Space-time factor driven complex network anomaly detection method and device and medium

Abstract

The application discloses a kind of spatiotemporal factor-driven complex network anomaly detection method, device and medium, it is related to complex network analysis and network security technical field.The method comprises: constructing network security industry chain network, based on time attenuation function to the time characteristic and space neighborhood characteristic are encoded, obtain spatiotemporal factor, according to spatiotemporal factor calculation dynamic relationship weight, based on time sequence sliding window sampling and contrast window learning, obtain the characteristic vector of each node, based on the characteristic vector of each node determine the node level feature deviation of each node, and based on the node level feature deviation of each node, structure evolution rate and cross-network alignment abnormality, the score of each node is calculated;Based on the score threshold value set dynamically, if the score of node exceeds the score threshold value set, then determine that the node exists abnormal behavior.The application can improve the accuracy of complex network anomaly detection.

Description

Technical Field

[0001] This invention relates to the fields of complex network analysis and network security technology, and more specifically, to a spatiotemporal factor-driven method, apparatus, and medium for detecting anomalies in complex networks. Background Technology

[0002] With the rapid development of the digital economy, the complexity and dynamism of industrial chain networks are growing exponentially. Traditional graph-based anomaly detection techniques face significant technical bottlenecks when dealing with modern industrial chain networks: First, in terms of spatiotemporal feature modeling, existing methods are mostly based on static topology analysis, failing to effectively integrate the temporal evolution patterns and spatial distribution characteristics of industrial chain networks. This leads to the risk of misjudgment when identifying spatiotemporally coupled anomalies such as cross-regional industrial transfers and sudden supply chain disruptions. Second, in terms of network relationship processing, current network alignment techniques mostly adopt homogeneous edge weight processing mechanisms, making it difficult to accurately characterize the heterogeneous characteristics of multimodal relationships such as competition, collaboration, and supply among enterprises, resulting in semantic distortion during cross-industry chain knowledge transfer. Third, at the dynamic behavior capture level, mainstream static network analysis methods can only capture the instantaneous state of enterprise nodes, lacking the ability to continuously track the dynamic evolution of node behavior patterns (such as the restructuring of cooperative relationships caused by strategic transformation and changes in demand due to market fluctuations), resulting in insufficient timeliness of early warning of potential risks. These technical deficiencies severely restrict the intelligent upgrading of industrial chain risk prevention and control systems. Summary of the Invention

[0003] To address the aforementioned technical problems, this invention provides a spatiotemporal factor-driven method, apparatus, and medium for detecting anomalies in complex networks. By considering the spatiotemporal evolution characteristics of the industrial chain network, addressing the heterogeneity of multi-dimensional relationships (competition / cooperation / supply), and capturing the dynamic behavior patterns of enterprise nodes, the accuracy of anomaly detection in complex networks is improved.

[0004] In a first aspect, the present invention provides a spatiotemporal factor-driven method for anomaly detection in complex networks, the method comprising:

[0005] Construct a cybersecurity industry chain network; wherein, the cybersecurity industry chain network is represented as G = (V, E) T A S ), where V is a set of nodes, including multiple nodes, each node representing an entity in the industry chain, and E T E is a set of temporal edges used to describe the dynamic interaction relationships between nodes. T ={E supply E compete E coop}×T,E supply E compete E coopLet T represent the supply relationship, competition relationship, and cooperation relationship, respectively, and let A represent the timestamp set. S Let A be a spatiotemporal attribute matrix. S =(X t ,S k ), X t ∈R n×d , representing the time feature, n and d representing the dimension, R representing the real number space, S k =A k Let X represent the spatial neighborhood features of order k, A represent the adjacency matrix, k represent the order, and X represent the node features. k This indicates that k graph convolution operations are performed. The temporal features are used to record the dynamic behavior indicators of each node, the spatial neighborhood features are used to capture the topological relationships of the industry chain network, and the weights of the supply relationship, competition relationship, and cooperation relationship are determined by the adjacency matrix.

[0006] The temporal features and spatial neighborhood features are encoded based on the time decay function to obtain the spatiotemporal factor. The dynamic relation weight is calculated based on the spatiotemporal factor and is used to quantify the abnormal contribution of different types of temporal edges.

[0007] Based on time-series sliding window sampling, the network state containing τ time steps is extracted from the network security industry chain network.

[0008] Based on the network state containing τ time steps, the feature vectors of the same node in different time windows are extracted as positive samples, and the feature vectors of different nodes in the same time window are extracted as negative samples. The feature vectors are dynamic relationship weights. The positive and negative samples are compared and learned based on the contrastive loss function to obtain the feature vectors of each node.

[0009] The node-level feature bias of each node is determined based on the feature vector of each node, and the score of each node is calculated based on the node-level feature bias, structural evolution rate and cross-network alignment anomaly of each node.

[0010] Based on a dynamically set scoring threshold, if a node's score exceeds the set threshold, then the node is determined to have abnormal behavior.

[0011] Furthermore, the spatiotemporal factor is obtained by encoding the temporal features and spatial neighborhood features based on the time decay function using the following formula:

[0012] Z = σ([X t ||S k ]·W z +b z )

[0013] In the formula, Z represents the spatiotemporal factor, || represents feature concatenation, and Wz Let b represent the weight matrix. z σ represents the bias term, and σ represents the time decay function.

