Abnormal traffic flow detection method and system based on dynamic graph

Abstract

The present invention discloses a method and system for detecting abnormal traffic flow based on dynamic graphs, which are applied to the field of abnormal traffic flow detection. The method includes: dividing a city into several sub-areas through urban road network data, obtaining vehicle trajectory data to construct a traffic flow tensor; constructing an approximate graph based on the traffic flow tensor and performing data enhancement to generate local and global views of the traffic flow tensor; designing a contrastive learning model with a time graph encoder to jointly train multi-view data and capture spatiotemporal dependency features; using a sliding window to obtain real-time traffic flow embedding vectors, identifying abnormal traffic patterns through a local anomaly factor algorithm, and ultimately locating abnormal traffic areas in the city. This method effectively improves the accuracy of traffic anomaly detection in complex road network environments through the fusion of a time graph encoder and contrastive learning, providing reliable technical support for intelligent urban traffic management.

Description

Technical Field

[0001] The present invention relates to the technical field of abnormal traffic flow detection, and in particular to a method and system for abnormal traffic flow detection based on dynamic graphs. Background Art

[0002] Detecting anomalies in urban traffic flow is a core requirement for intelligent transportation system optimization and emergency management. Current mainstream approaches rely primarily on traffic statistics collected by fixed sensors or threshold warning mechanisms based on historical data. While these methods can identify significant traffic fluctuations, they are limited by static analysis frameworks and struggle to capture the dynamic spatiotemporal characteristics of traffic flow in complex road networks.

[0003] In recent years, abnormal traffic flow detection technology based on graph neural networks has improved flow detection accuracy by modeling road network topology. However, these technologies typically employ fixed graph structures and fail to reflect the dynamic evolution of traffic conditions in real time, resulting in lags in anomaly detection. Furthermore, existing models often focus on single spatial or temporal scale features, lacking a coordinated analysis of the correlation between local road anomalies and the global road network state. This can easily lead to misjudgments due to incomplete feature representation.

[0004] The above-mentioned technical defects make it difficult for the existing system to meet the needs of real-time and accurate positioning of abnormal areas in highly dynamic urban road networks, restricting the improvement of the proactive response capabilities of traffic management. Summary of the Invention

[0005] The embodiments of the present invention provide a method and system for detecting abnormal traffic flow based on dynamic graphs, which can improve the accuracy of abnormal traffic flow detection.

[0006] To achieve the above objectives, the embodiments of the present application adopt the following technical solutions.

[0007] According to the first aspect of the present invention, a method for detecting abnormal traffic flow based on dynamic graph is provided, comprising: obtaining urban road network data, dividing the city into several sub-areas according to the urban road network data; obtaining vehicle trajectory data, and detecting abnormal traffic flow based on the time interval. Divide the time period, count the traffic flow of the sub-region in each time period, and construct a traffic flow tensor; calculate the similarity between sub-regions based on the traffic flow tensor and construct a similarity graph; obtain the spatial information of the sub-region and construct a proximity graph based on the spatial information; fuse the similarity graph and the proximity graph to obtain an approximate graph; perform temporal data enhancement on the traffic flow tensor and spatial data enhancement on the approximate graph to construct the local view and global view of the sub-region in each time period; use the temporal graph encoder to build a contrastive learning model, and input the local view and global view of the historical time period into the contrastive learning model for training; extract the temporal graph encoder from the trained contrastive learning model, obtain the traffic flow and approximate graph of the sub-region in the current time period, use the traffic flow as the node attribute corresponding to the sub-region in the approximate graph, input it into the temporal graph encoder, and obtain the embedding vector of the sub-region in the current time period; construct a sliding window, collect the embedding vectors within the sliding window, use the local anomaly factor algorithm to detect abnormal embedding vectors within the sliding window, and find the sub-region with abnormal traffic flow in the current time period based on the abnormal embedding vectors.

[0008] According to an embodiment of the present invention, the urban road network data includes: spatial information of the city and spatial information and topological information of the urban road network.

[0009] According to an embodiment of the present invention, the sub-region includes the region number and spatial information of the sub-region, the spatial information includes the latitude and longitude range, and the topological information includes the connection relationship between urban roads.

[0010] According to an embodiment of the present invention, vehicle trajectory data is obtained at time intervals of The time period is divided, the traffic flow of the sub-area in each time period is counted, and a traffic flow tensor is constructed, including: obtaining vehicle trajectory data, extracting the start and end trajectories in the vehicle trajectory data, projecting them to the sub-area according to the starting point and end point of the start and end trajectories, obtaining the starting area number and the ending area number of the start and end trajectories, and counting the traffic flow of the sub-area in each time period according to the starting area number, start time, ending area number and end time of the start and end trajectories. The traffic flow includes outflow and inflow. The outflow represents the traffic flow departing from the sub-area, and the inflow represents the traffic flow arriving at the sub-area. The traffic flow tensor is constructed with the number of sub-areas, the number of time periods and the traffic flow as the shape.

[0011] According to an embodiment of the present invention, the similarity between sub-regions is calculated based on the traffic flow tensor, and a similarity graph is constructed, including: obtaining the historical traffic flow of the sub-regions based on the traffic flow tensor, calculating the Pearson correlation coefficient between the historical traffic flow of the sub-regions, and using the Pearson correlation coefficient as the similarity between the sub-regions; using several sub-regions with the highest similarity in each sub-region as its similar regions; using the sub-regions as nodes, establishing edges between the sub-regions and their similar regions and constructing a similarity graph; the edge weights in the similarity graph are the similarities between the nodes.

[0012] According to an embodiment of the present invention, spatial information of sub-regions is obtained, and a proximity graph is constructed based on the spatial information, including: obtaining spatial information of sub-regions, calculating sub-region centers based on the spatial information, and calculating distances between sub-regions based on the sub-region centers; taking several sub-regions closest to each sub-region as its proximity regions; using sub-regions as nodes, establishing edges between sub-regions and their proximity regions and constructing a proximity graph; the edge weights in the proximity graph are the distances between the nodes.

[0013] According to an embodiment of the present invention, a similarity graph and a proximity graph are fused to obtain an approximate graph, including: nodes of the approximate graph are the same as nodes in the similarity graph and the proximity graph, edges of the approximate graph are the union of edges in the similarity graph and the proximity graph, and the approximation between nodes is calculated based on similarity and distance, and the approximation between nodes is used as the edge weight of the approximate graph. The calculation formula of the approximation is:

[0014] ;

[0015] in, represents any node in the approximate graph, Represents the approximate graph with Any adjacent node, Represents a node in the approximate graph With node The approximation between is the corresponding node in the similarity graph With node The edge weights between is the corresponding node in the neighboring graph With node The edge weights between is a hyperparameter.

[0016] According to an embodiment of the present invention, the traffic flow tensor is enhanced in time data, and the approximate graph is enhanced in space data, and the local view and the global view of the sub-region in each time period are constructed, including: adding Gaussian noise to the traffic flow tensor and then scaling it to obtain a first traffic flow tensor; randomly selecting a distortion ratio for each sub-region, and randomly selecting a distortion window of the traffic flow tensor for each sub-region in the time period dimension, stretching or compressing the traffic flow in the distortion window according to the distortion ratio to obtain a second traffic flow tensor; obtaining the adjacency matrix of the proximity graph, performing heat kernel graph diffusion calculation on the adjacency matrix, and obtaining a diffusion adjacency matrix of the proximity graph; setting the edge weights of the approximate graph as the similarity between nodes to obtain a global time graph; calculating and updating the edge weights of the approximate graph based on the diffusion adjacency matrix and the global time graph to obtain a global approximate graph; if an edge in the approximate graph exists in both the diffusion adjacency matrix and the global time graph, representing the element value in the diffusion adjacency matrix as the distance between nodes, and representing the edge weight in the global time graph as the similarity between nodes, according to the distance between nodes and the similarity between nodes. Similarity is used to calculate the proximity between nodes, and the proximity between nodes is used to update the edge weight of a certain edge in the approximate graph; otherwise, the distance between nodes is obtained from the proximity graph, and the edge weight in the global time graph is expressed as the similarity between nodes. The proximity between nodes is calculated based on the distance between nodes and the similarity between nodes, and the edge weight of a certain edge in the approximate graph is updated using the proximity between nodes; until the edge weights of all edges in the approximate graph are updated, a global approximate graph is obtained; the traffic flow of the sub-region in each time period is obtained from the first traffic flow tensor as the first traffic flow, and an approximate graph for each time period is obtained. In each time period, the first traffic flow is used as the node attribute in the approximate graph according to the correspondence between the node and the sub-region, and a local view of the sub-region in each time period is obtained; the traffic flow of the sub-region in each time period is obtained from the second traffic flow tensor as the second traffic flow, and a global approximate graph for each time period is obtained. In each time period, the second traffic flow is used as the node attribute in the global approximate graph according to the correspondence between the node and the sub-region, and a global view of the sub-region in each time period is obtained.

