Abnormality detection method and device, terminal equipment and computer readable storage medium

Abstract

The invention is suitable for the technical field of data detection, and provides an anomaly detection method and device, terminal equipment and a computer readable storage medium, and the method comprises the steps: constructing an original structure attribute graph according to interaction data of a solid object in an import and export process, carrying out the structural enhancement of the original structure graph based on a data enhancement strategy, and obtaining a plurality of high-order sub-graphs, acquiring an implicit interaction relationship among a plurality of import and export solid objects, and modeling local feature information of the import and export solid objects by using the trained multi-order contrast learning model; dividing the original structure attribute graph into a plurality of communities according to a topological connection relationship between entities, acquiring global feature information of the import and export solid articles by using a plurality of community structures, and performing anomaly detection on a target entity according to the local feature information and the global feature information of the import and export solid articles. According to the method, the attribute and structure information of each dimension of the solid article are utilized, and the anomaly detection precision of the import and export solid articles is improved.

Description

Technical Field

[0001] The present application belongs to the field of detection technology, and in particular relates to an anomaly detection method, apparatus, terminal device, and computer-readable storage medium. Background Art

[0002] In the current context of international trade, effective anomaly detection of imported and exported solid waste is essential to ensure the safety of import and export ports. In related technical research, researchers need to perform anomaly detection on imported and exported goods, ports, and their interaction patterns. Static attribute graphs have become an important data structure for representing these complex relationships.

[0003] However, in the actual detection process, the extraction of interactive information is incomplete. That is, when constructing the static attribute graph, the interactive information between commodities and ports is not fully extracted. In addition, the global topological structure in the graph, that is, all possible connections and layouts between imported and exported commodities and ports, is not fully considered during the detection process. This leads to insufficient comprehensiveness of the detection and low accuracy of anomaly detection. Summary of the Invention

[0004] The embodiments of the present application provide an anomaly detection method, apparatus, terminal device, and computer-readable storage medium, which can improve the detection accuracy of anomaly detection.

[0005] In a first aspect, the present invention provides a detection method, comprising: Constructing an original structure attribute graph based on the interaction data generated during the import and export process of solid articles, wherein each node in the original structure attribute graph includes the solid article and the port corresponding to the solid article during the import and export process, and the edges in the original structure attribute graph represent the interaction relationships between multiple nodes; According to the data enhancement strategy, the structural subgraph formed by each node in the original structural attribute graph is structurally enhanced to obtain multiple high-order subgraphs corresponding to each node, wherein the first structural subgraph is based on the original structural attribute graph and generated using a preset algorithm, and the nodes of the high-order subgraph are obtained by converting the nodes in the original structural attribute graph. The richness of the interactive information contained between multiple nodes in the original high-order subgraph is higher than the interactive information between multiple nodes in the original structural attribute graph.

[0006] Dividing the original structural attribute graph into multiple communities according to a community detection algorithm based on topological relationships, wherein the communities include topological information between multiple nodes, and obtaining topological abnormality estimates between multiple node pairs within the communities based on the topological information; Based on the multiple high-order subgraphs and divided communities, anomaly detection is performed on solid objects in the import and export process using a trained anomaly detection model and topological anomaly degree estimation between multiple node pairs in the community.

[0007] In an embodiment of the present application, an original structural attribute graph is constructed based on the interaction data between imported and exported solid objects, and a plurality of high-order subgraphs are generated based on the original structural attribute graph using a data enhancement strategy. The implicit interaction information of a plurality of solid objects is obtained through the plurality of high-order subgraphs, and then the original structural attribute graph is divided into communities. The entities in each community have a high topological correlation, and the global topological information of the imported and exported solid objects is obtained through the plurality of community structures. Therefore, the imported and exported solid object data can be accurately detected through the high-order subgraphs containing higher-order data interaction information and the communities containing global characteristics.

[0008] In a possible implementation of the first aspect, structurally enhancing the first structure subgraph formed by each node in the original structure attribute graph according to the data enhancement strategy to obtain multiple high-order subgraphs corresponding to each node includes: Acquire multiple construction units corresponding to each node based on the first structural subgraph, where the construction units are determined according to the adjacency relationship between multiple nodes in the first structural subgraph; determining a connection rule between a plurality of said building blocks; A plurality of the construction units are constructed according to the connection rule to obtain a high-order subgraph corresponding to each node.

[0009] In a possible implementation of the first aspect, the step of dividing the original structural attribute graph into multiple communities according to a community detection algorithm based on topological relationships includes: Obtaining a shared neighborhood of each node, where the shared neighborhood is used to measure neighborhood similarity between multiple nodes; Based on the original structural attribute graph and the shared neighborhood, a clustering algorithm is used to group multiple nodes to obtain multiple communities.

[0010] In a possible implementation of the first aspect, obtaining topological anomaly estimates between multiple node pairs in the community includes: Calculating the attribute similarity between each node and other nodes in each community using cosine distance to obtain multiple attribute similarity parameters; A topological abnormality estimate between the plurality of nodes in each of the communities is determined based on a plurality of attribute similarity parameters and the number of nodes in the community.

[0011] In a possible implementation of the first aspect, performing anomaly detection on solid objects during the import and export process based on the multiple high-order subgraphs and the communities, using a trained anomaly detection model and topological anomaly degree estimation between multiple node pairs within the communities, includes: The trained anomaly detection model and the topological anomaly degree estimation between multiple node pairs in the community are used to perform anomaly detection on solid objects in the import and export process to obtain an anomaly score corresponding to each node: Performing an abnormality risk assessment on the solid objects in the import and export process according to the abnormality score corresponding to each node; When a risk node with a risk greater than a preset threshold value is found among the plurality of nodes, it is determined that the solid article corresponding to the risk node has an abnormal risk during the import or export process.

[0012] In a possible implementation of the first aspect, obtaining the trained contrastive learning model includes: Constructing multiple historical structure attribute graphs based on multiple historical interaction data of solid objects in the import and export process, and using an enhancement strategy to structurally enhance the second structure subgraph in each of the historical structure attribute graphs, thereby obtaining multiple historical high-order subgraphs corresponding to each historical node in the historical structure attribute graph, wherein the second structure subgraph is generated based on the historical structure attribute graph using a preset algorithm; The second structure subgraph in each of the historical structure attribute graphs and the historical high-order subgraph corresponding to the second structure subgraph are used as training sample pairs to obtain multiple training sample pairs, where each of the second structure subgraphs corresponds to a historical target node.

