Dynamic graph representation model training, dynamic graph anomaly detection method and device

Abstract

The embodiments of this specification disclose a method and device for dynamic graph representation model training and dynamic graph anomaly detection. This training method relies on node memory representation for graph comparison learning during the training process, and can efficiently train the anomaly detection model without labels. The dynamic graph representation model trained based on the above-mentioned dynamic graph representation model training method can effectively capture graph structure anomalies, node attribute anomalies, and timing anomalies in dynamic graph scenes, and thus can effectively solve the problem of dynamic graph anomaly detection in an unsupervised manner. The dynamic graph representation model training device, dynamic graph anomaly detection method and device described in the embodiments of this specification also have the above-mentioned effects.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a dynamic graph representation model training, dynamic graph anomaly detection method and device. Background Art

[0002] Dynamic graphs refer to graph data whose nodes and edges evolve over time and show dynamic changes. Traditional anomaly detection methods for dynamic graph anomaly detection often rely on a large amount of labeled data for model training. However, in real applications, obtaining sufficient labeled data is both costly and time-consuming. Therefore, there is an urgent need for an unsupervised dynamic graph anomaly detection method that can realize node anomaly identification without relying on labels. Summary of the invention

[0003] One or more embodiments of the present specification provide a dynamic graph representation model training, dynamic graph anomaly detection method and device, which can deeply mine the intrinsic feature information of the dynamic graph and realize node anomaly identification without relying on labels.

[0004] In a first aspect, a dynamic graph representation model training method is provided, the method comprising:

[0005] Get dynamic image samples;

[0006] Dividing a subgraph based on at least one root node of the dynamic graph sample, and performing time-series sampling on the subgraph to obtain a time-series subgraph of the root node;

[0007] Inputting the time-series subgraph of the root node into the dynamic graph representation model to obtain a node representation time series of the root node;

[0008] Processing the node representation time series of the root node through a time series model to obtain a node memory representation time series of the root node;

[0009] The current node memory representation and the historical node memory representation of the same root node are used as positive sample pairs, and the current node memory representations of different root nodes are used as negative sample pairs. A contrastive learning strategy is used to train the dynamic graph representation model.

[0010] As an optional implementation manner of the method of the first aspect, the dynamic graph representation model includes a dynamic graph neural network; inputting the time-series subgraph of the root node into the dynamic graph representation model to obtain a node representation time series of the root node specifically includes:

[0011] The time-series subgraph of the root node is input into the dynamic graph neural network to obtain the node representation time series of the root node.

[0012] As an optional implementation of the method of the first aspect, the dynamic graph representation model includes a dynamic graph neural network and a hybrid expert network model; inputting the time-series subgraph of the root node into the dynamic graph representation model to obtain the node representation time series of the root node specifically includes:

[0013] Inputting the time-series subgraph of the root node into the dynamic graph neural network to obtain the first node representation time series of the root node;

[0014] Inputting the first node representation time series of the root node into the hybrid expert network model, selecting a corresponding expert model through the gating network of the hybrid expert network model to encode the first node representation time series of the root node, and obtaining a corresponding second node representation time series output by each expert;

[0015] The second node representation time series output by each corresponding expert is weighted to obtain the node representation time series of the root node.

[0016] As an optional implementation of the method of the first aspect, a contrastive learning strategy is used to train the dynamic graph representation model, specifically including:

[0017] Determining a first loss function according to the similarity of the positive sample pair;

[0018] Determining a second loss function according to the similarity of the negative sample pair;

[0019] A contrastive learning loss function is determined according to the first loss function and the second loss function to update the parameters of the dynamic graph representation model.

[0020] Specifically, a contrastive learning strategy is used to train the dynamic graph representation model, which specifically includes:

[0021] For the root node, determining a third loss function according to a similarity between a current node memory representation of the root node and a current node representation;

[0022] Determining a fourth loss function according to a similarity between the current node representation of the root node and the current node memory representations of other root nodes;

[0023] A contrastive learning loss function is determined according to the first loss function, the second loss function, the third loss function and the fourth loss function to update the parameters of the dynamic graph representation model.

[0024] In a second aspect, a method for detecting anomalies in a dynamic graph is provided, the method comprising:

[0025] Get the target dynamic image;

[0026] Dividing a subgraph based on at least one root node of the target dynamic graph, and performing time-series sampling on the subgraph to obtain a time-series subgraph of the root node;

[0027] Inputting the time-series subgraph of the root node into a dynamic graph representation model pre-trained by the method according to any one of claims 1 to 5 to obtain a node representation time series of the root node;

[0028] Processing the node representation time series of the root node through a time series model to obtain a node memory representation time series of the root node;

[0029] For each root node of the target dynamic graph, determine a first similarity score according to a current node memory representation and a historical node memory representation of the root node; determine a second similarity score according to a current node memory representation and a current node representation of the root node;

[0030] Determining an outlier score of the root node according to the first similarity score and the second similarity score;

[0031] Based on the outlier score of the root node, it is determined whether the root node is an outlier node.

[0032] In a third aspect, a dynamic graph representation model training device is provided, the device comprising:

[0033] A first data acquisition module, configured to acquire dynamic image samples;

[0034] A first sampling module is configured to divide a subgraph based on at least one root node of the dynamic graph sample, and perform time-series sampling on the subgraph to obtain a time-series subgraph of the root node;

[0035] The training module is configured to input the time-series subgraph of the root node into the dynamic graph representation model to obtain the node representation time series of the root node; process the node representation time series of the root node through the time-series model to obtain the node memory representation time series of the root node; use the current node memory representation and the historical node memory representation of the same root node as a positive sample pair, and use the current node memory representation of different root nodes as a negative sample pair, and adopt a comparative learning strategy to train the dynamic graph representation model.

[0036] As an optional implementation manner of the device according to the third aspect, the dynamic graph representation model includes a dynamic graph neural network; and the training module is specifically used for:

[0037] The time-series subgraph of the root node is input into the dynamic graph neural network to obtain the node representation time series of the root node.

[0038] As an optional implementation manner of the device of the third aspect, the dynamic graph representation model includes a dynamic graph neural network and a hybrid expert network model; and the training module is specifically used for:

[0039] Inputting the time-series subgraph of the root node into the dynamic graph neural network to obtain the first node representation time series of the root node;

[0040] Inputting the first node representation time series of the root node into the hybrid expert network model, selecting a corresponding expert model through the gating network of the hybrid expert network model to encode the first node representation time series of the root node, and obtaining a corresponding second node representation time series output by each expert;

[0041] The second node representation time series output by each corresponding expert is weighted to obtain the node representation time series of the root node.

