Data similarity query method and device integrating contrastive learning and graph neural network

Abstract

The present application discloses a data similarity query method and device for integrating contrastive learning with graph neural network, which relates to the field of artificial intelligence technology. The method maps requests to request nodes to construct a request graph. The graph attention network model is selected as the initial model. For each request node, positive sample nodes and negative sample nodes are sampled to construct a triplet, a contrastive learning task is established, and the graph attention network model is trained. Based on the embedded representation output by the graph attention network model, a request node anomaly judgment method is constructed to calculate the anomaly score of the request node. When the anomaly score is greater than the anomaly threshold, the request node is marked as an abnormal request. The embedded representation of the request node is used as a data point to construct an M-layer nearest neighbor index. According to the real-time abnormal request sent by the user, K candidate abnormal requests are searched and sorted based on the M-layer nearest neighbor index to obtain K similar abnormal requests, thereby realizing anomaly detection based on data similarity.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a data similarity query method and device that integrates contrastive learning and graph neural networks. Background Art

[0002] Data similarity query is an important technology for finding data similar to or related to the query object in a large-scale data set. Data similarity query plays an important role in information security, financial risk prevention and control, etc. For example, by identifying similar abnormal requests, potential security threats such as DDoS attacks and brute force cracking can be discovered in a timely manner. For example, in the financial and e-commerce fields, finding similar abnormal requests can prevent fraud, fake orders, and wool-pulling and other risky behaviors.

[0003] Traditional anomaly detection methods mainly rely on pre-defined rules or thresholds, which are difficult to cope with complex and changeable request patterns, and lack research on anomaly detection based on the similarity between request data. Summary of the invention

[0004] The present application aims to solve at least one of the technical problems in the related art to a certain extent. To this end, one purpose of the present application is to propose a data similarity query method and device that integrates contrastive learning and graph neural network to improve the accuracy of anomaly detection.

[0005] One aspect of the present application provides a data similarity query method integrating contrastive learning and graph neural network, including:

[0006] Step S100: Obtain request parameters and request result data, map the request to a request node, build a request graph, and when a new request arrives, insert it into the request graph to form a new request node and edge;

[0007] Step S200: Select the graph attention network model as the initial model, sample positive sample nodes and negative sample nodes for each request node, construct triples, establish a comparative learning task, and train the graph attention network model;

[0008] Step S300: Based on the embedded representation output by the graph attention network model, a request node anomaly judgment method is constructed to calculate the anomaly score of the request node. When the anomaly score is greater than the anomaly threshold, the request node is marked as an abnormal request.

[0009] Step S400: using the embedded representation of the request node as a data point, using the HNSW algorithm to construct an M-layer nearest neighbor index, and inserting the new request node detected in the request graph into the M-layer nearest neighbor index;

[0010] Step S500: According to the real-time abnormal request sent by the user, K candidate abnormal requests are searched and sorted based on the M-layer nearest neighbor index to obtain K sorted similar abnormal requests to be processed;

[0011] The specific method of obtaining request parameters and request result data, mapping the request to a request node, building a request graph, and inserting a new request into the request graph to form a new request node and edge is as follows:

[0012] Step S110: Obtain request parameters and request result data, construct a request graph, map each request to a request node in the request graph, and the feature vector of the request node is composed of key attributes of the request. There are a key attributes in total. The feature vector of request node i is expressed as: , where T is the transpose symbol of the matrix, is the ath key attribute of the request node i, and the feature vector of the request node includes but is not limited to: request parameters, characteristics of request results, number of request occurrences, and number of abnormal annotations;

[0013] Step S120: Calculate the similarity between request node i and request node j ;

[0014] Step S130: Preset a similarity threshold, determine whether there is an edge connection between the request node i and the request node j, if the similarity between the request node i and the request node j is greater than or equal to the similarity threshold, then establish an edge between the two request nodes, and the weight of the edge is the similarity of the two request nodes;

[0015] Step S140: Dynamically update the adjacency matrix of the requested graph, where the elements in the adjacency matrix represents the weight of the edge between request node i and request node j. If request node i and request node j are not adjacent, then ;

[0016] Step S150: when a new request arrives, convert it into a request node in real time and insert it into the request graph, calculate the similarity between the request node and the existing request nodes, and establish a new edge connection;

[0017] The specific method of selecting the graph attention network model as the initial model, sampling positive sample nodes and negative sample nodes for each request node, constructing triples, establishing a comparative learning task, and training the graph attention network model is as follows:

[0018] Step S210: Selecting a graph attention network model as an initial model for learning an embedding representation of a request node, using a feature vector and an adjacency matrix of the request node as input data of the graph attention network model, and using the embedding representation of the request node as output data;

[0019] Step S220: For each requesting node, randomly sample positive sample nodes from its neighboring nodes , randomly sample Ka negative sample nodes from the entire request graph , construct triples based on request nodes, positive sample nodes, and negative sample nodes;

[0020] Step S230: Based on the triples, a comparative learning task is established between the embedding representation of the positive sample node and the embedding representation of the negative sample node to obtain the loss function of the graph attention network model;

[0021] The loss function of the graph attention network model is constructed by calculating the loss function of the request node i and the positive sample node , calculate the negative sample similarity between the embedding representation of the request node i and the embedding representation of the negative sample node, compare the positive sample similarity with the sum of all negative sample similarities as the loss of the request node i, and take the average of the losses of all request nodes as the loss function for training the graph attention network model ;

[0022] Step S240: training the graph attention network model so that the value of the loss function is minimized. When the loss function converges, the training of the graph attention network model is completed.