[0014] Furthermore, the time decay function is expressed as:

[0015] σ(t)=e -λΔt

[0016] In the formula, e represents the natural constant, Δt represents the time interval, and λ represents the attenuation coefficient.

[0017] Furthermore, based on the aforementioned spatiotemporal factors, the dynamic relationship weights are calculated using the following formula:

[0018] α ij =softmax(LeakyReLu(a T [Z i ||Z j ]))

[0019] In the formula, α ij The dynamic relationship weights between the i-th and j-th nodes are represented by Z, softmax represents the normalization operation, LeakyReLU represents the activation function, and Z represents the dynamic relationship weights between the i-th and j-th nodes. i and Z j Let i and j represent the spatiotemporal factors of the i-th and j-th nodes, respectively, and || denote feature concatenation.

[0020] Furthermore, based on time-series sliding window sampling, the network state extracted from the network security industry chain network, comprising τ time steps, is represented as W. t =[G t-τ G t-τ+1 ,…,G t ], where G t-τ G t-τ+1 and G t These represent the network states at time steps t-τ, -τ+1, and t, respectively.

[0021] Furthermore, the contrastive loss function is expressed as:

[0022]

[0023] In the formula, L c This represents the contrast loss, where e represents the natural constant. Indicates a negative sample. Let τ represent the positive sample, sim represent the similarity, τ be the sliding window length, m be the index of the negative sample, M be the number of negative samples, and c be the similarity score. i Let be the feature vector of the i-th node.

[0024] Furthermore, based on the node-level feature bias, structural evolution rate, and cross-network alignment anomaly of each node, the score of each node is calculated using the following formula:

[0025] Score(v i )=α·||c i -μ W ||+β·ΔD(v i )+γ·Φ(v i )

[0026] In the formula, Score(v i ) represents node v i The score, where α, β, and γ represent the weights of node-level feature bias, structural evolution rate, and cross-network alignment anomaly, respectively. i -μ W || represents the node-level feature bias, μ W ΔD(v) represents the mean of the sliding window features. i Φ(v) represents the time-series rate of change of nodal degree centrality. i ) indicates the degree of cross-network alignment anomaly.

[0027] Furthermore, the scoring threshold is dynamically set based on the node's average score and standard deviation.

[0028] Secondly, the present invention provides a spatiotemporal factor-driven anomaly detection device for complex networks, the device comprising:

[0029] The network construction module is configured to build a network security industry chain network; wherein, the network security industry chain network is represented as G = (V, E) T A S ), where V is a set of nodes, including multiple nodes, each node representing an entity in the industry chain, and E T E is a set of temporal edges used to describe the dynamic interaction relationships between nodes. T ={E supply E compete E coop}×T,E supply E compete E coop Let T represent the supply relationship, competition relationship, and cooperation relationship, respectively, and let A represent the timestamp set. S Let A be a spatiotemporal attribute matrix. S =(X t ,S k ), X t ∈R n×d , representing the time feature, n and d representing the dimension, R representing the real number space, S k =A kLet X represent the spatial neighborhood features of order k, A represent the adjacency matrix, k represent the order, and X represent the node features. k This indicates that k graph convolution operations are performed. The temporal features are used to record the dynamic behavior indicators of each node, the spatial neighborhood features are used to capture the topological relationships of the industry chain network, and the weights of the supply relationship, competition relationship, and cooperation relationship are determined by the adjacency matrix.

[0030] The dynamic relation weight calculation module is configured to encode the temporal features and spatial neighborhood features based on the time decay function to obtain spatiotemporal factors, and calculate dynamic relation weights based on the spatiotemporal factors. The dynamic relation weights are used to quantify the abnormal contribution of different types of temporal edges.

[0031] The time-series sampling module is configured to extract the network state containing τ time steps from the network security industry chain network based on time-series sliding window sampling;

[0032] The contrastive learning module is configured to extract the feature vectors of the same node in different time windows as positive samples and the feature vectors of different nodes in the same time window as negative samples based on the network state containing τ time steps. The feature vectors are dynamic relation weights. The positive and negative samples are compared and learned based on the contrastive loss function to obtain the feature vector of each node.

[0033] The scoring calculation module is configured to determine the node-level feature deviation of each node based on the feature vector of each node, and to calculate the score of each node based on the node-level feature deviation, structural evolution rate and cross-network alignment anomaly of each node.

[0034] The anomaly detection module is configured to determine that the node has abnormal behavior if the node's score exceeds the set score threshold based on a dynamically set score threshold.

[0035] Thirdly, the present invention provides a readable storage medium storing one or more programs that can be executed by one or more processors to implement the method described above.

[0036] The present invention has at least the following beneficial effects:

[0037] 1) In terms of modeling, the timestamp mechanism of temporal edge sets accurately depicts the lifecycle of enterprise relationships, enabling the detection of anomalous behavior such as a company suddenly terminating long-term supply contracts (a sharp drop in edge weight) and switching to purchasing from competitors (creating new competitive edges). The spatiotemporal attribute matrix combines individual enterprise operating indicators (time dimension) with the impact of industry chain topology (spatial dimension). When a node experiences an abnormal increase in the number of patents, the model can simultaneously assess whether this triggers a technological synergy effect (positive spatial propagation) among upstream and downstream enterprises or a surge in malicious lawsuits from competitors (negative spatial propagation).