[0042] As an optional implementation manner of the device according to the third aspect, the training module is specifically used for:

[0043] Determining a first loss function according to the similarity of the positive sample pair;

[0044] Determining a second loss function according to the similarity of the negative sample pair;

[0045] A contrastive learning loss function is determined according to the first loss function and the second loss function to update the parameters of the dynamic graph representation model.

[0046] Specifically, the training module is further used for:

[0047] For the root node, determining a third loss function according to a similarity between a current node memory representation of the root node and a current node representation;

[0048] Determining a fourth loss function according to a similarity between the current node representation of the root node and the current node memory representations of other root nodes;

[0049] A contrastive learning loss function is determined according to the first loss function, the second loss function, the third loss function and the fourth loss function to update the parameters of the dynamic graph representation model.

[0050] In a fourth aspect, a dynamic graph anomaly detection device is provided, comprising:

[0051] A second data acquisition module is configured to acquire a target dynamic image;

[0052] A second sampling module is configured to divide a subgraph based on at least one root node of the target dynamic graph, and perform time-series sampling on the subgraph to obtain a time-series subgraph of the root node;

[0053] A dynamic graph representation extraction module is configured to input the time-series subgraph of the root node into a dynamic graph representation model pre-trained using the dynamic graph representation model training method to obtain a node representation time series of the root node;

[0054] A time series feature processing module, configured to process the node representation time series of the root node through a time series model to obtain a node memory representation time series of the root node;

[0055] The detection module is configured to determine, for each root node of the target dynamic graph, a first similarity score according to a current node memory representation and a historical node memory representation of the root node; determine a second similarity score according to a current node memory representation and a current node representation of the root node; determine an outlier score of the root node according to the first similarity score and the second similarity score; and determine whether the root node is an outlier node based on the outlier score of the root node.

[0056] In a fifth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program. When the computer program runs on an electronic device, the electronic device executes the above-mentioned dynamic graph representation model training method, or executes the above-mentioned dynamic graph anomaly detection method.

[0057] In a sixth aspect, an electronic device is provided, including:

[0058] at least one memory for storing a program;

[0059] At least one processor is used to execute the program stored in the memory. When the program stored in the memory is executed, the processor is used to execute the above-mentioned dynamic graph representation model training method, or execute the above-mentioned dynamic graph anomaly detection method.

[0060] The beneficial effect of the dynamic graph representation model training method described in the embodiments of this specification is that the method relies on node memory representation for graph comparison learning during the training process, and can efficiently train the anomaly detection model without labels. The dynamic graph representation model trained based on the above dynamic graph representation model training method can effectively capture graph structure anomalies, node attribute anomalies, and timing anomalies in dynamic graph scenes, and can effectively solve the dynamic graph anomaly detection problem in an unsupervised manner.

[0061] The dynamic graph representation model training device, dynamic graph anomaly detection method and device described in the embodiments of this specification also have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0063] Figure 1 A flow chart of a dynamic graph representation model training method described in an embodiment of this specification is exemplarily shown.

[0064] Figure 2 The structural diagram of a hybrid expert model described in the embodiment of this specification is exemplarily shown.

[0065] Figure 3 A structural diagram of a dynamic graph representation model training framework described in an embodiment of this specification is exemplarily shown.

[0066] Figure 4 A flowchart of a method for detecting anomalies in a dynamic graph described in an embodiment of this specification is exemplarily shown.

[0067] Figure 5 The structural diagram of a dynamic graph representation model training device described in an embodiment of this specification is exemplarily shown.

[0068] Figure 6 The structural diagram of a dynamic graph anomaly detection device described in an embodiment of this specification is exemplarily shown.

[0069] Figure 7 The structural diagram of an electronic device described in an embodiment of this specification is exemplarily shown. DETAILED DESCRIPTION

[0070] First of all, it should be noted that the terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "the" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates otherwise.

[0071] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Therefore, it should be recognized by those skilled in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0072] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

[0073] A temporal graph is a graph whose structure or properties change over time. In a temporal graph, nodes and edges can be added or deleted, and the weight of edges or the properties of nodes can also change over time.

[0074] Dynamic Graph Anomaly Detection refers to identifying nodes, edges or substructures that are significantly different from most data patterns in graph data that changes over time. These anomalies may indicate potential fraud, errors, attacks or other abnormal behaviors. For example, in social networks, normal user interaction patterns may include friendships and message exchanges, while abnormal behaviors may be manifested as frequent interactions with a large number of strangers or abnormally frequent message sending.

[0075] Traditional dynamic graph anomaly detection methods often rely on a large amount of labeled data for model training, but in real applications, due to the continuous updating and changes of data, they often face the problem of lack of labels. This is because new abnormal behaviors may continue to emerge over time, and the existing labeled data may not cover all possible abnormal situations. In addition, since obtaining sufficient labeled data is both costly and time-consuming, and the normal / abnormal samples have a serious sample imbalance problem, the current dynamic graph anomaly detection scheme is not ideal in the implementation process.

[0076] In view of this, one or more embodiments of the present specification propose a dynamic graph representation model training, dynamic graph anomaly detection method and device, which can deeply mine the intrinsic feature information of the dynamic graph and realize node anomaly identification without relying on labels.

[0077] The dynamic graph representation model training, dynamic graph anomaly detection method and device described in one or more embodiments of this specification will be further described in detail below in conjunction with the drawings and specific embodiments of the specification, but this detailed description does not constitute a limitation on the embodiments of this specification.

[0078] First, the technical terms involved in the embodiments of this specification are explained.

[0079] Graph neural network: a type of machine learning model specifically designed to process graph structured data. Unlike traditional neural networks, which are mainly used to process vector or matrix data, the design goal of graph neural networks is to model the nodes and edges in the graph in order to extract useful feature representations from the graph data. The core idea of ​​graph neural networks is to capture the structure and local relationships of the graph by transferring and aggregating information between nodes.

[0080] Temporal Graph: A graph whose structure or properties change over time. In a temporal graph, nodes and edges can be added or deleted, and edge weights or node properties can also change over time. This is in contrast to a static graph, where the structure and properties of the graph remain unchanged over the time period considered.

[0081] Dynamic graph learning or temporal graph learning (TGL): refers to a method of analyzing and learning graph (network) structures and information on graphs that change over time in machine learning and data mining. This concept is based on graph learning or graph mining, and focuses on how to effectively process and analyze graph data that changes dynamically over time.