[0023] The specific method of constructing a request node abnormality judgment method based on the output embedding representation of the graph attention network model, calculating the abnormality score of the request node, and marking the request node as an abnormal request when the abnormality score is greater than the abnormality threshold is as follows:

[0024] Step S310: Use the trained graph attention network model to output the embedding representation of the current request node and calculate the embedding relationship between the request node i and each neighbor node The Euclidean distance between , and calculate the average Euclidean distance between the request node i and all neighbor nodes , calculate the ratio of the sum of the Euclidean distances between the requesting node i and its NJ neighboring nodes to the sum of the Euclidean distances between all requesting nodes;

[0025] Step S320: Calculate the average Euclidean distance between the requesting node i and all neighboring nodes Relative to the average Euclidean distance between all request nodes the degree of deviation;

[0026] Step S330: Calculate the number of requests made by requesting node i The average number of requests relative to all request nodes The first degree of deviation , calculate the number of abnormal annotations of request node i The average number of anomaly annotations relative to all request nodes The second degree of deviation ;

[0027] Step S340: perform a weighted summation of the result of multiplying the proportion and the deviation degree with the first deviation degree and the second deviation degree to obtain the abnormal score of the embedded representation of the request node i ;

[0028] Step S350: The abnormal threshold includes a regular threshold and adaptive threshold , the graph attention network model periodically outputs the embedding representations of all request nodes in the request graph. When the distribution of the embedding representations of the request nodes does not change significantly, a conventional threshold is used With anomaly score When the distribution of the embedding representation of the request node changes significantly, an adaptive threshold is used to compare With anomaly score Compare and determine whether the request node is abnormal; wherein the distribution of the embedding representation of the request node has not changed significantly specifically refers to: calculating the mean of the embedding representation of all current request nodes and historical embedding represents the mean The mean shift between , when the mean shift is less than or equal to a1, it is determined that the distribution of the embedded representation of the request node has not changed significantly; the distribution of the embedded representation of the request node has changed significantly means that when the mean shift is greater than a1, the distribution of the embedded representation of the request node has changed significantly; the method for determining whether the request node is abnormal is: when the anomaly score is greater than the conventional threshold or the adaptive threshold, the request node is an abnormal request, otherwise, it is a normal request;

[0029] The calculation method of the conventional threshold is:

[0030] According to the historical request parameters and request result data of all request nodes in the recent T1 duration, the embedded representation of the historical T1 duration is output based on the graph neural network model to calculate the historical anomaly score , based on the historical anomaly scores of all request nodes, the mean historical anomaly score is obtained and the historical anomaly score standard deviation , the weighted sum of the two is used to obtain the conventional threshold ;

[0031] The calculation method of the adaptive threshold is:

[0032] Get the current timestamp t0 and the calculation timestamp of the previous historical anomaly score of the request node i , calculate the time decay weight of the historical anomaly score , based on the time-decay weight Take a weighted average of the historical anomaly scores to get a weighted average anomaly score , calculate the adaptive threshold ;

[0033] The specific method of using the embedded representation of the request node as a data point, using the HNSW algorithm to construct an M-layer nearest neighbor index, and inserting the new request node detected in the request graph into the M-layer nearest neighbor index is:

[0034] Step S410: The embedded representation of the request node is used as a data point, and the M-layer nearest neighbor index is constructed using the HNSW algorithm. When a new request node is detected to be inserted into the request graph, the embedded representation of the request node is added to the M-layer nearest neighbor index;

[0035] The method for constructing the M-layer nearest neighbor index is:

[0036] Step S411: randomly select a data point as an entry point, where the entry point is the first data point of the bottom layer graph;

[0037] Step S412: for each data point P to be inserted, starting from the bottom layer of the graph, find the data point with the closest Euclidean distance to the data point P as the entry point of the current layer L1, then search in the current layer to find the Kp data points with the closest Euclidean distance to the data point P as the nearest neighbor data points of the data point P; from the Kp nearest neighbor data points found, select the W data points with the closest Euclidean distance to the data point P, select a data point closest to the data point P from the nearest W data points as the new entry point of the current layer L1, then repeat step S412 in the next layer until the highest layer of the graph is reached;

[0038] Step S413: In each layer, a similarity connection is established between the data point P and the W nearest neighboring data points found. The similarity connection refers to calculating the Euclidean distance between the data points. When the Euclidean distance is greater than or equal to the similarity threshold, a similarity connection is established between the two data points.

[0039] Step S414: When the number of data points in the current layer reaches , a new upper layer graph is created based on the current layer, and the k-means clustering algorithm is used to select The centers of the clusters are used as the data points to be inserted into the new upper graph;

[0040] Step S415: Repeat steps S412 to S414 until all data points are inserted, and obtain an M-layer nearest neighbor index;

[0041] The specific method of inserting the new request node detected in the request graph into the M-layer nearest neighbor index is as follows: when adding the embedded representation of the new request node as a new data point into the M-layer nearest neighbor index, starting from the bottom layer, searching in each layer of the graph layer by layer, for each layer, finding the nearest neighbor data point of the new data point, and connecting the new data point to the nearest neighbor data point;

[0042] The specific method of searching and sorting K candidate abnormal requests based on the M-layer nearest neighbor index according to the real-time abnormal request sent by the user to obtain K sorted similar abnormal requests to be processed is:

[0043] Step S510: extracting a feature vector based on the real-time abnormal request input by the user, taking the feature vector of the real-time abnormal request as input data, using the graph attention network model to output an embedded representation of the real-time abnormal request, calculating the abnormal score of the real-time abnormal request, and judging the real-time abnormal request as an abnormal request based on the request node abnormality judgment method;

[0044] Step S520: using the embedded representation of the real-time abnormal request as the abnormal data point, searching in the M-layer nearest neighbor index to find the K data points most similar to the abnormal data point as candidate abnormal requests;

[0045] Step S530: Sort the abnormal data points and the K candidate abnormal requests from small to large according to the Euclidean distance between them, obtain K sorted similar abnormal requests and automatically annotate them with abnormal labels.

[0046] One aspect of the present application provides a data similarity query device integrating contrastive learning and graph neural network, comprising:

[0047] The request data acquisition module is used to obtain request parameters and request result data, map the request to a request node, and build a request graph. When a new request arrives, it is inserted into the request graph to form a new request node and edge.

[0048] The network model training module is used to select the graph attention network model as the initial model, sample positive sample nodes and negative sample nodes for each request node, construct triples, establish contrastive learning tasks, and train the graph attention network model;

[0049] The abnormal request judgment module is used to construct a request node abnormality judgment method based on the output embedding representation of the graph attention network model, calculate the abnormal score of the request node, and mark the request node as an abnormal request when the abnormal score is greater than the abnormal threshold;

[0050] The nearest neighbor index building module is used to use the embedding representation of the request node as a data point, build an M-layer nearest neighbor index using the HNSW algorithm, and insert the new request node detected in the request graph into the M-layer nearest neighbor index;

[0051] The similar anomaly search module is used to search for and sort K candidate anomaly requests based on the M-layer nearest neighbor index according to the real-time anomaly request sent by the user, and obtain K sorted similar anomaly requests to be processed.

[0052] One aspect of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps in the data similarity query method integrating contrastive learning and graph neural network are implemented.

[0053] One aspect of the present application provides a readable storage medium storing a computer program suitable for loading by a processor to execute the steps in a data similarity query method that integrates contrastive learning and graph neural network.