[0038] 2) Introduce the time decay factor λ and the spatial propagation order k to calculate the spatiotemporal factor, and calculate the dynamic relationship weight based on the spatiotemporal factor. Quantify the abnormal contribution of different types of edges (supply / competition / cooperation) through the dynamic relationship weight.

[0039] 3) The score is calculated by integrating the triple criteria of node-level feature deviation, structural evolution rate, and cross-network alignment anomaly, and the accuracy of anomaly detection in complex networks is improved by setting a dynamic scoring threshold. Attached Figure Description

[0040] Figure 1 A flowchart of a spatiotemporal factor-driven anomaly detection method for complex networks according to an embodiment of the present invention is shown.

[0041] Figure 2 A structural diagram of a network security industry chain according to an embodiment of the present invention is shown;

[0042] Figure 3 An anomaly determination flowchart according to an embodiment of the present invention is shown;

[0043] Figure 4 A structural diagram of a spatiotemporal factor-driven complex network anomaly detection device according to an embodiment of the present invention is shown. Detailed Implementation

[0044] To enable those skilled in the art to better understand the technical solutions of the present invention, the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. The embodiments of the present invention will be further described in detail below with reference to the accompanying drawings and specific examples, but this is not intended to limit the present invention. If there is no necessary sequential relationship between the various steps described herein, the order in which they are described as examples should not be considered a limitation. Those skilled in the art should understand that the order can be adjusted, as long as it does not disrupt the logical consistency between them and render the entire process impossible.

[0045] Figure 1A flowchart of a spatiotemporal factor-driven anomaly detection method for complex networks according to an embodiment of the present invention is shown. The present invention provides a spatiotemporal factor-driven anomaly detection method for complex networks, such as... Figure 1 As shown, the method includes the following steps S10-S70.

[0046] S10: Build a cybersecurity industry chain network.

[0047] In this embodiment, the network security industry chain network is represented as G = (V, E) T A S ), where V is a set of nodes, including multiple nodes, each node representing an entity in the industry chain, and E T E is a set of temporal edges used to describe the dynamic interaction relationships between nodes. T ={E supply E compete E coop}×T,E supply E compete E coop Let T represent the supply relationship, competition relationship, and cooperation relationship, respectively, and let A represent the timestamp set. S Let A be a spatiotemporal attribute matrix. S =(X t ,S k ), X t ∈R n×d , representing the time feature, n and d representing the dimension, R representing the real number space, S k =A k Let X represent the spatial neighborhood features of order k, A represent the adjacency matrix, k represent the order, and X represent the node features. k This indicates that k graph convolution operations are performed. The temporal features are used to record the dynamic behavior indicators of each node, and the spatial neighborhood features are used to capture the topological relationships of the industry chain network. The weights of the supply relationship, competition relationship, and cooperation relationship are determined by the adjacency matrix.

[0048] The node set represents entities such as enterprises and institutions in the industry chain, and can be represented as V = (v1...v2) / (v3) / (v4) / (v5) / (v6) / (v7) / (v8) / (v9) / (v1) / (v1) / (v1) / (v2 ...3) / (v4) / (v i ...v g ), v i Let i = 1, 2, ..., g, v be any node in the set of nodes. g This represents the last node, indicating that the node set V contains g nodes, each node v iEach node corresponds to an independent market entity. For example, a node can be a company or institution included in the cybersecurity industry chain network. Each node also has node attributes, which include static characteristics (such as company size and business area) and dynamic characteristics (such as quarterly operating data). For example, 500 member companies in a cybersecurity industry alliance constitute a set of nodes, and each node records basic information such as the company's registered capital and main business classification.

[0049] Temporal edge sets are used to describe the dynamic interaction relationships between nodes, and include three core types of relation edges:

[0050] Supply Relationship E supply This represents the product / service supply chain between enterprises, such as firewall equipment procurement and security service outsourcing. Each edge is accompanied by a timestamp t, which is recorded in the timestamp set T to mark the effective period of the business relationship. For example, the edge formed by enterprise A purchasing an intrusion detection system from enterprise B in Q1 2023 is denoted as E. 2023Q1 supply (A,B)

[0051] Competition relationship E compete This reflects adversarial interactions such as market share competition and patent litigation. Edge weights are quantified by the number of intellectual property disputes in the judicial database, and timestamps record the quarter in which the litigation occurred.

[0052] Collaboration relationship E coop This includes collaborative activities such as joint research and development and the formulation of technical standards, and is assigned dynamic weights based on the amount of the cooperation agreement and the execution period.

[0053] Spatiotemporal attribute matrix A S The feature expression system that integrates the dimensions of time and space consists of two parts:

[0054] Time feature X t ∈R n×d It records the dynamic behavior indicators of each node. For example, dimension n represents a specific time, and dimension d includes the quarterly revenue growth rate (calculated as: current value of previous period - previous period value) / previous period value, the number of patent authorizations (cumulative count within the time window), the proportion of supply chain order amount, etc.

