Target abnormal behavior detection and identification method based on enhanced graph learning

Abstract

The invention discloses a target abnormal behavior detection and recognition method based on enhanced graph learning. The method comprises the steps of 1, representing target data in a space-time diagram form; 2, designing a parameterized similarity function by using a neural network; step 3, neighbor filtering and global neighbor enhancement are realized based on a top-p sampling method; step 4, aggregating information from all neighbors and relationships based on a message passing graph neural network; 5, based on the idea of mutual information learning, maximizing mutual information between the local representation and the global representation; step 6, constructing a category perception classifier, enhancing the contribution of a small number of samples to the loss function, and weakening the contribution of a large number of samples to the loss function; and 7, performing sequential anomaly detection on the target data. The method is based on an abnormal behavior detection framework of enhanced graph learning, and the target abnormal behavior detection and recognition effect under the interference deception condition is improved.

Description

Technical Field

[0001] The invention relates to a target abnormal behavior detection and recognition method based on enhanced graph learning, and belongs to the field of pattern recognition and intelligent intelligence processing. Background Art

[0002] In complex scenarios of early warning and surveillance such as strong confrontation, multiple targets, and high mobility, the sea and air targets in the surveillance area are dense, mobile, and camouflaged, and the means of target perception are diverse, including radar, optoelectronics, sonar, AIS, ADS-B, etc. Complex scenario target data includes real-time high-dimensional target status data such as target attributes, types, categories, models, longitude, latitude, altitude, speed, and heading acquired by multiple sensors, historical target status data, historical activity patterns, sensor deployment, typical tasks, procedural rules, and control areas. When analyzing target behavior, target-related data can be represented in the form of a high-dimensional track graph. The nodes in the graph contain high-dimensional feature information such as the attributes, types, categories, models, longitude, latitude, altitude, speed, heading, historical activity patterns, and current tasks of the target at a certain moment. The edges connecting nodes contain dynamic information such as the relationship between the same target at different times, the relationship between different targets at the same time, and the relationship between different targets at different times.

[0003] Among a large amount of target data, targets with abnormal behaviors are important targets that the duty officer focuses on. Unsupervised anomaly detection can realize automatic detection and identification of target abnormal behaviors. Traditional anomaly detection methods are difficult to solve problems such as target behavior disguise under interference and deception conditions, data sparsity, and category imbalance, and have limitations in detecting and identifying target abnormal behaviors. Summary of the invention

[0004] Aiming at the limitations of existing target abnormal behavior detection and identification methods, the present invention provides a target abnormal behavior detection and identification method based on enhanced graph learning. An abnormal behavior detection framework based on enhanced graph learning is designed, and a parameterized graph neural network is used to obtain the similarity of target behaviors. With similarity as the central behavior, similar behaviors are increased and heterogeneous behaviors are reduced, alleviating the problem of target behavior disguise and data sparsity. The quality of behavior representation is enhanced by mutual information learning, and a category-aware loss function is designed to improve the detection and identification effect of target abnormal behavior under interference and deception conditions.

[0005] The target abnormal behavior detection and recognition method based on enhanced graph learning of the present invention is special in that it includes the following steps: Step 1: Represent the target data in the form of a spatiotemporal graph ,in, is a collection of nodes, and Respectively The edge set and adjacency matrix at each moment, the space-time graph is a directed weighted heterogeneous dynamic graph.

[0006] Step 2, using the advantages of neural network to extract implicit features and true label information, design a parameterized similarity function to describe the similarity of target behaviors and alleviate target feature camouflage under interference deception conditions.

[0007] Step 3: Filter neighbor nodes with low similarity to the central node based on the top-p sampling method, calculate the similarity between node features through metric learning, introduce edges with high confidence, and realize neighbor filtering and global neighbor enhancement.

[0008] Step 4: Based on the message passing graph neural network, information from all neighbors and relationships is aggregated, and after the neighbors of the central node are selected, the neighbor information aggregation is completed.

[0009] Step 5: Based on the idea of ​​mutual information learning, the mutual information between local representation and global representation is maximized to enhance the information representation of the node.

