Abnormal behavior detection method and device, equipment and storage medium

Abstract

The invention relates to the technical field of communication, and discloses an abnormal behavior detection method, device and equipment and a storage medium, and the method comprises the steps: inputting call data and environment data of each network node in a communication network into an improved graph neural network model which comprises a node feature extraction layer and an edge feature integration layer, the node feature extraction layer adopts an adaptive graph convolution algorithm, the edge feature integration layer adopts a dynamic attention mechanism, convolution parameters of an improved graph neural network model are adjusted through the adaptive graph convolution algorithm according to call data and environment data, and node features of a communication network are calculated based on the adjusted convolution parameters; according to the method, the edge weights among the network nodes are adjusted through a dynamic attention mechanism according to the call data and the environment data, the edge features of the communication network are obtained, and the network nodes with abnormal behaviors in the communication network are determined according to the node features and the edge features, so that the detection precision of the abnormal behaviors can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an abnormal behavior detection method, device, equipment and storage medium. Background Art

[0002] In the field of abnormality detection of communication bills, related technologies usually use traditional data analysis methods and basic bill content analysis to identify fraudulent behavior and abnormal communication patterns. These technologies involve simple data statistics and result analysis, such as threshold detection, cluster analysis, and decision trees. The above abnormal behavior detection methods usually rely on pre-defined features and manually set thresholds, and have the defect of low detection accuracy. Summary of the invention

[0003] The main purpose of the present application is to provide an abnormal behavior detection method, device, equipment and storage medium, aiming to solve the technical problem that existing abnormal behavior detection methods usually rely on pre-defined features and manually set thresholds, and have the defect of low detection accuracy.

[0004] To achieve the above objectives, the present application provides an abnormal behavior detection method, which includes:

[0005] Inputting the call data and environment data of each network node in the communication network into an improved graph neural network model, wherein the improved graph neural network model includes a node feature extraction layer and an edge feature integration layer, the node feature extraction layer adopts an adaptive graph convolution algorithm, and the edge feature integration layer adopts a dynamic attention mechanism;

[0006] Adjusting the convolution parameters of the improved graph neural network model by an adaptive graph convolution algorithm according to the call data and the environmental data, and calculating the node features of the communication network based on the adjusted convolution parameters, wherein the node features are used to represent the dynamic behavior of each network node;

[0007] According to the call data and the environment data, the edge weights between the network nodes are adjusted by the dynamic attention mechanism to obtain edge features of the communication network, wherein the edge weights are used to represent the importance of the interaction behaviors between the network nodes;

[0008] A network node with abnormal behavior in the communication network is determined according to the node feature and the edge feature.

[0009] Optionally, adjusting the convolution parameters of the improved graph neural network model according to the call data and the environment data, and calculating the node features of the communication network by an adaptive graph convolution algorithm based on the adjusted convolution parameters, includes:

[0010] Dynamically generate an adjacency matrix based on the call data and the environment data;

[0011] Adjusting the convolution parameters of the improved graph neural network model based on the adjacency matrix to obtain adjusted convolution parameters;

[0012] The node features of the communication network are calculated using an adaptive graph convolution algorithm according to the adjacency matrix and the adjusted convolution parameters.

[0013] Optionally, dynamically generating an adjacency matrix according to the call data and the environment data includes:

[0014] Constructing an initial adjacency matrix according to the number of nodes in the communication network, wherein the rows and columns in the initial adjacency matrix correspond to the network nodes in the communication network respectively, and the elements in the initial adjacency matrix represent the connection strength between the network nodes;

[0015] Calculate the connection strength between each network node according to the call data and the environment data;

[0016] The calculated connection strength values ​​are filled into corresponding positions in the initial adjacency matrix to obtain an adjacency matrix.

[0017] Optionally, adjusting the edge weights between network nodes through the dynamic attention mechanism according to the call data and the environment data to obtain edge features of the communication network includes:

[0018] Analyze the call records and data usage between the network nodes based on the call data and the environment data;

[0019] Calculating an attention coefficient according to the call records and the data usage, wherein the attention coefficient is used to represent the interaction intensity between each network node;

[0020] The edge weights between the network nodes are adjusted according to the calculated attention coefficient to obtain the edge features of the communication network.

[0021] Optionally, adjusting the edge weights between the network nodes according to the calculated attention coefficient to obtain the edge features of the communication network includes:

[0022] Obtaining node features of each network node and converting the node features into feature vectors;

[0023] Multiplying the feature vectors by weight matrices respectively to obtain transformed feature vectors, wherein the weight matrices are used to represent the importance of different node features in edge weight calculation;

[0024] Performing normalization calculation according to the transformed feature vector, the attention coefficient, and a nonlinear activation function with parameters to obtain a target edge weight;

[0025] The edge weights between the network nodes are adjusted to the target edge weights to obtain edge features of the communication network.

[0026] Optionally, before inputting the call data and environment data of each network node in the communication network into the improved graph neural network model, the method further includes:

[0027] Obtain call records, SMS records, and data traffic usage of each network node in the communication network;

[0028] Constructing call data of each network node according to at least one of the call record, the text message record and the data traffic usage;

[0029] The location information of each network node in the communication network is obtained, and the environment data of each network node is constructed according to the location information.

[0030] Optionally, the acquiring location information of each network node in the communication network and constructing environment data of each network node according to the location information includes:

[0031] Obtaining satellite positioning data, wireless network positioning data, and mobile network signal strength data of each network node in the communication network;

[0032] According to at least one of the satellite positioning data, the wireless network positioning data and the mobile network signal strength data, the location information of each network node in the communication network is calculated through a weighted hybrid model, and the environmental data of each network node is constructed according to the location information.