[0017] According to an embodiment of the present invention, the local view and the global view of the historical time period are input into the contrastive learning model for training, including: inputting the local view and the global view of the historical time period into the online network and the target network of the contrastive learning model respectively; using a time graph encoder to encode node events and edge events to obtain local embedding vectors and global embedding vectors; inputting the local embedding vectors and the global embedding vectors into a projection head to obtain local contrast vectors and global contrast vectors; using a prediction head of an online network to predict the local contrast vector to obtain a local prediction vector; calculating the mean square error between the local prediction vector and the global contrast vector to obtain a local loss; inputting the local view and the global view into the target network and the online network of the contrastive learning model respectively, and obtaining a global loss through the above steps; adding the local loss to the global loss to obtain a total loss, and finally updating the parameters of the contrastive learning model through the total loss.

[0018] According to an embodiment of the present invention, a temporal graph encoder includes: a temporal graph encoder is a deep learning model for dynamic graphs, which can model the graph as a series of node events and edge events and capture the long-term dependencies of the nodes; the temporal graph encoder includes a storage module, a message function module, a message aggregation module, a storage update module and an embedding module, the storage module is responsible for storing the memory vector of the node, the message function module is responsible for calculating the timestamp event and generating the message vector, the message aggregation module is used to aggregate multiple message vectors involving the same node in the same batch of training data, the storage update module updates the memory vector according to the message vector and the memory vector, and the embedding module is responsible for embedding the memory vector of the node to obtain the embedded vector.

[0019] According to an embodiment of the present invention, a node event occurs at a single node, indicating that the attributes of the node are updated in a certain time period, including: an edge event occurs at a node pair. If there is no edge between the node pair in the previous time period, the edge event indicates that a new edge and edge weight are added between the node pair in the current time period; otherwise, the edge event indicates that the edge weight between the node pair is updated in the current time period.

[0020] According to an embodiment of the present invention, a comparative learning model includes: an online network includes a time graph encoder, a projection head and a prediction head, and a target network includes a time graph encoder and a projection head; the time graph encoder and the projection head in the online network have the same structure and initial parameters as the time graph encoder and the projection head in the target network.

[0021] According to an embodiment of the present invention, a parameter updating method of a comparative learning model includes:

[0022] ;

[0023] in, represents the parameters of the online network, represents the parameters of the target network, represents the total loss, Represents the total loss in the online network The gradient, represents the learning rate, Represents the Adam optimizer, which is used to optimize network parameters; the parameters of the target network According to online network parameters Perform momentum update, is the momentum coefficient.

[0024] According to an embodiment of the present invention, a sliding window is constructed, embedding vectors in the sliding window are collected, an abnormal embedding vector in the sliding window is detected using a local anomaly factor algorithm, and a sub-region with abnormal traffic flow in the current time period is found based on the abnormal embedding vector, including: constructing a Sliding window, using the sliding window to collect the current time period and history The local anomaly factor algorithm is used to calculate the local anomaly factors of all embedded vectors in the sliding window, and the local anomaly factors are sorted to obtain the top vector with the largest local anomaly factor. The embedding vector of the proportion is used as the candidate abnormal embedding vector, and it is judged whether the candidate abnormal embedding vector is in the current time period. If so, the candidate abnormal embedding vector is used as the abnormal embedding vector; finally, the sub-areas corresponding to all abnormal embedding vectors are regarded as the sub-areas with abnormal traffic flow in the current time period.

[0025] A second aspect of the present invention provides a dynamic graph-based abnormal traffic flow detection system, comprising:

[0026] Sub-area division module: used to divide the city into several sub-areas based on urban road network data;

[0027] Traffic flow tensor construction module: used to obtain vehicle trajectory data and divide it into time periods, count the traffic flow of the sub-area in each time period, and construct the traffic flow tensor;

[0028] Approximate graph generation module: used to calculate the similarity between sub-regions based on the traffic flow tensor, construct a similarity graph, construct a proximity graph based on the spatial information of the sub-regions, and fuse the similarity graph and proximity graph to obtain an approximate graph;

[0029] Spatiotemporal data enhancement module: This module is used to perform temporal data enhancement on the traffic flow tensor and spatial data enhancement on the approximate graph, constructing local and global views of the sub-region in each time period.

[0030] Contrastive training module: used to input local views and global views of historical time periods into the contrastive learning model for training;

[0031] Anomaly Detection Module: This module extracts a time graph encoder from the trained contrastive learning model, uses the traffic flow of the sub-region in the current time period as the node attribute corresponding to the sub-region in the approximate graph, inputs the time graph encoder, and obtains the embedding vector of the sub-region in the current time period. It also constructs a sliding window, collects the embedding vectors within the sliding window, and uses the local anomaly factor algorithm to detect abnormal embedding vectors within the sliding window. Based on the abnormal embedding vectors, it finds sub-regions with abnormal traffic flow in the current time period.

[0032] A third aspect of the present invention provides an electronic device, comprising: a processor and a memory for storing executable instructions that can be run on the processor, wherein when the processor is used to run the executable instructions, the executable instructions execute the steps in the above method.

[0033] The fourth aspect of the present invention further provides a non-transitory computer-readable storage medium having computer-executable instructions stored thereon, which implement the steps in the above method when executed by a processor.

[0034] The beneficial effects of the present invention are as follows: It provides a method and system for detecting abnormal traffic flow based on dynamic graphs. This innovatively integrates four core modules: approximate graph construction, spatiotemporal data enhancement, a temporal graph encoder, and a contrastive learning model, enabling deep mining of spatiotemporal characteristics of traffic flow and discriminative representation learning. While effectively capturing the complex spatiotemporal dependencies in traffic flow, this method and system demonstrate outstanding stability and accuracy in detecting abnormal traffic flow in complex traffic scenarios. This provides a new solution for traffic flow anomaly detection and a valuable reference for the application of dynamic graph neural networks in spatiotemporal data mining. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The above contents and other objects, features and advantages of the present invention will become more apparent through the following description of the embodiments of the present invention with reference to the accompanying drawings, in which:

[0036] Figure 1 A flow chart of a method for detecting abnormal traffic flow based on a dynamic graph according to an embodiment of the present invention is shown;

[0037] Figure 2 A schematic diagram showing the fusion of a proximity graph and a similarity graph into an approximate graph according to an embodiment of the present invention is shown;

[0038] Figure 3 A schematic diagram of a contrastive learning model with a temporal graph encoder according to an embodiment of the present invention is shown;

[0039] Figure 4 shows a structural block diagram of an abnormal traffic flow detection system based on dynamic graph according to an embodiment of the present invention;

[0040] Figure 5 A schematic structural diagram of an electronic device according to an embodiment of the present invention is shown;

[0041] Figure 6 A schematic structural diagram of a non-transitory computer-readable storage medium according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0042] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present invention. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of embodiments of the present invention. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concept of the present invention.