[0082] Temporal Graph Neural Networks (TGNN): A type of neural network model specifically designed for processing and learning dynamic graph data. TGNNs capture this temporal change by combining the graph structure processing capabilities of Graph Neural Networks (GNNs) with the dynamics of time series modeling.

[0083] Dynamic Graph Anomaly Detection refers to the process of identifying abnormal patterns in graph data that changes over time.

[0084] Graph Contrastive Learning: A self-supervised learning method for graph data that aims to learn useful representations of nodes in the graph. Similar to traditional contrastive learning, graph contrastive learning trains the model by comparing the differences between similar and dissimilar node pairs. In graph contrastive learning, similar node pairs refer to node pairs that have similarities in graph structure and node attributes, while dissimilar node pairs refer to node pairs that have differences in graph structure and node attributes. By bringing the representations of similar node pairs closer together and pushing the representations of dissimilar node pairs apart, the model can learn features that capture the similarities and differences between nodes in the graph.

[0085] Mixture of Experts (MoE) is an integrated learning model that consists of multiple expert networks (usually different models or algorithms) and a gating network. The basic idea of ​​this model is to decompose a complex task into several simple subtasks, each of which is handled by an expert, while the gating network is responsible for deciding which experts should handle each input and how to integrate the outputs of these experts to obtain the final prediction result.

[0086] Please refer to Figure 1 , Figure 1 A flowchart of a dynamic graph representation model training method proposed in one or more embodiments of this specification. Figure 1 The training method shown can be performed by a dynamic graph representation model training device, which can be deployed on a device terminal or set on a server side. The device terminal can be a smart device such as a mobile phone, a tablet computer, a desktop computer, a portable notebook, etc. The server side can be an independent server or a server cluster composed of multiple servers.

[0087] like Figure 1 As shown, in some embodiments, the dynamic graph representation model training method may include steps S100 to S108:

[0088] S100: Obtain dynamic image samples.

[0089] The above dynamic graph sample is a user relationship graph constructed using user relationship data. The above user refers to any entity, such as a person, a physical device, and a virtual device. The user relationship graph contains nodes and edges. Nodes have node attributes, and edges have edge attributes. These node attributes and edge attributes change with driving events, thereby obtaining the above dynamic graph sample.

[0090] In some implementations, an initial relationship graph may be constructed based on the user's initial relationship data, and then a series of pre-constructed driving events may be used to trigger changes in node attributes and edge attributes in the initial relationship graph, thereby constructing the above-mentioned dynamic graph sample.

[0091] It should be noted that the construction method of the above dynamic image samples can be adaptively selected according to needs, and this embodiment does not limit this.

[0092] S102: Divide the subgraph based on at least one root node of the dynamic graph sample, and perform time-series sampling on the subgraph to obtain a time-series subgraph of the root node.

[0093] There is at least one root node in the dynamic graph sample, so the dynamic graph sample can be divided based on the root node to obtain a subgraph of each root node, and then these subgraphs are time-series sampled to obtain a time-series subgraph of each root node.

[0094] In some implementations, assuming that the dynamic graph sample is represented by G and the root node is u, the neighboring nodes of the root node u are sequentially sampled during the existence of the root node u. The specific steps are as follows:

[0095] S1020: First, perform neighbor sampling based on the dynamic graph:

[0096] S u ={v|v∈Ν(u)&T(v)≤T(u)}

[0097] Among them, S u is the set of neighbor nodes of the root node u obtained by sampling, N(u) is the set of all neighbor nodes during the existence of the root node u, T(u) represents the length of time the root node u appears, T(v) represents the length of time the neighbor node v of the root node u appears, and the time when the neighbor node v appears is after the time when the root node u appears.

[0098] S1022: Then based on S u For each neighbor node v in , sample the node set of the next hop of the neighbor node v as the second hop neighbor node set of the root node u. Repeat this process until the k-hop neighbor node set of the root node u is obtained. The neighbor node set of each hop of the root node is taken as a subgraph, thus obtaining the k-hop subgraph of the root node u.

[0099] S1024: Perform time-series sampling on these subgraphs to obtain a k-hop time-series subgraph of the root node u.

[0100] S104: Input the time-series subgraph of the root node into the dynamic graph representation model to obtain the node representation time series of the root node.

[0101] In some implementations, a dynamic graph representation learning model may be used to model the characteristics of the temporal subgraph of the root node, wherein the dynamic graph representation learning model may be implemented using models such as dynamic graph neural network TGAT and TGN. The following uses the dynamic graph neural network TGAT as an example to illustrate the process of modeling the characteristics of the temporal subgraph of the root node.

[0102] Based on step S102, the time-series subgraph of the root node has been obtained. In this step, the message aggregation method of the dynamic graph neural network TGAT is used to obtain the representation of the root node u at each layer (each hop subgraph):

[0103]

[0104] in, is the k-th hop representation of the root node u at time t. MEAN is the mean aggregation function, which averages the representations of all neighbor nodes of the root node u at time t to obtain the aggregated neighbor representation W (k) and b (k) are the training weight matrix and bias matrix of the kth layer respectively. | is the concatenation operation of the matrix. φ(t) is the time coding module, and its expression is: φ(t)=cos(W t ·t+b t ), where W t and b t are the weight matrix and bias matrix of the temporal encoding module respectively.

[0105] Based on the above The expression of can be used to obtain the node representation time series of the root node u.

[0106] Although the dynamic graph neural network can be used to obtain node representations with time information in the above process, the node representations obtained by a single model are prone to overfitting the training data in a certain field, resulting in poor generalization in other fields. Specifically, the behavior patterns of anomaly detection vary greatly in different scenarios (such as abnormal behaviors of social networks and transaction networks), and a single model is difficult to learn abnormal features in different fields. Therefore, in some embodiments, it is further proposed to use a hybrid expert model to improve the generalization ability of the dynamic graph representation model.

[0107] Please refer to Figure 2 , Figure 2 FIG. 1 is a schematic diagram of the structure of a hybrid expert model proposed in one or more embodiments of this specification. Figure 2 As shown in Figure 2, the hybrid expert model consists of an expert network and a gating network. The expert network is defined as N proprietary models, i.e., a series of dynamic graph neural networks, which can be represented by functions {f1,f2,…,f N}. Expert networks are specialized models, each trained to perform well on a subset of the data. The idea of ​​a hybrid expert model is to have multiple experts with complementary strengths to ensure comprehensive coverage of the problem space. The gating network acts as a conductor, coordinating or managing the contributions of individual experts, and it learns (or weighs) which network is good at processing which type of input. The trained gating network can evaluate new input vectors and assign processing responsibility to the most appropriate expert network or combination of expert networks based on their proficiency.