[0033] In addition, to achieve the above objectives, the present application also proposes an abnormal behavior detection device, the abnormal behavior detection device comprising:

[0034] A data input module, used to input the call data and environment data of each network node in the communication network into the improved graph neural network model, wherein the improved graph neural network model includes a node feature extraction layer and an edge feature integration layer, the node feature extraction layer adopts an adaptive graph convolution algorithm, and the edge feature integration layer adopts a dynamic attention mechanism;

[0035] A model processing module, used to adjust the convolution parameters of the improved graph neural network model through an adaptive graph convolution algorithm according to the call data and the environmental data, and calculate the node characteristics of the communication network based on the adjusted convolution parameters, wherein the node characteristics are used to represent the dynamic behavior of each network node;

[0036] The model processing module is further used to adjust the edge weights between the network nodes through the dynamic attention mechanism according to the call data and the environment data to obtain the edge features of the communication network, wherein the edge weights are used to represent the importance of the interaction behavior between the network nodes;

[0037] A behavior detection module is used to determine network nodes with abnormal behavior in the communication network based on the node characteristics and the edge characteristics.

[0038] In addition, to achieve the above-mentioned purpose, the present application also proposes an abnormal behavior detection device, which includes a memory, a processor, and an abnormal behavior detection program stored in the memory and executable on the processor, and the abnormal behavior detection program is configured to implement the abnormal behavior detection method described above.

[0039] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, on which an abnormal behavior detection program is stored, and when the abnormal behavior detection program is executed by a processor, the abnormal behavior detection method as described above is implemented.

[0040] One or more technical solutions proposed in this application have at least the following technical effects:

[0041] In the present application, the call data and environmental data of each network node in the communication network are input into an improved graph neural network model, wherein the improved graph neural network model includes a node feature extraction layer and an edge feature integration layer, the node feature extraction layer adopts an adaptive graph convolution algorithm, and the edge feature integration layer adopts a dynamic attention mechanism. The convolution parameters of the improved graph neural network model are adjusted by the adaptive graph convolution algorithm according to the call data and the environmental data, and the node features of the communication network are calculated based on the adjusted convolution parameters, wherein the node features are used to represent the dynamic behavior of each network node, and the edge weights between each network node are adjusted by the dynamic attention mechanism according to the call data and the environmental data to obtain the edge features of the communication network, wherein the edge weights are used to represent The importance of the interactive behavior between each network node is indicated, and the network nodes with abnormal behavior in the communication network are determined according to the node characteristics and edge characteristics; since the improved graph neural network model of the present application introduces an adaptive graph convolution algorithm and a dynamic attention mechanism, the node characteristics of the communication network are extracted through an adaptive graph convolution algorithm according to call data and environmental data to reflect the dynamic behavior of each network node, and the edge weights between each network node are adjusted in real time through the dynamic attention mechanism to obtain the edge characteristics of the communication network to reflect the interactive behavior between each network node. By comprehensively analyzing the node characteristics and edge characteristics, the dynamic behavior and interactive behavior of each network node in the communication network can be effectively captured, thereby improving the detection accuracy of abnormal behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0043] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0044] Figure 1 This is a flow chart of the first embodiment of the abnormal behavior detection method of the present application;

[0045] Figure 2 This is a flow chart of the second embodiment of the abnormal behavior detection method of the present application;

[0046] Figure 3 This is a flow chart of the third embodiment of the abnormal behavior detection method of the present application;

[0047] Figure 4 This is a flow chart of the fourth embodiment of the abnormal behavior detection method of the present application;

[0048] Figure 5 This is a schematic diagram of the module structure of the abnormal behavior detection device according to an embodiment of the present application;

[0049] Figure 6 Schematic diagram of the device structure of the hardware operating environment involved in the abnormal behavior detection method in the embodiment of the present application.

[0050] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0051] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0052] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0053] In the field of communication call record anomaly detection, existing technologies generally include using traditional data analysis methods to identify fraudulent behavior and abnormal communication patterns. These technologies involve simple data statistics and result analysis, such as threshold detection, cluster analysis, and decision trees. Existing technologies also include basic call record content analysis to identify abnormal communication behavior.

[0054] Current approaches mainly rely on traditional data analysis techniques, such as support vector machines (SVM) and random forests, to analyze call log data to identify abnormal behavior. These techniques usually rely on predefined features and manually set thresholds, rather than leveraging the relationship network between data.

[0055] Although existing methods can detect low-concurrency, single-mode fraud methods in some cases, such as frequent outbound calls from a single number, they are usually unable to fully utilize the complex connection relationships between call records and are not sensitive enough to changes in environmental factors. This limits their application capabilities in dynamic and complex communication network environments and cannot effectively deal with new types of Internet phone fraud, such as random number generation.

