditional Entropy Related to the joint entropy, expressed in variables In the known case The amount of information.

[0089] (3) variable and The transfer entropy between , can be arrive Information flow is measured by: (4) Where the indices t and t-1 represent time t and t-1 respectively. The complete equation for transfer entropy TF can be expressed as: (5) in Represents time series A possible value in the histogram encoding of , whose latest value is at time , the window size is . It includes values ​​for the following time series: Similarly, Contains time series A possible value in the histogram encoding of , whose latest value is at time , the window size is . Therefore, it contains the following time series values: [ ] Window size The most natural choice is or 1, when When greater than 0, lead to The higher the A value, the more For time series The greater the impact.

[0090] Here we introduce the application of cause-and-effect diagram in CGAD.

[0091] If the causality value in both directions is high, consider using the dominant direction of information flow in the pairwise transfer entropy calculation to calculate the difference between the two directions. Specifically, the calculation includes minus . This method will lead to the loss of causal information. The goal of the present disclosure is to maintain the natural value of and maintain the direction of influence between two variables. Therefore, it cannot remove causal information from every direction. Once the causal relationship value calculated based on the transfer entropy is obtained, the adjacency matrix of the graph can be constructed. ,in is the number of nodes. Therefore, the expression of the directed weighted adjacency matrix is ​​as follows: (6) in is a control constant to prevent the development of unnecessary relationships based on weak causal relationships. The value of can be chosen by the user based on sparsity preference. However, ideally the number should be close to 0. Representing time series To time series .

[0092] To speed up the process of calculating TE, the present disclosure implements a TE estimator based on the Kraskov method, which uses the k-nearest neighbor strategy. The Kraskov method is used to estimate TE using the PyIF library, an open source Python library. In addition, the present disclosure implements a sampling process because multivariate time series data has different series lengths and potentially large time steps. This process involves randomly dividing the series into smaller blocks and calculating the average weighted adjacency matrix of all samples. This approach helps to efficiently perform causal discovery with manageable series lengths, reducing the overall cost and effort involved in the entire series length.

[0093] Here, the technical means related to the weighted graph neural network prediction model 320 disclosed in the present invention are uniformly introduced to facilitate the understanding of the technical solutions described later.

[0094] Here we introduce weighted GNN prediction. Specifically, we will introduce weighted graph neural network (GNN) prediction methods to simulate the spatiotemporal patterns of multivariate time series data.

[0095] refer to Figure 4 As shown, the weighted GNN prediction consists of three main parts: weighted graph convolution module (corresponding to Figure 4 Conv), time convolution module (corresponding to Figure 4 TC modules), jump connections and output modules (corresponding to Figure 4In addition, a residual connection of the weighted graph convolution module input can be added to the output of the graph convolution module to prevent the gradient vanishing problem.

[0096] Here we introduce the weighted graph convolution module.

[0097] The graph convolution module performs spatial analysis based on the generated causal graph. It is crucial to extract node features and mine the interdependencies between time series data. The graph convolution network (GCN) layer is defined as: (7) in and They represent the new embedding and the previous layer embedding before applying the graph convolution operation, respectively. It is the normalized adjacency matrix added from floops to the original image. yes The diagonal matrix of Contains the corresponding layer Parameters, Represents the sigmoid function. The causal graph mentioned above is input into the GCN, using the edge weight information as the input of the graph convolution operator so that the adjacency matrix contains values ​​other than 1 to represent edge features.

[0098] Using a two-layer GCN model, a good balance is achieved between ensuring the simplicity of GCN and retaining the model's ability to express spatial dependencies in multivariate time series data. and cause-effect diagram The GCN model can be expressed as: (8) In the formula, is the normalized adjacency matrix, is the weight matrix input to the first hidden layer, is the weight matrix from hidden layer to output, The sequence length is The output, is the rectified linear unit, which is the standard activation function in deep neural networks.

[0099] Here we introduce the temporal convolution module.

[0100] For the weighted GNN prediction component, the input is first transformed through a linear layer and then passed to the temporal convolution module. Causal convolution is used for the temporal convolution module. Causal convolution uses parallel computing to model temporal features in a non-recursive process. It applies a 1D (dimensional) convolution filter to extract high-level temporal context features. Setting different kernel sizes in causal convolution can mine temporal patterns of different ranges in time series data. This disclosure does not use extended temporal convolution to expand the kernel size because a smaller window size is used in multivariate anomaly detection, so CGAD uses a fixed kernel size. However, choosing the right kernel size is challenging, and in order to effectively balance the signal pattern, the filter size must be carefully selected and cannot be too large or too small.

[0101] To address this challenge, the present disclosure uses multiple filter sizes to maximize the performance of the causal convolutional network. In prediction-based anomaly detection, a smaller input sequence length can better predict a value in advance. Since the measurement granularity of real-time anomaly detection is usually expressed in units such as seconds, minutes, or hours, 60 is a basic number. The present disclosure selects filter sizes such as 2, 3, 5, and 6 based on the lowest common divisor of 60. This selection allows filter sizes of 1 × 2, 1 × 3, 1 × 5, and 1 × 6 to cover common input sequences of time series in anomaly detection problems.

[0102] Time Series Input A linear layer is used to transform before entering the temporal convolution module to produce a vector sequence . Then the vector sequence Processed into two different initial layers. Given 4 filters, , , , As a causal convolution process, the initial layer is calculated as: (9) in represents the convolution operator. Therefore, The causal convolution represented by can be expressed as: (10) In addition to the causal convolution process in the initial layer, it is also necessary to consider the receptive field size of the convolutional network, which grows linearly based on the network depth and kernel size. By understanding the receptive field size, the present disclosure is able to balance the input and output sizes of the convolution operation by adding some control padding. The receptive field of the convolutional network can be calculated as follows: (11) in For the receiving field, is the number of convolutional layers, is the kernel size. In the last step of the temporal convolution, a gating mechanism is used to control the flow of information between layers during the temporal convolution. There are two activation functions: the tangent hyperbolic activation function as a filter and the sigmoid activation function that controls the information that needs to be passed to the next module. Therefore, the gating mechanism is: (12) in represents the sequence filtered from the initial layer, , , and are model parameters, is the element-wise product, is the tangent hyperbolic activation function, is the sigmoid activation function. Then, the result of the gated TCN (Temporal ConvolutionalNetwork) is passed to the GCN module and the skip connection layer.