[0013] Input each of the training sample pairs into a preset network model, and learn the plurality of training sample pairs using a contrastive learning model of a preset network structure to obtain a loss value of a loss function corresponding to the training sample learned by the learning model; The parameter values ​​corresponding to the preset network model are trained through multiple iterations until the learning model converges to the loss function corresponding to the training sample. When the loss value obtained is the optimal value, the preset network model corresponding to the output parameter corresponding to the optimal loss value is determined as the trained anomaly detection model.

[0014] In a possible implementation of the first aspect, the method further includes: When an abnormality is detected in the solid objects during the import and export process, an early warning prompt is issued.

[0015] In a second aspect, an embodiment of the present application provides an anomaly detection device, comprising: A data construction module is configured to construct an original structure attribute graph based on the interaction data generated during the import and export of solid articles, wherein each node in the original structure attribute graph includes the solid article and the port of entry corresponding to the solid article during the import and export process, and the edges in the original structure attribute graph represent the interaction relationships between multiple nodes; a data enhancement module that structurally enhances the structural subgraph formed by each node in the original structural attribute graph according to a data enhancement strategy to obtain multiple original high-order subgraphs corresponding to each node, wherein the first structural subgraph is generated based on the original structural attribute graph and using a preset algorithm, the nodes of the original high-order subgraph are obtained by converting the nodes in the original structural attribute graph, and the richness of the interactive information contained between the multiple nodes in the original high-order subgraph is higher than the interactive information between the multiple nodes in the original structural attribute graph; A topology perception module is used to divide the original structural attribute graph into multiple communities according to a community detection algorithm based on topological relationships, wherein the communities include topological information between multiple nodes, and based on this, obtain topological anomaly estimates between multiple node pairs in the communities; A data detection module is used to perform anomaly detection on solid objects in the import and export process based on the multiple high-order subgraphs and divided communities, using a trained anomaly detection model and topological anomaly estimation between multiple node pairs in the community.

[0016] In a third aspect, an embodiment of the present application provides a terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the anomaly detection method as described in any one of the first aspects above is implemented.

[0017] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the anomaly detection method as described in any one of the above-mentioned first aspects is implemented.

[0018] In a fifth aspect, an embodiment of the present application provides a computer program product, which, when executed on a terminal device, enables the terminal device to execute the anomaly detection method described in any one of the above-mentioned first aspects.

[0019] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0021] Figure 1 Schematic diagram of the process of anomaly detection method provided in an embodiment of the present application; Figure 2 Schematic diagram of the process of obtaining a high-order subgraph provided in an embodiment of the present application; Figure 3 This is a schematic structural diagram and block diagram of obtaining a high-order subgraph provided in an embodiment of the present application; Figure 4 This is a flowchart of the community detection provided by the embodiment of the present application; Figure 5 This is a flowchart of anomaly detection model training provided by an embodiment of the present application; Figure 6 This is a schematic diagram of the abnormality determination process provided by the embodiment of the present application; Figure 7 is a test data set provided in the embodiment of the present application; Figure 8 is an abnormal test result provided by the embodiment of the present application; Figure 9 is a schematic diagram of an anomaly detection device provided in an embodiment of the present application; Figure 10 It is a structural diagram of the terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0022] In the following description, specific details such as specific system structures and techniques are provided for purposes of illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obscuring the description of the present application with unnecessary detail.

[0023] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0024] It will also be understood that the term "and / or" used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0025] As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0026] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0027] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with the embodiment is included in one or more embodiments of the present application. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in yet other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized.

[0028] In the current context of international trade, effective anomaly detection for imported and exported solid waste is essential to ensure the security of import and export ports. In related technical research, researchers need to perform anomaly detection on imported and exported goods, ports, and their interaction patterns. Static attribute graphs have become an important data structure for representing these complex relationships.

[0029] In anomaly detection tasks, static attribute graphs not only capture the direct relationship between goods and ports, but also further explore the complex connections hidden within the graph structure. By constructing static attribute graphs, regulators can comprehensively analyze goods, ports, and their interaction patterns. However, regulatory agencies' customs clearance systems accumulate a large amount of unlabeled data, and how to efficiently extract useful information from this data to accurately identify anomalous import and export entities (goods or ports) has become a current technical bottleneck.

[0030] Specifically, the following problems exist in the actual detection process: First, existing technologies struggle to effectively capture diverse structural features and complex interaction patterns between multiple entities for anomaly detection. Networks inherently contain a variety of substructures, each with distinct structural characteristics and real-world significance. By leveraging these substructures, we can better model the complex interactions within the network. Current methods tend to capture a limited range of substructure types and may miss key underlying structural features, which can negatively impact the performance of subsequent learning tasks. Furthermore, most existing enhancement methods focus on random perturbations of edge or node attributes. Methods for enhancing substructure diversity remain largely unexplored in graph anomaly detection, a key area awaiting further exploration.

[0031] Second, existing methods primarily focus on local dimensions, emphasizing attribute features while ignoring the broader global topological information in the graph. Detecting topological anomalies requires capturing the connectivity patterns of nodes. However, current GNNs are inherently attribute-centric, prioritizing node attributes and only considering network topology as supplementary information. These attribute-centric methods are insufficient for identifying anomalous structural behaviors. Furthermore, nodes with anomalous topological structures often form dense clusters in the network, representing complex, collective patterns that cannot be effectively exploited by methods that focus solely on local dimensions (e.g., nodes or subgraphs). Therefore, developing methods that effectively integrate attribute and topological information for anomaly detection across local and global dimensions remains an important challenge.