[0054] Compared with the prior art, the data similarity query method and device for integrating contrastive learning and graph neural network proposed in this application have the following advantages:

[0055] Traditional anomaly detection methods mainly rely on predefined rules or thresholds, which are difficult to cope with complex and changing request patterns. However, this application constructs a request graph and uses a graph attention network model to learn the embedded representation of request nodes, which can automatically capture the correlation and similarity between requests and calculate the anomaly score based on the embedded representation. This method can adaptively detect unknown abnormal patterns and significantly improve the recall rate and accuracy of anomaly detection.

[0056] The calculation of anomaly scores makes full use of the embedded representation of requests and can capture more complex and hidden anomaly patterns. The setting of adaptive thresholds avoids the problem of difficult threshold determination in traditional methods, making the detection method adaptable to the dynamic changes of request flows.

[0057] Performing similarity search among massive request parameters and request results is a very time-consuming operation. This application uses the HNSW algorithm to construct a multi-level nearest neighbor index, which can find the K requests most similar to the abnormal request in sub-linear time. This greatly accelerates the retrieval efficiency of similar abnormal requests and shortens the response time of abnormal handling.

[0058] The nearest neighbor index organically combines anomaly detection with similar request retrieval. When an abnormal request is found, similar historical abnormal requests can be quickly found, and the system automatically locates and annotates the anomaly. The multi-level index design can achieve sublinear retrieval time complexity in massive requests. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 A method flow chart of a data similarity query method that integrates contrastive learning and graph neural network provided in this application;

[0060] Figure 2 A flowchart of the request node abnormality judgment method provided by this application;

[0061] Figure 3 A flowchart of a method for obtaining similar abnormal requests provided by this application;

[0062] Figure 4 Functional module diagram of the data similarity query device that integrates contrastive learning and graph neural network provided in this application. DETAILED DESCRIPTION

[0063] In order to better understand the present application, various aspects of the present application will be described in more detail with reference to the accompanying drawings. It should be understood that these detailed descriptions are only descriptions of exemplary embodiments of the present application and do not limit the scope of the present application in any way. Throughout the specification, the same reference numerals refer to the same elements. The expression "and / or" includes any and all combinations of one or more of the associated listed items.

[0064] In the accompanying drawings, the size, dimensions and shapes of the elements have been slightly adjusted for ease of illustration. The drawings are for illustration only and are not strictly drawn to scale. As used herein, the terms "substantially", "approximately" and similar terms are used as terms of approximation, not as terms of degree, and are intended to illustrate the inherent deviations in measurements or calculations that will be recognized by those of ordinary skill in the art. In addition, in this application, the order in which the steps are described does not necessarily represent the order in which these processes occur in actual operation, unless otherwise specified or can be derived from the context.

[0065] It should also be understood that expressions such as "including", "comprising", "having", "containing" and / or "comprising" are open rather than closed expressions in this specification, which indicate the presence of the stated features, elements and / or components, but do not exclude the presence of one or more other features, elements, components and / or combinations thereof. In addition, when expressions such as "at least one of..." appear after a list of listed features, they modify the entire list of features rather than just the individual elements in the list. In addition, when describing embodiments of the present application, "may" is used to mean "one or more embodiments of the present application". And, the term "exemplary" is intended to refer to an example or illustration.

[0066] Unless otherwise defined, all words (including engineering terms and scientific and technological terms) used in this article have the same meaning as those commonly understood by ordinary technicians in the field to which this application belongs. It should also be understood that unless there is a clear explanation in this application, words defined in commonly used dictionaries should be interpreted as having the same meaning as their meaning in the context of the relevant technology, and should not be interpreted in an idealized or overly formal sense.

[0067] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0068] Example 1

[0069] like Figure 1 As shown, the data similarity query method of fusion contrast learning and graph neural network provided in this application includes:

[0070] Step S100: Obtain request parameters and request result data, map the request to a request node, build a request graph, and when a new request arrives, insert it into the request graph to form a new request node and edge;

[0071] The specific method of obtaining request parameters and request result data, mapping the request to a request node, building a request graph, and inserting a new request into the request graph to form a new request node and edge is as follows:

[0072] Step S110: Obtain request parameters and request result data, construct a request graph, map each request to a request node in the request graph, and the feature vector of the request node is composed of key attributes of the request. There are a key attributes in total. The feature vector of request node i is expressed as: , where T is the transpose symbol of the matrix, is the ath key attribute of the request node i, and the feature vector of the request node includes but is not limited to: request parameters, characteristics of request results, number of request occurrences, and number of abnormal annotations;

[0073] The number of abnormal markings refers to the number of times a request is marked as abnormal after being identified as an abnormal request;

[0074] Step S120: Calculate the similarity between request node i and request node j ;

[0075] The calculation formula of the similarity between the requesting node i and the requesting node j is: ,in, represents the feature vector of the request node i, represents the feature vector of the request node j;

[0076] Step S130: Preset a similarity threshold, determine whether there is an edge connection between the request node i and the request node j, if the similarity between the request node i and the request node j is greater than or equal to the similarity threshold, then establish an edge between the two request nodes, and the weight of the edge is the similarity of the two request nodes;

[0077] Step S140: Dynamically update the adjacency matrix of the requested graph, where the elements in the adjacency matrix represents the weight of the edge between request node i and request node j. If request node i and request node j are not adjacent, then ;

[0078] Step S150: when a new request arrives, convert it into a request node in real time and insert it into the request graph, calculate the similarity between the request node and the existing request nodes, and establish a new edge connection;

[0079] This step converts the request stream into graph structure data, where each request corresponds to a node and the similarity between requests corresponds to the weight of the edge. This graph representation can fully describe the complex relationship between requests and provide rich structural information for anomaly detection.

[0080] Step S200: Select the graph attention network model as the initial model, sample positive sample nodes and negative sample nodes for each request node, construct triples, establish a comparative learning task, and train the graph attention network model;

[0081] The specific method of selecting the graph attention network model as the initial model, sampling positive sample nodes and negative sample nodes for each request node, constructing triples, establishing a comparative learning task, and training the graph attention network model is as follows:

[0082] Step S210: Selecting a graph attention network model as an initial model for learning an embedding representation of a request node, using a feature vector and an adjacency matrix of the request node as input data of the graph attention network model, and using the embedding representation of the request node as output data;

[0083] Step S220: For each requesting node, randomly sample positive sample nodes from its neighboring nodes , randomly sample Ka negative sample nodes from the entire request graph , construct triples based on request nodes, positive sample nodes, and negative sample nodes;

[0084] The core of this step is to construct the triple data required for training the graph attention network model. A node is uniformly randomly sampled from the neighbor nodes of the request node as a positive sample node. The neighbor node is connected to the request node i and is semantically similar. Ka non-neighbor nodes are uniformly randomly sampled from the entire request graph as negative sample nodes. These nodes are not connected to the request node i in the request graph and are not semantically similar.