[0103] Here we introduce skip connections and output modules.

[0104] The skip connection module collects the results of each layer of temporal convolutional modules to prevent the temporal information from succumbing to the gradient vanishing problem. The skip connection layer is essentially standard convolution, where For the The sequence length of the input to the skip connection layer is then added together before passing to the output module. The output module consists of two linear layers ( Figure 2 It is composed of 2 layers of ReLU+Linear in , which is used to convert the channel dimension into the required output dimension so that all nodes of the time series data can be predicted one time step ahead.

[0105] The mean squared error (MSE) training objective is used between the predicted output and the observed data. The MSE loss function can be calculated as follows: (13) in, is the maximum observation time of multivariate time series data, is the window size, is the single-step prediction result of all nodes, For a specific time step The observation data of all nodes.

[0106] In some embodiments, the weighted graph neural network prediction model 320 includes: a weighted graph convolution module, a temporal convolution module, a jump connection, and an output module. Exemplarily, the weighted graph convolution module can capture the correlation strength and feature information between nodes in the graph structure; the temporal convolution module can analyze the dynamic changes of time series data; the jump connection is used to promote the efficient transmission of information between different layers and alleviate the gradient vanishing problem; and the output module is used to generate the final prediction result. The present disclosure is set up in this way to achieve accurate prediction of the evolution pattern of complex graph structure data over time.

[0107] In step S120, the multivariate time series data of the networked device is input into the causal graph generation model 310 to obtain a causal graph and an adjacency matrix of the causal graph; wherein the multivariate time series data is related to the network behavior of the networked device. Exemplarily, such a setting can automatically construct a causal graph and an adjacency matrix reflecting the causal relationship of the device network behavior, thereby facilitating further analysis and calculation of the device network behavior.

[0108] In some embodiments, the multivariate time series data of networked devices is input into the causal graph generation model 310 to obtain a causal graph, including: The causal graph is calculated using the transfer entropy method and multivariate time series data using the formula (5) mentioned above: (5) in, represents a cause-effect diagram, Including variables in multivariate time series data To variable The transfer entropy of represents the probability density function; represents the variable i at time step t; Indicates the time step Based on time series The values ​​in the histogram encoding of , with a window size of ; Indicates the time step Based on time series The values ​​in the histogram encoding of , with a window size of .

[0109] In some embodiments, the multivariate time series data of networked devices is input into the causal graph generation model 310 to obtain an adjacency matrix of the causal graph, including: The adjacency matrix is ​​calculated using the formula (6) mentioned above: (6) in, represents the adjacency matrix; Representing time series To time series The transfer entropy of represents the control constant, The value of is obtained according to the sparsity preference.

[0110] In step S130, the adjacency matrix and multivariate time series data are input into the weighted graph neural network prediction model 320 to obtain the abnormal behavior prediction value. Exemplarily, such a setting can use the graph structure information and time series features for comprehensive analysis, thereby more accurately predicting the abnormal behavior value of the networked device, and improving the early warning and identification capabilities of potential problems.

[0111] In some embodiments, the adjacency matrix and multivariate time series data are input into the weighted graph neural network prediction model 320 to obtain abnormal behavior prediction values, including: The adjacency matrix and the multivariate time series data are linearly transformed using a weighted graph convolution module to obtain the first data.

[0112] The time feature of the first data is modeled using a time convolution module to obtain second data.

[0113] The second data is subjected to skip connection processing and channel dimension conversion processing by utilizing a skip connection and an output module to obtain third data.

[0114] The third data is predicted and calculated using a preset linear layer to obtain an abnormal behavior prediction value.

[0115] Exemplarily, the above steps perform linear transformation through a weighted graph convolution module, model time features through a time convolution module, process data through a jump connection and an output module, and finally perform prediction calculations using a preset linear layer. This setting can accurately capture graph structure information and time series features, and effectively predict abnormal behavior values ​​of networked devices.

[0116] In some embodiments, a weighted graph convolution module is used to perform a linear transformation on the adjacency matrix and the multivariate time series data to obtain the first data, including: using the formula (8) mentioned above to calculate the first data: (8) in, Indicates that the sequence length is The first data, X represents multivariate time series data, represents the adjacency matrix; is the rectified linear unit; represents the normalized adjacency matrix, , yes The diagonal matrix of It is the normalized adjacency matrix added to the causal graph from floops; , Represents the weight matrix input to the first hidden layer; , represents the weight matrix from hidden layer to output; C represents the dimension of input features; H represents the dimension of hidden layer; F represents the sequence length, that is, the dimension of output layer.

[0117] In some embodiments, the skip connection and the output module are trained using the formula (13) mentioned above: (13) in, Indicates the loss function using mean square error MSE; Represents the maximum observation time of multivariate time series data; Indicates the window size; , Represents the single-step prediction results of all nodes; , Indicates a specific time step The observation data of all nodes under, N represents the number of nodes.

[0118] In step S140, an abnormality score is calculated based on the abnormal behavior prediction value. Exemplarily, this step is equivalent to performing a median deviation score. Subsequently, it can be determined whether the networked device has abnormal behavior based on the abnormality score.

[0119] Here, the technical means related to the median deviation score of the present disclosure are uniformly introduced to facilitate the understanding of the technical solutions in the following text.

[0120] Here we introduce the median deviation score.