[0108] The dynamic graph neural network is abstracted as a function f, whose input is the time-series subgraph of the root node and whose output is the first node representation time series of the root node. Then the input of the hybrid expert network model is the first node representation time series of the root node, and the gated network of the hybrid expert network model selects a suitable expert network for processing the input first node representation time series, and obtains the corresponding second node representation time series output by each expert. Finally, the hybrid expert network model performs weighted summation on the second node representation time series output by each expert to obtain the node representation time series of the root node.

[0109] Specifically, the above gating network can be expressed as:

[0110] G(x) = softmax(x·W G )

[0111] Among them, W G is the training parameter of the gated network, G is the gated network, and x is the input of the gated network, that is, the first node represents the time series.

[0112] The output of the mixture of experts model can be expressed as:

[0113]

[0114] Through the above method, the hybrid expert model can be used to effectively integrate multiple expert networks to avoid the poor generalization of a single expert network, thereby better coping with the mining and processing of abnormal behavior patterns in different fields.

[0115] S106: Processing the node representation time series of the root node through the time series model to obtain the node memory representation time series of the root node.

[0116] Considering that the node representation changes of normal nodes in the time dimension are generally much smaller than those of abnormal nodes, the graph learning method of memory representation is used in this step to model the graph abnormal information in the time dimension.

[0117] First, the node representation time series of the root node needs to be mapped to the node memory representation time series. Specifically, a time series model can be used to process the node representation time series of the root node to obtain the node memory representation time series of the root node.

[0118] The above-mentioned time series model can be adaptively selected according to the requirements, and this embodiment does not limit this. For example, a network structure such as a GRU network, a LSTM network, a Transformer network, etc. can be used as a time series model.

[0119] Taking the GRU network as an example, the GRU calculates the current memory node representation of the root node based on the historical node representation in the node representation time series of the root node.

[0120] The parameter update formula of the GRU network is as follows:

[0121] m=σ(W m ·z+U m ·h(t-1)+b m )

[0122] r=σ(W r ·z+m*U r ·h(t-1)+b r )

[0123]

[0124] Among them, W m , W r , W h , U m , U r , U h is the weight matrix of the GRU network, b m , b r , b z is the bias coefficient of the GRU network. z is the node representation at the current moment, h is the node memory representation output at the current moment, and h(t-1) is the node memory representation at the previous moment. Each node memory representation obtained is cached, that is, each time a new node memory representation is obtained, the node memory representation is cached into the historical node memory representation.

[0125] S108: The current node memory representation and the historical node memory representation of the same root node are used as positive sample pairs, and the current node memory representations of different root nodes are used as negative sample pairs, and a contrastive learning strategy is used to train the dynamic graph representation model.

[0126] In the above contrastive learning strategy, it is necessary to construct a contrastive learning loss function to update the parameters of the dynamic graph representation model. In some embodiments, the contrastive learning loss function can be constructed in the following manner:

[0127] Determine a first loss function according to the similarity of the positive sample pair;

[0128] Determine a second loss function according to the similarity of the negative sample pair;

[0129] A contrastive learning loss function is determined according to the first loss function and the second loss function to update the parameters of the dynamic graph representation model.

[0130] It should be noted that the above similarity can be measured by using distance functions such as cosine similarity function and Euclidean distance. The similarity calculation method can be adaptively selected according to needs, and this embodiment does not limit this.

[0131] In some embodiments, the first loss function can be expressed as:

[0132]

[0133] Among them, sim() represents cosine similarity, and sim() is defined as:

[0134]

[0135] The second loss function can be expressed as l2(h,n), where h represents the current node memory representation of a root node, n represents the current node memory representation of other root nodes, and n can be randomly sampled from the cached node memory representation.

[0136] Preferably, a third loss function and a fourth loss function may be introduced into the above contrastive learning loss function. The third loss function is determined based on the similarity between the current node memory representation of the root node and the current node representation, and the fourth loss function is determined based on the similarity between the current node representation of the root node and the current node memory representations of other root nodes.

[0137] Specifically, the third loss function can be expressed as:

[0138]

[0139] Correspondingly, the fourth loss function can be expressed as l4(z,n), where z represents the current node representation of a root node, n represents the current node memory representation of other root nodes, and n can be randomly sampled from the cached node memory representation.

[0140] The contrastive learning loss function is determined based on the first loss function, the second loss function, the third loss function and the fourth loss function as follows:

[0141] L=-l1(h,h(t-1))-l3(h,z)+l2(h,n)+l4(z,n)

[0142] By optimizing the above contrastive learning loss at the training node, the dynamic graph representation model can be trained in an unsupervised manner.

[0143] It can be seen that in Figure 1 In the dynamic graph representation model training method shown, the dynamic graph representation model is used to simultaneously learn graph structure information and timing information, thereby capturing graph structure anomalies, node attribute anomalies, and timing anomalies in dynamic graph scenes. In addition, a graph learning method based on memory representation is used to model graph anomaly information in the time dimension, and then a contrastive learning method is used to train the dynamic graph representation model, and node labels are not required during the training process.

[0144] Next, we will combine a specific training framework to explain the implementation process of the above training method. Figure 3 , Figure 3 The structure diagram of a dynamic graph representation model training framework proposed in one or more embodiments of this specification is shown in FIG. The training framework mainly includes a dynamic graph representation model, a memory representation extraction and update module, and a comparison module.

[0145] The dynamic graph representation model includes a dynamic graph neural network and a hybrid expert network. The dynamic graph representation model is mainly used to perform preliminary feature extraction on the temporal subgraph of the input root node, while the hybrid expert network is used to select a suitable expert network to further process the preliminary node features output by the dynamic graph representation model to improve the generalization ability of the dynamic graph representation model.

[0146] The memory representation extraction and update module mainly includes a memory cache module and a memory update module. Among them, the memory cache module is used to store and index the historical node memory representation of the root node, which is essentially a zero-initialized matrix. The memory update module is essentially a time series network, which can be implemented through a GRU network, and is used to obtain the current node memory representation based on the current node representation and the historical node memory representation.

[0147] The contrast module is used to construct a contrastive learning loss function using a contrastive learning strategy, thereby using the contrastive learning loss function to update the dynamic graph representation model.