[0085] Ka is a hyperparameter, which indicates the number of negative samples sampled by each request node. It is set by technicians in this field based on experience. The larger the value of Ka is, the more training samples are generated and the longer the optimization time is, but it is conducive to learning a more stable embedding representation.

[0086] Step S230: Based on the triples, a comparative learning task is established between the embedding representation of the positive sample node and the embedding representation of the negative sample node to obtain the loss function of the graph attention network model;

[0087] The loss function of the graph attention network model is constructed by calculating the loss function of the request node i and the positive sample node , calculate the negative sample similarity between the embedding representation of the request node i and the embedding representation of the negative sample node, compare the positive sample similarity with the sum of all negative sample similarities as the loss of the request node i, and take the average of the losses of all request nodes as the loss function for training the graph attention network model ;

[0088] The functional expression of the loss function is: ,in, represents the embedding representation of the requested node i, represents the embedding representation of the positive sample node obtained by randomly sampling the request node i, represents the cosine similarity, represents the temperature parameter, represents the embedded representation of the negative sample node randomly sampled from the entire request graph, Ka represents the number of negative sample nodes, k represents the variable of the current negative sample node index, k∈{1,2,...,Ka};

[0089] For a triplet, the goal to be optimized is to make the embedding representation of the requested node i as similar as possible to the positive sample node, and as dissimilar as possible to the embedding representation of the negative sample node.

[0090] The temperature parameter is a parameter used to adjust the similarity distribution in contrastive learning and is set by those skilled in the art based on experience;

[0091] Step S240: training the graph attention network model so that the value of the loss function is minimized. When the loss function converges, the training of the graph attention network model is completed.

[0092] The training method of the graph attention network model is:

[0093] Define a feedforward neural network as the main architecture of the graph attention network model;

[0094] Use the back propagation algorithm and Adam optimizer to train the parameters of the feedforward neural network with the loss function as the optimization target until the loss function converges;

[0095] Generate a batch of triplets and input them into the feedforward neural network for training. During the training process, monitor the loss function value. When the value change of Nd consecutive loss functions is less than the change threshold dloss, it is considered that the feedforward neural network has converged and the training is completed to obtain the graph attention network model. The change threshold is set by technicians in this field based on experience.

[0096] The graph attention network model includes an input layer, an output layer, an attention layer, an activation function, and an aggregation function. Different importance weights are assigned to different neighbor nodes through the attention mechanism, and neighbor information is aggregated to update the embedding representation of the request node.

[0097] The formula for embedding the request node is: ,in, is the embedding representation of the request node i in the l+1th layer, is the set of neighbor nodes of the requesting node i, is the requesting node i and its neighboring nodes The attention weights between is the parameter matrix of the lth layer, is the activation function, is the neighbor node in layer l The embedding representation of , l is the number of layers in the graph attention network model;

[0098] The requesting node i and the neighboring node The calculation formula of the attention weight between is: ,in, is an exponential function, for Activation function, || is the concatenation operation of vectors, represents the attention parameter vector in layer l The transpose of

[0099] The neighbor node is the neighbor node of the requesting node i.

[0100] In this step, the graph attention network is used to learn the embedding representation of request nodes on the request graph, and the local structural information is adaptively aggregated through the attention mechanism. At the same time, a contrastive learning task is introduced to optimize the embedding representation based on positive and negative samples, so that it can distinguish similar requests from abnormal requests.

[0101] Step S300: Based on the embedded representation output by the graph attention network model, a request node anomaly judgment method is constructed to calculate the anomaly score of the request node. When the anomaly score is greater than the anomaly threshold, the request node is marked as an abnormal request.

[0102] The specific method of constructing a request node abnormality judgment method based on the output embedding representation of the graph attention network model, calculating the abnormality score of the request node, and marking the request node as an abnormal request when the abnormality score is greater than the abnormality threshold is as follows:

[0103] Step S310: Use the trained graph attention network model to output the embedding representation of the current request node and calculate the embedding relationship between the request node i and each neighbor node The Euclidean distance between , and calculate the average Euclidean distance between the request node i and all neighbor nodes , calculate the ratio of the sum of the Euclidean distances between the requesting node i and its NJ neighboring nodes to the sum of the Euclidean distances between all requesting nodes;

[0104] The requesting node i and each neighboring node The Euclidean distance between The calculation formula is: ,in, Neighbor node Embedded representation of ;

[0105] The neighbor node The embedding representation is output through the trained graph attention network model;

[0106] Step S320: Calculate the average Euclidean distance between the requesting node i and all neighboring nodes Relative to the average Euclidean distance between all request nodes the degree of deviation;

[0107] Step S330: Calculate the number of requests made by requesting node i The average number of requests relative to all request nodes The first degree of deviation , calculate the number of abnormal annotations of request node i The average number of anomaly annotations relative to all request nodes The second degree of deviation ;

[0108] The calculation formula of the first deviation degree is: ;

[0109] The calculation formula for the mean number of request occurrences of all request nodes is: , where N is the total number of requesting nodes;

[0110] The calculation formula of the second deviation degree is: ;

[0111] The calculation formula for the average number of abnormal annotation times of all request nodes is: ;

[0112] Step S340: perform a weighted summation of the result of multiplying the proportion and the deviation degree with the first deviation degree and the second deviation degree to obtain the abnormal score of the embedded representation of the request node i ;

[0113] The calculation formula of the anomaly score of the embedding representation of the request node i is: , where NJ is the number of neighbor nodes of the requesting node i, Na is the total number of requests, is a hyperparameter that controls the rate of Euclidean distance decay, is a hyperparameter that controls the steepness of the anomaly score. , , They are weight coefficients of the impact of three dimensions, namely, balance graph structure abnormality, request frequency, and system attention, on abnormality, and are adjusted by technicians in this field according to actual needs;

[0114] in, is the ratio of the sum of the Euclidean distances between the requesting node i and its NJ neighboring nodes to the sum of the Euclidean distances between all requesting nodes, is the average Euclidean distance between the requesting node i and all neighboring nodes Relative to the average Euclidean distance between all request nodes the degree of deviation;

[0115] The values ​​of the hyperparameters for controlling the Euclidean distance decay rate and the hyperparameters for controlling the steepness of the anomaly score are set by those skilled in the art according to actual needs and experience;

[0116] γ>0, the larger γ is, the smaller the impact of long-distance requests is.