[0043] The terms used herein are only for describing specific embodiments and are not intended to limit the present invention. The terms "comprise," "include," etc. used herein indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0044] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0045] The embodiment of the present invention provides a method for detecting abnormal traffic flow based on dynamic graphs, comprising: obtaining urban road network data, dividing the city into several sub-areas according to the urban road network data; obtaining vehicle trajectory data, and Divide the time period, count the traffic flow of the sub-region in each time period, and construct a traffic flow tensor; calculate the similarity between sub-regions based on the traffic flow tensor and construct a similarity graph; obtain the spatial information of the sub-region, and construct a proximity graph based on the inter-information; fuse the similarity graph and the proximity graph to obtain an approximate graph; perform temporal data enhancement on the traffic flow tensor and spatial data enhancement on the approximate graph to construct the local view and global view of the sub-region in each time period; use the temporal graph encoder to build a contrastive learning model, and input the local view and global view of the historical time period into the contrastive learning model for training; extract the temporal graph encoder from the trained contrastive learning model, obtain the traffic flow and approximate graph of the sub-region in the current time period, use the traffic flow as the node attribute corresponding to the sub-region in the approximate graph, input it into the temporal graph encoder, and obtain the embedding vector of the sub-region in the current time period; construct a sliding window, collect the embedding vectors within the sliding window, use the local anomaly factor algorithm to detect abnormal embedding vectors within the sliding window, and find the sub-region with abnormal traffic flow in the current time period based on the abnormal embedding vectors.

[0046] Figure 1 A flow chart of a method for detecting abnormal traffic flow based on a dynamic graph according to an embodiment of the present invention is shown.

[0047] like Figure 1 As shown, the abnormal traffic flow detection method based on dynamic graphs of this embodiment includes operations S10 to S70.

[0048] In operation S10, urban road network data is acquired, and the city is divided into several sub-areas according to the urban road network data.

[0049] In operation S20, the vehicle trajectory data is obtained at a time interval of Divide the time period, count the traffic flow of the sub-area in each time period, and construct the traffic flow tensor.

[0050] In operation S30 , similarities between sub-regions are calculated based on the traffic flow tensor, a similarity graph is constructed, spatial information of the sub-regions is obtained, a proximity graph is constructed, and the similarity graph and the proximity graph are fused to obtain an approximate graph.

[0051] In operation S40 , temporal data enhancement is performed on the traffic flow tensor, and spatial data enhancement is performed on the approximate graph, so as to construct a local view and a global view of the sub-region in each time period.

[0052] In operation S50 , a contrastive learning model is constructed using a temporal graph encoder, and the local view and the global view of the historical time period are input into the contrastive learning model for training.

[0053] In operation S60, a time graph encoder is extracted from the trained contrastive learning model, and the traffic flow and the approximate graph of the sub-region of the current time period are obtained. The traffic flow is used as the node attribute corresponding to the sub-region in the approximate graph and input into the time graph encoder to obtain the embedding vector of the sub-region of the current time period.

[0054] In operation S70, a sliding window is constructed, embedding vectors within the sliding window are collected, abnormal embedding vectors within the sliding window are detected using a local anomaly factor algorithm, and sub-regions with abnormal traffic flow in the current time period are found based on the abnormal embedding vectors.

[0055] According to an embodiment of the present invention, urban road network data is acquired and regionalized to obtain several sub-regions. A traffic flow tensor is constructed based on vehicle trajectory data, and local and global views of traffic flow are generated through dynamic graph modeling and multi-view data enhancement. The local and global views are input into a comparative learning model for training, and a temporal graph encoder is used to capture the spatiotemporal evolution characteristics of traffic flow. A sliding window mechanism is combined with a local anomaly factor algorithm to detect abnormal embedding vectors that deviate from the spatiotemporal pattern, thereby achieving accurate positioning of abnormal areas of urban traffic flow. Through a multi-stage joint modeling and comparative learning mechanism, the accuracy and robustness of traffic anomaly detection are effectively improved.

[0056] According to an embodiment of the present invention, urban road network data is obtained, and the city is divided into several sub-areas based on the urban road network data, including: the urban road network data includes the spatial information of the city and the spatial information and topological information of the urban road network; the sub-area includes the area number and the spatial information of the sub-area, the spatial information includes the latitude and longitude range, and the topological information includes the connection relationship between urban roads.

[0057] According to an embodiment of the present invention, the spatial information and topological information data of the urban road network obtained refer to the geographical location information data composed of urban expressways, main roads, secondary roads and branches divided according to road grades and data covering the topological connection relationship of roads; based on the obtained spatial information and topological information data of the urban road network, a sub-area division result is formed, and finally a sub-area set is constructed.

[0058] According to an embodiment of the present invention, the sub-region set is as shown in formula (1):

[0059]

[0060] in, represents a set of sub-regions, represents the number of sub-regions, Indicates the The sub-region includes the region number and the spatial information of the sub-region. The spatial information includes the latitude and longitude range, and the topological information includes the connection relationship between urban roads.

[0061] According to an embodiment of the present invention, the acquired urban road network data is subjected to sub-region division processing, so that the urban traffic distribution characteristics are comprehensively and accurately determined by analyzing the sub-region division results and traffic flow data.

[0062] According to an embodiment of the present invention, vehicle trajectory data is obtained at time intervals of The time period is divided, the traffic flow of the sub-area in each time period is counted, and a traffic flow tensor is constructed, including: obtaining vehicle trajectory data, extracting the start and end trajectories in the vehicle trajectory data, projecting them to the sub-area according to the starting point and end point of the start and end trajectories, obtaining the starting area number and the ending area number of the start and end trajectories, and counting the traffic flow of the sub-area in each time period according to the starting area number, start time, ending area number and end time of the start and end trajectories. The traffic flow includes outflow and inflow. The outflow represents the traffic flow departing from the sub-area, and the inflow represents the traffic flow arriving at the sub-area. The traffic flow tensor is constructed with the number of sub-areas, the number of time periods and the traffic flow as the shape.

[0063] According to an embodiment of the present invention, preferably, the vehicle trajectory data is recorded at 30-minute intervals. Divide into segments, as shown in formula (2):

[0064]

[0065] in, Represents a set of divided time periods, Indicates the number of time periods, Indicates the Time periods, adjacent time periods meet the conditions .

[0066] According to an embodiment of the present invention, the time period is calculated based on the start and end trajectories in the vehicle trajectory data. Sub-area Influx and outflow , into the flow and outflow The initial value is 0. Analyze the vehicle trajectory data. If the starting time of the vehicle trajectory data shows that it is in the time period Entering a sub-area from another sub-area ,but If the end time of the vehicle trajectory shows that it is within the time period Inner sub-area Entering other sub-areas, , according to the inflow and outflow Building traffic flow .

[0067] According to an embodiment of the present invention, the number of sub-regions , number of time periods , traffic flow Constructing a traffic flow tensor for the shape .

[0068] According to an embodiment of the present invention, vehicle trajectory data containing multi-dimensional spatiotemporal features is structured and analyzed and traffic modeled, thereby comprehensively characterizing the dynamic evolution of urban traffic by constructing a traffic flow tensor and improving the accuracy of urban traffic status analysis.

[0069] According to an embodiment of the present invention, the similarity between sub-regions is calculated based on the traffic flow tensor, and a similarity graph is constructed, including: obtaining the historical traffic flow of the sub-regions based on the traffic flow tensor, calculating the Pearson correlation coefficient between the historical traffic flow of the sub-regions, and using the Pearson correlation coefficient as the similarity between the sub-regions; using several sub-regions with the highest similarity in each sub-region as its similar regions; using the sub-regions as nodes, establishing edges between the sub-regions and their similar regions and constructing a similarity graph; the edge weights in the similarity graph are the similarities between the nodes.

[0070] According to an embodiment of the present invention, based on the traffic flow tensor Get the historical traffic flow of the sub-area and calculate the sub-area based on the Pearson coefficient With sub-region The similarity of single-day traffic flow characteristics between Sub-area With sub-region The calculation method of the inflow similarity between is shown in formula (3):

[0071]

[0072] in, Indicates the time period Sub-area With sub-region The inflow similarity between Indicates sub-area In the time period The inflow, Indicates sub-area In the time period The average inflow of 48 time periods in the previous day, Indicates sub-area In the time period The inflow, Indicates sub-area In the time period The average inflow of the previous day in 48 time periods.