[0055] k-order spatial neighborhood features S k =A k • X, through the k-th power operation of the adjacency matrix A, achieves feature propagation and captures the topological relationships of the industry chain network. For example, S3 = A 3 • X represents a technical indicator for aggregating the third-order neighborhood (i.e., the upstream and downstream of the supply chain), used to assess the risk transmission effect. The upstream and downstream of the supply chain refers to the upstream and downstream of the upstream of the supply chain and the upstream and downstream of the downstream of the supply chain.

[0056] Adjacency matrix A: Initially defined as a binary matrix A∈{0,1} n×n If node v i With v j If there exists an edge of any type of relation, then A ij =1. In practical applications, it can be expanded into a weighted matrix, with weight values ​​set differently depending on the relationship type:

[0057] Supply relationship weight w supply Calculated based on standardized order amount;

[0058] Competition weight w compete The amount and frequency of related litigation cases;

[0059] Collaboration relationship weight w coop Values ​​are assigned based on the technological content of the cooperation agreement.

[0060] k-order spatial propagation: via matrix exponentiation A k Achieve multi-hop neighborhood feature aggregation. Technically, A... k • X is equivalent to performing k graph convolution operations, propagating node features layer by layer. For example: when k=1, it captures the features of direct suppliers / customers; when k=2, it extends to second-tier suppliers or competitors' partners; when k=3 or higher, it can identify systemic risks in the industrial chain.

[0061] For example, Figure 2 A structural diagram of a network security industry chain according to an embodiment of the present invention is shown. Figure 2 As shown, this cybersecurity industry chain network exemplifies nine nodes: v1, v2, v3, v4, v5, v6, v7, v8, and v9. Connected nodes indicate a relationship between two nodes, which can be at least one of supply, competition, or cooperation. Unconnected nodes indicate that the two nodes do not currently have at least one of these relationships within the cybersecurity industry chain network. In this embodiment, E... Tij To represent node v i and node v j Temporal edges between nodes, for example, the temporal edge between nodes v1 and v2 is represented by E. T12 The temporal edge between nodes v2 and v3 is represented by E. T13 This can be represented by the spatiotemporal attribute matrix A. S It is a feature expression system, so it is not shown in the figure. Figure 2The relationships between nodes can be at least one of supply, competition, and collaboration. For example, the relationships between nodes v1 and v2, and between nodes v1 and v8, are both supply relationships. In the supply relationship between nodes v1 and v2, node v1 acts as the supplier, and in the supply relationship between nodes v1 and v8, node v8 acts as the supplier. If node v1 selects two suppliers for the same product, namely nodes v2 and v3, then the relationship between nodes v2 and v3 is one of competition. If nodes v2, v4, and v5 reach a tripartite cooperation agreement, then each of nodes v2, v4, and v5 forms a collaborative relationship, such as three companies or institutions jointly developing a product and reaching a collaborative development agreement. Multiple relationships may also exist between two nodes. For example, nodes v3 and v6 have both a supply and collaboration relationship; node v6 provides products to node v3, but nodes v3 and v6 also collaborate on developing a technology. For some large, diversified enterprises, all three types of relationships may exist simultaneously between two enterprises. For example, nodes v3 and v7 simultaneously have supply, competition, and cooperation relationships. At least one service of node v3 is provided by node v7, but at least one service of node v3 conflicts with that of node v7, thus creating a competitive relationship. Furthermore, on certain cross-functional or identical services, nodes v3 and v7 have reached a cooperative development agreement, thereby forming E... T37 Also includes E supply E compete E coop The situation.

[0062] In some embodiments, the constructed network security industry chain network can also initially achieve network anomaly detection. This is achieved through dynamic relationship awareness, spatiotemporal coupling analysis, and multi-relationship heterogeneity processing. Specifically, spatiotemporal coupling analysis is based on the characteristics of the spatiotemporal attribute matrix, while dynamic relationship awareness and multi-relationship heterogeneity processing are based on temporal edge sets.

[0063] Specifically:

[0064] Dynamic relationship awareness: through the temporal edge set E T The timestamp mechanism accurately depicts the lifecycle of enterprise relationships. For example, it can detect abnormal behavior such as a company suddenly terminating a long-term supply contract (edge ​​weight drops sharply) and switching to a competitor for procurement (creating a new competitive edge).

[0065] Spatiotemporal coupling analysis: Spatiotemporal attribute matrix A S This model combines individual enterprise performance indicators (time dimension) with the impact of industry chain topology (spatial dimension). When a node experiences an abnormal increase in the number of patents, the model can simultaneously assess whether this triggers technological synergy effects (positive spatial propagation) among upstream and downstream enterprises or a surge in malicious lawsuits from competitors (negative spatial propagation).

[0066] Heterogeneity handling across multiple relationships: Designing differentiated detection strategies for different anomaly patterns in supply, competition, and cooperation relationships.

[0067] Anomalies in supply relationships: Order volume decreased by more than 30% quarter-on-quarter while competitors' orders surged by 50%;

[0068] Anomalies in competitive relations: The frequency of patent litigation exceeds three standard deviations of the historical average;

[0069] Abnormal collaborative relationship: The ratio of joint R&D investment to patent output deviates from the industry benchmark by 40%.