[0121] The present disclosure applies the established prediction model to test data containing abnormal samples. Using a threshold-based method, if the abnormality score exceeds the threshold, the time The observations are classified as abnormal. First, the prediction results are compared with The anomaly score is calculated by comparing the actual observed value at the time. At this moment, the error of the sensor can be calculated as: (14) After calculating the error value, use the z-score to compare the sensor time The anomaly scores are normalized. The present disclosure chooses z-score instead of standard normalization techniques (such as min-max) because z-score ensures that scores are placed on a common scale and has been shown to be more robust when dealing with data anomalies. Specifically, the present disclosure adopts an improved z-score based on median absolute deviation (MAD), which is more resistant to outliers than the traditional z-score. Compared with the traditional z-score, the improved z-score uses the median instead of the mean, and the median absolute deviation instead of the standard deviation. These medians replace the mean, ensuring that anomalies do not affect the z-score calculation, while assigning higher scores to anomalies far from 0. This robustness facilitates comparison and identification of outliers. Sensor The anomaly score can be calculated using the modified z-score: (15) In the formula, For a specific time series The median of the error values. Given The present disclosure regards abnormal events as global abnormalities, that is, if a single node Anomaly alerts are issued at each node and regarded as abnormal events for the entire system. Therefore, it is necessary to aggregate all anomaly scores across different nodes. The collective anomaly score of , the individual abnormal scores are summarized using the maximum function, and the calculation formula is as follows: (16) in is an aggregate function that passes through time Select the highest value from all node anomaly scores to get a collective anomaly score. Once you get this score, you can use this scenario to determine whether an event is abnormal or normal: (17) In the formula, is the anomaly threshold; if the comprehensive anomaly score exceeds the threshold, The event is classified as an anomaly. The disclosure uses a Peaks Over Threshold (POT) strategy to automate the threshold selection process, which exploits extreme value theory based on the generalized Pareto distribution. Using this strategy enables the CGAD framework to dynamically identify appropriate thresholds under specific risk parameters.

[0122] In some embodiments, calculating the abnormality score according to the abnormal behavior prediction value includes: using the above-mentioned formula (14), formula (15), formula (16), and formula (17) to calculate the abnormality score: (14) (15) (16) (17) in, Indicates the error value; Represents the abnormal behavior prediction value, that is, the single-step prediction result of all nodes; Indicates a specific time step Observation data of all nodes; represents the anomaly score; Representing time series The median of the error values; Representing time series The median absolute deviation of , Represents the median function; Indicates time The collective anomaly score of Represents an aggregate function; indicates abnormal score; Indicates the anomaly threshold.

[0123] In order to further improve the accuracy of abnormal behavior detection, the present disclosure also designs a topology-enhanced group-level graph model 330 and integrates the model into the abnormal behavior detection process.

[0124] Figure 2 An exemplary flow chart 200 of an abnormal behavior detection method for a networked device according to another embodiment of the present disclosure is shown. For example, the technical means in this embodiment that are repeated in the above content will not be described in detail. Figure 2 and Figure 3 As shown, the abnormal behavior detection method of the networked device of this embodiment includes the following steps: Step S210: construct a causal graph generation model 310, construct a weighted graph neural network prediction model 320, and construct a topology pattern enhanced group-level graph model 330.

[0125] Step S220: input the multivariate time series data of the networked devices into the causal graph generation model 310 to obtain a causal graph and an adjacency matrix of the causal graph; wherein the multivariate time series data is related to the network behavior of the networked devices.

[0126] Step S230: Input the causal graph and multivariate time series data into the topology pattern enhanced group-level graph model 330 to obtain embedded data.

[0127] Step S240: Input the embedded data, the adjacency matrix and the multivariate time series data into the weighted graph neural network prediction model 320 to obtain the abnormal behavior prediction value.

[0128] Step S250: Calculate an abnormality score according to the abnormal behavior prediction value.

[0129] Here, the technical means related to the group-level graph model 330 with enhanced topology mode disclosed in the present invention are uniformly introduced to facilitate the understanding of the technical solutions in the following text. Figure 5 A schematic diagram 500 of a topology-pattern-enhanced group-level graph framework is shown according to some embodiments of the present disclosure.

[0130] A group-level graph enhanced with a topology pattern is introduced here.

[0131] This framework targets the possibility of anomalous groups in graphs and designs Group-level Graph Anomaly Detection (Gr-GAD), which focuses on identifying group-level anomalies by leveraging topological pattern information, as well as a Multi-HopGraph AutoEncoder (MH-GAE), which can effectively capture long-range inconsistencies, and a Topology Pattern-based Graph Convolutional Learning (TPGCL), which can detect anomalous groups of arbitrary size without any labeling.

[0132] refer to Figure 3 As shown, the present disclosure inputs the embedded data output by the topological pattern enhanced group-level graph model 330 into the weighted graph neural network prediction model 320, which can extract the potential correlation between the abnormal group and its topological pattern, thereby optimizing the anomaly detection framework.

[0133] Combine the following Figure 3 and Figure 5 Describe the specific process of a topology-enhanced group-level graph anomaly detection model, refer to Figure 3 and Figure 5 , the topology-enhanced group-level graph model 330 includes the following parts: 1. Anchor node positioning based on multi-hop graph autoencoder: Input the causal graph and part of the data after data preprocessing into the multi-hop graph autoencoder to locate the anchor node.

[0134] 2. Candidate group sampling: Then group sampling is performed to select candidate groups and obtain potential abnormal groups for further differentiation.

[0135] 3. Graph contrast learning based on topological patterns: After determining the candidate group, graph contrast learning based on topological patterns is introduced. In order to capture the topological pattern information, two types of topological augmentation are introduced: Pattern Preservation Augmentation (PPA) and Pattern Breaking Augmentation (PBA). Positive and negative views are generated, and then GNN is used to output the input graph embedding containing rich topological patterns and label-related information.

[0136] The following describes each step of the above process in detail.

[0137] Here we introduce GAE for node-level anomaly detection.