[0117] β>0. The larger β is, the more sensitive the anomaly score is to the degree of deviation.

[0118] Step S350: The abnormal threshold includes a regular threshold and adaptive threshold , the graph attention network model periodically outputs the embedding representations of all request nodes in the request graph. When the distribution of the embedding representations of the request nodes does not change significantly, a conventional threshold is used With anomaly score When the distribution of the embedding representation of the request node changes significantly, an adaptive threshold is used to compare With anomaly score Compare and determine whether the request node is abnormal; wherein the distribution of the embedding representation of the request node has not changed significantly specifically refers to: calculating the mean of the embedding representation of all current request nodes and historical embedding represents the mean The mean shift between , when the mean shift is less than or equal to a1, it is determined that the distribution of the embedded representation of the request node has not changed significantly; the distribution of the embedded representation of the request node has changed significantly means that when the mean shift is greater than a1, the distribution of the embedded representation of the request node has changed significantly; the method for determining whether the request node is abnormal is: when the anomaly score is greater than the conventional threshold or the adaptive threshold, the request node is an abnormal request, otherwise, it is a normal request;

[0119] The calculation formula of the mean shift is: ,in, is the mold length;

[0120] Preferably, the value of a1 is 1.2;

[0121] The calculation method of the conventional threshold is:

[0122] Step S351: Based on the historical request parameters and request result data of all request nodes in the recent T1 duration, the embedded representation of the historical T1 duration is output based on the graph neural network model to calculate the historical anomaly score , based on the historical anomaly scores of all request nodes, the mean historical anomaly score is obtained and the historical anomaly score standard deviation , the weighted sum of the two is used to obtain the conventional threshold;

[0123] The calculation formula of the conventional threshold is: ,in, is the weight coefficient for controlling the threshold;

[0124] The weight coefficient of the control threshold is determined by those skilled in the art based on experience;

[0125] The calculation formula of the historical anomaly score mean is: ;

[0126] The calculation formula of the historical anomaly score standard deviation is: ;

[0127] The calculation method of the adaptive threshold is:

[0128] Step S352: Obtain the current timestamp t0 and the calculation timestamp of the previous historical anomaly score of the requesting node i , calculate the time decay weight of the historical anomaly score , based on the time-decay weight Take a weighted average of the historical anomaly scores to get a weighted average anomaly score , calculate the adaptive threshold ;

[0129] The calculation formula of the time decay weight is: ,in, is a hyperparameter that controls the decay rate;

[0130] The value of the hyperparameter controlling the decay rate is set by those skilled in the art according to actual needs and experience;

[0131] The calculation formula of the weighted average anomaly score is: ;

[0132] The calculation formula of the adaptive threshold is: ,in, Tune hyperparameters for adaptiveness;

[0133] The values ​​of the adaptively adjusted hyperparameters are set by those skilled in the art according to actual needs;

[0134] Figure 2 A flowchart of the request node abnormality judgment method provided by this application;

[0135] This step uses the request embedding representation to design a calculation method for the anomaly score, which comprehensively considers the distance between the request and its neighbors and the degree of deviation relative to the entire request graph. At the same time, according to the distribution changes of the request embedding representation, the anomaly threshold is adaptively adjusted to improve the robustness of detection.

[0136] Step S400: using the embedded representation of the request node as a data point, using the HNSW algorithm to construct an M-layer nearest neighbor index, and inserting the new request node detected in the request graph into the M-layer nearest neighbor index;

[0137] The specific method of using the embedded representation of the request node as a data point, using the HNSW algorithm to construct an M-layer nearest neighbor index, and inserting the new request node detected in the request graph into the M-layer nearest neighbor index is:

[0138] Step S410: The embedded representation of the request node is used as a data point, and the M-layer nearest neighbor index is constructed using the HNSW algorithm. When a new request node is detected to be inserted into the request graph, the embedded representation of the request node is added to the M-layer nearest neighbor index;

[0139] The method for constructing the M-layer nearest neighbor index is:

[0140] Step S411: randomly select a data point as an entry point, where the entry point is the first data point of the bottom layer graph;

[0141] Step S412: for each data point P to be inserted, starting from the bottom layer of the graph, find the data point with the closest Euclidean distance to the data point P as the entry point of the current layer L1, then search in the current layer to find the Kp data points with the closest Euclidean distance to the data point P as the nearest neighbor data points of the data point P; from the Kp nearest neighbor data points found, select the W data points with the closest Euclidean distance to the data point P, select a data point closest to the data point P from the nearest W data points as the new entry point of the current layer L1, then repeat step S412 in the next layer until the highest layer of the graph is reached;

[0142] W and Kp are preset data points, which are set by those skilled in the art based on experience, and W is less than or equal to Kp;

[0143] The core idea of ​​the HNSW algorithm is to maintain an M-layer nearest neighbor index. Each layer is a cluster of the original data, and the clustering granularity gradually decreases from top to bottom. When querying, start from the highest layer, refine layer by layer, quickly lock the target area, and finally find the accurate nearest neighbor at the bottom layer. The process of inserting a new node is as follows:

[0144] Step (1): Starting from the entry point at the bottom layer, use the greedy algorithm to search for the nearest neighbor at the bottom layer. The greedy algorithm search strategy is: find the node closest to the new node in the bottom layer L1 as the current search position, and then select the Kp nodes closest to the new node from the nodes that have not been visited and are directly connected to the current position, and add them to the nearest neighbor candidate pool. Continue to iterate until there are no new nodes to add to the nearest neighbor candidate pool;

[0145] Step (2): Select W nodes closest to the new node from the nearest neighbor candidate pool and establish bidirectional edges with the new node, where W is an adjustable parameter;

[0146] Step (3): From the W nearest neighbor nodes selected from the L1 layer, select the one closest to the new node as the entry point of the L2 layer, and repeat steps (1) and (2) until the highest layer. In this way, W nearest neighbor edges are established for the new node in each layer.

[0147] In the HNSW algorithm, each new node selects at most one node in each layer as the entrance to the next layer, but since connections are established with W nodes, in fact each new node has W upper-level nodes connected to it in each layer, thereby achieving fast search.

[0148] Step S413: In each layer, a similarity connection is established between the data point P and the W nearest neighboring data points found. The similarity connection refers to calculating the Euclidean distance between the data points. When the Euclidean distance is greater than or equal to the similarity threshold, a similarity connection is established between the two data points.