[0070] For example, taking data from a cybersecurity industry alliance (containing 427 companies), quarterly data from the past three years is extracted, including 12 features (d=12) such as company revenue growth rate (dimensional 1), number of vulnerability disclosures (dimensional 2), and R&D investment ratio (dimensional 3). Neighborhood propagation is set to k=3, and the third-order supply chain technical indicators for each company are calculated. For example, the third-order features of a firewall vendor include the cybersecurity level protection certification status of its customers (first-order), its customers' system integrators (second-order), and the government agencies served by the integrators (third-order). Four abnormal companies are identified through the cybersecurity industry chain network. One cloud service provider exhibits abnormal collaborative relationships: despite a 120% increase in quarterly R&D investment, its joint laboratory's patent output is zero, and the R&D efficiency of its partners within the third-order neighborhood decreases by 35% simultaneously, triggering the abnormal scoring threshold.

[0071] S20: Encode the temporal features and spatial neighborhood features based on the time decay function to obtain spatiotemporal factors, and calculate dynamic relation weights based on the spatiotemporal factors. The dynamic relation weights are used to quantify the abnormal contribution of different types of temporal edges.

[0072] In some embodiments, the spatiotemporal factors are obtained by encoding the temporal features and spatial neighborhood features based on a time decay function using the following formula:

[0073] Z = σ([X t ||S k ]·W z +b z )

[0074] In the formula, Z represents the spatiotemporal factor, || represents feature concatenation, and W z Let b represent the weight matrix. z σ represents the bias term, and σ represents the time decay function.

[0075] The time decay function is expressed as:

[0076] σ(t)=e -λΔt

[0077] In the formula, e represents the natural constant, Δt represents the time interval, and λ represents the attenuation coefficient.

[0078] In this embodiment, during the calculation of the spatiotemporal factor, the time feature matrix X is... t (such as historical time series data) and spatial neighborhood features S k Perform tensor splicing [X] t ||S k [The text appears to be incomplete and contains several errors. A more accurate translation would require the full context.] z and bias term b z Linear mapping is applied to the spliced ​​features to generate an intermediate representation. A time decay function is then applied to dynamically weight the features based on the time interval Δt. This time decay function controls the rate at which the contribution of historical data decays; the decay coefficient λ is recommended to be between 0.05 and 0.2. For example, when λ = 0.1, the influence weight of supply chain contracts from 2020 in 2023 decays to 30% of the initial value (calculated as e). -0.1×3 ≈0.74 per annum (decaying over the years).

[0079] In some embodiments, the dynamic relationship weights are calculated based on the spatiotemporal factors using the following formula:

[0080] α ij =softmax(LeakyReLu(a T [Z i ||Z j ]))

[0081] In the formula, α ij The dynamic relationship weights between the i-th and j-th nodes are represented by Z, softmax represents the normalization operation, LeakyReLU represents the activation function, and Z represents the dynamic relationship weights between the i-th and j-th nodes. i and Z j Let i and j represent the spatiotemporal factors of the i-th and j-th nodes, respectively, and || denote feature concatenation.

[0082] α calculated using the attention mechanism ij It can quantify the anomalous contribution of different types of edges (supply / competition / cooperation).

[0083] Therefore, step S20, through a time decay function, allows the model to balance the contributions of historical and recent data, avoiding long-term noise interference while preserving key long-term patterns (such as seasonal trends). The attention mechanism dynamically adjusts the connection weights between nodes, replacing the fixed adjacency matrix of traditional graph networks, making it more suitable for non-uniform, time-varying spatiotemporal relationships (such as sudden collaborations in supply chains). The concatenation operation and nonlinear transformation (LeakyReLU) enhance the interaction of spatiotemporal features, enabling the resulting feature vectors to capture complex spatiotemporal coupling phenomena.

[0084] S30: Based on time-series sliding window sampling, extract the network state containing τ time steps from the network security industry chain network.

[0085] In some embodiments, based on time-series sliding window sampling, the network state containing τ time steps extracted from the network security industry chain network is represented as W. t =[G t-τ G t-τ+1 ,…,G t ], where G t-τ G t-τ+1 and G t These represent the network states at time steps t-τ, -τ+1, and t, respectively. By employing the sliding window sampling method described above, the continuous network state is discretized into local time segments, balancing timeliness and contextual information.

[0086] S40: Based on the network state containing τ time steps, the feature vectors of the same node in different time windows are extracted as positive samples, and the feature vectors of different nodes in the same time window are extracted as negative samples. The feature vectors are dynamic relationship weights. The positive and negative samples are compared and learned based on the contrastive loss function to obtain the feature vectors of each node.

[0087] In this embodiment, based on the network state containing τ time steps, the method for extracting feature vectors of the same node in different time windows and feature vectors of different nodes in the same time window is the same, and it can be calculated in the manner described in step 30, which will not be repeated here. Based on the constructed positive and negative samples, a cross-window comparative learning method is used to compare and learn the positive and negative samples. The purpose is to learn the discriminativeness of node representations, so that normal nodes maintain consistency over time and abnormal nodes deviate from the normal state, thereby obtaining the feature vectors of each node.