[0010] Step 6: Build a category-aware classifier to enhance the contribution of a small number of samples to the loss function, weaken the contribution of a large number of samples to the loss function, and prevent overfitting of normal categories.

[0011] Step 7: Perform sequential anomaly detection on the target data to detect and identify target abnormal behavior by judging whether the classification probability of the node exceeds the anomaly threshold.

[0012] Preferably, when designing the parameterized similarity function in step 2, the distance function between nodes is: ; in is a fully connected layer, is different from Nodes, based on the learned embedding Prediction Node exist Layers and Relationships The probability of camouflage under is a learnable weight matrix, It is the abnormal node detection framework The input of the layer, It is through the framework The output after the layer is input into the first network layer. Based on the above distance definition, any node pair in the relationship and In the layer network, the similarity between nodes can be expressed as , and They are two different nodes; The similarity calculation model parameters of the neural network are obtained through the cross entropy loss of labeled data, that is, the loss function is expressed as: ; In the similarity calculation module based on neural network, the loss function constructed Deoptimization , so as to further obtain the similarity between the two nodes and update it as , Represents a collection of nodes, Representation Node The weight coefficient of .

[0013] Preferably, when implementing neighbor filtering and global neighbor enhancement in step 3, during the training phase, for the relationship The nodes in the current batch , first use Calculate the similarity score of a set of nodes .in , It is Layer Relationship Then according to Rank the similarities of its neighbors in descending order and take the top Neighbor as the The selected neighbors of the layer, where is a manually specified hyperparameter. All other nodes are discarded in the current batch and will not participate in the aggregation process. The top-p sampling process is applied to the central node of each layer of each relation, assuming that the relation Next Neighbors The large similarity value is , for each node, the neighbors of the filtered node can be expressed as: ; It's a relationship The adjacency matrix below.

[0014] Generate a better graph structure by using graph structure enhancement with metric learning. First, calculate the similarity matrix between nodes ,node The neighbors of can be expressed as . In addition, edges with high confidence are introduced to avoid introducing too much noise. K-nearest neighbor (KNN) sparsification is performed on dense graphs: For each node, edges with top-K prediction scores are retained, that is: ; In the similarity-based neighbor filtering and neighbor enhancement module, for the central node For example, The final neighborhood of is composed of neighbor filtering and global neighbor enhancement: .

[0015] Preferably, when the graph neural network based on message passing performs neighbor information aggregation in step 4, it is assumed that Representation Node In relationship The next Layer representation, where , is the number of network layers.

[0016] After selecting the neighbors of the central node, gather the neighbor information: ; is the weight matrix, represents the nonlinear activation function in the neural network, It is a function used to calculate the average of a set of data.

[0017] Preferably, in step 5, when enhancing the node information representation based on the idea of ​​mutual information learning, the node representation vector is obtained. Based on this, we use the idea of ​​average pooling to construct a global vector To represent the global information of the entire heterogeneous graph, yes Activation function.

[0018] ;

[0019] Using the negative embedding feature matrix of the node As a negative sample of the mutual information estimator, in the graph representation enhancement module based on mutual information, the node representation is further enhanced from the perspective of mutual information learning. The loss function of the graph representation enhancement module based on mutual information can be written as: ; for The elements in for The dimension of .

[0020] Preferably, when constructing the category-aware classifier in step 6, after obtaining the representation vector of the node, the classification probability of the node is obtained through a multilayer perceptron: ; Constructing a category-aware loss function: ; Used to optimize the entire model, is the category-aware weight, which is used to adjust the contribution of samples to the loss function. Assume that the number of normal samples is , the number of abnormal samples is , It is expressed as follows: ; The loss of the entire model consists of the similarity measurement loss of the graph enhancement module, the self-supervised learning loss of the mutual information-based graph representation enhancement module, the category-aware cross entropy loss under the category-aware classifier module, and the regularization loss to prevent model overfitting.

[0021] ;

[0022] and The hyperparameters used to measure the similarity calculation loss and mutual information loss, respectively. It is a hyperparameter used to prevent the model from overfitting.