[0148] according to Figure 3 The training framework shown in the figure has the following training process:

[0149] Perform root node-based temporal sampling on the dynamic graph samples to obtain the temporal subgraph of the root node;

[0150] Input the time-series subgraph of the root node into the dynamic graph neural network to obtain the first node representation time series of the root node;

[0151] The first node representation time series of the root node is input into the hybrid expert network model, and the corresponding expert model is selected through the gating network of the hybrid expert network model to further encode the first node representation time series of the root node to obtain the corresponding second node representation time series output by each expert; the corresponding second node representation time series output by each expert is weighted to obtain the node representation time series of the root node;

[0152] Input the node representation time series of the root node into the memory update module to obtain the node memory representation time series of the root node;

[0153] Update the node memory representation time series of the root node into the memory cache module;

[0154] In the comparison module, the contrastive learning strategy is used to construct a contrastive learning loss function to update the parameters of the dynamic graph representation model until the target dynamic graph representation model is obtained.

[0155] Based on the dynamic representation model trained by the above dynamic representation model training method, this implementation also provides a dynamic graph anomaly detection method. Figure 4 , Figure 4 Flowchart of a method for detecting anomalies in a dynamic graph proposed in one or more embodiments of this specification. Figure 4 As shown, the method includes steps S400 to S410:

[0156] S400: Acquire a target dynamic image.

[0157] S402: Divide the subgraph based on at least one root node of the target dynamic graph, and perform time-series sampling on the subgraph to obtain a time-series subgraph of the root node.

[0158] S404: Input the time-series subgraph of the root node into the dynamic graph representation model to obtain the node representation time series of the root node.

[0159] S406: Processing the node representation time series of the root node through the time series model to obtain the node memory representation time series of the root node.

[0160] S408: For each root node of the target dynamic graph, determine a first similarity score according to the current node memory representation and the historical node memory representation of the root node; and determine a second similarity score according to the current node memory representation and the current node representation of the root node.

[0161] S410: Determine an outlier score of the root node according to the first similarity score and the second similarity score, and determine whether the root node is an outlier node based on the outlier score of the root node.

[0162] For the above-mentioned steps 400 to 406, their specific processes can refer to the corresponding steps of the above-mentioned dynamic graph representation model training method, which will not be repeated here.

[0163] As for step S408, in this step, the following formula may be used to calculate the first similarity score and the second similarity score:

[0164] s1=1-sim(h,h(t-1))

[0165] s2=1-sim(h,z)

[0166] Here, s1 represents the first similarity score, and s2 represents the second similarity score.

[0167] For step S410, the following formula may be used to calculate the outlier score of the root node:

[0168] s=(s1+s2) / 2

[0169] Among them, s represents the outlier score of the root node, which is between 0 and 1. The higher the outlier score, the greater the probability of the node being abnormal.

[0170] After obtaining the outlier score of the root node, you can determine whether the root node is abnormal by setting the anomaly detection threshold.

[0171] visible, Figure 4 In the dynamic graph anomaly detection method shown, it is necessary to first perform time-series sampling on the target dynamic graph to be detected, so as to obtain a time-series subgraph that meets the input requirements of the above-mentioned dynamic graph representation model. Then, the above-mentioned dynamic graph representation model is used to capture the graph structure anomalies, node attribute anomalies, and time-series anomalies in the target dynamic graph, and finally, the root node is judged to be abnormal through similarity comparison.

[0172] Corresponding to the above-mentioned dynamic graph representation model training method, this embodiment also provides a dynamic graph representation model training device. Figure 5 , Figure 5 The exemplary embodiment shows a dynamic graph representation model training device, which can be used to implement the above-mentioned dynamic graph representation model training method. It should be noted that the dynamic graph representation model training method described in one or more embodiments of the present application can rely on Figure 5 The dynamic graph representation model training device shown is implemented, but not limited to this training device.

[0173] like Figure 5 As shown, the training device comprises:

[0174] The first data acquisition module 501 is configured to acquire dynamic image samples.

[0175] The first sampling module 502 is configured to divide the subgraphs based on at least one root node of the dynamic graph sample, and perform time-series sampling on the subgraphs to obtain time-series subgraphs of the root nodes.

[0176] The training module 503 is configured to input the time-series subgraph of the root node into the dynamic graph representation model to obtain the node representation time series of the root node; process the node representation time series of the root node through the time-series model to obtain the node memory representation time series of the root node; use the current node memory representation and the historical node memory representation of the same root node as a positive sample pair, and use the current node memory representation of different root nodes as a negative sample pair, and adopt a comparative learning strategy to train the dynamic graph representation model.

[0177] For the first data acquisition module 501, the dynamic graph sample acquired is a user relationship graph constructed using user relationship data, and the above-mentioned user refers to any entity, such as a person, a physical device, and a virtual device. The user relationship graph includes nodes and edges, and the nodes have node attributes and the edges have edge attributes. These node attributes and edge attributes will change with the driving event, thereby obtaining the above-mentioned dynamic graph sample.

[0178] In some embodiments, the first data acquisition module 501 can construct an initial relationship graph based on the user's initial relationship data, and then trigger changes in node attributes and edge attributes in the initial relationship graph through a series of pre-constructed driving events, thereby constructing the above-mentioned dynamic graph sample.

[0179] It should be noted that the construction method of the above dynamic image samples can be adaptively selected according to needs, and this embodiment does not limit this.

[0180] For the first sampling module 502 mentioned above, the first sampling module 502 can divide the dynamic graph sample based on the root node to obtain the subgraph of each root node, and then perform time-series sampling on the subgraphs to obtain the time-series subgraph of each root node.

[0181] In some implementations, assuming that the dynamic graph sample is represented by G and the root node is u, the first sampling module 502 may perform time-series sampling on its neighboring nodes during the existence of the root node u, and the specific steps are as follows:

[0182] First, perform neighbor sampling based on dynamic graph:

[0183] S u ={v|v∈Ν(u)&T(v)≤T(u)}

[0184] Among them, S uis the set of neighbor nodes of the root node u obtained by sampling, N(u) is the set of all neighbor nodes during the existence of the root node u, T(u) represents the length of time the root node u appears, T(v) represents the length of time the neighbor node v of the root node u appears, and the time when the neighbor node v appears is after the time when the root node u appears.

[0185] Then based on S u For each neighbor node v in , sample the node set of the next hop of the neighbor node v as the second hop neighbor node set of the root node u. Repeat this process until the k-hop neighbor node set of the root node u is obtained. The neighbor node set of each hop of the root node is taken as a subgraph, thus obtaining the k-hop subgraph of the root node u.

[0186] Finally, these subgraphs are temporally sampled to obtain the k-hop temporal subgraph of the root node u.

[0187] For the above-mentioned training module 503, the dynamic graph representation model in the training module 503 can be implemented using a dynamic graph neural network, and the training module 503 can input the time-series subgraph of the root node into the dynamic graph neural network to obtain the node representation time series of the root node.