[0032] In order to solve the above technical problems, the present application provides an attribute network anomaly detection algorithm based on local multi-order contrastive learning and global topology awareness (LMGTA). In this method, when it is necessary to perform safety inspection on solid objects in the import and export process, the user is required to send a detection instruction to the anomaly detection device for detecting abnormal behavior. The detection instruction includes the interaction data generated by the solid objects in the import and export process. After receiving the risk detection instruction, the solid object detection device constructs an original structure attribute graph according to the interaction data generated by the solid objects in the import and export process. Each node in the original structure attribute graph includes the solid object and the port corresponding to the solid object in the import and export process. The edges in the original structure attribute graph are the interaction relationships between multiple nodes. According to the data enhancement strategy, the structural subgraph formed by each node in the original structure attribute graph is structurally enhanced to obtain the corresponding Multiple high-order subgraphs, wherein the first structural subgraph is generated based on the original structural attribute graph and using a preset algorithm, the nodes of the high-order subgraph are obtained by converting the nodes in the original structural attribute graph, and the richness of the interactive information contained between multiple nodes in the original high-order subgraph is higher than the interactive information between multiple nodes in the original structural attribute graph, and then the original structural attribute graph is divided into multiple communities according to a community detection algorithm based on topological relationships, and the community includes topological information between multiple nodes, based on which the topological anomaly estimation between multiple node pairs in the community is obtained, and finally, based on multiple high-order subgraphs and divided communities, the trained anomaly detection model and the topological anomaly estimation between multiple node pairs in the community are used to perform anomaly detection on solid objects in the import and export process.

[0033] In this application, the above-mentioned original structural attribute graph is a static attribute graph, and node anomaly detection is performed by constructing a static attribute graph. The present invention first defines the specific definition of the static attribute graph as follows: ,in It is a collection of entities or nodes (commodities or ports) in the graph. The number of entities , is the set of edges, represents the attribute matrix, To represent entities Features, is the adjacency matrix, Representing an entity and When an edge between When present ,otherwise Our goal is to learn an anomaly scoring function , which takes the attribute graph as input data and estimates The degree of anomaly for each entity in the dataset. The higher the anomaly score, the greater the likelihood that the entity is anomaly. The steps for anomaly detection based on the static attribute graph are as follows: See also Figure 1 , is a flowchart of an anomaly detection method provided in an embodiment of the present application. As an example and not a limitation, the method may include the following steps: S101, constructing an original structure attribute graph based on the interaction data generated during the import and export process of solid objects, wherein each node in the original structure attribute graph includes the solid object and the port corresponding to the solid object during the import and export process, and the edges in the original structure attribute graph are the interaction relationships between multiple nodes.

[0034] In this embodiment of the present application, when the detection device receives an instruction to perform abnormality detection on an imported or exported solid object, it is necessary to construct an original structural attribute graph (static attribute graph) based on the interactive data generated by the solid object during the import or export process. The specific steps are as follows: Node definition: Each import and export item (hereinafter referred to as commodity) can be regarded as a node with a unique identifier (such as HS code). Each port or customs inspection station of a port entity is regarded as a node with a unique identifier (such as port code). Data collection: Collect import and export data of all commodities and ports, including transaction volume, transaction date, transaction amount, etc.; Determine the relationship type: Determine the relationship type between goods and ports. For example, goods can be imported and exported through ports, and ports are channels for the import and export of goods. Build graph nodes: Create graph nodes for each commodity and port, and assign attributes to each node, such as commodity attributes (HS code, name, weight, value, etc.) and port attributes (port name, geographical location, processing capacity, etc.); Build graph edges: Based on import and export data, create graph edges for the interactions between commodities and ports. The weight of the edge can represent the import and export quantity or value of commodities passing through the port. Original structure attribute graph: A static attribute graph is used to represent the relationship between commodities and ports, where each node represents an entity and the edges between nodes represent the interaction relationship between entities.

[0035] S102, structurally enhance the structural subgraph formed by each node in the original structural attribute graph according to the data enhancement strategy to obtain multiple high-order subgraphs corresponding to each node, wherein the first structural subgraph is based on the original structural attribute graph and generated using a preset algorithm, the nodes of the high-order subgraph are obtained by converting the nodes in the original structural attribute graph, and the richness of the interactive information contained between the multiple nodes in the original high-order subgraph is higher than the interactive information between the multiple nodes in the original structural attribute graph. In an embodiment of the present application, in order to fully extract the interactive information between commodities and ports, the present application provides a data enhancement strategy, namely a subgraph reconstruction strategy (Reconstruction Based Subgraph, ReSub) data enhancement strategy. ReSub is implemented on the first structural subgraph (a subgraph of the original structural attribute graph), which fully utilizes the implicit high-order structural information and the interactive relationship between substructures in the network. Through the subgraph reconstruction strategy, each entity can be used as a target node, and the subgraph corresponding to the target node can be expanded to generate multiple high-order subgraphs. In the process of generating the high-order subgraph, the relationship between the structures of the target node in the original subgraph is retained.

[0036] Among them, the above-mentioned first structural subgraph can be generated according to a preset algorithm, such as the preset algorithm can be a random walk algorithm. In the process of random sampling of the target node, sampling parameters can be set, such as the number of walk steps (i.e., the number of times from one node to another node) and the sampling frequency (i.e., the probability of determining whether the walk path is included in the sampling result), etc., and then, with the target node (any node in the original structural attribute graph) as the starting point, an adjacent node is randomly selected for walk. If the predetermined number of walk steps is reached or the sampling frequency condition is met, the current path is recorded, and the above steps are repeated until all sampling is completed or the sampling limit is reached. According to the recorded walk path, the corresponding first structural subgraph is generated, and then the subgraph enhancement is performed based on the first structural subgraph to obtain a high-order subgraph. For details, please refer to the following steps S201-S203.

[0037] In one embodiment, Figure 2 is a schematic diagram of a process for obtaining a high-order original subgraph provided in an embodiment of the present application, wherein step S102 includes: S201: Acquire multiple construction units based on the first structural subgraph, where the construction units are determined according to adjacency relationships between multiple nodes in the first structural subgraph.

[0038] In an embodiment of the present application, after obtaining the first structure subgraph, during the subgraph enhancement process, it is necessary to detect basic construction units from the first structure subgraph, wherein the construction units are determined based on the connection relationship (i.e., edges) between the nodes in the first structure subgraph. If two nodes in the first structure subgraph are connected by an edge, the two nodes can be constructed into a construction unit.

[0039] S202: Determine a connection rule between the plurality of building blocks.