[0138] The core assumption of GAE-based node-level anomaly detection is that anomaly nodes in a graph usually show inconsistent structural or attribute characteristics compared with their neighboring nodes. Specifically, if a node is linked to nodes belonging to different classes or communities, it is considered a structural anomaly. On the contrary, if the attributes of a node are similar to those of nodes from different classes or communities, it is considered an attribute anomaly.

[0139] GAE-based anomaly detection uses reconstruction error to quantify this local inconsistency. Specifically, using a GNN-based encoder To generate a low-dimensional embedding of a node: ,in and are the adjacency matrix and feature matrix of the graph respectively. Then, from the generated embedding In the decoder Reconstructing the graph structure and properties , .

[0140] For any node in the graph , its reconstruction error The structural error and attribute error The weighted sum of is expressed as: (18) (19) (20) in Is a node (excluding ), is a hyperparameter that adjusts the relative importance between structural and attribute errors. Then minimize all nodes The encoder and decoder are trained together. After training, the encoder with a large reconstruction error (for example, exceeding the threshold ) are identified as abnormal.

[0141] Here we introduce graph contrast learning.

[0142] Graph Contrastive Learning (GCL) is a powerful and widely used unsupervised graph learning method. GCL models generate embeddings for downstream tasks when no labels are available. Early GCL was built on the basis of mutual information maximization (InfoMax). This is achieved by augmenting the generation of multiple views of the input graph and maximizing the mutual information between these views and the input graph as the training objective. Common augmentations in GCL include perturbations to nodes and edges, such as adding or removing nodes or edges.

[0143] Current GCL methods follow the Graph Information Bottleneck (GIB) principle. Their goal is to simultaneously maximize the mutual information between the encoding and the label of the input graph, while minimizing the mutual information between the encoding and the input graph. This can be expressed as follows: (twenty one) in, and are the input graph and label respectively, For models, such as GNN.

[0144] This disclosure defines the group-level graph anomaly detection (Gr-GAD) problem and distinguishes it from sub-graph-level graph anomaly detection (Sub-GAD).

[0145] Represent a graph as ,in is a collection of nodes, is a collection of edges, and the attributes of all nodes are summarized into a matrix Given a graph , threshold As input, the Gr-GAD method can be expressed as the function , which outputs the anomaly score Related Groups gather: ,in and satisfy: (twenty two) (twenty three) in For the group The associated anomaly score.

[0146] function Relatively high anomaly scores should be output for those identified groups. Therefore, assuming that each anomaly score Should exceed the threshold . In addition, no label information is provided as input.

[0147] This paper mainly studies unsupervised Gr-GAD. It is worth noting the difference between Gr-GAD and Sub-GAD. In particular, Sub-GAD outputs a node set Induced subgraph , and each node Anomaly score . Therefore, there are two main differences between Gr-GAD and Sub-GAD: Sub-GAD generates anomaly scores at the node level, and the identified anomalous nodes constitute a single anomalous subgraph. In contrast, Gr-GAD assigns anomaly scores at the group level, i.e., anomaly scores are assigned to groups instead of nodes.

[0148] Abnormal subgraphs generated in Sub-GAD In the example, from the node level perspective, each node is abnormal (i.e. , ). In contrast, the nodes of the anomalous group identified by Gr-GAD may be normal at the node level. That is, Gr-GAD distinguishes the anomalous group from other groups at the group level, while Sub-GAD identifies subgraphs consisting of nodes that are considered anomalous at the individual node level.

[0149] Here, the topology-enhanced group-level graph model TP-GrGAD is introduced.

[0150] This paper mainly introduces the introduced model TP-GrGAD to solve the task of Gr-GAD. Figure 5 As shown, the model consists of three components: locating anchor nodes through Multi-Hop GAE, candidate group sampling, and identifying candidate groups through graph comparison learning based on topological patterns.

[0151] As the time complexity increases, it is difficult to directly identify the abnormal group. To solve this problem, the present disclosure adopts a three-step method. First, a set of anchor nodes are identified as potential anomalies. Then, sampling and grouping are performed based on these anchor nodes. The overall framework of the TP-GrGAD method is as follows: Figure 5 shown.

[0152] TP-GrGAD mainly consists of three parts: anchor node localization, candidate group sampling, and candidate group classification. To overcome the limitations of GAE, a new variant called Multi-Hop Graph AutoEncoder (MH-GAE) is introduced, which can more accurately detect nodes in anomaly groups by capturing long-range inconsistencies. Then, a group sampling algorithm from anchor nodes to sample candidate groups is introduced. Finally, given the sampled candidate groups, a new GCL framework called Topological Pattern-based Graph Contrastive Learning (TPGCL) is introduced, which is able to classify the candidate groups by comparing the positive samples ( ) and negative samples ( ) to capture topological pattern information. This enables TPGCL to effectively generate embeddings for candidate groups. The existence of abnormal groups is then identified by existing unsupervised outlier detectors such as SUOD and ECOD.

[0153] Here we introduce anchor node positioning based on MH-GAE.

[0154] To address the challenge of exponentially growing possible anomaly groups as the graph size increases, a multi-hop graph autoencoder (MH-GAE) is introduced to identify a set of anchor nodes and subsequently identify sample groups based on these anchor nodes. First, the limitations of the original GAE need to be discussed.

[0155] Here we introduce the limitations of GAE.

[0156] Although Graph AutoEncoder (GAE) and its variants are useful in unsupervised anomaly detection, they may face limitations in detecting anomalous groups. Specifically, some anomalous nodes are consistent with their neighbors within the same group, but show inconsistency with other remote nodes outside the group, which is called long-range inconsistency. Existing GAE-based anomaly detection methods cannot capture such long-range inconsistency and thus fail to detect group-level anomalies. This limitation is mainly attributed to the reconstruction objective of GAE, namely the adjacency matrix GAE-based anomaly detection methods emphasize measuring the dissimilarity between nodes and their direct one-hop neighbors. Therefore, identifying nodes deeply embedded in anomaly groups (similar to their one-hop neighbors) may pose a challenge for detection using GAE.

[0157] Here we introduce Multi-Hop Graph AutoEncoder (MH-GAE).