[0056] Therefore, in order to overcome the above-mentioned defects, the present application provides a solution, which includes: inputting the call data and environmental data of each network node in the communication network into an improved graph neural network model, wherein the improved graph neural network model includes a node feature extraction layer and an edge feature integration layer, the node feature extraction layer adopts an adaptive graph convolution algorithm, and the edge feature integration layer adopts a dynamic attention mechanism, and the convolution parameters of the improved graph neural network model are adjusted through the adaptive graph convolution algorithm according to the call data and the environmental data, and the node features of the communication network are calculated based on the adjusted convolution parameters, wherein the node features are used to represent the dynamic behavior of each network node, and the edge weights between each network node are adjusted through the dynamic attention mechanism according to the call data and the environmental data to obtain the edge features of the communication network. Features, wherein the edge weight is used to represent the importance of the interactive behavior between each network node, and the network nodes with abnormal behavior in the communication network are determined according to the node features and edge features; since the improved graph neural network model of the present application introduces an adaptive graph convolution algorithm and a dynamic attention mechanism, the node features of the communication network are extracted through an adaptive graph convolution algorithm according to call data and environmental data to reflect the dynamic behavior of each network node, and the edge weights between each network node are adjusted in real time through the dynamic attention mechanism to obtain the edge features of the communication network to reflect the interactive behavior between each network node, and through the comprehensive analysis of node features and edge features, the dynamic behavior and interactive behavior of each network node in the communication network can be effectively captured, thereby improving the detection accuracy of abnormal behavior.

[0057] Based on this, the present application embodiment provides a method for detecting abnormal behavior. Figure 1 , Figure 1 This is a flow chart of the first embodiment of the abnormal behavior detection method of the present application.

[0058] In a first embodiment, the abnormal behavior detection method includes:

[0059] Step S10: Input the call data and environmental data of each network node in the communication network into the improved graph neural network model, wherein the improved graph neural network model includes a node feature extraction layer and an edge feature integration layer, the node feature extraction layer adopts an adaptive graph convolution algorithm, and the edge feature integration layer adopts a dynamic attention mechanism.

[0060] It should be understood that the execution subject of this embodiment can be an abnormal behavior detection device with data processing, network communication and program running functions, such as a computer, or other electronic devices that can achieve the same or similar functions, and this embodiment does not limit this.

[0061] It should be noted that a communication network may refer to a system formed by connecting multiple network nodes (such as mobile phones, base stations, etc.) through communication links to realize the transmission and exchange of information. A network node may refer to a basic unit in a communication network, which may be a mobile phone, base station, server or other device. Call data may refer to data that records call behavior between network nodes. Including but not limited to communication bill data such as call records, text message records, and data traffic usage. Environmental data may refer to information used to describe the environment in which a network node is located, including but not limited to environmental data such as user geographic location information, device type, operating system version, and application usage, which is not limited in this embodiment. The node feature extraction layer may refer to a part of an improved graph neural network model, which is used to extract features of network nodes. The edge feature integration layer may refer to a part of an improved graph neural network model, which is used to integrate edge features between network nodes (i.e., interaction behaviors between network nodes).

[0062] It can be understood that in this embodiment, the call data of each network node in the communication network can be directly obtained from the communication service database, and the environmental data of each network node in the communication network can be obtained from the location service database; the call data set of each network node in the communication network can also be obtained from the communication service database, and the environmental data set of each network node in the communication network can be obtained from the location service database, and the collected communication call data set and environmental data set can be cleaned and standardized to remove invalid or erroneous data records, and the cleaned data can be converted into a graphical data structure. This embodiment does not limit this.

[0063] For ease of understanding, the following examples are given, but are not intended to limit the present application. As an example, the steps for cleaning and standardizing the collected communication call record data set and environment data set are as follows:

[0064] 1. Perform data cleaning on the collected communication call record data set, including identifying and removing records with incomplete or erroneous fields, using data validation algorithms to check the integrity and validity of each record, and ensuring that the start time of the call record is earlier than the end time and that the call duration is positive;

[0065] 2. Clean the environmental data set, detect and remove abnormal or illogical geographic location information, such as data points whose location coordinates are outside the geographic constraints (data points outside the geographic constraints refer to data whose location information does not conform to the expected geographic area, such as beyond the expected geographic range: the location data points of the device fall outside the managed area. Abnormal movement speed: the device shows an impossible long-distance movement in a short period of time. Inaccessible area: the location data points of the device are displayed in an area that is theoretically impossible to reach, etc.), as well as duplicate or erroneous records in the device information;

[0066] 3. Standardize the cleaned communication call data set and environmental data set, including normalizing the user's geographic location information, converting all coordinate data to the same coordinate reference system, and unifying the timestamps to ensure that all time data formats are consistent and arranged in chronological order.

[0067] Step S20: Adjust the convolution parameters of the improved graph neural network model through an adaptive graph convolution algorithm according to the call data and the environmental data, and calculate the node characteristics of the communication network based on the adjusted convolution parameters, wherein the node characteristics are used to represent the dynamic behavior of each network node.

[0068] It can be understood that in this embodiment, the node feature extraction layer adopts an adaptive graph convolution algorithm. Compared with the traditional graph neural network that uses a fixed graph convolution kernel and does not consider the dynamic environmental characteristics of the network nodes, the present application proposes an adaptive graph convolution algorithm that dynamically and automatically adjusts the convolution parameters according to the call data and environmental data of the network nodes, thereby more accurately analyzing the dynamic behavior of each network node in the communication network.

[0069] Step S30: According to the call data and the environmental data, the edge weights between the network nodes are adjusted through the dynamic attention mechanism to obtain edge features of the communication network, wherein the edge weights are used to represent the importance of the interaction behaviors between the network nodes.

[0070] It should be understood that in this embodiment, the edge feature integration layer adopts a dynamic attention mechanism. Compared with the traditional static attention mechanism, which only considers fixed network node relationships and ignores time factors, this application analyzes changes in call data and environmental data and adjusts the edge weights between network nodes in real time, thereby being able to more effectively capture the key interaction behaviors between network nodes.