[0088] In some embodiments, the contrastive loss function is expressed as:

[0089]

[0090] In the formula, L c This represents the contrast loss, where e represents the natural constant. Indicates a negative sample. Let τ represent the positive sample, sim represent the similarity, τ be the sliding window length, m be the index of the negative sample, M be the number of negative samples, and c be the similarity score. i Let be the feature vector of the i-th node.

[0091] S50: Determine the node-level feature deviation of each node based on the feature vector of each node, and calculate the score of each node based on the node-level feature deviation, structural evolution rate and cross-network alignment anomaly degree of each node.

[0092] In some embodiments, the score of each node is calculated based on its node-level feature bias, structural evolution rate, and cross-network alignment anomaly using the following formula:

[0093] Score(v i )=α·||c i -μ W ||+β·ΔD(v i )+γ·Φ(v i )

[0094] In the formula, Score(v i ) represents node v i The score, where α, β, and γ represent the weights of node-level feature bias, structural evolution rate, and cross-network alignment anomaly, respectively. i -μ W || represents the node-level feature bias, μ W ΔD(v) represents the mean of the sliding window features. i Φ(v) represents the time-series rate of change of nodal degree centrality. i ) indicates the degree of cross-network alignment anomaly.

[0095] S60: Based on a dynamically set scoring threshold, if a node's score exceeds the set scoring threshold, then the node is determined to have abnormal behavior.

[0096] In some embodiments, the scoring threshold is dynamically set based on the node's average score and standard deviation.

[0097] For example, Figure 3 A flowchart for anomaly determination according to an embodiment of the present invention is shown. The anomaly determination process includes the following steps:

[0098] S61: Computation node v i Score (v) i ).

[0099] S62: Dynamically setting scoring thresholds: S L =μ+3σ i (μ is the average score, σ)i (Standard deviation).

[0100] S63: Determine Score(v) i )>S L If yes, execute S64; otherwise, execute S66.

[0101] S64: Perform source analysis on nodes that exceed the threshold.

[0102] This step is used to check the historical behavior, associated nodes, and feature contribution of nodes that exceed the threshold.

[0103] S65: Check the spatiotemporal feature contribution max(α,β,γ).

[0104] This step is used to identify the dominant factors causing the abnormality of nodes exceeding the threshold (i.e., node-level feature bias, structural evolution rate, and cross-network alignment anomaly), and to determine which of these factors caused the anomaly.

[0105] S66: End.

[0106] This invention also provides a spatiotemporal factor-driven anomaly detection device for complex networks, such as... Figure 4 As shown, the device includes:

[0107] Network construction module 401 is configured to construct a network security industry chain network; wherein, the network security industry chain network is represented as G = (V, E) T A S ), where V is a set of nodes, including multiple nodes, each node representing an entity in the industry chain, and E T E is a set of temporal edges used to describe the dynamic interaction relationships between nodes. T ={E supply E compete E coop}×T,E supply E compete E coop Let T represent the supply relationship, competition relationship, and cooperation relationship, respectively, and let A represent the timestamp set. S Let A be a spatiotemporal attribute matrix. S =(X t ,S k ), X t ∈R n×d , representing the time feature, n and d representing the dimension, R representing the real number space, S k =A k Let X represent the spatial neighborhood features of order k, A represent the adjacency matrix, k represent the order, and X represent the node features. kThis indicates that k graph convolution operations are performed. The temporal features are used to record the dynamic behavior indicators of each node, the spatial neighborhood features are used to capture the topological relationships of the industry chain network, and the weights of the supply relationship, competition relationship, and cooperation relationship are determined by the adjacency matrix.

[0108] The dynamic relation weight calculation module 402 is configured to encode the temporal features and spatial neighborhood features based on the time decay function to obtain spatiotemporal factors, and calculate dynamic relation weights based on the spatiotemporal factors. The dynamic relation weights are used to quantify the abnormal contribution of different types of temporal edges.

[0109] The timing sampling module 403 is configured to extract network states containing τ time steps from the network security industry chain network based on timing sliding window sampling.

[0110] The contrastive learning module 404 is configured to extract the feature vectors of the same node in different time windows as positive samples and the feature vectors of different nodes in the same time window as negative samples based on the network state containing τ time steps. The feature vectors are dynamic relation weights. The positive and negative samples are compared and learned based on the contrastive loss function to obtain the feature vectors of each node.

[0111] The scoring calculation module 405 is configured to determine the node-level feature deviation of each node based on the feature vector of each node, and to calculate the score of each node based on the node-level feature deviation, structural evolution rate and cross-network alignment anomaly of each node.

[0112] The anomaly detection module 406 is configured to determine that the node has abnormal behavior if the node's score exceeds the set score threshold based on a dynamically set score threshold.

[0113] In some embodiments, the dynamic relationship weight calculation module is further configured to encode the temporal features and spatial neighborhood features based on a time decay function using the following formula to obtain a spatiotemporal factor:

[0114] Z = σ([X t ||S k ]·W z +b z )

[0115] In the formula, Z represents the spatiotemporal factor, || represents feature concatenation, and W z Let b represent the weight matrix. z σ represents the bias term, and σ represents the time decay function.