[0158] This paper introduces a new multi-hop graph autoencoder MH-GAE, which focuses on the inconsistency between a node and its multi-hop neighbors, thereby capturing long-range inconsistencies. To this end, this paper explores two methods. A naive method is to use a standardized multi-hop matrix (such as , etc.) instead of the adjacent matrix in the objective function (Formula 19) .

[0159] For the standardized k-hop matrix , which is The kth power, then the node The reconstruction error is: (twenty four) The above formula is To achieve the reconstruction goal, the model is required to reconstruct not only the substructure within one-hop neighborhood but also the substructure within k-hop neighborhood, thereby capturing long-range inconsistencies and perceptual nodes deep in the population that are ignored by the original GAE.

[0160] In this method, there may be a lack of flexibility because determining and calculating the matrix It is difficult to find an appropriate value for the power and computational cost associated with the k-th power of . Therefore, the present disclosure may adopt an alternative approach involving using the weighted adjacency matrix proposed in GraphSNN Replace the adjacency matrix : (25) (26) For a given graph , node set and edge set , and The nodes are and The neighborhood subgraph of . for , Overlapping subgraphs of , . is a hyperparameter. It can help GNN learn the local structural information of nodes to obtain the strong performance of high-order Weisfeiler-Lehman (WL) test, which can capture information beyond the one-hop neighbors of a node and thus capture long-range inconsistencies.

[0161] Candidate population sampling is introduced here.

[0162] Starting from the anchor nodes identified by MH-GAE, candidate group sampling is performed to obtain potential outlier groups for further differentiation. In order to comprehensively capture the potential outlier groups in the graph, three pattern search algorithms are used: path search, tree search, and cycle search. These three types of patterns (path, tree, and cycle) are the basic building blocks of many complex patterns, making them important for detecting various structures of outlier groups in the graph. For example, triangle and diamond patterns can be simplified to cycles, while the star pattern can be viewed as a tree. The path search algorithm is responsible for identifying any two anchor nodes. and A linear sequence of nodes between nodes, which can reveal the existence of simple and direct connections between nodes, such as sequential transactions or relationships.

[0163] The tree search algorithm aims to detect anchor nodes and The hierarchical structure between them indicates that there are branching relationships or nested dependencies in the graph. The loop search algorithm finds the nodes that contain anchor nodes. The overlap and repetitive patterns obtained through sampling help increase the number of candidate groups input into TPGCL, thereby improving the performance of the model.

[0164] Here we introduce graph contrastive learning based on topological patterns After determining the candidate groups, a new GCL variant named Topological Pattern-based Graph Contrastive Learning (TPGCL) is introduced. TPGCL incorporates specially designed enhancements to capture topological pattern information, thereby improving the detection of outlier groups. Compared with the common design of GCL, this paper differs in two key aspects: the way to generate enhanced views and the construction of the training objective function.

[0165] Topology pattern awareness enhancement is introduced here.

[0166] The present disclosure relies on a key assumption that abnormal groups usually possess some specific topological patterns. Widely used enhancement methods such as node or edge removal and feature masking generate views by randomly perturbing the structure or node features of the graph. However, these enhancements are not suitable for Gr-GAD because these enhancements do not consider the potential impact on the topological structure that is highly correlated with the labels. For example, node removal may delete the root node of the tree, on the other hand, edge removal may delete a specific edge in the chain, causing the entire chain to break. The occurrence of this situation may affect the performance of group detection, making it difficult to distinguish abnormal groups.

[0167] Therefore, in order to capture the topological pattern information, the present disclosure introduces two types of topological enhancement: pattern preserving enhancement (PPA) and pattern breaking enhancement (PBA). Specifically, PPA will preserve the inherent topological patterns in the candidate group, while PBA will break these patterns. The present disclosure refers to the views generated by PPA and PBA as positive views and negative views. Negative views will share less mutual information with the abnormal group by breaking the inherent topological pattern, while positive views will share more mutual information, which will help to construct the training objective function.

[0168] In general, PPA and PBA have two reasonable properties compared with previous widely used extensions: (1) Topological pattern orientation. Unlike previous extensions, which ignore possible effects on local structures and topological patterns, PPA and PBA perturb the group from the perspective of the entire topological pattern. (2) Reduced randomness. Previous enhancements usually produce random perturbations, while PPA and PBA have a prescribed effect on the topological pattern (destroy or preserve).

[0169] To achieve these two extensions, topological pattern search is first applied. For each candidate group, topological pattern search finds three patterns in the group: tree, path, and cycle. The reason for selecting these three patterns is that they represent different basic subclasses, and other topological patterns such as triangle, diamond, star, etc. can be regarded as their different specific cases. After determining the three patterns in the candidate group, these patterns are broken to generate negative views, and the patterns are extended in positive views. Specifically, to generate the negative view, the root node of the tree is deleted, the path is broken by deleting the middle node of the path, and the cycle is broken by deleting any two nodes. For the generation of the positive view, the inherent topological patterns are simultaneously extended and maintained. That is, new child nodes are added to the tree, the path is extended by adding new nodes, and the cycle is extended by adding new nodes.

[0170] Here we introduce the construction of learning objectives In addition to the enhancement process, another key factor in contrastive learning is the design of the contrastive loss function. This paper constructs a dedicated objective function that explicitly considers topological pattern information.

[0171] Specifically, we first construct a labeled version of the contrastive loss (Formula 28) based on the principle of the graph information bottleneck (GIB). Since labels are not available in an unsupervised learning setting, we eliminate the labels by exploiting the mutual information between the positive and negative view embeddings, thereby obtaining the unlabeled objective (Formula 29). Finally, in order to make this objective easy to compute, we further adopt a technique for efficiently estimating mutual information, resulting in the final objective used in this disclosure.

[0172] Given a set of candidate groups , using the previous topological pattern-aware enhancement (i.e., PPA and PBA) to generate the front view and negative view .set up is the label set corresponding to each group. is the number of candidate groups. The goal is to train a Parameterized Model , it can be used without using tag information In the case of The groups in generate embeddings.