[0040] In an embodiment of the present application, after detecting the first structural subgraph to obtain multiple basic building units, it is necessary to define connection rules between the multiple building units based on whether the basic building units share common nodes or edges in the original network, i.e., the first structural subgraph. If a node or edge is shared, in ReSub, the two basic building units are connected.

[0041] S203: Construct a plurality of the construction units according to the construction rule to obtain an original high-order subgraph corresponding to each node.

[0042] In the embodiment of the present application, after obtaining the basic building blocks and defining the construction rules between multiple building blocks, it is necessary to reconstruct the multiple building blocks according to the construction rules to generate an enhanced high-order subgraph. This data enhancement process can be regarded as a transformation function of the subgraph: (1) The set of basic building blocks is composed of Indicates that each is a basic building block, and the connections between them are express.

[0043] For example, Figure 3 As shown in FIG, it is a schematic block diagram of obtaining a high-order subgraph provided by an embodiment of the present application, such as Figure 3 (a) shows the first structural subgraph obtained by random sampling of the target node (the original subgraph is denoted as ), after obtaining the first structural subgraph, the basic building blocks are detected based on the connection relationship between the nodes of the first structural subgraph. For example, if there is a shared edge between nodes 1 and 2 and between nodes 1, 3 and 2, 4 in the first structural subgraph, then the node (1, 2) is taken as a building block, the node (2, 4) as a building block, and so on. Figure 3 The multiple building blocks shown in (b) are constructed based on the first structural subgraph between two building blocks. If they share a node, they are connected in ReSub, such as the basic building blocks (1,2) and (2,4) in Shared node 2, then in the ReSub process, build (1,2) and (2,4) connections, and define the construction rules between multiple construction units according to the above method, and get the following Figure 3 The first-order reconstructed subgraph shown in (c) is denoted as To ensure that the first-order reconstructed subgraph has the same dimension as the original subgraph, the first-order reconstructed subgraph shown in (c) in 3 is processed to obtain Figure 3 The first-order subgraph shown in (d) .

[0044] Getting the first-order subgraph Then, with the first-order subgraph As the original subgraph, the higher-order subgraph is constructed according to the above method, and the second-order ReSub is recorded as . And so on.

[0045] It should be noted that multiple ReSub iterations can generate higher-order subgraphs by using different building blocks for each order. As ReSub progresses towards higher-order network spaces, more interaction information can be observed. However, the potential structural information provided by higher-order ReSub may gradually decrease as the order increases. Therefore, in our experiments, we only apply ReSub to the second-order dimension.

[0046] In the above method, by constructing multiple high-order subgraphs, the implicit structural information of multiple solid objects can be fully obtained to improve the accuracy of subsequent anomaly detection.

[0047] S103: Divide the original structural attribute graph into multiple communities according to a community detection algorithm based on topological relationships. The communities include topological information between multiple nodes, and based on this, obtain topological abnormality estimates between multiple node pairs in the communities.

[0048] In an embodiment of the present application, the randomness of subgraph sampling, i.e., the sampling of the first structure subgraph, will ignore the global characteristics of the graph, i.e., the global topology information. In order to fully consider the global characteristics of the network (global topology information), the present application provides a topology perception module, which uses a community detection algorithm based on topological relationships to extract global information between nodes. Among them, the community is an important dimension of the graph, and anomaly detection can be performed by detecting the communities contained in the static attribute graph.

[0049] Given that the clustering algorithm is applied to the entire graph, some communities consist only of normal nodes, while others include both normal nodes and structural anomalies. It is noteworthy that nodes that exhibit greater differences in properties compared to other nodes in the community are more likely to be anomalous. Therefore, we evaluate the degree of anomalousness of internal nodes by calculating the intra-community topological anomaly estimate. Targeted structural anomaly detection is performed by evaluating the topological anomaly estimates of node pairs within each community.

[0050] In one embodiment, Figure 4 : This is a flowchart of community division provided in an embodiment of the present application. The community division steps in step S103 are S301-S302, which specifically include: S301: Obtain a shared neighborhood of each node, where the shared neighborhood is used to measure neighborhood similarity between multiple nodes.

[0051] In this embodiment of the application, nodes are grouped based on shared neighbors (neighborhoods), similar to how individuals in a social network form communities with many common friends. In addition to this direct structure-based algorithm, our topology-aware module also allows the application of any other community detection algorithm strategy.

[0052] S302: Based on the original structural attribute graph and the shared neighborhood, a clustering algorithm is used to group multiple nodes to obtain multiple communities.

[0053] In the present embodiment, structural anomaly refers to a set of nodes with dense structural connections but significant attribute differences. Using the node structure (based on the original structural attribute graph) and common neighborhood as clustering criteria, we group nodes based on shared neighbors. Finally, we obtain communities that may contain abnormal nodes. .

[0054] In the above method, the division of communities can effectively establish an effective association between node attribute features and topological information, improve the integrity of the data, and thus improve the accuracy of abnormal data detection.

[0055] In one embodiment, obtaining topological anomaly estimates between multiple node pairs in the community in step S103 includes: S401, using cosine distance to calculate the attribute similarity between each node in each community and other nodes, to obtain multiple attribute similarity parameters.

[0056] In the embodiment of the present application, the topological abnormality estimation can evaluate the abnormality of internal nodes by calculating the average similarity of attribute pairs within the community. In order to improve the accuracy of the similarity measurement, we use node attribute embedding instead of the original attribute value. Specifically, we choose cosine distance as the metric to determine the similarity (attribute similarity parameter) between each community node pair, which can be obtained by the following formula:

[0057] in, Represents nodes respectively Embedding representation of .

[0058] S402: Determine a topological abnormality estimate between multiple nodes in each community based on multiple attribute similarity parameters and the number of nodes in the community.

[0059] In the embodiment of the present application, after obtaining the attribute similarities between multiple node pairs in each community, we then use an average function to calculate the average similarity between node pairs in each community, that is, the topological abnormality estimation.

[0060]

[0061] in, Representing the community The number of node pairs in Indicates belonging to the community Node.