[0149] Step S414: When the number of data points in the current layer reaches , a new upper layer graph is created based on the current layer, and the k-means clustering algorithm is used to select The centers of the clusters are used as the data points to be inserted into the new upper graph;

[0150] Said is the data point threshold, which is set by those skilled in the art based on experience;

[0151] Step S415: Repeat steps S412 to S414 until all data points are inserted, and obtain an M-layer nearest neighbor index;

[0152] The specific method of inserting the new request node detected in the request graph into the M-layer nearest neighbor index is as follows: when adding the embedded representation of the new request node as a new data point into the M-layer nearest neighbor index, starting from the bottom layer, searching in each layer of the graph layer by layer, for each layer, finding the nearest neighbor data point of the new data point, and connecting the new data point to the nearest neighbor data point;

[0153] Since the incremental update caused by inserting new data points will cause the quality of the M-layer nearest neighbor index to deteriorate, it is necessary to regularly evaluate the recall rate and computational overhead of the M-layer nearest neighbor index. When the recall rate drops to the recall threshold, the full reconstruction of the M-layer nearest neighbor index is triggered. The selection of the recall threshold is dynamically adjusted according to actual needs.

[0154] The M-layer nearest neighbor index is an M-layer graph structure. Each layer of the graph is an approximation of a Kp nearest neighbor graph. In the Kp nearest neighbor graph, each data point is connected to its Kp nearest neighbor data points. The upper-layer graph can be regarded as the clustering result of the lower-layer graph. Each data point in the upper-layer graph represents the clustering center of some data points in the lower-layer graph. The edges of the upper-layer graph reflect the similarities between these clusters. When searching, the target area is first quickly located in the upper-layer graph, and then refined layer by layer, and finally the nearest neighbors are found in the data points at the bottom layer.

[0155] In this step, the request embedding representation is used as a data point, and the HNSW algorithm is used to build a multi-level nearest neighbor index. When a new request node is inserted, the index is dynamically updated to ensure the real-time retrieval.

[0156] Step S500: According to the real-time abnormal request sent by the user, K candidate abnormal requests are searched and sorted based on the M-layer nearest neighbor index to obtain K sorted similar abnormal requests to be processed;

[0157] The specific method of searching and sorting K candidate abnormal requests based on the M-layer nearest neighbor index according to the real-time abnormal request sent by the user to obtain K sorted similar abnormal requests to be processed is:

[0158] Step S510: extracting a feature vector based on the real-time abnormal request input by the user, taking the feature vector of the real-time abnormal request as input data, using the graph attention network model to output an embedded representation of the real-time abnormal request, calculating the abnormal score of the real-time abnormal request, and judging the real-time abnormal request as an abnormal request based on the request node abnormality judgment method;

[0159] Step S520: using the embedded representation of the real-time abnormal request as the abnormal data point, searching in the M-layer nearest neighbor index to find the K data points most similar to the abnormal data point as candidate abnormal requests;

[0160] Step S530: Sort the abnormal data points and the K candidate abnormal requests in ascending order according to the Euclidean distance between them, obtain K sorted similar abnormal requests and automatically annotate them with abnormal labels;

[0161] The specific method of obtaining K sorted similar abnormal requests and automatically marking abnormal labels is: automatically marking abnormal labels on the K sorted similar abnormal requests in order;

[0162] Optionally, the number of request occurrences and the number of abnormal annotations of similar abnormal requests are comprehensively considered, and higher priority is given to abnormal requests that occur frequently and are frequently annotated;

[0163] Optionally, feedback on the automatic annotated abnormal labels is collected, including but not limited to whether the annotation is correct and the user's abnormal request feedback, which is used to evaluate the query and annotation effect of similar abnormal requests. Based on the feedback, relevant indicators of the annotation of similar abnormal requests are regularly counted, and the relevant indicators include accuracy and recall rate. The relevant indicators are fed back to step S340, and the weight coefficient is dynamically adjusted to optimize the entire abnormal request detection and annotation process;

[0164] Figure 3 A flowchart of a method for obtaining similar abnormal requests provided by this application;

[0165] In this step, the embedded representation of the real-time exception request is used as the query point, and a similarity search is performed in the nearest neighbor index to obtain K similar exception requests, which are sorted by similarity and annotated with exception labels in sequence according to the self-feedback mechanism of the system.

[0166] Example 2

[0167] like Figure 4 As shown, the data similarity query device for integrating contrastive learning and graph neural network provided by the present application includes:

[0168] The request data acquisition module is used to obtain request parameters and request result data, map the request to a request node, and build a request graph. When a new request arrives, it is inserted into the request graph to form a new request node and edge.

[0169] The network model training module is used to select the graph attention network model as the initial model, sample positive sample nodes and negative sample nodes for each request node, construct triples, establish contrastive learning tasks, and train the graph attention network model;

[0170] The abnormal request judgment module is used to construct a request node abnormality judgment method based on the output embedding representation of the graph attention network model, calculate the abnormal score of the request node, and mark the request node as an abnormal request when the abnormal score is greater than the abnormal threshold;

[0171] The nearest neighbor index building module is used to use the embedding representation of the request node as a data point, build an M-layer nearest neighbor index using the HNSW algorithm, and insert the new request node detected in the request graph into the M-layer nearest neighbor index;

[0172] The similar anomaly search module is used to search for and sort K candidate anomaly requests based on the M-layer nearest neighbor index according to the real-time anomaly request sent by the user, and obtain K sorted similar anomaly requests to be processed.

[0173] Example 3

[0174] According to another aspect of the present application, an electronic device is also provided. The electronic device may include one or more processors and one or more memories. The memory stores a computer-readable code, and when the computer-readable code is executed by one or more processors, the data similarity query method of fusion contrast learning and graph neural network as described above can be executed.