[0071] Step S40: determining network nodes having abnormal behaviors in the communication network according to the node characteristics and the edge characteristics.

[0072] For ease of understanding, the following examples are provided, but are not intended to limit the present application. As an example, the abnormal behavior detection step includes:

[0073] 1. The anomaly detection module is deployed using an improved graph neural network model. Different from the traditional graph neural network that uses fixed graph convolution kernels and static attention mechanisms, the improved model of this application introduces an adaptive graph convolution algorithm and a dynamic attention mechanism, which allows the convolution parameters to be automatically adjusted according to the communication frequency of network nodes and environmental changes, as well as real-time adjustment of edge weights to reflect the impact of time changes, thereby more accurately analyzing the behavior and mutual relationships of each network node in the communication network.

[0074] 2. Apply the abnormal behavior recognition algorithm based on the learned node features and edge features, such as the edge weight between network nodes i and j at time t, to calculate the abnormal behavior score of the network node. The abnormal behavior score formula is:

[0075]

[0076] Among them, S anom (i) is the abnormal behavior score of network node i, is the edge weight between network nodes i and j at time t, N(i) is the set of neighboring network nodes of network node i, and F c (i) and F e (i) are the communication feature and environment feature vectors of network node i (obtained by analyzing the node features of the communication network), α1 and α2 are weight factors used to adjust the influence of communication features and environment features in the anomaly score.

[0077] 3. Using the obtained abnormal behavior scores, each network node is evaluated for abnormal behavior. Scores above a certain threshold θ are marked as potential abnormal behaviors. The threshold setting is based on statistical analysis of historical data and network behavior patterns:

[0078]

[0079] in, is the mean of the historical anomaly scores, is the standard deviation of historical anomaly scores, and k is an adjustment factor used to set the strictness of the threshold.

[0080] 4. Combine the complex communication patterns and environmental factors learned by the improved graph neural network model, the geographic location information and device types of network nodes, and perform abnormal behavior analysis and verification.

[0081] It is understandable that after obtaining the abnormal behavior detection results, an abnormal report can also be output for the user to view. In a specific implementation, the abnormal report can include classifying and summarizing the detected abnormal behavior, providing detailed information of the abnormal behavior, including the account involved, timestamp, abnormal type and possible fraud or error indicators, and related environmental context information, which is not limited in this embodiment.

[0082] For ease of understanding, the following examples are provided, but are not intended to limit the present application. As an example, the steps of outputting an abnormality report include:

[0083] 1. Automatically generate anomaly reports. The reporting system uses abnormal behavior scores, such as the abnormal behavior score S of network nodes. anom (i),Systematically classify and summarize the detected abnormal behaviors;

[0084] 2. The classification algorithm classifies abnormal behaviors in detail, including fraud, technical errors, and data intrusion, based on the anomaly scores and their associated communication patterns and environmental characteristics, such as time t, geographic location information of network node i, and device type;

[0085] 3. Abnormal behavior reports include the following details:

[0086] (1) Caller number;

[0087] (2) Call start time;

[0088] (3) Call duration;

[0089] (4) Determine the type of abnormality;

[0090] (5) Fraud or abnormal indicators involved;

[0091] (6) Relevant environmental context information, communication device type and system version.

[0092] The improved graph neural network model of this embodiment introduces an adaptive graph convolution algorithm and a dynamic attention mechanism. The node features of the communication network are extracted through the adaptive graph convolution algorithm based on call data and environmental data to reflect the dynamic behavior of each network node. The edge weights between each network node are adjusted in real time through the dynamic attention mechanism to obtain the edge features of the communication network to reflect the interactive behavior between each network node. By comprehensively analyzing the node features and edge features, the dynamic behavior and interactive behavior of each network node in the communication network can be effectively captured, thereby improving the detection accuracy of abnormal behavior.

[0093] Reference Figure 2 , Figure 2 This is a flow chart of the second embodiment of the abnormal behavior detection method of the present application. Figure 1 The first embodiment shown provides a second embodiment of the abnormal behavior detection method of the present application.

[0094] In the second embodiment, the step S20 includes:

[0095] Step S201: dynamically generate an adjacency matrix according to the call data and the environment data.

[0096] It should be understood that in this embodiment, the node feature extraction layer adopts an adaptive graph convolution method. Compared with the traditional graph neural network using a fixed graph convolution kernel, the dynamic environmental characteristics of the network nodes are not considered. The present application proposes an adaptive graph convolution algorithm to generate an adjacency matrix based on the call data and environmental data of the network nodes, which can reflect the real-time connection strength between network nodes. This can accurately reflect the behavior changes of network nodes at different times and environments. Among them, the adjacency matrix can be a matrix used to represent the connection relationship between network nodes in a communication network.

[0097] Furthermore, in order to improve the accuracy of the adjacency matrix, the step S201 includes: constructing an initial adjacency matrix according to the number of nodes in the communication network, wherein the rows and columns in the initial adjacency matrix respectively correspond to the network nodes in the communication network, and the elements in the initial adjacency matrix represent the connection strength between the network nodes; calculating the connection strength between the network nodes according to the call data and the environmental data; and filling the calculated connection strength values ​​into the corresponding positions in the initial adjacency matrix to obtain the adjacency matrix.