[0073] According to an embodiment of the present invention, according to the sub-region With sub-region The inflow similarity between Similarity with outflow , calculate the sub-region With sub-region Similarity between sub-region sets Divide the sub-region External sub-areas, calculate their and sub-regions The similarity of the two is sorted in ascending order, and the first one with the smallest similarity is selected. sub-regions, constructed as Sub-area Similar areas , in the time period Sub-area With sub-region The similarity calculation method between them is shown in formula (4):

[0074]

[0075] in, Indicates the time period Sub-area With sub-region The inflow similarity between Indicates the time period Sub-area With sub-region The outflow similarity between .

[0076] According to an embodiment of the present invention, Sub-area Similar areas Construct the time period between sub-regions The set of similar edges ; Set similar edges With sub-region collection Combination, sub-area For the node, get Similar graphs of , where the sub-region in the similarity graph With sub-region The weight of the edge equal and The similarity between .

[0077] According to an embodiment of the present invention, the similarity between sub-regions in a sub-region set is calculated based on the traffic flow tensor and the Pearson coefficient, thereby constructing a similarity graph, effectively improving the accuracy of traffic flow correlation analysis.

[0078] According to an embodiment of the present invention, spatial information of sub-regions is obtained, and a proximity graph is constructed based on the spatial information, including: obtaining spatial information of sub-regions, calculating sub-region centers based on the spatial information, and calculating distances between sub-regions based on the sub-region centers; taking several sub-regions closest to each sub-region as its proximity regions; using sub-regions as nodes, establishing edges between sub-regions and their proximity regions and constructing a proximity graph; the edge weights in the proximity graph are the distances between the nodes.

[0079] According to an embodiment of the present invention, based on the spatial information of urban road network data and the sub-region set , calculate the sub-region center The sub-region center and calculate the sub-region With the sub-area set except The Euclidean distance between subregions, where is the size of the sub-region set; after sorting the Euclidean distance in ascending order, select the sub-region The first one with the smallest Euclidean distance Sub-regions are constructed into sub-regions Neighboring areas , neighboring areas The expression of is shown in formula (5):

[0080]

[0081] in, Indicates sub-area neighboring areas, Indicates returning the parameter set corresponding to the minimum value that meets the conditions. Represents a sub-region set Middle sub-regions, Indicates excluding subregions from the full set R After the collection elements, Represents a sub-region set Middle sub-regions, Indicates sub-area With sub-region The Euclidean distance between .

[0082] According to an embodiment of the present invention, based on the adjacent area Construct a set of adjacent edges between sub-regions , The expression of is shown in formula (6):

[0083]

[0084] in, represents the set of adjacent edges between sub-regions, Indicates the first sub-regions, Indicates the first sub-regions, Indicates sub-area With sub-region The normalized Euclidean distance between Indicates the The neighboring area of ​​a sub-region.

[0085] According to an embodiment of the present invention, the adjacent edges are grouped With sub-region collection Combination, sub-area For nodes, we get the proximity graph , where the sub-regions in the adjacent graph With sub-region The weight of the edge equal and The normalized Euclidean distance between them.

[0086] According to an embodiment of the present invention, a proximity graph is constructed to comprehensively and accurately represent the spatial association relationship between sub-regions.

[0087] According to an embodiment of the present invention, a similarity graph and a proximity graph are fused to obtain an approximate graph, including: the nodes of the approximate graph are the same as the nodes in the similarity graph and the proximity graph, the edges of the approximate graph are the union of the edges in the similarity graph and the proximity graph, the approximation between the nodes is calculated based on the similarity and distance, and the approximation between the nodes is used as the edge weight of the approximate graph.

[0088] Figure 2 A schematic diagram showing the fusion of a proximity graph and a similarity graph into an approximate graph according to an embodiment of the present invention is shown;

[0089] like Figure 2 As shown, according to the Euclidean distance and Pearson similarity between sub-regions, a proximity graph and a similarity graph are constructed. After the proximity graph and the similarity graph are fused, the nodes and edges in the proximity graph and the similarity graph all exist in the approximate graph.

[0090] According to an embodiment of the present invention, a proximity graph and a similarity graph are fused to obtain an approximate graph, including: the nodes of the approximate graph are the same as the nodes in the similarity graph and the proximity graph, the edges of the approximate graph are the union of the edges in the similarity graph and the proximity graph, the approximation between the nodes is calculated based on the similarity and distance, and the approximation between the nodes is used as the edge weight of the approximate graph. The calculation method of the approximation is shown in formula (7):

[0091]

[0092] in, represents any node in the approximate graph, Represents the approximate graph with Any adjacent node, Represents a node in the approximate graph With node The approximation between is the corresponding node in the similarity graph With node The edge weights between is the corresponding node in the neighboring graph With node The edge weights between is a hyperparameter.

[0093] According to an embodiment of the present invention, based on the adjacent edge set and time period The set of similar edges The union of , constructing the time period The approximate edge set of , time period The approximate edge set of The expression of is shown in formula (8):

[0094]

[0095] in, Indicates time period The dynamic approximate edge set of is the set of adjacent edges, Indicates time period The set of similar edges .

[0096] According to an embodiment of the present invention, the neighboring map and time period Similar graphs of Combine them to get the time period Approximate graph of ,in, represents a set of sub-regions, Indicates time period Dynamic approximate edge set of and time period Weights of similar graph edges , calculate the time period The weights of the edges of the approximate graph .

[0097] According to an embodiment of the present invention, the proximity graph and the similarity graph are fused to obtain the dual features of sub-region spatial proximity and traffic flow similarity. The traffic flow association network is dynamically reconstructed to accurately extract the dynamic approximate relationship between sub-regions.

[0098] According to an embodiment of the present invention, the traffic flow tensor is enhanced in time data, and the approximate graph is enhanced in space data, and the local view and global view of the sub-region in each time period are constructed, including: adding Gaussian noise to the traffic flow tensor and then scaling it to obtain a first traffic flow tensor; randomly selecting a distortion ratio for each sub-region, and randomly selecting a distortion window of the traffic flow tensor for each sub-region in the time period dimension, stretching or compressing the traffic flow in the distortion window according to the distortion ratio to obtain a second traffic flow tensor; obtaining the adjacency matrix of the proximity graph, performing heat kernel graph diffusion calculation on the adjacency matrix, and obtaining a diffusion adjacency matrix of the proximity graph; setting the edge weights of the approximate graph to the similarity between nodes to obtain a global time graph; calculating and updating the edge weights of the approximate graph based on the diffusion adjacency matrix and the global time graph to obtain a global approximate graph; if an edge in the approximate graph exists in both the diffusion adjacency matrix and the global time graph, representing the element value in the diffusion adjacency matrix as the distance between nodes, and representing the edge weight in the global time graph as the similarity between nodes, according to the distance between nodes and the similarity between nodes The similarity between nodes is calculated based on the degree of similarity between nodes, and the edge weight of a certain edge in the approximate graph is updated using the similarity between nodes; otherwise, the distance between nodes is obtained from the proximity graph, the edge weight in the global time graph is expressed as the similarity between nodes, the similarity between nodes is calculated based on the distance between nodes and the similarity between nodes, and the edge weight of a certain edge in the approximate graph is updated using the similarity between nodes; until the edge weights of all edges in the approximate graph are updated, a global approximate graph is obtained; the traffic flow of the sub-region in each time period is obtained from the first traffic flow tensor as the first traffic flow, an approximate graph for each time period is obtained, and the first traffic flow is used as the node attribute in the approximate graph according to the correspondence between nodes and sub-regions in each time period to obtain a local view of the sub-region in each time period; the traffic flow of the sub-region in each time period is obtained from the second traffic flow tensor as the second traffic flow, a global approximate graph for each time period is obtained, and the second traffic flow is used as the node attribute in the global approximate graph according to the correspondence between nodes and sub-regions in each time period to obtain a global view of the sub-region in each time period.