[0023] The beneficial effects of the present invention are as follows: the present invention provides a method for detecting and identifying abnormal target behaviors based on enhanced graph learning, which obtains the similarity of target behaviors by utilizing a parameterized graph neural network, takes similarity as the center behavior, increases similar behaviors and reduces heterogeneous behaviors, alleviates the problems of target behavior disguise and data sparsity, enhances the quality of behavior representation by mutual information learning, designs a category-aware loss function, and improves the detection and identification effect of abnormal target behaviors under interference and deception conditions. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Attached Figure 1 It is an overall flow chart of the target abnormal behavior detection and recognition method based on enhanced graph learning described in the present invention. DETAILED DESCRIPTION

[0025] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0026] The target abnormal behavior detection and recognition method based on enhanced graph learning in this embodiment includes the following steps: Step 1: Represent the target data in the form of a spatiotemporal graph ,in, is a collection of nodes, and Respectively indicate time The edge set and adjacency matrix of the space-time graph are directed weighted heterogeneous dynamic graphs.

[0027] Step 2, using the advantages of neural network to extract implicit features and true label information, design a parameterized similarity function to describe the similarity of target behaviors and alleviate target feature camouflage under interference deception conditions.

[0028] In complex scenes, the target's mobile camouflage characteristics are prominent. The traditional Euclidean distance and its similarity measurement method are not applicable to target behavior camouflage detection, and it is difficult to measure the differences in attributes between different types of nodes. Therefore, a parameterized similarity function is designed by taking advantage of the neural network to extract implicit features and the real label information to alleviate the feature camouflage problem. The distance function between nodes is: ; in is a fully connected layer, is different from Nodes, based on the learned embedding Prediction Node exist Layers and Relationships The probability of camouflage under is a learnable weight matrix, It is the abnormal node detection framework The input of the layer, It is through the framework The output after the layer is input into the first network layer. Based on the above distance definition, any node pair in the relationship and In the layer network, the similarity between nodes can be expressed as , and They are two different nodes.

[0029] In order to make full use of the experienced label information, the similarity calculation model parameters of the neural network are obtained through the cross entropy loss of the labeled data, that is, the loss function is expressed as: ; In the similarity calculation module based on neural network, the loss function constructed Deoptimization , so as to further obtain the similarity between the two nodes and update it as , Represents a collection of nodes, Representation Node The weight coefficient of .

[0030] Step 3: Filter neighbor nodes with low similarity to the central node based on the top-p sampling method, calculate the similarity between node features through metric learning, introduce edges with high confidence, and realize neighbor filtering and global neighbor enhancement.

[0031] The purpose of similarity-based neighbor filtering and neighbor enhancement is to enhance the original input graph structure, supplement and delete some edges that should not exist. The top-p sampling method is used to filter neighbor nodes with low similarity to the central node under each relationship.

[0032] Specifically, in the training phase, for the relationship The nodes in the current batch , first use Calculate the similarity score of a set of nodes .in , It is Layer Relationship Then according to Rank the similarities of its neighbors in descending order and take the top Neighbor as the The selected neighbors of the layer, where is a manually specified hyperparameter. All other nodes are discarded in the current batch and will not participate in the aggregation process. The top-p sampling process is applied to the central node of each layer of each relation, assuming that the relation Next Neighbors The large similarity value is For each node, the neighbors of the node after filtering can be expressed as: ; It's a relationship The adjacency matrix below.

[0033] In order to solve the sparsity problem of target behavior data, a better graph structure is generated by using graph structure enhancement with metric learning. First, the similarity between node features is calculated through metric learning to infer the potential connections between nodes. First, the similarity matrix between nodes is calculated ,node The neighbors of can be expressed as . In addition, edges with high confidence are introduced to avoid introducing too much noise. Therefore, K nearest neighbor (KNN) sparsification is performed on the dense graph: for each node, edges with top-K prediction scores are retained, that is: ; In general, in the similarity-based neighbor filtering and neighbor enhancement modules, for the central node For example, The final neighborhood of is composed of neighbor filtering and global neighbor enhancement: ; Step 4: Based on the message passing graph neural network, information from all neighbors and relationships is aggregated, and after the neighbors of the central node are selected, the neighbor information aggregation is completed.