[0098] In the specific implementation, first, it is necessary to determine the number of nodes in the communication network, and then build a blank adjacency matrix based on this number. In this matrix, the rows and columns correspond to each network node in the communication network. Initially, the elements in the matrix can be 0, indicating that no connection has been established between the nodes. Then use the actual call data (such as call records, text message records, data traffic usage) and environmental data (such as geographic location information, device type, operating system version, etc.) to calculate the connection strength between the nodes in the network. The calculation of connection strength can be based on a variety of factors, such as call frequency, number of text messages, data traffic exchange volume, geographic location proximity, etc. Finally, fill the connection strength value calculated above into the corresponding position in the initial adjacency matrix. In this way, each element in the adjacency matrix represents the connection strength between the corresponding nodes.

[0099] For ease of understanding, the following examples are given, but are not intended to limit the present application. As an example, assuming that there are three network nodes (A, B, C) in the communication network, the initial adjacency matrix can be expressed as:

[0100]

[0101] Assume that there are frequent calls and data exchanges between nodes A and B, and there is almost no communication between nodes A and C. Based on these data, it can be calculated that the connection strength between nodes A and B is high, the connection strength between nodes A and B is normal, and the connection strength between nodes A and C is low.

[0102] Continuing with the previous example, assuming that the calculated connection strength between nodes A and B is 0.8, the connection strength between nodes B and C is 0.5, and the connection strength between nodes A and C is 0.2, the filled adjacency matrix can be expressed as:

[0103]

[0104] Step S202: Adjust the convolution parameters of the improved graph neural network model based on the adjacency matrix to obtain adjusted convolution parameters.

[0105] It is understandable that in the improved graph neural network model, convolution parameters are used to extract node features. This step is to adjust these convolution parameters based on the dynamically generated adjacency matrix to adapt to dynamic changes in the communication network. The adjustment process can involve fine-tuning the size, shape or weight of the convolution kernel to better capture the complex relationships between nodes.

[0106] Step S203: Calculate the node features of the communication network through an adaptive graph convolution algorithm according to the adjacency matrix and the adjusted convolution parameters.

[0107] For ease of understanding, the following examples are given, but are not intended to limit the present application. As an example, the adaptive graph convolution formula is shown below, which is used to dynamically generate new node features based on node features and adjacency matrix:

[0108] H (l+1) =σ(D -1 / 2 A (l) (X)D -1 / 2 H (l) W (l) )

[0109] Among them, A (l) (X) is the adjacency matrix dynamically generated according to the node feature X, reflecting the real-time connection strength between network nodes. (l) and W (l) They represent the node features and weight matrix of the lth layer (i.e., the convolution kernel, used to represent the convolution parameters), D is the degree matrix, and σ is the activation function, such as ReLU, which is used to introduce nonlinearity to help the model learn more complex features.

[0110] This embodiment generates an adjacency matrix based on the call data and environment data of the network nodes, which can reflect the real-time connection strength between the network nodes, and thus can more accurately reflect the behavior changes of the network nodes in different times and environments.

[0111] Reference Figure 3 , Figure 3 This is a flow chart of the third embodiment of the abnormal behavior detection method of the present application. Figure 1 The first embodiment shown is a third embodiment of the abnormal behavior detection method of the present application.

[0112] In the third embodiment, the step S30 includes:

[0113] Step S301: Analyze the call records and data usage between network nodes based on the call data and the environment data.

[0114] It should be understood that in order to provide basic data for the subsequent calculation of the attention coefficient and adjustment of the edge weight, in this embodiment, the call records and data usage between each network node are analyzed based on the call data and environmental data. In a specific implementation, by collecting and analyzing the call data and data usage of the network nodes, the call records and data usage between the network nodes can be understood. Among them, the call record may refer to a record of call events between nodes in the network, including the initiator, receiver, timestamp, and duration of the call. Data usage may refer to the data traffic generated by the network node during the communication process, including the start time of data use, the end time of data use, and the amount of data used.

[0115] Step S302: Calculate an attention coefficient according to the call records and the data usage, wherein the attention coefficient is used to represent the interaction intensity between each network node.

[0116] It is understandable that in order to provide an important basis for the subsequent adjustment of edge weights and improve the accuracy of anomaly detection. In this embodiment, the attention coefficient is calculated based on call records and data usage. In a specific implementation, the attention coefficient between nodes is calculated by a preset algorithm using key information in call records and data usage (such as the start time of data use, the end time of data use, and data usage, etc.). Among them, the preset algorithm can be pre-set, and this embodiment does not limit this. The attention coefficient reflects the interaction intensity between nodes, that is, the frequency of communication behavior and data exchange between nodes.

[0117] Step S303: adjusting the edge weights between the network nodes according to the calculated attention coefficient to obtain edge features of the communication network.

[0118] It should be understood that the edge weights between each network node are adjusted according to the calculated attention coefficient, and obtaining the edge features of the communication network can be to obtain the node features of each network node and convert the node features into feature vectors; multiply the feature vectors by the weight matrix respectively to obtain the transformed feature vectors, wherein the weight matrix is ​​used to represent the importance of different node features in the edge weight calculation; perform normalization calculation based on the transformed feature vector, the attention coefficient, and a nonlinear activation function with parameters to obtain the target edge weight; adjust the edge weights between each network node to the target edge weight to obtain the edge features of the communication network.

[0119] For ease of understanding, the following examples are provided, but are not intended to limit the present application. As an example, the edge feature integration layer introduces a network based on a dynamic attention mechanism, which is an improvement over the traditional static attention mechanism, which only considers fixed network node relationships and ignores time factors. The present application method analyzes changes in call history and data traffic patterns to adjust the importance of each edge in real time, and more effectively captures key interactive behaviors. The edge feature integration formula is as follows, which is used to dynamically adjust edge weights based on the feature vectors of network nodes i and j and the attention mechanism.