[0173] The representation learning of graph structured data should follow the Graph Information Bottleneck (GIB) principle: (27) in is mutual information, is a learnable model with parameters For example, GNN, and is the input graph and the corresponding label. GIB aims to maximize the mutual information between embedding and label while minimizing the mutual information between embedding and input.

[0174] Following GIB’s intention, we construct an objective function based on positive and negative views, assuming that the label Currently available: (28) The goal of maximizing formula 28 is actually equivalent to maximizing GIB. That is, GIB and There is a common maximization goal.

[0175] Next, we derive the unlabeled version of Equation 28, since the label is not available in the context of unsupervised learning. Replace Equation 28 with the following objective function: (29) The conversion from Equation 28 to Equation 29 relies on a key assumption: there is a strong correlation between topological patterns and labels. This assumption allows the present disclosure to replace the mutual information between labels and embeddings with the mutual information between positive and negative view embeddings. However, due to the difficulty in directly calculating the mutual information, the objective function (Equation 29) cannot be used for training.

[0176] In order to solve this problem, the present disclosure adopts the existing MINE technology to achieve the goal. Specifically, the function (Formula 29) can be rewritten as: (30) In the above function, It is a trainable estimator, usually implemented by MLP (MultilayerPerceptron). After minimizing Formula 30 and converging, TPGCL outputs an input graph embedding containing rich topological patterns and label-related information.

[0177] In some embodiments, reference Figure 3 As shown, after obtaining the causal graph, it also includes: inputting the causal graph and multivariate time series data into the topological pattern enhanced group-level graph model 330 to obtain embedded data.

[0178] Inputting the adjacency matrix and the multivariate time series data into the weighted graph neural network prediction model 320 to obtain the abnormal behavior prediction value further includes: inputting the embedded data, the adjacency matrix and the multivariate time series data into the weighted graph neural network prediction model 320 to obtain the abnormal behavior prediction value.

[0179] Exemplarily, by executing the above steps, such a setting can combine multivariate time series anomaly detection with group-level graph anomaly detection, effectively apply topological pattern information for group detection, and improve the accuracy of anomaly detection.

[0180] refer to Figure 5 As shown, in some embodiments, the topological pattern enhanced group-level graph model 330 includes: a multi-hop graph autoencoder, a candidate group sampling module, and a topological pattern-based graph contrast learning model, and the topological pattern-based graph contrast learning model includes a graph neural network model GNN.

[0181] The causal graph and multivariate time series data are input into the group-level graph model 330 enhanced by the topological pattern to obtain embedded data, including: A multi-hop graph autoencoder is used to locate anchor nodes from causal graphs and multivariate time series data; the anchor nodes are related to potential abnormal behaviors of networked devices.

[0182] The candidate group sampling module is used to perform group sampling processing on the anchor nodes to obtain candidate groups.

[0183] A graph contrast learning model based on topological patterns is used to perform topological enhancement on the candidate group to obtain a positive view and a negative view. The positive view and the negative view are input into a graph neural network model to obtain embedded data. The topological enhancement processing includes pattern-preserving enhancement (PPA) and pattern-breaking enhancement (PBA).

[0184] Exemplarily, the above steps effectively reduce the number of groups that need to be identified through the group-level graph framework enhanced by topological patterns, extract the potential correlation between abnormal groups and their topological patterns, and detect abnormal groups of any size without any labeling.

[0185] In some embodiments, the graph contrast learning model based on topological patterns is trained using the formula (30) mentioned above: (30) in, represents the contrast loss function; Represents a learnable model; represents a trainable estimator; Indicates the number of candidate groups; Indicates a front view; Indicates a negative view.

[0186] The key technologies disclosed herein and the beneficial effects thereof are as follows: 1. A new method, CGAD, namely Entropy Causal Graph for Anomaly Detection in Multivariate Time Series, is introduced. The goal is to pre-construct meaningful graph structures based on causal relationships between time series, thereby achieving more informative anomaly detection. In addition, to enhance the flexibility of generated graphs, the graph structure is automatically constructed without limiting the number of edge relations generated. First, causal discovery of multivariate time series is used to construct causal graphs, where causal factors assess whether one variable causes changes in other variables. To this end, transfer entropy, a comprehensive method based on information theory, is used to reveal causal relationships between variables in multivariate time series. Transfer entropy measures the amount of information transferred from one variable to another over time, enabling the construction of graph structures with edge weights that reflect the causal relationships between variables.

[0187] 2. CGAD adopts a prediction-based anomaly detection strategy to characterize abnormal events by calculating the deviation between the predicted value and the actual observed value. The CGAD framework is divided into three main parts: 1) Causal graph generation, which uses causal discovery techniques for multivariate time series to generate graph structures; 2) Weighted GNN prediction for multivariate time series future pattern learning based on weighted graph convolutional networks and causal convolutions to model the causal graph structure and temporal patterns of multivariate time series data; 3) Median deviation score, which is used to evaluate the deviation between the predicted results and the actual observed values ​​as an anomaly score for detecting anomalies within a specific time period. It uses the median absolute deviation (MAD) to standardize the anomaly score and enhance the robustness of comparing and identifying abnormal events.

[0188] 3. A novel unsupervised Gr-GAD framework combining graph autoencoder and graph contrastive learning, namely topological pattern enhanced unsupervised group-level graph anomaly detection (TP-GrGAD), is introduced. Specifically, a multi-hop graph autoencoder (MH-GAE) is adopted to detect anchor nodes that may belong to anomaly groups. Subsequently, the group sampling phase begins to sample candidate groups starting from the anchor nodes, effectively reducing the number of groups that need to be identified. The topological pattern enhanced graph contrastive learning (TPGCL) takes candidate groups as input and utilizes two novel enhancements to perturb the topological pattern. The process generates an embedding containing topological pattern information for each candidate group, which is then fed into the anomaly detector for anomaly scoring.