[0099] According to an embodiment of the present invention, the traffic flow tensor Add Gaussian noise to each element in to get the jittered traffic flow tensor , the traffic flow tensor after jitter After global scaling, we get the first traffic flow tensor , the operations of adding Gaussian noise and global scaling are shown in formula (9) and formula (10):

[0100]

[0101]

[0102] in, Indicates time period Sub-area after dithering traffic flow, Indicates time period Sub-area traffic flow, Indicates that it obeys a zero-mean Gaussian distribution A random variable, represents the noise variance, Indicates time period Sub-area The first traffic flow tensor, According to the normal distribution The resulting scaling factor, represents the scaling factor variance.

[0103] According to an embodiment of the present invention, the traffic flow tensor Sub-areas in Randomly select a , the distortion ratio is , the range is The window is distorted and the size after distortion is Window; perform linear interpolation on the distorted window area in the time series to obtain the second traffic flow tensor .

[0104] Among them, the window distortion ratio , represents the upper bound of the distortion, Represents the lower bound of the distortion; the distortion window range is expressed as: ,in, Indicates sub-area Traffic flow, Represents a randomly selected subregion At a moment in the time series, Indicates the size of the warp window.

[0105] According to an embodiment of the present invention, the neighboring map The adjacency matrix Perform heat core diffusion operation to obtain the diffusion adjacency matrix , based on the approximate graph The adjacency matrix of the global time graph is used to construct the global time graph. The weight of the edge in the global time graph is similar to the similarity graph. The weights remain consistent, where the thermal nuclear diffusion process is shown in formula (11):

[0106]

[0107] in, is the diffusion adjacency matrix, represents the natural exponential function, represents the diffusion time, Adjacency matrix representing a proximity graph The diagonal matrix of .

[0108] According to an embodiment of the present invention, based on the diffusion adjacency matrix The edge weights of the global time graph and the edge weights of the approximate graph The weights of the edges are updated, specifically: for the edges that exist in the diffusion adjacency matrix and the edges of the global time graph, according to the diffusion adjacency matrix The weights of the edges representing distance in the global time graph and the edges representing similarity in the global time graph are recalculated using formula (7) to obtain the approximate graph For the edges that only exist in the global time graph, the approximate graph is recalculated using formula (7) based on the distance between sub-regions and the weight of the edge representing similarity in the global time graph. The weight of the edge is updated until the weight of all edges in the approximate graph is updated, and the global approximate graph is finally obtained. .

[0109] According to an embodiment of the present invention, the sub-area Its neighboring nodes , construct the sub-region The subgraph collection ; From the first traffic flow tensor Get sub-area In each time period The traffic flow is the first traffic flow , get each time period Approximate graph of , in each time period According to the node and sub-area The corresponding relationship will be the first traffic flow As an approximate graph Node attributes in the sub-area In each time period Partial view of ; From the second traffic flow tensor Get sub-area In each time period The traffic flow is used as the second traffic flow , get each time period Global approximation graph of , in each time period According to the node and sub-area The corresponding relationship will be the second traffic flow As a global approximation graph Node attributes in the sub-area In each time period Global view , in the time period Sub-area Partial view of With global view The calculation method is as shown in formula (12) and formula (13):

[0110]

[0111]

[0112] in, Indicates sub-area A partial view of represents a strong time-enhancing operation, represents the length of the sampled time series, Indicates from arrive Containing sub-areas of the moment The subgraph collection The traffic flow tensor, represents the adjacency matrix of the approximate graph, represents a weak time enhancement operation, Represents the adjacency matrix of the global approximate graph.

[0113] According to embodiments of the present invention, the model's robustness to random interference is enhanced by noise perturbation and scaling of the traffic flow tensor. A strongly time-enhanced tensor, generated through window warping and linear interpolation, effectively captures the nonlinear fluctuations and localized mutations of traffic flow. A spatially enhanced view, constructed by fusing heat kernel diffusion with a global temporal graph, models the dynamic spatial correlations between subregions.

[0114] According to an embodiment of the present invention, a contrastive learning model is constructed using a temporal graph encoder, and the local view and the global view of a historical time period are input into the contrastive learning model for training, including: inputting the local view and the global view of the historical time period into the online network and the target network of the contrastive learning model respectively; encoding node events and edge events using the temporal graph encoder to obtain local embedding vectors and global embedding vectors; inputting the local embedding vectors and the global embedding vectors into a projection head to obtain local contrast vectors and a global contrast vector; using the prediction head of the online network to predict the local contrast vector to obtain a local prediction vector; calculating the mean square error between the local prediction vector and the global contrast vector to obtain a local loss; inputting the local view and the global view into the target network and the online network of the contrastive learning model respectively, and obtaining a global loss through the above steps; adding the local loss to the global loss to obtain a total loss, and finally updating the parameters of the contrastive learning model through the total loss.

[0115] According to an embodiment of the present invention, a temporal graph encoder is a deep learning model for dynamic graphs, which can model the graph as a series of node events and edge events and capture the long-term dependencies of nodes; the temporal graph encoder includes a storage module, a message function module, a message aggregation module, a storage update module and an embedding module. The storage module is responsible for storing the memory vector of the node, the message function module is responsible for calculating the timestamp event and generating the message vector, the message aggregation module is used to aggregate multiple message vectors involving the same node in the same batch of training data, the storage update module updates the memory vector according to the message vector and the memory vector, and the embedding module is responsible for embedding the memory vector of the node to obtain the embedded vector.

[0116] According to an embodiment of the present invention, a node event occurs at a single node, indicating that the attributes of the node are updated in a certain time period; an edge event occurs at a node pair. If there is no edge between the node pair in the previous time period, the edge event indicates that a new edge and edge weight are added between the node pair in the current time period; otherwise, the edge event indicates that the edge weight between the node pair is updated in the current time period.

[0117] According to an embodiment of the present invention, for example, based on a plurality of approximate graphs within a certain time interval, The changes between them are constructed as event sets ,in, express Events at a certain moment, including node events Side events Two types, among which express Sub-area of ​​time The attributes of the node Node event, if the sub-area First appeared in Event Collection Indicates adding a sub-area Node attributes, otherwise it means updating the sub-area Node attributes, express Sub-area of ​​time With sub-region The weight of the edge, that is, the node With node Edge event, if the node With node edge First appeared in Event Collection Indicates adding an edge The weight of , otherwise it means updating the edge The weight of .

[0118] According to an embodiment of the present invention, the time map encoder converts any sub-region Related The node attributes and edge weights before the moment are constructed as nodes Memory vector , stored in the storage module of the temporal graph encoder.

[0119] According to an embodiment of the present invention, according to the event set , in the message function module, for the sub-area For each node event, a corresponding memory vector is generated for updating the storage module of the time graph encoder. The message function for the sub-area For each edge event, two events are generated to update the memory vector. The message function of the node event and the message function of the edge event are shown in formula (14), formula (15) and formula (16) respectively:

[0120]

[0121]

[0122]

[0123] in, Indicates The node where the node event occurs at the time News, Representation node exist The memory vector before time, Representation node exist Node events at the moment, Indicates the message function that implements the splicing operation on the input vectors. Indicates The node where the edge event occurs at any moment News, Representation node exist The memory vector before time, represents the time embedding vector, express Node of moment With node The side event, Indicates The node where the edge event occurs at any moment news.

[0124] According to an embodiment of the present invention, in the message aggregation module, a plurality of messages generated by events involving the same node in the same training batch are aggregated, and the messages involving the node The message aggregation operation is as follows: As shown:

[0125]

[0126] in, Indicates the nodes involved The message after the aggregation operation, Indicates that there are involved nodes News, Indicates the nodes involved in the current batch No. A message.