[0120]

[0121] in, is the edge weight between network nodes i and j at time t, indicating the importance of the relationship at the current moment, and are the feature vectors of network nodes i and j at time t, a T and W are the attention coefficient and weight matrix respectively. Among them, and To include their call records and data usage at time t, softmax is a normalized exponential function, and LeakyReLU is an improved ReLU function, which is a nonlinear activation function with parameters. The attention mechanism determines the adjustment of edge weights by analyzing the interaction strength between network nodes. The attention coefficient can be calculated based on the call frequency and data exchange frequency between network nodes. The weight matrix is ​​used for linear transformation of feature vectors, reflecting the importance of different features in edge weight calculation.

[0122] This embodiment calculates the attention coefficient based on the call records and data usage between each network node, and adjusts the edge weights between each network node based on the calculated attention coefficient to obtain the edge characteristics of the communication network, thereby improving the accuracy of edge weight adjustment and further improving the accuracy of abnormal behavior detection.

[0123] Reference Figure 4 , Figure 4This is a flow chart of a fourth embodiment of the abnormal behavior detection method of the present application. Based on the above embodiments, a fourth embodiment of the abnormal behavior detection method of the present application is proposed.

[0124] In the fourth embodiment, before step S10, the method further includes:

[0125] Step S01: Acquire call records, text message records and data traffic usage of each network node in the communication network.

[0126] It should be understood that obtaining call records, text message records and data traffic usage of each network node in the communication network may be obtaining call records, text message records and data traffic usage of each network node in the communication network from a communication service database.

[0127] Of course, in order to improve the accuracy of data acquisition, the call record includes the call frequency within a specific time window, the SMS record includes the complexity of the SMS content, and the data traffic usage includes an abnormal data usage index; the step S01 includes: obtaining the call start time, call end time and the total number of call records within a specific time window of each call, and calculating the call frequency within the specific time window based on the call start time, the call end time and the total number of call records within the specific time window; obtaining the total number of words, word frequency and inverse document frequency value of each SMS, and calculating the complexity of the SMS content through the SMS behavior model based on the total number of words, the word frequency and the inverse document frequency value; monitoring the current data usage, and calculating the data usage abnormality index based on the current data usage and historical data usage.

[0128] For ease of understanding, the following examples are provided, but are not intended to limit the present application. As an example, the steps of obtaining data include:

[0129] 1. Automated collection of call logs, including querying the communication service database to capture the start time of each call s , end time t e , calling number N c , called number N r And the call duration D t , this application uses an improved data parsing algorithm to extract this information from call metadata and automatically mark high-frequency call users to identify potential abnormal behavior patterns:

[0130]

[0131] Among them, R freqIndicates the call frequency within a specific time window, which is set dynamically according to actual needs (because each standard is different in different scenarios, different settings should be made in actual applications. Due to different regions and user bases, taking City A as an example, calls exceeding 50 times a day or a total call duration exceeding 6 hours are considered high frequency). is the indicator function, t s,i and t e,i are the start and end time of the i-th call, and n is the total number of call records in the time window.

[0132] 2. In order to refine the collection of SMS records, this application uses text analysis tools to analyze the keywords and emotional tendencies of SMS content, determine the purpose and urgency of SMS, and record the sending time. t , send number N s , receiving number N r , SMS content length L m , and build SMS behavior models based on content complexity and sending frequency:

[0133]

[0134] C m >T

[0135] Among them, C m Indicates the complexity of the SMS content, TF-IDF j is the term frequency-inverse document frequency value of the jth word, freq j,t is the frequency of the word in a specific time period, k is the total number of words, and T is the complexity threshold. If it exceeds the threshold, it is considered complex.

[0136] 3. Dynamic monitoring of data traffic usage, real-time monitoring of the start time of data traffic usage t b , end of use time t e and data usage V d , using packet analysis technology to identify high data consumption applications and services, and provide preliminary judgment on data traffic anomalies:

[0137]

[0138] Among them, A d represents the normalized data usage anomaly indicator, V d is the observed data usage, and They are the mean and standard deviation of historical data usage (for a single user's historical data, all data usage records of the user in the past six months are automatically recorded, and the mean and standard deviation are calculated based on the user's historical data usage. This can more accurately reflect the user's usage habits and abnormal situations).

[0139] Step S02: constructing call data of each network node according to at least one of the call record, the text message record and the data traffic usage.

[0140] It can be understood that constructing the call data of each network node based on call records, text message records and data traffic usage can be to construct a communication call bill data set based on call records, text message records and data traffic usage, clean and standardize the communication call bill data set, remove invalid or erroneous data records, and obtain the call data of each network node.

[0141] Step S03: Acquire the location information of each network node in the communication network, and construct the environment data of each network node according to the location information.

[0142] Furthermore, in order to achieve high-precision geographic location information collection, the step S03 includes: obtaining satellite positioning data, wireless network positioning data and mobile network signal strength data of each network node in the communication network; calculating the location information of each network node in the communication network through a weighted hybrid model based on at least one of the satellite positioning data, the wireless network positioning data and the mobile network signal strength data, and constructing environmental data of each network node based on the location information.