[0062] In one embodiment, before step S104, that is, before detecting abnormal risks of solid objects during import and export, the detection device needs to first use multiple historical interaction data of the same type of solid objects during import and export to perform deep learning training on the preset network structure to obtain an abnormality detection model, so that the trained abnormality detection model can be directly used to detect abnormal risks of solid objects during import and export. Figure 5 FIG. 1 is a flow chart of the anomaly detection model training process provided by an embodiment of the present application. The anomaly prediction model is trained in the following manner: S501, constructing an attribute graph for multiple historical interaction data of solid items in the import and export process to obtain multiple constructed historical structure attribute graphs, and using an enhancement strategy to structurally enhance the second structure subgraph in each of the historical structure attribute graphs to obtain multiple historical high-order subgraphs corresponding to each historical node in the historical structure attribute graph, wherein the second structure subgraph is generated based on the historical structure attribute graph and using a preset algorithm.

[0063] In an embodiment of the present application, an attribute graph is constructed for the historical interaction information generated by solid objects during the import and export process to obtain a constructed historical structure attribute graph. Each node in the historical structure attribute graph includes the same type of solid objects and the ports corresponding to the same type of solid objects during the import and export process. The edges in the historical structure attribute graph are the historical interaction data between multiple nodes. A second structure subgraph is constructed based on the historical structure attribute graph, and a subgraph is enhanced based on the second structure subgraph using a data enhancement strategy to obtain multiple historical high-order subgraphs.

[0064] Among them, the construction process of the historical structure attribute graph is the same as the construction process of the original structure attribute in the previous article, and the acquisition process of the historical high-order subgraph is the same as the acquisition process of the original high-order structure graph in the previous article, which will not be repeated here.

[0065] S502: Using the second structure subgraph in each of the historical structure attribute graphs and the historical high-order subgraph corresponding to the second structure subgraph as training sample pairs, a plurality of training sample pairs are obtained, wherein each of the second structure subgraphs corresponds to a historical target node.

[0066] In an embodiment of the present application, each historical node in the historical structure attribute graph is used as a target node, and it and the corresponding high-order historical subgraph are used as training sample pairs to obtain multiple training sample pairs, so that target anomaly detection can be performed subsequently with the target node as the target.

[0067] S503, inputting each of the training sample pairs into a preset network model, learning the multiple training sample pairs through the contrast learning model in the preset network model, and obtaining the loss value of the loss function corresponding to the training sample learned by the learning model.

[0068] In an embodiment of the present application, the preset network model includes a learning comparison model and a detection model. The comparison learning model is trained and learned by using the above-mentioned multiple training sample pairs to obtain a loss value corresponding to the learning comparison model, and the output result of the detection model is output through the loss value for performing anomaly detection on the target node.

[0069] In one embodiment, the training samples include a positive instance subgroup and a negative instance subgroup, and step S503 includes: Combining the second structural subgraph corresponding to the historical target node and a plurality of enhanced high-order historical subgraphs into a positive instance subgraph; Combining the second structural subgraph of the historical target node and any other nodes and a plurality of enhanced high-order historical subgraphs into a negative instance subgraph; The positive instance subgraph and the negative instance subgraph are subjected to comparative learning by the comparative learning model to obtain a loss value of a loss function corresponding to a training sample.

[0070] In this embodiment, the contrastive learning model aims to transform a group of instances from a high-dimensional feature set into a low-dimensional embedding space. This is achieved by minimizing the distance between the target node and the positive instance subgraph while maximizing the distance to the negative instance subgraph. The learned patterns are then used to detect anomalies.

[0071] Specifically, the data in the instance group can be expressed as:

[0072] in, target node, Representation node The original subgraph, first-order subgraph and second-order subgraph of .

[0073] The multi-order contrastive network aims to transform instance groups from high-dimensional features into a low-dimensional embedding space. This is achieved by minimizing the distance between the target node and the positive instance subgraph while maximizing the distance to the negative instance subgraph. The learned patterns are then used to detect anomalies. First, we use the GCN layer to obtain the embeddings of all subgraphs. The embedding of the hidden layer at any order of subgraph can be expressed as follows:

[0074] in, and Respectively represent Layer and The hidden representation of the layer. We define the node embedding representation of the output subgraph as . represents the adjacency matrix of the subgraph including self-loops, Represents the degree matrix of the subgraph. Is a trainable parameter matrix. The activation function used here is the ReLU function, expressed as .

[0075] Next, we need to map the target node to the same embedding space. We use the weight matrix of GCN And the corresponding activation function to transform the attributes of the target node and obtain the embedding of the target node This transformation can be expressed as follows:

[0076] At the same time, we adopted a function to get the representation of the final sub-graph. In particular, we choose the average pooling function to implement .

[0077]

[0078] We used a layer to calculate the target node embedding and multi-level subgraph embedding (respectively represented as ) similarities between them.

[0079]

[0080] Where k = 0, 1, 2 represents the order of the subgraph, is the parameter matrix, is the activation function. Finally, we aggregate the similarity scores of subgraphs of different orders.

[0081]

[0082] in, It is a balancing parameter used to balance the weight influence between subgraphs of different orders.

[0083] Our goal is to make the target node similar to the subgraph in the positive instance group ( ), which is different from the subgraph in the negative instance group ( ). Therefore, we choose Binary Cross Entropy (BCE) loss to train the model.

[0084]

[0085] Among them, in the positive instance group, , in the negative instance group, .

[0086] By inputting multiple training samples into the contrastive learning model, the model can output the loss value corresponding to the training sample pair as shown in the above formula (10).

[0087] S504, training the parameter values ​​corresponding to the preset network model through multiple iterations until the learning model converges to the loss function corresponding to the training sample, and determining the preset network model corresponding to the output parameter corresponding to the optimal loss value as the trained anomaly detection model.

[0088] In an embodiment of the present application, other parameter values ​​in the comparative learning model are trained iteratively multiple times so that the loss value of the acquired training model converges to obtain the optimal value. At this time, the comparative learning network model and the detection model corresponding to the adjusted parameter values ​​are used as the trained anomaly detection model.

[0089] In the above method, the multi-order contrastive learning model is trained by minimizing the distance between the target node and the positive instance subgraph group, while maximizing the distance with the negative instance subgraph group, ensuring the reliability of the model.