[0175] The method or system according to the embodiment of the present application can also be implemented with the help of the architecture of the electronic device described below. The electronic device may include a bus, one or more CPUs, a read-only memory (ROM), a random access memory (RAM), a communication port connected to a network, an input / output component, a hard disk, etc. A storage device in the electronic device, such as a ROM or a hard disk, can store the data similarity query method of the fusion contrast learning and graph neural network provided in the present application. The data similarity query method integrating contrastive learning and graph neural network may include, for example: obtaining request parameters and request result data, mapping the request to a request node, constructing a request graph, and when a new request arrives, inserting it into the request graph to form a new request node and edge; selecting a graph attention network model as the initial model, sampling positive sample nodes and negative sample nodes for each request node, constructing a triple, establishing a contrastive learning task, and training the graph attention network model; based on the output embedding representation of the graph attention network model, constructing a request node abnormality judgment method, calculating the abnormality score of the request node, and when the abnormality score is greater than the abnormal threshold, marking the request node as an abnormal request; using the embedding representation of the request node as a data point, using the HNSW algorithm to construct an M-layer nearest neighbor index, inserting the new request node detected in the request graph into the M-layer nearest neighbor index; according to the real-time abnormal request sent by the user, searching for K candidate abnormal requests based on the M-layer nearest neighbor index and sorting them, and obtaining K similar abnormal requests to be processed after sorting. Further, the electronic device may also include a user interface. Of course, the above architecture is only exemplary. When implementing different devices, one or more components in the above electronic device may be omitted according to actual needs.

[0176] Example 4

[0177] A readable storage medium according to an embodiment of the present application. Computer-readable instructions are stored on the computer-readable storage medium. When the computer-readable instructions are executed by the processor, the data similarity query method of the fusion contrast learning and graph neural network according to the embodiment of the present application described with reference to the above figures can be executed. The storage medium includes, but is not limited to, for example, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and cache memory (cache). Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc.

[0178] In addition, according to an embodiment of the present application, the process described above with reference to the flowchart may be implemented as a computer software program. For example, the present application provides a non-transitory machine-readable storage medium, which stores machine-readable instructions, and the machine-readable instructions can be executed by a processor to execute instructions corresponding to the method steps provided in the present application, for example: obtaining request parameters and request result data, mapping the request to a request node, building a request graph, and when a new request arrives, inserting it into the request graph to form a new request node and edge; selecting a graph attention network model as the initial model, for each request node, sampling positive sample nodes and negative sample nodes, building a triplet, establishing a comparative learning task, and training the graph attention network model; based on the output embedding representation of the graph attention network model, building a request node anomaly judgment method, calculating the anomaly score of the request node, and when the anomaly score is greater than the anomaly threshold, marking the request node as an abnormal request; using the embedded representation of the request node as a data point, using the HNSW algorithm to build an M-layer nearest neighbor index, and inserting the new request node detected in the request graph into the M-layer nearest neighbor index; according to the real-time abnormal request sent by the user, searching for K candidate abnormal requests based on the M-layer nearest neighbor index and sorting them, and obtaining K similar abnormal requests to be processed after sorting. When the computer program is executed by a central processing unit (CPU), the above functions defined in the method of the present application are performed.

[0179] The methods, apparatuses, and devices of the present application may be implemented in many ways. For example, the methods, apparatuses, and devices of the present application may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above order of steps for the method is for illustration only, and the steps of the method of the present application are not limited to the order specifically described above unless otherwise specified. In addition, in some embodiments, the present application may also be implemented as programs recorded in a recording medium, which include machine-readable instructions for implementing the method according to the present application. Therefore, the present application also covers recording media storing programs for executing the method according to the present application.

[0180] In addition, the parts of the above-mentioned technical solutions provided in the embodiments of the present application that are consistent with the implementation principles of the corresponding technical solutions in the prior art are not described in detail to avoid excessive redundancy.

[0181] The specific implementation modes as described above further describe the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation mode of the present invention and is not intended to limit the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A data similarity query method integrating contrastive learning and graph neural network, characterized in that: include: Get request parameters and request result data, map the request to a request node, build a request graph, and when a new request arrives, insert it into the request graph to form a new request node and edge; Select the graph attention network model as the initial model. For each request node, sample the positive sample nodes and negative sample nodes, construct triples, establish a contrastive learning task, and train the graph attention network model. Based on the output embedding representation of the graph attention network model, a request node anomaly judgment method is constructed to calculate the anomaly score of the request node. When the anomaly score is greater than the anomaly threshold, the request node is marked as an abnormal request. The embedded representation of the request node is used as a data point, and the M-layer nearest neighbor index is constructed using the HNSW algorithm. The new request node detected in the request graph is inserted into the M-layer nearest neighbor index; According to the real-time abnormal request sent by the user, K candidate abnormal requests are searched and sorted based on the M-layer nearest neighbor index to obtain K sorted similar abnormal requests to be processed; The specific method of constructing a request node abnormality judgment method based on the output embedding representation of the graph attention network model, calculating the abnormality score of the request node, and marking the request node as an abnormal request when the abnormality score is greater than the abnormality threshold is as follows: Use the trained graph attention network model to output the embedding representation of the current request node and calculate the relationship between the request node i and each neighbor node The Euclidean distance between , and calculate the average Euclidean distance between the request node i and all neighbor nodes , calculate the ratio of the sum of the Euclidean distances between the requesting node i and its NJ neighboring nodes to the sum of the Euclidean distances between all requesting nodes; Calculate the average Euclidean distance between the request node i and all neighbor nodes Relative to the average Euclidean distance between all request nodes the degree of deviation; Calculate the number of requests for request node i The average number of requests relative to all request nodes The first degree of deviation , calculate the number of abnormal annotations of request node i The average number of anomaly annotations relative to all request nodes The second degree of deviation ; The result of multiplying the proportion and the degree of deviation is weighted and summed with the first degree of deviation and the second degree of deviation to obtain the abnormal score of the embedding representation of the request node i ; The abnormal threshold includes a conventional threshold and adaptive threshold , the graph attention network model periodically outputs the embedding representations of all request nodes in the request graph. When the distribution of the embedding representations of the request nodes does not change significantly, a conventional threshold is used With anomaly score When the distribution of the embedding representation of the request node changes significantly, an adaptive threshold is used to compare With anomaly score Compare and determine whether the request node is abnormal; wherein the distribution of the embedding representation of the request node has not changed significantly specifically refers to: calculating the mean of the embedding representation of all current request nodes and historical embedding represents the mean The mean shift between , when the mean shift is less than or equal to a1, it is determined that the distribution of the embedded representation of the request node has not changed significantly; the distribution of the embedded representation of the request node has changed significantly means that: when the mean shift is greater than a1, the distribution of the embedded representation of the request node has changed significantly; the method for determining whether the request node is abnormal is: when the anomaly score is greater than the conventional threshold or the adaptive threshold, the request node is an abnormal request, otherwise, it is a normal request.