[0143] For ease of understanding, the following examples are given, but they are not intended to limit the present application. As an example, in order to achieve high-precision geographic location information collection, the present application integrates multi-source location services, not only using Global Positioning System (GPS) data, but also Wireless Fidelity (WiFi) positioning and mobile network signal strength data to obtain more accurate user location information (x, y), the time stamp of the location data t p Combined with user behavior pattern analysis to identify atypical mobility patterns or unexpected behavior trajectories, this application uses an improved weighted hybrid model to calculate the location, integrating GPS data, WiFi positioning, and mobile network signal strength data. The formula is as follows:

[0144] P(x,y|t p )=λ1P GPS (x,y|t p )+λ2P Wi-Fi (x,y|t p )+λ3P Mobile (x,y|t p )

[0145] Among them, P(x,y|t p) is a given time t p The predicted position probability density function of the user, P GPS (x,y|t p ), P Wi-Fi (x,y|t P ) and P Mobile (x,y|t p ) are location prediction models based on GPS, WiFi and mobile network signal strength, respectively. λ1, λ2 and λ3 are weight values ​​corresponding to GPS data, WiFi positioning and mobile network signal strength data, respectively.

[0146] This embodiment adopts an innovative method of integrating multi-source location services, which not only uses GPS data, but also includes WiFi positioning and mobile network signal strength data to obtain more accurate user location information. In addition, a weighted hybrid model is used to calculate the user location, which fully utilizes the advantages of various data sources to improve the accuracy and reliability of location information. This is often not considered in traditional technologies, which limits the accuracy and practicality of location information.

[0147] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the abnormal behavior detection method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0148] This application also provides an abnormal behavior detection device, please refer to Figure 5 , the abnormal behavior detection device comprises:

[0149] A data input module 10, used to input the call data and environment data of each network node in the communication network into the improved graph neural network model, wherein the improved graph neural network model includes a node feature extraction layer and an edge feature integration layer, the node feature extraction layer adopts an adaptive graph convolution algorithm, and the edge feature integration layer adopts a dynamic attention mechanism;

[0150] A model processing module 20, configured to adjust the convolution parameters of the improved graph neural network model by an adaptive graph convolution algorithm according to the call data and the environmental data, and calculate the node features of the communication network based on the adjusted convolution parameters, wherein the node features are used to represent the dynamic behavior of each network node;

[0151] The model processing module 20 is further used to adjust the edge weights between the network nodes through the dynamic attention mechanism according to the call data and the environment data to obtain the edge features of the communication network, wherein the edge weights are used to represent the importance of the interaction behavior between the network nodes;

[0152] The behavior detection module 30 is used to determine the network nodes with abnormal behavior in the communication network according to the node characteristics and the edge characteristics.

[0153] The abnormal behavior detection device provided by the present application adopts the abnormal behavior detection method in the above embodiment, which can solve the technical problem that the existing abnormal behavior detection method usually relies on pre-defined features and manually set thresholds, and has the defect of low detection accuracy. Compared with the prior art, the beneficial effects of the abnormal behavior detection device provided by the present application are the same as the beneficial effects of the abnormal behavior detection method provided by the above embodiment, and the other technical features in the abnormal behavior detection device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0154] The present application provides an abnormal behavior detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the abnormal behavior detection method in the above-mentioned embodiment 1.

[0155] Reference below Figure 6 , which shows a schematic diagram of the structure of an abnormal behavior detection device suitable for implementing the embodiment of the present application. The abnormal behavior detection device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The abnormal behavior detection device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0156] like Figure 6As shown, the abnormal behavior detection device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a ROM (Read Only Memory) 1002 or a program loaded from a storage device 1003 to a RAM (Random Access Memory) 1004. In RAM 1004, various programs and data required for the operation of the abnormal behavior detection device are also stored. The processing device 1001, ROM 1002, and RAM 1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, an LCD (Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the abnormal behavior detection device to communicate with other devices wirelessly or by wire to exchange data. Although the abnormal behavior detection device with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0157] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0158] The abnormal behavior detection device provided by the present application adopts the abnormal behavior detection method in the above embodiment, which can solve the technical problem that the existing abnormal behavior detection method usually relies on pre-defined features and manually set thresholds, and has the defect of low detection accuracy. Compared with the prior art, the beneficial effects of the abnormal behavior detection device provided by the present application are the same as the beneficial effects of the abnormal behavior detection method provided by the above embodiment, and the other technical features in the abnormal behavior detection device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0159] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0160] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0161] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the abnormal behavior detection method in the above-mentioned embodiment.

[0162] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, RAM (Random Access Memory), ROM (Read Only Memory), EPROM (Erasable Programmable Read Only Memory) or flash memory, optical fiber, CD-ROM (CD-Read Only Memory, portable compact disk read-only memory), optical storage device, magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0163] The computer-readable storage medium may be included in the abnormal behavior detection device; or may exist independently without being assembled into the abnormal behavior detection device.

[0164] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the abnormal behavior detection device, the abnormal behavior detection device executes the abnormal behavior detection method in the above embodiment.

[0165] The computer program code for performing the operation of the present application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on the remote computer, or completely on the remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a LAN (Local Area Network) or a WAN (Wide Area Network), or it can be connected to an external computer (e.g., using an Internet service provider to connect through the Internet).

[0166] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0167] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0168] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned abnormal behavior detection method, and can solve the technical problem that the existing abnormal behavior detection method usually relies on pre-defined features and manually set thresholds, and has the defect of low detection accuracy. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the abnormal behavior detection method provided by the above-mentioned embodiment, and will not be repeated here.