[0090] S104: Based on the multiple high-order subgraphs and divided communities, anomaly detection is performed on solid objects in the import and export process using a trained anomaly detection model and topological anomaly degree estimation between multiple node pairs in the community.

[0091] In one embodiment, Figure 6 : is a flowchart of anomaly detection model training provided in an embodiment of the present application, step S104 includes: S601: Perform anomaly detection on solid objects in the import and export process based on the trained anomaly detection model and the topological anomaly degree estimation between multiple node pairs in the community to obtain an anomaly score corresponding to each target node.

[0092] In an embodiment of the present application, the present application provides an anomaly scoring model, which includes using a trained anomaly detection model to obtain a local anomaly score of a target node and a global topological anomaly score corresponding to the target node based on a community, and determining a final anomaly score of the target node based on the local anomaly score and the global topological anomaly score of the target node, so as to determine the anomaly risk of the target node based on the final anomaly score. The details are as follows: (1) Local anomaly score: During the testing phase, we use the trained model to calculate the final local contrast anomaly score for each node. Since most of the training data consists of normal samples, the model is more likely to learn the matching patterns of these samples, while due to the irregularity and diversity of abnormal samples, they may deviate from the patterns learned by the model. Therefore, a normal node is expected to show similarity with the subgraph in the positive instance pair and dissimilarity with the subgraph in the negative group. In contrast, an abnormal node is different from the subgraphs in both the positive and negative groups. Therefore, we define the local contrast anomaly degree of the target node as:

[0093] in is a node and the similarity of its corresponding subgraph in the negative instance group, is a node and the similarity of its corresponding subgraph in the positive instance group.

[0094] Due to the random nature of the subgraph sampling method, it cannot capture all attribute information of the node neighborhood in a single sampling. Therefore, we use multiple rounds of sampling to address this problem and generate multiple sets of positive and negative pairs. The final local contrast anomaly score of the target node is expressed as follows:

[0095] In the formula Indicates the target node The final local contrast anomaly score, R number of sampling rounds.

[0096] (2) Global anomaly score: The degree of anomaly of nodes in a community is negatively correlated with the average node pair similarity. We use the inverse of the average node pair similarity to represent their degree of anomaly. This inverse value is considered to be an estimate of the topological anomaly of each internal node in the community. We then calculate the global topological anomaly score for each node in the community:

[0097] in For the community The average similarity of the node pairs in Representing the community The number of nodes in . Indicates belonging Target node The global topological anomaly score of .

[0098] (3) Final anomaly score. We normalize the local contrast anomaly score and the global topological anomaly score and aggregate them into the final anomaly score of the node.

[0099]

[0100] in, is a balance parameter that balances the importance between the two scores.

[0101] S602: Perform an abnormality risk assessment on the solid objects in the import and export process according to the abnormality score corresponding to each target node.

[0102] In an embodiment of the present application, after calculating the final anomaly score of each node, it is determined whether the target point has a risk anomaly based on the anomaly score.

[0103] S603: When a risk node greater than a preset threshold value is detected among the plurality of target nodes, determine whether the solid article corresponding to the risk node has an abnormal risk during the import or export process.

[0104] In an embodiment of the present application, the final anomaly score of each target node is compared with a preset threshold. If the final anomaly score of a target node exceeds the preset threshold, it is considered that the node exhibits abnormal behavior or characteristics, and the target node corresponding to the score exceeding the threshold is marked as an abnormal node. In the above method, by detecting anomalies of solid objects through anomaly scoring, the risk anomaly degree of solid objects can be obtained more intuitively, thereby improving complex anomaly detection tasks.

[0105] In one embodiment, the anomaly detection method further includes: When an abnormality is detected in the solid objects during the import and export process, an early warning prompt is issued.

[0106] In an embodiment of the present application, if an abnormality is detected in a solid object, an early warning process is performed to prompt relevant personnel to conduct abnormality inspection or processing.

[0107] In the above method, solid objects in the import and export process can be effectively supervised through early warning prompts.

[0108] See also Figure 7 , is a test dataset provided in the embodiments of this application, and the experiments are conducted on eight real-world datasets.

[0109] Experimental Setup and Baseline Methods: We compare our algorithm with two classic image anomaly detection methods. The first category consists of traditional shallow methods, namely AMEN, Radar, and ANOMALOUS. The second category consists of deep learning methods, namely DOMINANT, CoLA, ANEMONE, SL-GAD, Sub-CR, and GRADATE. We use the ROC-AUC metric to evaluate our algorithm and the baseline method. A higher AUC value indicates better detection performance.

[0110] See also Figure 8 , are the anomaly test results provided by the examples of this application (the data in bold and underlined represent the top two performance test results, with the data in bold indicating the best performance). The experimental results show that LMGTA outperforms all baseline methods on eight benchmark datasets, significantly improving the AUC by an average of 4.13%. Shallow methods perform poorly in detecting anomalies because they have difficulty distinguishing anomalies from graphs with complex and high-dimensional features, resulting in poor performance. Compared with other deep methods, LMGTA has better detection performance because these methods fail to pay attention to the diversity and interactions of substructures in the local neighborhood of nodes and ignore global topological information. In contrast, our model improves performance by simultaneously leveraging local contrastive learning based on enhanced subgraphs and global topological awareness to effectively capture abnormal patterns.

[0111] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0112] Corresponding to the anomaly detection method described in the above embodiment, Figure 9 This is a structural block diagram of the abnormality detection device provided in an embodiment of the present application. For the sake of convenience, only the parts related to the embodiment of the present application are shown.

[0113] Reference Figure 9 , the abnormality detection device 9 includes: A data construction module 91 is configured to construct an original structure attribute graph based on the interaction data generated during the import and export of solid articles. Each node in the original structure attribute graph includes the solid article and the port of entry corresponding to the solid article during the import and export process. An edge in the original structure attribute graph represents an interaction relationship between multiple nodes. The data enhancement module 92 is used to take each node in the original structure attribute graph as a target node, and structurally enhance the first structure subgraph formed by each target node according to the data enhancement strategy to obtain multiple original high-order subgraphs corresponding to each target node, wherein the first structure subgraph is based on the original structure attribute graph and generated using a preset algorithm, the nodes of the original high-order subgraph are obtained by converting the nodes in the original structure attribute graph, and the richness of the interactive information contained between multiple nodes in the original high-order subgraph is higher than the interactive information between multiple nodes in the original structure attribute graph.