[0127] According to an embodiment of the present invention, based on the aggregated message, a gated recurrent unit is used in the storage update module to update the memory vector in the storage module of the time graph encoder. The calculation process of the update process is shown in Formula (18), Formula (19), Formula (20) and Formula (21) respectively:

[0128]

[0129]

[0130]

[0131]

[0132] in, represents the update gate in the gated recurrent unit, Refers to the Sigmoid activation function, represents the trainable parameter matrix in the update gate, Representation node exist The memory vector before time, Indicates the nodes involved The message after the aggregation operation, represents the trainable bias vector in the update gate, represents the reset gate in the gated recurrent unit, represents the trainable parameter matrix in the reset gate, represents the trainable bias vector in the reset gate, represents the candidate state in the gated recurrent unit, represents the trainable parameter matrix in the candidate state, represents the dot product between vectors, represents the trainable bias vector in the candidate state, Indicates Time Node Updated memory vector.

[0133] According to an embodiment of the present invention, Time Node Updated memory vector As the embedding vector of the temporal graph encoder, it is stored in the embedding module of the temporal graph encoder.

[0134] According to an embodiment of the present invention, a temporal graph encoder efficiently models graph structures and node interactions that evolve over time. Combining graph neural networks with temporal encoding, it captures long-term dependencies in traffic flow by storing and updating node memories. Furthermore, the memory vector is incrementally updated through gated recurrent units, thereby capturing long-term dependencies and dynamic evolution patterns in traffic flow.

[0135] Figure 3 A schematic diagram of a contrastive learning model with a temporal graph encoder according to an embodiment of the present invention is shown.

[0136] like Figure 3 As shown in the figure, the contrastive learning model enhances the input traffic flow tensor data into local and global views, which are fed into an online network with a temporal graph encoder and a projection head and a target network for processing respectively. The online network outputs a prediction vector, and the target network outputs a contrast feature vector. The model is trained by calculating the local loss between the two.

[0137] According to an embodiment of the present invention, the sub-region obtained after data enhancement is Partial view of With global view Input the temporal graph encoder of the online network and the target network in the contrastive learning model respectively for encoding to obtain the sub-region The local embedding vector and global embedding vector of , the encoding process is shown in formula (22) and formula (23):

[0138]

[0139]

[0140] in, Indicates sub-area The local embedding vector of represents a temporal graph encoder in an online network, Indicates sub-area A partial view of Indicates the sub-area The global embedding vector of Indicates sub-area A global view of Represents the temporal graph encoder in the target network.

[0141] According to an embodiment of the present invention, the sub-area The local embedding vector of With the global embedding vector Input the feature mapping into the online network and the projection head of the target network in the contrastive learning model respectively to obtain the sub-region The local contrast vector Compare to the global vector , the feature mapping process is shown in formula (24) and formula (25):

[0142]

[0143]

[0144] in, Indicates sub-area The local contrast vector of represents the projection head in the online network consisting of a linear layer, a batch normalization layer, a rectified linear unit, and a linear layer, Indicates sub-area The local embedding vector of Indicates sub-area The global contrast vector of represents the projection head in the target network consisting of a linear layer, a batch normalization layer, a rectified linear unit, and a linear layer, Indicates sub-area The global embedding vector of .

[0145] According to an embodiment of the present invention, the sub-area The local contrast vector Input into the multilayer perceptron with the same structure as the projection head in the online network to obtain the local prediction vector , the local prediction vector Global comparison vector with the target network Align and calculate the local loss. The local loss function is shown in formula (26):

[0146]

[0147] in, Indicates local loss, Represents the local prediction vector With the global prediction vector The dot product of Represents the local prediction vector norm, Represents the global prediction vector norm.

[0148] According to an embodiment of the present invention, the local prediction vector is obtained The process is shown in formula (27):

[0149]

[0150] in, Indicates sub-area The local prediction vector of represents multi-layer perception in an online network, Indicates sub-area The local contrast vector of .

[0151] According to an embodiment of the present invention, the sub-area The global contrast vector Input the multi-layer perceptron in the online network to obtain the global prediction vector and align it with the local contrast vector of the target network. Calculate the global loss, add the local loss to the global loss, and obtain the total loss function of the contrastive learning model. The total loss function is shown in formula (28):

[0152]

[0153] in, represents the total loss function, represents the local loss function, represents the global loss function.

[0154] According to an embodiment of the present invention, the local view and the global view of the traffic flow tensor are input into the contrastive learning model for training. The network parameters of the contrastive learning model are updated according to the total loss of the contrastive learning model and the Adam optimizer to obtain the time graph encoder in the trained contrastive learning model. The process of updating the network parameters is shown in Formula (29) and Formula (30):

[0155]

[0156]

[0157] in, represents the parameters in the online network, represents the Adam optimizer, Represents the total loss of the contrastive learning model The gradient, represents the learning rate, represents the parameters in the target network, represents the momentum coefficient.

[0158] According to embodiments of the present invention, in traffic flow anomaly detection tasks, a contrastive learning model can effectively learn discriminative feature representations of traffic flow, thereby improving anomaly detection performance. The contrastive learning model can capture the spatiotemporal dependencies of traffic flow and enhance the model's ability to identify abnormal patterns by comparing the feature differences between normal and abnormal samples.

[0159] According to an embodiment of the present invention, a time graph encoder is extracted from the trained contrastive learning model, the traffic flow and the approximate graph of the sub-region of the current time period are obtained, the traffic flow is used as the node attribute corresponding to the sub-region in the approximate graph, and is input into the time graph encoder to obtain the embedding vector of the sub-region of the current time period.

[0160] According to an embodiment of the present invention, the current time period is obtained Traffic flow , according to the traffic flow tensor Build the current time period Approximate graph of , the traffic flow As an approximate graph Middle and sub-areas Corresponding node attributes to get the current time period A collection of events.

[0161] According to an embodiment of the present invention, the current time period The event set is input into the trained time graph encoder to obtain the current time period Embedding vector of the subregion.

[0162] According to an embodiment of the present invention, a sliding window is constructed, embedding vectors in the sliding window are collected, an abnormal embedding vector in the sliding window is detected using a local anomaly factor algorithm, and a sub-region with abnormal traffic flow in the current time period is found based on the abnormal embedding vector, including: constructing a Sliding window, using the sliding window to collect the current time period and history The local anomaly factor algorithm is used to calculate the local anomaly factors of all embedded vectors in the sliding window, and the local anomaly factors are sorted to obtain the top vector with the largest local anomaly factor. Embedding vectors are used as candidate abnormal embedding vectors to determine whether the candidate abnormal embedding vectors are in the current time period. If so, the candidate abnormal embedding vectors are used as abnormal embedding vectors; finally, the sub-regions corresponding to all abnormal embedding vectors are used as sub-regions with abnormal traffic flow in the current time period.

[0163] According to an embodiment of the present invention, a sliding window is used to collect the current time period The set of embedding vectors within the sliding window of , the process of collecting the set of embedded vectors in the sliding window is shown in formula (31):

[0164]

[0165] in, Indicates the current time period The sliding window set of express Sub-area of ​​time The embedding vector of represents the time span of the sliding window, Indicates sub-area , Represents a collection of subregions.

[0166] According to an embodiment of the present invention, a local anomaly factor algorithm is used to calculate the current time period Each embedding vector in the sliding window Local anomaly factor ;

[0167] According to an embodiment of the present invention, all local abnormal factors Sort in descending order and select local anomaly factors The highest value The embedding vector of the ratio is used as the candidate anomaly embedding vector ;

[0168] According to an embodiment of the present invention, the candidate abnormal embedding vector is judged The corresponding time Is it the current time period? , if satisfied , then mark the candidate abnormal embedding vector as the final abnormal embedding vector;

[0169] According to an embodiment of the present invention, the sub-region corresponding to the final abnormal embedding vector As the current time period The location of abnormal urban traffic flow areas.

[0170] According to embodiments of the present invention, a local anomaly factor algorithm is used to calculate anomaly factors for embedded vectors, eliminating the need to rely on a global fixed threshold or uniform standard for anomaly detection, thereby reducing the likelihood of false positives or missed detections. A sliding window mechanism is used to filter sparse anomalies, ensuring that historical traffic flow trends are fully considered when detecting anomalies. This avoids the high false positive rate associated with methods that use fixed thresholds or specific ratios to select anomalous areas within a certain time period.