[0116] In some embodiments, the time decay function is expressed as:

[0117] σ(t)=e-λΔt

[0118] In the formula, e represents the natural constant, Δt represents the time interval, and λ represents the attenuation coefficient.

[0119] In some embodiments, the dynamic relationship weight calculation module is further configured to calculate the dynamic relationship weight based on the spatiotemporal factor using the following formula:

[0120] α ij =softmax(LeakyReLu(a T [Z i ||Z j ]))

[0121] In the formula, α ij The dynamic relationship weights between the i-th and j-th nodes are represented by Z, softmax represents the normalization operation, LeakyReLU represents the activation function, and Z represents the dynamic relationship weights between the i-th and j-th nodes. i and Z j Let i and j represent the spatiotemporal factors of the i-th and j-th nodes, respectively, and || denote feature concatenation.

[0122] In some embodiments, based on time-series sliding window sampling, the network state containing τ time steps extracted from the network security industry chain network is represented as W. t =[G t-τ G t-τ+1 ,…,G t ], where G t-τ G t-τ+1 and G t These represent the network states at time steps t-τ, -τ+1, and t, respectively.

[0123] In some embodiments, the contrastive loss function is expressed as:

[0124]

[0125] In the formula, L c This represents the contrast loss, where e represents the natural constant. Indicates a negative sample. Let τ represent the positive sample, sim represent the similarity, τ be the sliding window length, m be the index of the negative sample, M be the number of negative samples, and c be the similarity score. i Let be the feature vector of the i-th node.

[0126] In some embodiments, the scoring calculation module is further configured to calculate the score of each node based on the node-level feature bias, structural evolution rate, and cross-network alignment anomaly of each node, using the following formula:

[0127] Score(v i)=α·||c i -μ W ||+β·ΔD(v i )+γ·Φ(v i )

[0128] In the formula, Score(v i ) represents node v i The score, where α, β, and γ represent the weights of node-level feature bias, structural evolution rate, and cross-network alignment anomaly, respectively. i -μ W || represents the node-level feature bias, μ W ΔD(v) represents the mean of the sliding window features. i Φ(v) represents the time-series rate of change of nodal degree centrality. i ) indicates the degree of cross-network alignment anomaly.

[0129] In some embodiments, the anomaly detection module is further configured to dynamically set a scoring threshold based on the node's average score and standard deviation.

[0130] It should be noted that the structures of the various spatiotemporal factor-driven complex network anomaly detection devices described in this embodiment belong to the same technical concept as the previously described spatiotemporal factor-driven complex network anomaly detection methods, achieving the same beneficial effects through the same principles, and will not be elaborated here.

[0131] This invention also provides a readable storage medium storing one or more programs that can be executed by one or more processors to implement the methods described in any of the above embodiments.

[0132] The above embodiments are only used to illustrate the present invention and are not intended to limit the present invention. Those skilled in the art can make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, all equivalent technical solutions also fall within the scope of the present invention, and the patent protection scope of the present invention should be defined by the claims.

Claims

1. A spatiotemporal factor-driven anomaly detection method for complex networks, characterized in that, The method includes: Construct a cybersecurity industry chain network; wherein, the cybersecurity industry chain network is represented as G = (V, E) T A S ), where V is a set of nodes, including multiple nodes, each node representing an entity in the industry chain, and E T E is a set of temporal edges used to describe the dynamic interaction relationships between nodes. T ={E supply E compete E coop }×T,E supply E compete E coop Let T represent the supply relationship, competition relationship, and cooperation relationship, respectively, and let A represent the timestamp set. S Let A be a spatiotemporal attribute matrix. S =(X t ,S k ), X t ∈R n ×d , representing the time feature, n and d representing the dimension, R representing the real number space, S k =A k Let X represent the spatial neighborhood features of order k, A represent the adjacency matrix, k represent the order, and X represent the node features. k This indicates that k graph convolution operations are performed. The temporal features are used to record the dynamic behavior indicators of each node, the spatial neighborhood features are used to capture the topological relationships of the industry chain network, and the weights of the supply relationship, competition relationship, and cooperation relationship are determined by the adjacency matrix. The temporal features and spatial neighborhood features are encoded based on the time decay function to obtain the spatiotemporal factor. The dynamic relation weight is calculated based on the spatiotemporal factor and is used to quantify the abnormal contribution of different types of temporal edges. Based on time-series sliding window sampling, the network state containing τ time steps is extracted from the network security industry chain network. Based on the network state containing τ time steps, the feature vectors of the same node in different time windows are extracted as positive samples, and the feature vectors of different nodes in the same time window are extracted as negative samples. The feature vectors are dynamic relationship weights. The positive and negative samples are compared and learned based on the contrastive loss function to obtain the feature vectors of each node. The node-level feature bias of each node is determined based on the feature vector of each node, and the score of each node is calculated based on the node-level feature bias, structural evolution rate and cross-network alignment anomaly of each node. Based on a dynamically set scoring threshold, if a node's score exceeds the set threshold, then the node is determined to have abnormal behavior.