[0114] Optionally, the data enhancement module 92 is further configured to: Acquire, based on the first structural subgraph, a plurality of construction units corresponding to each target node, wherein the construction units are determined according to an adjacency relationship between a plurality of nodes in the first structural subgraph; determining a connection rule between a plurality of said building blocks; A plurality of the construction units are constructed according to the connection rule to obtain a plurality of the original high-order subgraphs corresponding to each of the target nodes.

[0115] A topology perception module 93 is configured to divide the original structural attribute graph into a plurality of communities according to a community detection algorithm based on topological relationships, wherein the communities include topological information between a plurality of nodes, and obtain topological anomaly estimates between a plurality of node pairs within the communities; Optionally, the topology awareness module 93 is further configured to: Obtaining a shared neighborhood of each node, where the shared neighborhood is used to measure neighborhood similarity between multiple nodes; Based on the original structural attribute graph and the shared neighborhood, a clustering algorithm is used to group multiple nodes to obtain multiple communities, and the target node exists in the community.

[0116] Optionally, the topology awareness module 93 is further configured to: Calculating the attribute similarity between each node and other nodes in each community using cosine distance to obtain multiple attribute similarity parameters; A topological abnormality estimate between the plurality of nodes in each of the communities is determined based on a plurality of attribute similarity parameters and the number of nodes in the community.

[0117] The abnormality detection device 9 further includes: Data training module 94 is configured to construct attribute graphs based on multiple historical interaction data of solid articles during the import and export process, thereby obtaining multiple constructed historical structure attribute graphs, and to perform data enhancement on the second structure subgraph in each of the historical structure attribute graphs using an enhancement strategy, thereby obtaining multiple historical high-order subgraphs corresponding to each historical node in the historical structure attribute graph, wherein the second structure subgraph is generated based on the historical structure attribute graph using a preset algorithm; Taking the second structure subgraph in each of the historical structure attribute graphs and the historical high-order subgraph corresponding to the second structure subgraph as training sample pairs, a plurality of training sample pairs are obtained, wherein each of the second structure subgraphs corresponds to a historical target node; Input each of the training sample pairs into a preset network model, and learn the plurality of training sample pairs using a comparative learning model of the preset network model structure to obtain a loss value of a loss function corresponding to the training sample learned by the learning model; The parameter values ​​corresponding to the preset network model are trained through multiple iterations until the loss function corresponding to the training sample learned by the learning model converges. When the loss value obtained is the optimal value, the preset network model corresponding to the output parameter value of the converged loss function is determined as the anomaly detection model.

[0118] The anomaly detection module 95 is used to perform anomaly detection on solid objects in the import and export process based on the multiple high-order subgraphs and divided communities, using the trained anomaly detection model and the topological anomaly degree estimation between multiple node pairs in the community.

[0119] Optionally, the anomaly detection module 95 is further configured to: Anomaly detection is performed on solid objects in the import and export process based on the trained anomaly detection model and the topological anomaly degree estimation between multiple node pairs in the community to obtain an anomaly score corresponding to each target node: Performing abnormal risk detection on the solid objects in the import and export process according to the abnormality score corresponding to each target node; When it is detected that there is a risk node whose risk level is greater than a preset threshold value among the plurality of target nodes, it is determined whether the solid article corresponding to the risk node has an abnormal risk during the import or export process.

[0120] The abnormality detection device 9 further includes: The abnormality warning module 96 is used to issue an early warning prompt when an abnormality is detected in the solid objects during the import and export process.

[0121] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of this application. Their specific functions and technical effects can be found in the method embodiment section and will not be repeated here.

[0122] in addition, Figure 9 The anomaly detection device shown can be a software unit, a hardware unit, or a combination of software and hardware units built into an existing terminal device, or can be integrated into the terminal device as an independent accessory, or can exist as an independent terminal device.

[0123] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0124] Figure 10 This is a schematic diagram of the structure of the terminal device provided in the embodiment of the present application. Figure 10 As shown, the terminal device 10 of this embodiment includes: at least one processor 100 ( Figure 10 Only one is shown in the figure) a processor, a memory 101, and a computer program 102 stored in the memory 101 and executable on the at least one processor 100, wherein the processor 100 implements the steps of any of the above-mentioned embodiments of the abnormality detection method when executing the computer program 102.

[0125] The terminal device may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The terminal device may include, but is not limited to, a processor and a memory. Those skilled in the art will understand that Figure 10 This is merely an example of the terminal device 10 and does not constitute a limitation on the terminal device 10 . The terminal device 10 may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the terminal device 10 may also include input and output devices, network access devices, etc.

[0126] The processor 100 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. A general-purpose processor may be a microprocessor or any conventional processor.

[0127] In some embodiments, the memory 101 may be an internal storage unit of the terminal device 10, such as a hard disk or memory of the terminal device 10. In other embodiments, the memory 101 may also be an external storage device of the terminal device 10, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a flash card, etc. equipped on the terminal device 10. Furthermore, the memory 101 may include both an internal storage unit of the terminal device 10 and an external storage device. The memory 101 is used to store an operating system, application programs, a boot loader, data, and other programs, such as the program code of the computer program. The memory 101 may also be used to temporarily store data that has been output or is about to be output.

[0128] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned various method embodiments can be implemented.

[0129] An embodiment of the present application provides a computer program product. When the computer program product is run on a terminal device, the terminal device can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0130] If the integrated unit is implemented as a software functional unit and sold or used as a standalone product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the process steps in the above-mentioned method embodiments by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When executed by a processor, the computer program can implement the steps of each of the above-mentioned method embodiments. The computer program includes computer program code, which can be in source code form, object code form, executable file, or some intermediate form. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a device / terminal equipment, recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signals, telecommunication signals, and software distribution media. Examples include USB flash drives, removable hard drives, magnetic disks, or optical disks. In some jurisdictions, based on legislation and patent practice, computer-readable media cannot be electric carrier signals or telecommunication signals.