[0188] In some implementations, the dynamic graph representation model in the training module 503 may also include a dynamic graph neural network and a hybrid expert network model. Then the specific steps of extracting the node representation time series of the root node in the training module 503 may be:

[0189] Input the time-series subgraph of the root node into the dynamic graph neural network to obtain the first node representation time series of the root node;

[0190] Inputting the first node representation time series of the root node into the hybrid expert network model, selecting the corresponding expert model through the gating network of the hybrid expert network model to encode the first node representation time series of the root node, and obtaining the corresponding second node representation time series output by each expert;

[0191] The second node representation time series output by each corresponding expert is weighted to obtain the node representation time series of the root node.

[0192] For the above-mentioned training module 503, the training module 503 also needs to map the node representation time series of the root node to the node memory representation time series. Specifically, the training module 503 can use a timing model to process the node representation time series of the root node to obtain the node memory representation time series of the root node. The above-mentioned timing model can be adaptively selected according to demand, and this embodiment does not limit this. For example, network structures such as GRU network, LSTM network, Transformer network, etc. can be used as timing models.

[0193] For the above training module 503, the training module 503 may construct a contrastive learning loss function in the following manner:

[0194] The current node memory representation and the historical node memory representation of the same root node are taken as positive sample pairs, and the current node memory representations of different root nodes are taken as negative sample pairs;

[0195] Determine a first loss function according to the similarity of the positive sample pair;

[0196] Determine a second loss function according to the similarity of the negative sample pair;

[0197] A contrastive learning loss function is determined according to the first loss function and the second loss function to update the parameters of the dynamic graph representation model.

[0198] It should be noted that the above similarity can be measured by using distance functions such as cosine similarity function and Euclidean distance. The similarity calculation method can be adaptively selected according to needs, and this embodiment does not limit this.

[0199] In some embodiments, the first loss function can be expressed as:

[0200]

[0201] Among them, sim() represents cosine similarity, and sim() is defined as:

[0202]

[0203] The second loss function can be expressed as l2(h,n), where h represents the current node memory representation of a root node, n represents the current node memory representation of other root nodes, and n can be randomly sampled from the cached node memory representation.

[0204] Preferably, a third loss function and a fourth loss function may be introduced into the contrastive learning loss function constructed by the training module 503. The third loss function is determined based on the similarity between the current node memory representation of the root node and the current node representation, and the fourth loss function is determined based on the similarity between the current node representation of the root node and the current node memory representations of other root nodes.

[0205] Specifically, the third loss function can be expressed as:

[0206]

[0207] Correspondingly, the fourth loss function can be expressed as l4(z,n), where z represents the current node representation of a root node, n represents the current node memory representation of other root nodes, and n can be randomly sampled from the cached node memory representation.

[0208] The training module 503 may determine the contrastive learning loss function based on the first loss function, the second loss function, the third loss function, and the fourth loss function as follows:

[0209] L=-l1(h,h(t-1))-l3(h,z)+l2(h,n)+l4(z,n).

[0210] For the above-mentioned dynamic graph representation model training device, taking a module as an example of a software functional unit, the first data acquisition module 501 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the first data acquisition module 501 may include code running on multiple hosts / virtual machines / containers. The multiple hosts / virtual machines / containers used to run the code may be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including a data center or multiple data centers with close geographical locations. Among them, usually a region may include multiple AZs.

[0211] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0212] As an example of a hardware functional unit, the first data acquisition module 501 may include at least one computing device, such as a server, etc. Alternatively, the first data acquisition module 501 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0213] The multiple computing devices included in the first data acquisition module 501 can be distributed in the same region or in different regions. The multiple computing devices included in the first data acquisition module 501 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the first data acquisition module 501 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0214] In other embodiments, the first data acquisition module 501 can be used to execute any step in the above-mentioned dynamic graph representation model training method, the first sampling module 502 can be used to execute any step in the above-mentioned dynamic graph representation model training method, and the training module 503 can be used to execute any step in the above-mentioned dynamic graph representation model training method. The steps that the first data acquisition module 501, the first sampling module 502 and the training module 503 are responsible for implementing can be specified as needed, and the first data acquisition module 501, the first sampling module 502 and the training module 503 respectively implement different steps in the above-mentioned dynamic graph representation model training method to realize all the functions of the above-mentioned dynamic graph representation model training device.

[0215] In this implementation, the training device can also be applied to computing devices such as computers and servers, or to a computing device cluster including at least one computing device, to realize the function of dynamic graph representation model training.

[0216] Corresponding to the above-mentioned dynamic graph anomaly detection method, this embodiment also provides a dynamic graph anomaly detection device. Figure 6 , Figure 6The schematic diagram of the structure of a dynamic graph anomaly detection device is shown as an example, which can be used to implement the above-mentioned dynamic graph anomaly detection method. It should be noted that the dynamic graph anomaly detection method described in one or more embodiments of the present application can rely on Figure 6 The dynamic graph anomaly detection device shown is implemented, but not limited to this device.

[0217] like Figure 6 As shown, the dynamic graph anomaly detection device comprises:

[0218] The second data acquisition module 601 is configured to acquire a target dynamic image.

[0219] The second sampling module 602 is configured to divide the subgraph based on at least one root node of the target dynamic graph, and perform time-series sampling on the subgraph to obtain a time-series subgraph of the root node.

[0220] The dynamic graph representation extraction module 603 is configured to input the time-series subgraph of the root node into a pre-trained dynamic graph representation model to obtain a node representation time series of the root node.

[0221] The time series feature processing module 604 is configured to process the node representation time series of the root node through the time series model to obtain the node memory representation time series of the root node.

[0222] The detection module 605 is configured to determine, for each root node of the target dynamic graph, a first similarity score based on the current node memory representation and the historical node memory representation of the root node; determine a second similarity score based on the current node memory representation and the current node representation of the root node; determine an outlier score of the root node based on the first similarity score and the second similarity score; and determine whether the root node is an abnormal node based on the outlier score of the root node.

[0223] For the second data acquisition module 601, the target dynamic graph acquired is pre-constructed using user relationship data, and the user mentioned above refers to any entity, such as a person, a physical device, and a virtual device, etc. The user relationship graph includes nodes and edges, and the nodes have node attributes and the edges have edge attributes, and these node attributes and edge attributes will change over time.

[0224] Regarding the above-mentioned second sampling module 602, the second sampling module 602 can divide the target dynamic graph based on the root node to obtain a subgraph of each root node, and then perform time-series sampling on these subgraphs to obtain a time-series subgraph of each root node.