2. The spatiotemporal factor-driven anomaly detection method for complex networks according to claim 1, characterized in that, The spatiotemporal factor is obtained by encoding the temporal and spatial neighborhood features based on the time decay function using the following formula: Z=σ([X t ||S k ]·W z +b z ) In the formula, Z represents the spatiotemporal factor, || represents feature concatenation, and W z Let b represent the weight matrix. z σ represents the bias term, and σ represents the time decay function.

3. The spatiotemporal factor-driven anomaly detection method for complex networks according to claim 2, characterized in that, The time decay function is expressed as: σ(t)=e -λΔt In the formula, e represents the natural constant, Δt represents the time interval, and λ represents the attenuation coefficient.

4. The spatiotemporal factor-driven anomaly detection method for complex networks according to claim 1, characterized in that, Based on the aforementioned spatiotemporal factors, the dynamic relationship weights are calculated using the following formula: α ij =softmax(LeakyReLu(a T [WITH i ||From j ])) In the formula, α ij The dynamic relationship weights between the i-th and j-th nodes are represented by Z, softmax represents the normalization operation, LeakyReLU represents the activation function, and Z represents the dynamic relationship weights between the i-th and j-th nodes. i and Z j Let represent the spatiotemporal factors of the i-th node and the j-th node, respectively, and || denote feature concatenation.

5. The spatiotemporal factor-driven anomaly detection method for complex networks according to claim 1, characterized in that, Based on time-series sliding window sampling, the network state containing τ time steps extracted from the network security industry chain network is represented as W. t =[G t-τ G t-τ+1 ,…,G t ], where G t-τ G t-τ+1 and G t These represent the network states at time steps t-τ, -τ+1, and t, respectively.

6. The spatiotemporal factor-driven anomaly detection method for complex networks according to claim 1, characterized in that, The contrastive loss function is expressed as follows: In the formula, L c This represents the contrast loss, where e represents the natural constant. Indicates a negative sample. Let τ represent the positive sample, sim represent the similarity, τ be the sliding window length, m be the index of the negative sample, M be the number of negative samples, and c be the similarity score. i Let be the feature vector of the i-th node.

7. The spatiotemporal factor-driven anomaly detection method for complex networks according to claim 6, characterized in that, Based on the node-level feature bias, structural evolution rate, and cross-network alignment anomaly of each node, the score of each node is calculated using the following formula: Score(v i )=α·||c i -m W ||+β·ΔD(v i )+γ·Φ(v i ) In the formula, Score(v i ) represents node v i The score, where α, β, and γ represent the weights of node-level feature bias, structural evolution rate, and cross-network alignment anomaly, respectively. i -μ W || represents the node-level feature bias, μ W ΔD(v) represents the mean of the sliding window features. i φ(v) represents the time-series rate of change of nodal degree centrality. i ) indicates the degree of cross-network alignment anomaly.

8. The spatiotemporal factor-driven anomaly detection method for complex networks according to claim 1, characterized in that, The scoring threshold is dynamically set based on the average score and standard deviation of the nodes.

9. A spatiotemporal factor-driven anomaly detection device for complex networks, characterized in that, The device includes: The network construction module is configured to build a network security industry chain network; wherein, the network security industry chain network is represented as G = (V, E) T A S ), where V is a set of nodes, including multiple nodes, each node representing an entity in the industry chain, and E T E is a set of temporal edges used to describe the dynamic interaction relationships between nodes. T ={E supply E compete E coop }×T,E supply E compete E coop Let T represent the supply relationship, competition relationship, and cooperation relationship, respectively, and let A represent the timestamp set. S Let A be a spatiotemporal attribute matrix. S =(X t ,S k ), X t ∈R n×d , representing the time feature, n and d representing the dimension, R representing the real number space, S k =A k Let X represent the spatial neighborhood features of order k, A represent the adjacency matrix, k represent the order, and X represent the node features. k This indicates that k graph convolution operations are performed. The temporal features are used to record the dynamic behavior indicators of each node, the spatial neighborhood features are used to capture the topological relationships of the industry chain network, and the weights of the supply relationship, competition relationship, and cooperation relationship are determined by the adjacency matrix. The dynamic relation weight calculation module is configured to encode the temporal features and spatial neighborhood features based on the time decay function to obtain spatiotemporal factors, and calculate dynamic relation weights based on the spatiotemporal factors. The dynamic relation weights are used to quantify the abnormal contribution of different types of temporal edges. The time-series sampling module is configured to extract network states containing τ time steps from the network security industry chain network based on time-series sliding window sampling; The contrastive learning module is configured to extract the feature vectors of the same node in different time windows as positive samples and the feature vectors of different nodes in the same time window as negative samples based on the network state containing τ time steps. The feature vectors are dynamic relation weights. The positive and negative samples are compared and learned based on the contrastive loss function to obtain the feature vector of each node. The scoring calculation module is configured to determine the node-level feature deviation of each node based on the feature vector of each node, and to calculate the score of each node based on the node-level feature deviation, structural evolution rate and cross-network alignment anomaly of each node. The anomaly detection module is configured to determine that the node has abnormal behavior if the node's score exceeds the set score threshold based on a dynamically set scoring threshold.

10. A non-transitory computer-readable storage medium storing instructions, characterized in that, When the instructions are executed by the processor, the method according to any one of claims 1 to 8 is performed.

Images