[0034] After the above neighbor enhancement step, Representation Node In relationship No. The final neighbors are obtained after neighbor filtering and global neighbor enhancement at the next layer. The enhanced graph is the graph obtained after deleting and enhancing the edges of the original graph. After obtaining the enhanced graph, the graph neural network based on message passing aggregates information from all neighbors and relationships. Assume Representation Node In relationship The next Layer representation, where . is the number of network layers.

[0035] After selecting the neighbors of the central node, gather the neighbor information: ; is the weight matrix, represents the nonlinear activation function in the neural network, It is a function used to calculate the average of a set of data.

[0036] Step 5: Based on the idea of ​​mutual information learning, the mutual information between local representation and global representation is maximized to enhance the information representation of the node.

[0037] In order to extract node features more efficiently and extract discriminative node feature representations, the idea of ​​mutual information learning is adopted to capture the unique information of each perspective by maximizing the node representation and global representation.

[0038] The goal of mutual information learning is to maximize the mutual information between local representation and global representation. The local vector representation of the node has been obtained through the above aggregation method. . After obtaining the node's representation vector Based on this, we use the idea of ​​average pooling to construct a global vector To represent the global information of the entire heterogeneous graph, yes Activation function.

[0039] ;

[0040] Using the negative embedding feature matrix of the node As a negative sample of the mutual information estimator, in the graph representation enhancement module based on mutual information, the node representation is further enhanced from the perspective of mutual information learning. The loss function of the graph representation enhancement module based on mutual information can be written as: ; for The elements in for The dimension of .

[0041] Step 6: Build a category-aware classifier to enhance the contribution of a small number of samples to the loss function, weaken the contribution of a large number of samples to the loss function, and prevent overfitting of normal categories.

[0042] In specific application scenarios, the distribution ratio of abnormal behavior to normal behavior is very unbalanced. This class imbalance problem will cause most classification models to overfit the normal data in the training set and underfit the abnormal data. Therefore, a class-aware classifier is constructed to enhance the contribution of a small number of samples to the loss function and weaken the contribution of a large number of samples to the loss function.

[0043] After obtaining the node representation vector, the classification probability of the node is obtained through a multilayer perceptron: ; Constructing a category-aware loss function: ; Used to optimize the entire model. is the category-aware weight, which is used to adjust the contribution of samples to the loss function. Assume that the number of normal samples is , the number of abnormal samples is , expressed as follows: ; The loss of the entire model consists of the similarity measurement loss of the graph enhancement module, the self-supervised learning loss of the mutual information-based graph representation enhancement module, the category-aware cross entropy loss under the category-aware classifier module, and the regularization loss to prevent model overfitting.

[0044] ;

[0045] and The hyperparameters used to measure the similarity calculation loss and mutual information loss, respectively. It is a hyperparameter used to prevent the model from overfitting.

[0046] Step 7: Perform sequential anomaly detection on the target data to detect and identify target abnormal behavior by judging whether the classification probability of the node exceeds the anomaly threshold.

[0047] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A target abnormal behavior detection and recognition method based on enhanced graph learning, characterized in that: The following steps are involved: Step 1: Represent the target data in the form of a spatiotemporal graph ; Step 2: Using the advantages of neural networks to extract implicit features and real label information, design a parameterized similarity function to describe the similarity of target behaviors and alleviate target feature camouflage under interference deception conditions; Step 3: Filter neighbor nodes with low similarity to the central node based on the top-p sampling method, calculate the similarity between node features through metric learning, introduce edges with high confidence, and realize neighbor filtering and global neighbor enhancement; Step 4: Based on the message passing graph neural network, information from all neighbors and relationships is aggregated. After the neighbors of the central node are selected, the neighbor information aggregation is completed. Step 5: Based on the idea of ​​mutual information learning, maximize the mutual information between local representation and global representation to enhance the information representation of nodes; Step 6: Build a category-aware classifier to enhance the contribution of small number of samples to the loss function, weaken the contribution of large number of samples to the loss function, and prevent overfitting of normal categories; Step 7: Perform sequential anomaly detection on the target data to detect and identify target abnormal behavior by judging whether the classification probability of the node exceeds the anomaly threshold.