2. The data similarity query method integrating contrastive learning and graph neural network as claimed in claim 1, characterized in that: The specific method of obtaining request parameters and request result data, mapping the request to a request node, building a request graph, and inserting a new request into the request graph to form a new request node and edge is as follows: Get the request parameters and request result data, build a request graph, and map each request to a request node in the request graph. The feature vector of the request node is composed of the key attributes of the request. There are a key attributes in total. The feature vector of request node i is expressed as: , where T is the transpose symbol of the matrix, is the ath key attribute of the request node i, the feature vector of the request node includes but is not limited to: request parameters, characteristics of request results, number of request occurrences, number of page views by users; Calculate the similarity between request node i and request node j ; A similarity threshold is preset to determine whether there is an edge connection between the request node i and the request node j. If the similarity between the request node i and the request node j is greater than or equal to the similarity threshold, an edge is established between the two request nodes, and the weight of the edge is the similarity of the two request nodes; Dynamically update the adjacency matrix of the requested graph, the elements in the adjacency matrix represents the weight of the edge between request node i and request node j. If request node i and request node j are not adjacent, then ; When a new request arrives, it is converted into a request node in real time and inserted into the request graph. The similarity between the request node and the existing request nodes is calculated, and a new edge connection is established.

3. The data similarity query method of integrating contrastive learning and graph neural network as claimed in claim 2 is characterized in that: The specific method of selecting the graph attention network model as the initial model, sampling positive sample nodes and negative sample nodes for each request node, constructing triples, establishing a comparative learning task, and training the graph attention network model is as follows: Select the graph attention network model as the initial model to learn the embedding representation of the request node, use the feature vector and adjacency matrix of the request node as the input data of the graph attention network model, and use the embedding representation of the request node as the output data; For each requesting node, randomly sample positive sample nodes from its neighboring nodes , randomly sample Ka negative sample nodes from the entire request graph , construct triples based on request nodes, positive sample nodes, and negative sample nodes; Based on the triples, a contrastive learning task is established between the embedding representation of the positive sample nodes and the embedding representation of the negative sample nodes, and the loss function of the graph attention network model is obtained; The loss function of the graph attention network model is constructed by calculating the loss function of the request node i and the positive sample node , calculate the negative sample similarity between the embedding representation of the request node i and the embedding representation of the negative sample node, compare the positive sample similarity with the sum of all negative sample similarities as the loss of the request node i, and take the average of the losses of all request nodes as the loss function for training the graph attention network model ; The graph attention network model is trained to minimize the value of the loss function. When the loss function converges, the training of the graph attention network model is completed.

4. The data similarity query method of integrating contrastive learning and graph neural network as claimed in claim 3 is characterized in that: The calculation method of the conventional threshold is: according to the historical request parameters and request result data of all request nodes in the recent T1 duration, the embedded representation of the historical T1 duration is output based on the graph neural network model, and the historical anomaly score is calculated. , based on the historical anomaly scores of all request nodes, the mean historical anomaly score is obtained and the historical anomaly score standard deviation , the weighted sum of the two is used to obtain the conventional threshold .

5. The data similarity query method of integrating contrastive learning and graph neural network as claimed in claim 4 is characterized in that: The calculation method of the adaptive threshold is: obtain the current timestamp t0 and the calculation timestamp of the previous historical anomaly score of the request node i , calculate the time decay weight of the historical anomaly score , based on the time-decay weight Take a weighted average of the historical anomaly scores to get a weighted average anomaly score , calculate the adaptive threshold .

6. The data similarity query method of integrating contrastive learning and graph neural network as claimed in claim 5 is characterized in that: The specific method of using the embedded representation of the request node as a data point, using the HNSW algorithm to construct an M-layer nearest neighbor index, and inserting the new request node detected in the request graph into the M-layer nearest neighbor index is: The embedded representation of the request node is used as a data point, and the HNSW algorithm is used to build an M-layer nearest neighbor index. When a new request node is detected to be inserted into the request graph, the embedded representation of the request node is added to the M-layer nearest neighbor index. The method for constructing the M-layer nearest neighbor index is: Step S411: randomly select a data point as an entry point, where the entry point is the first data point of the bottom layer graph; Step S412: For each data point P to be inserted, starting from the bottom layer of the graph, find the data point with the closest Euclidean distance to the data point P as the entry point of the current layer L1, and then search in the current layer to find the Kp data points with the closest Euclidean distance to the data point P as the nearest neighboring data points of the data point P; From the Kp nearest neighbor data points found, select the W data points with the closest Euclidean distance to the data point P, select a data point closest to the data point P from the nearest W data points as the new entry point of the current layer L1, and then repeat step S412 in the next layer until the highest layer graph is reached; Step S413: In each layer, a similarity connection is established between the data point P and the W nearest neighboring data points found. The similarity connection refers to calculating the Euclidean distance between the data points. When the Euclidean distance is greater than or equal to the similarity threshold, a similarity connection is established between the two data points. Step S414: When the number of data points in the current layer reaches , a new upper layer graph is created based on the current layer, and the k-means clustering algorithm is used to select The centers of the clusters are used as the data points to be inserted into the new upper graph; Step S415: Repeat steps S412 to S414 until all data points are inserted to obtain an M-layer nearest neighbor index.

7. A data similarity query device integrating contrastive learning and graph neural network, which is used to implement the data similarity query method integrating contrastive learning and graph neural network according to any one of claims 1 to 6, characterized in that: include: The request data acquisition module is used to obtain request parameters and request result data, map the request to a request node, and build a request graph. When a new request arrives, it is inserted into the request graph to form a new request node and edge. The network model training module is used to select the graph attention network model as the initial model, sample positive sample nodes and negative sample nodes for each request node, construct triples, establish contrastive learning tasks, and train the graph attention network model; The abnormal request judgment module is used to construct a request node abnormality judgment method based on the output embedding representation of the graph attention network model, calculate the abnormal score of the request node, and mark the request node as an abnormal request when the abnormal score is greater than the abnormal threshold; The nearest neighbor index building module is used to use the embedding representation of the request node as a data point, build an M-layer nearest neighbor index using the HNSW algorithm, and insert the new request node detected in the request graph into the M-layer nearest neighbor index; The similar anomaly search module is used to search for and sort K candidate anomaly requests based on the M-layer nearest neighbor index according to the real-time anomaly request sent by the user, and obtain K sorted similar anomaly requests to be processed.

8. An electronic device, characterized in that: It includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps in the data similarity query method of integrating contrastive learning and graph neural network as described in any one of claims 1 to 6 are implemented.

9. A readable storage medium, characterized in that: The readable storage medium stores a computer program, which is suitable for being loaded by a processor to execute the steps in the data similarity query method of integrating contrastive learning and graph neural network as described in any one of claims 1 to 6.

Images