[0225] With respect to the above-mentioned dynamic graph representation extraction module 603, the dynamic graph representation extraction module 603 may adopt the above-mentioned dynamic graph representation model training method to train the dynamic graph representation model in advance, or may directly load the offline trained dynamic graph representation model.

[0226] The above-mentioned dynamic graph representation model can be implemented using a dynamic graph neural network, and the dynamic graph representation extraction module 603 is specifically used to input the time-series subgraph of the root node into a pre-trained dynamic graph neural network to obtain the node representation time series of the root node.

[0227] The above-mentioned dynamic graph representation model may include a dynamic graph neural network and a hybrid expert model, and the dynamic graph representation extraction module 603 is specifically used to input the time-series subgraph of the root node into the dynamic graph neural network to obtain the first node representation time series of the root node; input the first node representation time series of the root node into the hybrid expert network model, and select the corresponding expert model through the gating network of the hybrid expert network model to encode the first node representation time series of the root node to obtain the corresponding second node representation time series output by each expert; weight the corresponding second node representation time series output by each expert to obtain the node representation time series of the root node.

[0228] For the above-mentioned time series feature processing module 604, the time series feature processing module 604 can use a time series model to process the node representation time series of the root node to obtain the node memory representation time series of the root node. The above-mentioned time series model can be adaptively selected according to the needs, and this embodiment does not limit this. For example, a network structure such as a GRU network, an LSTM network, and a Transformer network can be used as a time series model.

[0229] With respect to the above detection module 605, the detection module 605 may use the following formula to calculate the first similarity score and the second similarity score:

[0230] s1=1-sim(h,h(t-1))

[0231] s2=1-sim(h,z)

[0232] Here, s1 represents the first similarity score, and s2 represents the second similarity score.

[0233] The detection module 605 may also use the following formula to calculate the outlier score of the root node, and after obtaining the outlier score of the root node, determine whether the root node is abnormal by setting an anomaly detection threshold.

[0234] The expression for the outlier score of the root node is:

[0235] s=(s1+s2) / 2

[0236] Among them, s represents the outlier score of the root node, which is between 0 and 1. The higher the outlier score, the greater the probability of the node being abnormal.

[0237] For the above-mentioned dynamic graph anomaly detection device, taking a module as an example of a software functional unit, the second data acquisition module 601 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the second data acquisition module 601 may include code running on multiple hosts / virtual machines / containers. Multiple hosts / virtual machines / containers for running the code may be distributed in the same region (region) or in different regions. Furthermore, multiple hosts / virtual machines / containers for running the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including a data center or multiple data centers with similar geographical locations. Among them, usually a region may include multiple AZs.

[0238] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0239] As an example of a hardware functional unit, the second data acquisition module 601 may include at least one computing device, such as a server, etc. Alternatively, the second data acquisition module 601 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0240] The multiple computing devices included in the second data acquisition module 601 can be distributed in the same region or in different regions. The multiple computing devices included in the second data acquisition module 601 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the second data acquisition module 601 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0241] In other embodiments, the second data acquisition module 601 can be used to execute any step in the above-mentioned dynamic graph anomaly detection method, the second sampling module 602 can be used to execute any step in the above-mentioned dynamic graph anomaly detection method, the dynamic graph representation extraction module 603 can be used to execute any step in the above-mentioned dynamic graph anomaly detection method, the time series feature processing module 604 can be used to execute any step in the above-mentioned dynamic graph anomaly detection method, and the detection module 605 can be used to execute any step in the above-mentioned dynamic graph anomaly detection method. The steps that the second data acquisition module 601, the second sampling module 602, the dynamic graph representation extraction module 603, the time series feature processing module 604 and the detection module 605 are responsible for implementing can be specified as needed, and the second data acquisition module 601, the second sampling module 602, the dynamic graph representation extraction module 603, the time series feature processing module 604 and the detection module 605 respectively implement different steps in the above-mentioned dynamic graph anomaly detection method to realize all the functions of the above-mentioned dynamic graph anomaly detection device.

[0242] In this implementation, the dynamic graph anomaly detection device can also be applied to computing devices such as computers and servers, or to a computing device cluster including at least one computing device, to perform dynamic graph anomaly detection.

[0243] In some embodiments, an electronic device is also provided. Figure 7 , the electronic device includes: a bus 701, a processor 702, a memory 703 and a communication interface 704. The processor 702, the memory 703 and the communication interface 704 communicate with each other through the bus 701. The electronic device can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the electronic device.

[0244] The bus 701 may be a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 The use of only one line does not mean that there is only one bus or one type of bus. Bus 701 may include a path for transmitting information between various components of the electronic device (eg, processor 702, memory 703, and communication interface 704).

[0245] The processor 702 may include any one or more of a processor such as a CPU, a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0246] The memory 703 may include a volatile memory, such as a random access memory (RAM). The memory 703 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0247] The memory 703 stores executable program codes, and the processor 702 executes the executable program codes to respectively implement the functions of the aforementioned first data acquisition module 501, the first sampling module 502, and the training module 503, that is, to implement the functions of the aforementioned dynamic graph representation model training device, thereby implementing the aforementioned dynamic graph representation model training method. Alternatively, the processor 702 executes the executable program codes to respectively implement the functions of the aforementioned second data acquisition module 601, the second sampling module 602, the dynamic graph representation extraction module 603, the time series feature processing module 604, and the detection module 605, that is, to implement the functions of the aforementioned dynamic graph anomaly detection device, thereby implementing the aforementioned dynamic graph anomaly detection method.

[0248] The communication interface 704 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the electronic device and other devices or a communication network.

[0249] In some embodiments, a computer-readable storage medium is also provided, on which a computer program is stored. When the computer program is executed by a processor, it implements the above-mentioned dynamic graph representation model training method, or implements the above-mentioned dynamic graph anomaly detection method.

[0250] The computer-readable storage medium may be any available medium that can be stored in an electronic device or a data storage device such as a data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the electronic device to execute the above-mentioned dynamic graph representation model training method, or to execute the above-mentioned dynamic graph anomaly detection method.

[0251] It is to be understood that the structure illustrated in the embodiments of this specification does not constitute a specific limitation on the system of the embodiments of this specification. In other embodiments of the specification, the above system may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0252] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0253] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0254] It should be noted that the above examples are only specific embodiments of the present invention, and the present invention is obviously not limited to the above examples, and there are many similar variations. All variations directly derived or associated from the contents disclosed by the technicians in this field should fall within the protection scope of the present invention.