[0189] The present disclosure also proposes an abnormal behavior detection device for a networked device, which includes a device for executing the abnormal behavior detection method for a networked device as described above.

[0190] The present disclosure also proposes a computing device, including: at least one processor; and at least one memory on which instructions are stored. When the instructions are executed individually or collectively by the at least one processor, the computing device executes the abnormal behavior detection method for networked devices as described above.

[0191] Figure 6 A simplified block diagram of a device suitable for implementing the exemplary embodiments of the present disclosure is shown. Figure 6 It can be used to represent the abnormal behavior detection device of the networked device mentioned above in this disclosure, or the computing device. Figure 6 As shown, the device 600 includes one or more processors 610 , one or more memories 620 coupled to the processors 610 , and one or more communication modules 640 coupled to the processors 610 .

[0192] The communication module 640 is used for two-way communication. The communication module 640 has at least one antenna to facilitate communication. The communication interface may represent any interface necessary for communicating with other network elements.

[0193] Processor 610 may be of any type suitable for the local technology network, and may include, as non-limiting examples, one or more of: a general purpose computer, a special purpose computer, a microprocessor, a digital signal processor (DSP), and a processor based on a multi-core processor architecture. Device 600 may have multiple processors, such as application specific integrated circuit chips, which are driven in time to a clock that synchronizes a master processor.

[0194] The memory 620 may include one or more non-volatile memories and one or more volatile memories. Examples of non-volatile memories include, but are not limited to, read-only memory (ROM) 624, electrically programmable read-only memory (EPROM), flash memory, hard disk, compact disk (CD), digital video disk (DVD), and other magnetic and / or optical memories. Examples of volatile memories include, but are not limited to, random access memory (RAM) 622 and other volatile memories that do not persist during the duration of a power outage.

[0195] The computer program 630 includes computer executable instructions that are executed by the associated processor 610. The program 630 may be stored in the ROM 624. The processor 610 may perform any appropriate actions and processes by loading the program 630 into the RAM 622.

[0196] The embodiments of the present disclosure may be implemented by a program 630, so that the device 600 may execute the reference Figures 1 to 5 Any process of the disclosure discussed. The embodiments of the present disclosure may also be implemented by hardware or by a combination of software and hardware.

[0197] In some embodiments, the program 630 may be tangibly contained in a computer-readable medium, which may be contained in the device 600 (e.g., memory 620) or other storage devices accessible to the device 600. The device 600 may load the program 630 from the computer-readable medium to the RAM 622 for execution. The computer-readable medium may include any type of tangible non-volatile memory, such as ROM, EPROM, flash memory, hard disk, CD, DVD, etc. The computer-readable medium has the program 630 stored thereon.

[0198] Generally, various embodiments of the present disclosure may be implemented in hardware or dedicated circuits, software, logic, or any combination thereof. Certain aspects may be implemented in hardware, while other aspects may be implemented in firmware or software, which may be executed by a controller, microprocessor, or other computing device. Although various aspects of the embodiments of the present disclosure are shown and described as block diagrams, flow charts, or using some other graphical representations, it should be understood that, as non-limiting examples, the blocks, devices, systems, techniques, or methods described herein may be implemented in hardware, software, firmware, dedicated circuits or logic, general hardware or controllers or other computing devices, or some combination thereof.

[0199] The present disclosure also provides at least one computer program product tangibly stored on a non-transitory computer-readable storage medium. The computer program product includes computer executable instructions, such as instructions included in a program module, which are executed in a device on a target real or virtual processor to perform the abnormal behavior detection method of a networked device as described above, such as the above Figure 1 The method 100, or Figure 2 The method 200 described. Typically, program modules include routines, programs, libraries, objects, classes, components, data structures, etc. that perform specific tasks or implement specific abstract data types. In various embodiments, the functions of program modules can be combined or separated between program modules as needed. Machine executable instructions for program modules can be executed in local or distributed devices. In distributed devices, program modules can be located in local and remote storage media.

[0200] The program code for executing the disclosed method can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing equipment so that when the program code is executed by the processor or controller, the function / operation specified in the flow chart and / or block diagram is realized. The program code can be executed completely on the machine as an independent software package, partially on the machine, partially on the machine, partially on a remote machine, partially on a remote machine, or all on a remote machine or server.

[0201] In the context of the present disclosure, computer program codes or related data may be carried by any suitable carrier to enable a device, apparatus or processor to perform various processes and operations as described above. Examples of carriers include signals, computer readable media, etc.

[0202] The computer readable medium may be a computer readable signal medium or a computer readable storage medium. The computer readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or apparatuses, or any suitable combination of the foregoing. More specific examples of computer readable storage media include an electrical connection having one or more conductors, a portable computer floppy disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0203] In addition, although the operations are described in a specific order, this should not be understood as requiring the specific order or sequence shown to be performed, or performing all the operations shown, to obtain the desired result. In some cases, multitasking and parallel processing may be advantageous. Similarly, although several specific implementation details are included in the above discussion, these details should not be interpreted as limitations on the scope of the present disclosure, but can be interpreted as descriptions of features specific to a particular embodiment. Certain features described in the context of a separate embodiment may also be implemented in combination in a single embodiment. On the contrary, the various features described in the context of a single embodiment may also be implemented in multiple embodiments individually or in any suitable sub-combination.

[0204] Although the disclosure has been described in language specific to structural features and / or methodological acts, it should be understood that the disclosure defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

[0205] It should be fully understood that the use of personally identifiable information should be subject to privacy policies and practices generally recognized as meeting or exceeding industry or government requirements for maintaining user privacy. In particular, personally identifiable information data should be managed and processed to minimize the risk of inadvertent or unauthorized access or use, and the nature of authorized use should be clearly indicated to users.