[0169] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A method for detecting abnormal behavior, characterized in that: The abnormal behavior detection method comprises: Inputting the call data and environment data of each network node in the communication network into an improved graph neural network model, wherein the improved graph neural network model includes a node feature extraction layer and an edge feature integration layer, the node feature extraction layer adopts an adaptive graph convolution algorithm, and the edge feature integration layer adopts a dynamic attention mechanism; Adjusting the convolution parameters of the improved graph neural network model by an adaptive graph convolution algorithm according to the call data and the environmental data, and calculating the node features of the communication network based on the adjusted convolution parameters, wherein the node features are used to represent the dynamic behavior of each network node; According to the call data and the environment data, the edge weights between the network nodes are adjusted by the dynamic attention mechanism to obtain edge features of the communication network, wherein the edge weights are used to represent the importance of the interaction behaviors between the network nodes; A network node with abnormal behavior in the communication network is determined according to the node feature and the edge feature.

2. The abnormal behavior detection method according to claim 1, characterized in that: The step of adjusting the convolution parameters of the improved graph neural network model according to the call data and the environmental data, and calculating the node features of the communication network by an adaptive graph convolution algorithm based on the adjusted convolution parameters, comprises: Dynamically generate an adjacency matrix based on the call data and the environment data; Adjusting the convolution parameters of the improved graph neural network model based on the adjacency matrix to obtain adjusted convolution parameters; The node features of the communication network are calculated using an adaptive graph convolution algorithm according to the adjacency matrix and the adjusted convolution parameters.

3. The abnormal behavior detection method according to claim 2, characterized in that: The dynamically generating an adjacency matrix according to the call data and the environment data comprises: Constructing an initial adjacency matrix according to the number of nodes in the communication network, wherein the rows and columns in the initial adjacency matrix correspond to the network nodes in the communication network respectively, and the elements in the initial adjacency matrix represent the connection strength between the network nodes; Calculate the connection strength between each network node according to the call data and the environment data; The calculated connection strength values ​​are filled into corresponding positions in the initial adjacency matrix to obtain an adjacency matrix.

4. The abnormal behavior detection method according to claim 1, characterized in that: The step of adjusting the edge weights between the network nodes through the dynamic attention mechanism according to the call data and the environment data to obtain the edge features of the communication network includes: Analyze the call records and data usage between the network nodes based on the call data and the environment data; Calculating an attention coefficient according to the call records and the data usage, wherein the attention coefficient is used to represent the interaction intensity between each network node; The edge weights between the network nodes are adjusted according to the calculated attention coefficient to obtain the edge features of the communication network.

5. The abnormal behavior detection method according to claim 4, characterized in that: The step of adjusting the edge weights between the network nodes according to the calculated attention coefficient to obtain the edge features of the communication network includes: Obtaining node features of each network node and converting the node features into feature vectors; Multiplying the feature vectors by weight matrices respectively to obtain transformed feature vectors, wherein the weight matrices are used to represent the importance of different node features in edge weight calculation; Performing normalization calculation according to the transformed feature vector, the attention coefficient, and a nonlinear activation function with parameters to obtain a target edge weight; The edge weights between the network nodes are adjusted to the target edge weights to obtain edge features of the communication network.

6. The abnormal behavior detection method according to any one of claims 1 to 5, characterized in that: Before inputting the call data and environment data of each network node in the communication network into the improved graph neural network model, the method further includes: Obtain call records, SMS records, and data traffic usage of each network node in the communication network; Constructing call data of each network node according to at least one of the call record, the text message record and the data traffic usage; The location information of each network node in the communication network is obtained, and the environment data of each network node is constructed according to the location information.

7. The abnormal behavior detection method according to claim 6, characterized in that: The obtaining of location information of each network node in the communication network and constructing environment data of each network node according to the location information includes: Obtaining satellite positioning data, wireless network positioning data, and mobile network signal strength data of each network node in the communication network; According to at least one of the satellite positioning data, the wireless network positioning data and the mobile network signal strength data, the location information of each network node in the communication network is calculated through a weighted hybrid model, and the environmental data of each network node is constructed according to the location information.

8. An abnormal behavior detection device, characterized in that: The abnormal behavior detection device comprises: A data input module, used to input the call data and environment data of each network node in the communication network into the improved graph neural network model, wherein the improved graph neural network model includes a node feature extraction layer and an edge feature integration layer, the node feature extraction layer adopts an adaptive graph convolution algorithm, and the edge feature integration layer adopts a dynamic attention mechanism; A model processing module, used to adjust the convolution parameters of the improved graph neural network model through an adaptive graph convolution algorithm according to the call data and the environmental data, and calculate the node characteristics of the communication network based on the adjusted convolution parameters, wherein the node characteristics are used to represent the dynamic behavior of each network node; The model processing module is further used to adjust the edge weights between the network nodes through the dynamic attention mechanism according to the call data and the environment data to obtain the edge features of the communication network, wherein the edge weights are used to represent the importance of the interaction behavior between the network nodes; A behavior detection module is used to determine network nodes with abnormal behavior in the communication network based on the node characteristics and the edge characteristics.

9. An abnormal behavior detection device, characterized in that: The abnormal behavior detection device includes: a memory, a processor, and an abnormal behavior detection program stored in the memory and executable on the processor. When the abnormal behavior detection program is executed by the processor, the abnormal behavior detection method according to any one of claims 1 to 7 is implemented.

10. A storage medium, characterized in that: The storage medium stores an abnormal behavior detection program, and when the abnormal behavior detection program is executed by the processor, the abnormal behavior detection method according to any one of claims 1 to 7 is implemented.

Images