Claims

1. A dynamic graph representation model training method, comprising: Get dynamic image samples; Dividing a subgraph based on at least one root node of the dynamic graph sample, and performing time-series sampling on the subgraph to obtain a time-series subgraph of the root node; Inputting the time-series subgraph of the root node into the dynamic graph representation model to obtain a node representation time series of the root node; Processing the node representation time series of the root node through a time series model to obtain a node memory representation time series of the root node; The current node memory representation and the historical node memory representation of the same root node are used as positive sample pairs, and the current node memory representations of different root nodes are used as negative sample pairs. A contrastive learning strategy is used to train the dynamic graph representation model.

2. According to the method of claim 1, the dynamic graph representation model comprises a dynamic graph neural network; inputting the time-series subgraph of the root node into the dynamic graph representation model to obtain the node representation time series of the root node specifically comprises: The time-series subgraph of the root node is input into the dynamic graph neural network to obtain the node representation time series of the root node.

3. According to the method of claim 1, the dynamic graph representation model includes a dynamic graph neural network and a hybrid expert network model; inputting the time series subgraph of the root node into the dynamic graph representation model to obtain the node representation time series of the root node specifically includes: Inputting the time-series subgraph of the root node into the dynamic graph neural network to obtain the first node representation time series of the root node; Inputting the first node representation time series of the root node into the hybrid expert network model, selecting a corresponding expert model through the gating network of the hybrid expert network model to encode the first node representation time series of the root node, and obtaining a corresponding second node representation time series output by each expert; The second node representation time series output by each corresponding expert is weighted to obtain the node representation time series of the root node.

4. The method according to claim 1, wherein a contrastive learning strategy is used to train the dynamic graph representation model, specifically comprising: Determining a first loss function according to the similarity of the positive sample pair; Determining a second loss function according to the similarity of the negative sample pair; A contrastive learning loss function is determined according to the first loss function and the second loss function to update the parameters of the dynamic graph representation model.

5. The method according to claim 4, wherein a contrastive learning strategy is used to train the dynamic graph representation model, further comprising: For the root node, determining a third loss function according to a similarity between a current node memory representation of the root node and a current node representation; Determining a fourth loss function according to a similarity between the current node representation of the root node and the current node memory representations of other root nodes; A contrastive learning loss function is determined according to the first loss function, the second loss function, the third loss function and the fourth loss function to update the parameters of the dynamic graph representation model.

6. A method for detecting anomalies in a dynamic graph, comprising: Get the target dynamic image; Dividing a subgraph based on at least one root node of the target dynamic graph, and performing time-series sampling on the subgraph to obtain a time-series subgraph of the root node; Inputting the time-series subgraph of the root node into a dynamic graph representation model pre-trained by the method according to any one of claims 1 to 5 to obtain a node representation time series of the root node; Processing the node representation time series of the root node through a time series model to obtain a node memory representation time series of the root node; For each root node of the target dynamic graph, determine a first similarity score according to a current node memory representation and a historical node memory representation of the root node; Determining a second similarity score based on the current node memory representation and the current node representation of the root node; Determining an outlier score of the root node according to the first similarity score and the second similarity score; Based on the outlier score of the root node, it is determined whether the root node is an outlier node.

7. A dynamic graph representation model training device, comprising: A first data acquisition module, configured to acquire dynamic image samples; A first sampling module is configured to divide a subgraph based on at least one root node of the dynamic graph sample, and perform time-series sampling on the subgraph to obtain a time-series subgraph of the root node; A training module is configured to input the time-series subgraph of the root node into the dynamic graph representation model to obtain a node representation time series of the root node; The node representation time series of the root node is processed through a timing model to obtain the node memory representation time series of the root node; the current node memory representation and the historical node memory representation of the same root node are used as positive sample pairs, and the current node memory representations of different root nodes are used as negative sample pairs, and a comparative learning strategy is used to train the dynamic graph representation model.

8. The apparatus according to claim 7, wherein the dynamic graph representation model comprises a dynamic graph neural network; The training module is specifically used for: The time-series subgraph of the root node is input into the dynamic graph neural network to obtain the node representation time series of the root node.

9. The device according to claim 7, wherein the dynamic graph representation model comprises a dynamic graph neural network and a hybrid expert network model; and the training module is specifically used for: Inputting the time-series subgraph of the root node into the dynamic graph neural network to obtain the first node representation time series of the root node; Inputting the first node representation time series of the root node into the hybrid expert network model, selecting a corresponding expert model through the gating network of the hybrid expert network model to encode the first node representation time series of the root node, and obtaining a corresponding second node representation time series output by each expert; The second node representation time series output by each corresponding expert is weighted to obtain the node representation time series of the root node.

10. The device according to claim 7, wherein the training module is specifically used for: Determining a first loss function according to the similarity of the positive sample pair; Determining a second loss function according to the similarity of the negative sample pair; A contrastive learning loss function is determined according to the first loss function and the second loss function to update the parameters of the dynamic graph representation model.

11. The apparatus according to claim 10, wherein the training module is further configured to: For the root node, determining a third loss function according to a similarity between a current node memory representation of the root node and a current node representation; Determining a fourth loss function according to a similarity between the current node representation of the root node and the current node memory representations of other root nodes; A contrastive learning loss function is determined according to the first loss function, the second loss function, the third loss function and the fourth loss function to update the parameters of the dynamic graph representation model.

12. A dynamic graph anomaly detection device, comprising: A second data acquisition module is configured to acquire a target dynamic image; A second sampling module is configured to divide a subgraph based on at least one root node of the target dynamic graph, and perform time-series sampling on the subgraph to obtain a time-series subgraph of the root node; A dynamic graph representation extraction module, configured to input the time-series subgraph of the root node into a dynamic graph representation model pre-trained by the method according to any one of claims 1 to 5, to obtain a node representation time series of the root node; A time series feature processing module, configured to process the node representation time series of the root node through a time series model to obtain a node memory representation time series of the root node; A detection module configured to determine, for each root node of the target dynamic graph, a first similarity score according to a current node memory representation and a historical node memory representation of the root node; Determining a second similarity score based on the current node memory representation and the current node representation of the root node; Determining an outlier score of the root node according to the first similarity score and the second similarity score; Based on the outlier score of the root node, it is determined whether the root node is an outlier node.

13. A computer-readable storage medium storing a computer program, wherein when the computer program is executed on an electronic device, the electronic device executes the method according to any one of claims 1 to 5, or the method according to claim 6.

14. An electronic device comprising: at least one memory for storing a program; At least one processor is used to execute the program stored in the memory. When the program stored in the memory is executed, the processor is used to execute the method according to any one of claims 1 to 5, or execute the method according to claim 6.

Images