[0131] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0132] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0133] In the embodiments provided in this application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are merely illustrative. For example, the division of the modules or units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0134] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0135] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.

Claims

1. A method for detecting anomalies, characterized in that: The method comprises: Constructing an original structure attribute graph based on the interaction data generated during the import and export process of solid articles, wherein each node in the original structure attribute graph includes the solid article and the port corresponding to the solid article during the import and export process, and the edges in the original structure attribute graph represent the interaction relationships between multiple nodes; Taking each node in the original structure attribute graph as a target node, structurally enhancing the first structure subgraph formed by each target node according to the data enhancement strategy, thereby obtaining multiple original high-order subgraphs corresponding to each target node, wherein the first structure subgraph is generated based on the original structure attribute graph and using a preset algorithm, the nodes of the original high-order subgraph are obtained by converting the nodes in the original structure attribute graph, and the richness of the interactive information contained between the multiple nodes in the original high-order subgraph is higher than the interactive information between the multiple nodes in the original structure attribute graph; Dividing the original structural attribute graph into multiple communities according to a community detection algorithm based on topological relationships, wherein the communities include topological information between multiple nodes, and obtaining topological abnormality estimates between multiple node pairs within the communities based on the topological information; Based on the multiple original high-order subgraphs and divided communities, anomaly detection is performed on solid objects in the import and export process using a trained anomaly detection model and topological anomaly degree estimation between multiple node pairs in the community.

2. The anomaly detection method according to claim 1, wherein: The step of structurally enhancing the first structural subgraph formed by each target node according to the data enhancement strategy to obtain multiple original high-order subgraphs corresponding to each target node includes: Acquire, based on the first structural subgraph, a plurality of construction units corresponding to each target node, wherein the construction units are determined according to an adjacency relationship between a plurality of nodes in the first structural subgraph; determining a connection rule between a plurality of said building blocks; The plurality of construction units are connected according to the connection rule to obtain a plurality of the original high-order subgraphs corresponding to each target node.

3. The anomaly detection method according to claim 1, wherein: The step of dividing the original structural attribute graph into a plurality of communities according to a community detection algorithm based on topological relationships includes: Obtaining a shared neighborhood of each node, where the shared neighborhood is used to measure neighborhood similarity between multiple nodes; Based on the original structural attribute graph and the shared neighborhood, a clustering algorithm is used to group multiple nodes to obtain multiple communities, in which the target node exists.

4. The anomaly detection method according to claim 1, wherein: The obtaining of topological anomaly estimations between multiple node pairs in the community includes: Calculating the attribute similarity between each node and other nodes in each community using cosine distance to obtain multiple attribute similarity parameters; A topological abnormality estimate between the plurality of nodes in each of the communities is determined based on a plurality of attribute similarity parameters and the number of nodes in the community.

5. The anomaly detection method according to claim 1, wherein: The method of performing anomaly detection on solid objects in the import and export process based on the plurality of high-order subgraphs and divided communities and utilizing a trained anomaly detection model and topological anomaly degree estimation between a plurality of node pairs in the community includes: Anomaly detection is performed on solid objects in the import and export process based on the trained anomaly detection model and the topological anomaly degree estimation between multiple node pairs in the community to obtain an anomaly score corresponding to each target node: Performing an abnormality risk assessment on the solid objects in the import and export process according to the abnormality score corresponding to each target node; When a risk node greater than a preset threshold value is found among the plurality of target nodes, it is determined whether the solid article corresponding to the risk node has an abnormal risk during the import or export process.

6. The abnormality detection method according to claim 1 or 5, wherein: The training process to obtain the trained anomaly detection model includes: Constructing an attribute graph for multiple historical interaction data of solid items during the import and export process to obtain multiple constructed historical structure attribute graphs, and using an enhancement strategy to structurally enhance the second structure subgraph in each of the historical structure attribute graphs to obtain multiple historical high-order subgraphs corresponding to each historical node in the historical structure attribute graph, wherein the second structure subgraph is generated based on the historical structure attribute graph and using a preset algorithm; Taking the second structure subgraph in each of the historical structure attribute graphs and the historical high-order subgraph corresponding to the second structure subgraph as training sample pairs, a plurality of training sample pairs are obtained, wherein each of the second structure subgraphs corresponds to a historical target node; Input each of the training sample pairs into a preset network model, and learn the plurality of training sample pairs using a contrastive learning model of a preset network structure to obtain a loss value of a loss function corresponding to the training sample learned by the learning model; The parameter values ​​corresponding to the preset network model are trained through multiple iterations until the loss function corresponding to the training sample learned by the learning model converges. When the loss value obtained is the optimal value, the preset network model corresponding to the output parameter value of the converged loss function is determined as the anomaly detection model.

7. The anomaly detection method according to any one of claims 1 to 5, characterized in that: The method further comprises: When an abnormality is detected in the solid objects during the import and export process, an early warning prompt is issued.

8. An abnormality detection device, characterized in that: include: A data construction module is configured to construct an original structure attribute graph based on the interaction data generated during the import and export of solid articles, wherein each node in the original structure attribute graph includes the solid article and the port of entry corresponding to the solid article during the import and export process, and the edges in the original structure attribute graph represent the interaction relationships between multiple nodes; a data enhancement module that structurally enhances a first structural subgraph formed by each node in the original structural attribute graph according to a data enhancement strategy to obtain multiple original high-order subgraphs corresponding to each node, wherein the first structural subgraph is generated based on the original structural attribute graph and using a preset algorithm, the nodes of the original high-order subgraph are obtained by converting the nodes in the original structural attribute graph, and the richness of the interactive information contained between the multiple nodes in the original high-order subgraph is higher than the interactive information between the multiple nodes in the original structural attribute graph; A topology perception module is used to divide the original structural attribute graph into multiple communities according to a community detection algorithm based on topological relationships, wherein the communities include topological information between multiple nodes, and based on this, obtain topological anomaly estimates between multiple node pairs in the communities; A data detection module is used to perform anomaly detection on solid objects in the import and export process based on the multiple original high-order subgraphs and divided communities, using a trained anomaly detection model and topological anomaly estimation between multiple node pairs in the community.

9. A terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the abnormality detection method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the abnormality detection method according to any one of claims 1 to 7 is implemented.

Images