2. The target abnormal behavior detection and recognition method based on enhanced graph learning according to claim 1 is characterized in that: When designing the parameterized similarity function in step 2, the distance function between nodes is: ； in is a fully connected layer, is different from Nodes, based on the learned embedding Prediction Node exist Layers and relationships The probability of camouflage under is a learnable weight matrix, It is the abnormal node detection framework The input of the layer, It is through the framework The output after the layer is input into the first network layer. Based on the above distance definition, any node pair in the relationship and In the layer network, the similarity between nodes is expressed as , and They are two different nodes; The similarity calculation model parameters of the neural network are obtained through the cross entropy loss of labeled data, that is, the loss function is expressed as: ； In the similarity calculation module based on neural network, the loss function constructed Deoptimization , so as to further obtain the similarity between the two nodes and update it as , Represents a collection of nodes, Representation Node The weight coefficient of .

3. The target abnormal behavior detection and recognition method based on enhanced graph learning according to claim 1 is characterized in that: When implementing neighbor filtering and global neighbor enhancement in step 3, during the training phase, for the relationship The nodes in the current batch , first use Calculate the similarity score of a set of nodes ,in , It is Layer Relationship The next set of edges, and then according to Rank the similarities of its neighbors in descending order and take the top Neighbor as the The selected neighbors of the layer, where is a manually specified hyperparameter. All other nodes are discarded in the current batch and will not participate in the aggregation process. The top-p sampling process is applied to the central node of each layer of each relation. It is assumed that the relation Next Neighbors The large similarity value is , for each node, the neighbors of the filtered node can be expressed as: ； It's a relationship The adjacency matrix under ; By using graph structure enhancement with metric learning to generate a better graph structure, we first calculate the similarity matrix between nodes. ,node The neighbors of can be expressed as ,In addition, edges with high confidence are introduced to avoid introducing too much noise, and K nearest neighbor (KNN) sparsification is performed on dense graphs: for each node, edges with top-K prediction scores are retained, that is: ； In the similarity-based neighbor filtering and neighbor enhancement module, for the central node For example, The final neighborhood of is composed of neighbor filtering and global neighbor enhancement: 。 4. The target abnormal behavior detection and recognition method based on enhanced graph learning according to claim 1 is characterized in that: When the graph neural network based on message passing performs neighbor information aggregation in step 4, it is assumed that Representation Node In relationship The next Layer representation, where , is the number of network layers; After selecting the neighbors of the central node, gather the neighbor information: ； is the weight matrix, represents the nonlinear activation function in the neural network, It is a function used to calculate the average of a set of data.

5. The target abnormal behavior detection and recognition method based on enhanced graph learning according to claim 1 is characterized in that: In step 5, based on the idea of ​​mutual information learning, when enhancing the node information representation, the node representation vector is obtained. Based on this, we use the idea of ​​average pooling to construct a global vector To represent the global information of the entire heterogeneous graph, yes Activation function: ； Using the negative embedding feature matrix of the node As a negative sample of the mutual information estimator, in the graph representation enhancement module based on mutual information, the node representation is further enhanced from the perspective of mutual information learning. The loss function of the graph representation enhancement module based on mutual information is written as: ； for The elements in for The dimension of .

6. The target abnormal behavior detection and recognition method based on enhanced graph learning according to claim 1 is characterized in that: When building a category-aware classifier in step 6, after obtaining the representation vector of the node, the classification probability of the node is obtained through a multilayer perceptron: ； Constructing a category-aware loss function: ； Used to optimize the entire model, is the category-aware weight, which is used to adjust the contribution of samples to the loss function. Assuming that the number of normal samples is , the number of abnormal samples is , It is expressed as follows: ； The loss of the entire model consists of the similarity measurement loss of the graph enhancement module, the self-supervised learning loss of the mutual information-based graph representation enhancement module, the category-aware cross entropy loss under the category-aware classifier module, and the regularization loss to prevent the model from overfitting: ； and The hyperparameters used to measure the similarity calculation loss and mutual information loss, respectively. Hyperparameters used to prevent the model from overfitting.

Images