Claims

1. A method for detecting abnormal behavior of a networked device, characterized in that: include: Construct a causal graph generation model and a weighted graph neural network prediction model; Inputting the multivariate time series data of the networked device into the causal graph generation model to obtain a causal graph and an adjacency matrix of the causal graph; wherein the multivariate time series data is related to the network behavior of the networked device; Inputting the adjacency matrix and the multivariate time series data into the weighted graph neural network prediction model to obtain an abnormal behavior prediction value; An abnormality score is calculated according to the abnormal behavior prediction value.

2. The method according to claim 1, characterized in that Inputting the multivariate time series data of the networked device into the causal graph generation model to obtain a causal graph, comprising: The cause-effect diagram is calculated using the following formula: in, Representing the causal graph, Including variables in the multivariate time series data To variable The transfer entropy of represents the probability density function; represents the variable i at time step t; Indicates the time step Based on time series The values ​​in the histogram encoding of , with a window size of ; Indicates the time step Based on time series The values ​​in the histogram encoding of , with a window size of .

3. The method according to claim 1 or 2, characterized in that Inputting the multivariate time series data of the networked device into the causal graph generation model to obtain an adjacency matrix of the causal graph includes: The adjacency matrix is ​​calculated using the following formula: in, represents the adjacency matrix; Representing time series To time series The transfer entropy of represents the control constant, The value of is obtained according to the sparsity preference.

4. The method according to claim 1, characterized in that The weighted graph neural network prediction model includes: a weighted graph convolution module, a temporal convolution module, a skip connection and an output module; Inputting the adjacency matrix and the multivariate time series data into the weighted graph neural network prediction model to obtain an abnormal behavior prediction value, including: Using the weighted graph convolution module to perform a linear transformation on the adjacency matrix and the multivariate time series data to obtain first data; Modeling the time characteristics of the first data using the time convolution module to obtain second data; Using the skip connection and output module to perform skip connection processing and channel dimension conversion processing on the second data to obtain third data; The third data is predicted and calculated using a preset linear layer to obtain the abnormal behavior prediction value.

5. The method according to claim 4, characterized in that Using the weighted graph convolution module to perform a linear transformation on the adjacency matrix and the multivariate time series data to obtain first data includes: calculating the first data using the following formula: in, Indicates that the sequence length is The first data, X represents the multivariate time series data, represents the adjacency matrix; is the rectified linear unit; represents the normalized adjacency matrix, , yes The diagonal matrix of is the normalized adjacency matrix added to the causal graph from floops; , Represents the weight matrix input to the first hidden layer; , represents the weight matrix from hidden layer to output; C represents the dimension of input features; H represents the dimension of hidden layer; F represents the sequence length.

6. The method according to claim 4 or 5, characterized in that The skip connection and output module are trained using the following formula: in, Indicates the loss function using mean square error MSE; represents the maximum observation time of the multivariate time series data; Indicates the window size; , Represents the single-step prediction results of all nodes; , Indicates a specific time step The observation data of all nodes under, N represents the number of nodes.

7. The method according to claim 1 or 2, characterized in that: Calculating an abnormality score according to the abnormal behavior prediction value includes: calculating the abnormality score using the following formula: in, Indicates the error value; represents the abnormal behavior prediction value, that is, the single-step prediction result of all nodes; Indicates a specific time step Observation data of all nodes; represents the anomaly score; Representing time series The median of the error values; Representing time series The median absolute deviation of , Represents the median function; Indicates time The collective anomaly score of Represents an aggregate function; represents the abnormality score; Indicates the anomaly threshold.

8. The method according to claim 1 or 2, characterized in that: Also includes: Constructing a group-level graph model enhanced with topological patterns; After obtaining the causal graph, the method further includes: inputting the causal graph and the multivariate time series data into the topological pattern enhanced group-level graph model to obtain embedded data; Inputting the adjacency matrix and the multivariate time series data into the weighted graph neural network prediction model to obtain an abnormal behavior prediction value further includes: inputting the embedded data, the adjacency matrix and the multivariate time series data into the weighted graph neural network prediction model to obtain the abnormal behavior prediction value.

9. The method according to claim 8, characterized in that The topology pattern enhanced group-level graph model includes: a multi-hop graph autoencoder, a candidate group sampling module, and a topology pattern-based graph contrast learning model, wherein the topology pattern-based graph contrast learning model includes a graph neural network model; Inputting the causal graph and the multivariate time series data into the topological pattern enhanced group-level graph model to obtain embedded data, including: locating anchor nodes from the causal graph and the multivariate time series data using the multi-hop graph autoencoder; wherein the anchor nodes are related to potential abnormal behaviors of the networked devices; Using the candidate group sampling module to perform group sampling processing on the anchor nodes to obtain a candidate group; Performing topological enhancement processing on the candidate group using the graph contrast learning model based on topological patterns to obtain a positive view and a negative view; The front view and the negative view are input into the graph neural network model to obtain the embedded data; wherein the topology enhancement processing includes pattern-preserving enhancement PPA and pattern-breaking enhancement PBA.

10. The method according to claim 9, characterized in that The graph contrast learning model based on topological patterns is trained using the following formula: in, represents the contrast loss function; Represents a learnable model; represents a trainable estimator; represents the number of candidate groups; represents the front view; Represents the negative view.

11. An abnormal behavior detection device for a networked device, characterized in that: The apparatus comprises means for performing the method of any one of claims 1-10.

12. A computing device, characterized in that: include: at least one processor; as well as At least one memory storing instructions thereon, which, when executed individually or collectively by the at least one processor, cause the computing device to perform the method according to any one of claims 1 to 10.

13. A non-transitory computer-readable storage medium storing machine-executable instructions, characterized in that: When the machine executable instructions are executed individually or collectively by one or more processors of the machine, the machine is caused to perform the method of any one of claims 1 to 10.

14. A computer program product comprising machine executable instructions, characterized in that When the machine executable instructions are executed individually or collectively by one or more processors of the machine, the machine is caused to perform the method of any one of claims 1 to 10.

15. A chip system, characterized in that: Comprising a circuit system configured to perform the method of any one of claims 1-10.

Images