[0171] Based on the above abnormal traffic flow detection method based on dynamic graph, the present invention also provides an abnormal traffic flow detection system based on dynamic graph. Figure 4 The system is described in detail.

[0172] Figure 4 The figure shows a structural block diagram of an abnormal traffic flow detection system based on a dynamic graph according to an embodiment of the present invention.

[0173] like Figure 4 As shown, the abnormal traffic flow detection system 400 based on dynamic graphs of this embodiment includes a sub-area division module 410, a traffic flow tensor construction module 420, an approximate graph generation module 430, a spatiotemporal data enhancement module 440, a comparative training module 450 and an anomaly detection module 460.

[0174] The sub-region division module 410 is used to divide the city into several sub-regions according to the urban road network data. In one embodiment, the sub-region division module 410 can be used to perform the operation S10 described above, which will not be repeated here.

[0175] Traffic flow tensor construction module 420 is used to obtain vehicle trajectory data and divide it into time periods, calculate the traffic flow of the sub-area in each time period, and construct a traffic flow tensor. In one embodiment, traffic flow tensor construction module 420 can be used to perform operation S20 described above, which will not be repeated here.

[0176] Approximation graph generation module 430 is used to calculate the similarity between sub-regions based on the traffic flow tensor, construct a similarity graph, construct a proximity graph based on the spatial information of the sub-regions, and fuse the similarity graph and proximity graph to generate an approximation graph. In one embodiment, approximation graph generation module 430 can be used to perform operation S30 described above and will not be further described here.

[0177] Spatiotemporal data enhancement module 440 is used to perform temporal data enhancement on the traffic flow tensor and spatial data enhancement on the approximation graph, constructing local and global views of the subregion at each time period. In one embodiment, spatiotemporal data enhancement module 440 can be used to perform operation S40 described above and will not be further described here.

[0178] The contrast training module 450 is used to input the local view and the global view of the historical time period into the contrast learning model for training. In one embodiment, the contrast training module 450 can be used to perform the operation S50 described above, which will not be repeated here.

[0179] Anomaly detection module 460 is configured to extract a temporal graph encoder from the trained contrastive learning model, use the traffic flow of the sub-region in the current time period as the node attribute corresponding to the sub-region in the approximate graph, input the temporal graph encoder, and obtain an embedding vector for the sub-region in the current time period. Anomaly detection module 460 constructs a sliding window, collects the embedding vectors within the sliding window, and uses a local anomaly factor algorithm to detect abnormal embedding vectors within the sliding window. Based on the abnormal embedding vectors, sub-regions with abnormal traffic flow in the current time period are identified. In one embodiment, anomaly detection module 460 can be configured to perform operations S60 and S70 described above, which will not be further described here.

[0180] Figure 5 A structural diagram of an electronic device suitable for implementing a method for detecting abnormal traffic flow based on a dynamic graph according to an embodiment of the present invention is shown.

[0181] like Figure 5 As shown, an electronic device according to an embodiment of the present invention includes: a memory 510 and a processor 520. The memory 510 includes internal memory and a non-volatile storage medium for storing executable instructions that can be executed by the processor. The non-volatile storage medium stores an operating system and a computer program. When executed by the processor 520, the computer program implements the method of any of the above-mentioned embodiments. When executing the computer program, the processor 520 is configured to implement the steps of the abnormal traffic flow detection method based on dynamic graphs in the above-mentioned embodiments.

[0182] Figure 6 A schematic structural diagram of a non-transitory computer-readable storage medium suitable for implementing a method for abnormal traffic flow detection based on a dynamic graph according to an embodiment of the present invention is shown.

[0183] like Figure 6 As shown, a non-transitory computer-readable storage medium 600 according to an embodiment of the present invention stores a computer program 610 , which, when executed by the processor 520 , implements the steps of the abnormal traffic flow detection method based on dynamic graphs in the aforementioned embodiment.

[0184] The above are only preferred embodiments of the present application and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for detecting abnormal traffic flow based on dynamic graph, characterized in that: The method comprises: Obtaining urban road network data, and dividing the city into a plurality of sub-regions according to the urban road network data; Get vehicle trajectory data at time intervals Divide the time period, count the traffic flow of the sub-area in each time period, and construct the traffic flow tensor; Calculating similarities between sub-regions based on the traffic flow tensor and constructing a similarity graph; Acquiring spatial information of the sub-region, and constructing a proximity graph based on the spatial information; Fusing the similarity graph and the proximity graph to obtain an approximate graph; Performing temporal data enhancement on the traffic flow tensor and spatial data enhancement on the approximate graph to construct local and global views of the sub-region in each time period; A contrastive learning model is constructed using a time graph encoder, and the local view and the global view of the historical time period are input into the contrastive learning model for training; Extracting a temporal graph encoder from the trained contrastive learning model, obtaining the traffic flow and approximate graph of the sub-region in the current time period, using the traffic flow as the node attribute corresponding to the sub-region in the approximate graph, and inputting it into the temporal graph encoder to obtain an embedding vector for the sub-region in the current time period; A sliding window is constructed, and embedding vectors within the sliding window are collected. Abnormal embedding vectors within the sliding window are detected using a local anomaly factor algorithm, and sub-regions with abnormal traffic flow in the current time period are found based on the abnormal embedding vectors.

2. The abnormal traffic flow detection method based on dynamic graph according to claim 1, characterized in that: The urban road network data includes spatial information of the city and spatial information and topological information of the urban road network; The sub-region includes a region number and spatial information of the sub-region, the spatial information includes a latitude and longitude range, and the topological information includes a connection relationship between urban roads.

3. The abnormal traffic flow detection method based on dynamic graph according to claim 1, characterized in that: The vehicle trajectory data is obtained at a time interval of Divide the time period, count the traffic flow of the sub-area in each time period, and construct the traffic flow tensor, including: Vehicle trajectory data is obtained, and the start and end trajectories in the vehicle trajectory data are extracted. The start and end trajectories are projected onto subregions according to the start and end points of the start and end trajectories to obtain the start and end region numbers of the start and end trajectories. The traffic flow in each time period of the subregion is counted based on the start and end region numbers, the start time, the end region numbers, and the end time of the start and end trajectories. The traffic flow includes outflow and inflow. The outflow represents the traffic flow departing from the subregion, and the inflow represents the traffic flow arriving at the subregion. A traffic flow tensor is constructed with the number of subregions, the number of time periods, and the traffic flow as the shape.

4. The abnormal traffic flow detection method based on dynamic graph according to claim 1, characterized in that: Calculating the similarity between sub-areas based on the traffic flow tensor and constructing a similarity graph includes: The historical traffic flow of the sub-regions is obtained according to the traffic flow tensor, the Pearson correlation coefficient between the historical traffic flows of the sub-regions is calculated, and the Pearson correlation coefficient is used as the similarity between the sub-regions; the sub-regions with the highest similarity in each sub-region are used as its similar regions; with the sub-regions as nodes, edges are established between the sub-regions and their similar regions to construct a similarity graph; the edge weights in the similarity graph are the similarities between the nodes.

5. The abnormal traffic flow detection method based on dynamic graph according to claim 1, characterized in that: The acquiring of spatial information of the sub-region and constructing a proximity map according to the spatial information includes: Obtain spatial information of subregions, calculate subregion centers based on the spatial information, and calculate distances between subregions based on the subregion centers; take the several subregions closest to each subregion as its neighboring regions; use subregions as nodes, establish edges between subregions and their neighboring regions, and construct a proximity graph; the edge weights in the proximity graph are the distances between nodes.

6. The abnormal traffic flow detection method based on dynamic graph according to claim 1, characterized in that: The fusing of the similarity graph and the proximity graph to obtain an approximate graph includes: The nodes of the approximate graph are the same as the nodes in the similarity graph and the proximity graph. The edges of the approximate graph are the union of the edges in the similarity graph and the proximity graph. The approximation between the nodes is calculated based on the similarity and distance, and the approximation between the nodes is used as the edge weight of the approximate graph. The calculation formula of the approximation is: ； in, represents any node in the approximate graph, Indicates that the approximate graph is Any adjacent node, Represents the nodes in the approximate graph With node The approximation between is the corresponding node in the similarity graph With node The edge weights between is the corresponding node in the neighborhood graph With node The edge weights between is a hyperparameter.

7. The abnormal traffic flow detection method based on dynamic graphs according to claim 1, wherein the traffic flow tensor is subjected to temporal data enhancement, and the approximate graph is subjected to spatial data enhancement, and local and global views of the sub-region in each time period are constructed, characterized in that: include: Adding Gaussian noise to the traffic flow tensor and then scaling it to obtain a first traffic flow tensor; Randomly selecting a distortion ratio for each sub-region, randomly selecting a distortion window of the traffic flow tensor for each sub-region in the time period dimension, and stretching or compressing the traffic flow within the distortion window according to the distortion ratio to obtain a second traffic flow tensor; Obtaining an adjacency matrix of the proximity graph, performing a heat kernel graph diffusion calculation on the adjacency matrix to obtain a diffusion adjacency matrix of the proximity graph; setting the edge weights of the approximate graph to the similarity between nodes to obtain a global time graph; calculating and updating the edge weights of the approximate graph based on the diffusion adjacency matrix and the global time graph to obtain a global approximate graph; If an edge in the approximate graph exists in both the diffusion adjacency matrix and the global time graph, the element value in the diffusion adjacency matrix is ​​represented as the distance between nodes, the edge weight in the global time graph is represented as the similarity between nodes, the similarity between nodes is calculated based on the distance between nodes and the similarity between nodes, and the edge weight of an edge in the approximate graph is updated using the similarity between nodes; otherwise, the distance between nodes is obtained from the proximity graph, the edge weight in the global time graph is represented as the similarity between nodes, the similarity between nodes is calculated based on the distance between nodes and the similarity between nodes, and the edge weight of an edge in the approximate graph is updated using the similarity between nodes; until the edge weights of all edges in the approximate graph are updated, a global approximate graph is obtained; Obtaining the traffic flow of the sub-region in each time period from the first traffic flow tensor as a first traffic flow, obtaining an approximate graph for each time period, and using the first traffic flow as a node attribute in the approximate graph according to a correspondence between nodes and sub-regions in each time period to obtain a local view of the sub-region in each time period; The traffic flow of the sub-area in each time period is obtained from the second traffic flow tensor as the second traffic flow, and a global approximate graph for each time period is obtained. In each time period, the second traffic flow is used as a node attribute in the global approximate graph according to the correspondence between the node and the sub-area, so as to obtain a global view of the sub-area in each time period.

8. The abnormal traffic flow detection method based on dynamic graph according to claim 1, characterized in that: The temporal graph encoder is a deep learning model for dynamic graphs that can model the graph as a series of node events and edge events and capture the long-term dependencies of nodes; The time graph encoder includes a storage module, a message function module, a message aggregation module, a storage update module and an embedding module. The storage module is responsible for storing the memory vector of the node, the message function module is responsible for calculating the timestamp event and generating the message vector, the message aggregation module is used to aggregate multiple message vectors involving the same node in the same batch of training data, the storage update module updates the memory vector according to the message vector and the memory vector, and the embedding module is responsible for embedding the memory vector of the node to obtain the embedded vector.

9. The abnormal traffic flow detection method based on dynamic graph according to claim 1, characterized in that: The contrastive learning model includes an online network and a target network; The online network includes a time graph encoder, a projection head and a prediction head, and the target network includes a time graph encoder and a projection head; the time graph encoder and projection head in the online network have the same structure and initial parameters as the time graph encoder and projection head in the target network.

10. The abnormal traffic flow detection method based on dynamic graph according to claim 1, characterized in that: The inputting the local view and the global view of the historical time period into the contrastive learning model for training includes: The local view and global view of the historical time period are input into the online network and target network of the contrastive learning model respectively; Use the temporal graph encoder to encode node events and edge events to obtain local embedding vectors and global embedding vectors; Inputting the local embedding vector and the global embedding vector into a projection head to obtain a local contrast vector and a global contrast vector; Predicting the local contrast vector using a prediction head of an online network to obtain a local prediction vector; Calculating a mean square error between the local prediction vector and the global comparison vector to obtain a local loss; The local view and the global view are input into the target network and the online network of the contrastive learning model respectively, and the global loss is obtained through the above steps; The local loss is added to the global loss to obtain the total loss, and finally the parameters of the comparative learning model are updated based on the total loss.

11. The abnormal traffic flow detection method based on dynamic graph according to claim 1, characterized in that: The step of constructing a sliding window, collecting embedding vectors within the sliding window, detecting abnormal embedding vectors within the sliding window using a local anomaly factor algorithm, and finding a sub-region with abnormal traffic flow in the current time period based on the abnormal embedding vectors includes: The build size is Sliding window, using the sliding window to collect the current time period and history The local anomaly factor algorithm is used to calculate the local anomaly factors of all embedded vectors in the sliding window, and the local anomaly factors are sorted to obtain the top vector with the largest local anomaly factor. The embedding vector of the proportion is used as the candidate abnormal embedding vector, and it is determined whether the candidate abnormal embedding vector is in the current time period. If so, the candidate abnormal embedding vector is used as the abnormal embedding vector; finally, the sub-areas corresponding to all abnormal embedding vectors are used as the sub-areas with abnormal traffic flow in the current time period.

12. The abnormal traffic flow detection method based on dynamic graph according to claim 8, characterized in that: The node event occurs at a single node, indicating that the node's attributes are updated within a certain time period. The edge event occurs at a node pair. If no edge existed between the node pair in the previous time period, the edge event indicates that a new edge and edge weight are added between the node pair in the current time period. Otherwise, the edge event indicates that the edge weight between the node pair is updated in the current time period.

13. The abnormal traffic flow detection method based on dynamic graph according to claim 10, characterized in that: The parameter updating method of the contrastive learning model is: ； in, represents the parameters of the online network, represents the parameters of the target network, represents the total loss, Represents the total loss in the online network The gradient, represents the learning rate, Represents the Adam optimizer, which is used to optimize network parameters; the parameters of the target network According to online network parameters Perform momentum update, is the momentum coefficient.

14. An abnormal traffic flow detection system based on dynamic graph, characterized in that: A method for detecting abnormal traffic flow based on a dynamic graph according to any one of claims 1 to 13 is implemented, comprising: Sub-area division module: used to divide the city into several sub-areas based on urban road network data; Traffic flow tensor construction module: used to obtain vehicle trajectory data and divide it into time periods, count the traffic flow of the sub-area in each time period, and construct the traffic flow tensor; An approximate graph generation module is configured to calculate the similarity between sub-regions based on the traffic flow tensor, construct a similarity graph, construct a proximity graph based on the spatial information of the sub-regions, and fuse the similarity graph and the proximity graph to obtain an approximate graph; Spatiotemporal data enhancement module: used to perform temporal data enhancement on the traffic flow tensor and spatial data enhancement on the approximate graph, constructing local and global views of the sub-region in each time period; Comparative training module: used for inputting the local view and the global view of the historical time period into the comparative learning model for training; Anomaly detection module: This module is used to extract a time graph encoder from the trained contrastive learning model, use the traffic flow of the sub-region in the current time period as the node attribute corresponding to the sub-region in the approximate graph, input the time graph encoder, and obtain the embedding vector of the sub-region in the current time period; construct a sliding window, collect the embedding vectors within the sliding window, use the local anomaly factor algorithm to detect abnormal embedding vectors within the sliding window, and find the sub-region with abnormal traffic flow in the current time period based on the abnormal embedding vectors.

15. An electronic device, characterized in that: The system comprises at least: a processor and a memory for storing executable instructions that can be run on the processor, wherein: When the processor is used to run the executable instructions, the executable instructions execute the steps in the abnormal traffic flow detection method based on dynamic graph according to any one of claims 1 to 13.

16. A non-transitory computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, implement the steps of the abnormal traffic flow detection method based on a dynamic graph according to any one of claims 1 to 13.

Images