Import and export behavior attribute graph anomaly detection method and device, computer device and computer program product

Abstract

This application provides an anomaly detection method, apparatus, computer equipment, and computer program product for import and export behavior attribute graphs, applicable to the field of computer technology. The method includes: sampling and generating multiple subgraphs from an import and export behavior attribute graph, each subgraph being associated with a target node; performing anomaly edge suppression processing on each subgraph to filter out edges representing abnormal transaction relationships; calculating the comparison relationship between the target node and its corresponding subgraph after anomaly edge suppression processing in Euclidean space and hyperbolic space, respectively, to extract the local similarity and hierarchical relationship of the target node in transaction behavior; and finally, based on the comparison relationship, calculating the anomaly score of each target node in the import and export behavior attribute graph and outputting the anomaly node; thereby improving detection accuracy and making the final import and export behavior analysis results more reliable.

Description

Technical Field

[0001] This application belongs to the field of computer technology, and in particular relates to a method, apparatus, computer equipment and computer program product for detecting anomalies in import and export behavior attribute graphs. Background Technology

[0002] In today's global trade environment, the scale and complexity of import and export activities have increased dramatically, leading to a surge in the amount of data that customs supervision needs to process. Customs clearance systems contain a wealth of critical information, such as commodity types, transaction amounts, port locations, and the relationships between them. Effectively managing and analyzing this data to identify potential anomalies is a core task in maintaining national economic security and international trade order. Failure to detect anomalies in a timely manner, such as smuggling, tax evasion, and money laundering, can pose a serious threat to the national economy.

[0003] Self-supervised contrastive learning has emerged as an new technology for detecting anomalies in import and export activities. It can automatically learn complex patterns and interaction features from graph data without relying on large amounts of manually labeled data. Compared to traditional methods, self-supervised contrastive learning can quickly and accurately detect abnormal behavior in complex and ever-changing trade environments, providing strong technical support for customs in addressing trade security issues.

[0004] However, due to the limitations of abnormal edge interference and single Euclidean space representation, the self-supervised contrastive learning schemes used in existing technologies have insufficient detection accuracy in current import and export behavior analysis schemes, resulting in inaccurate final import and export behavior analysis results. Summary of the Invention

[0005] To address the aforementioned technical problems, embodiments of this application provide a method, apparatus, computer equipment, and computer program product for detecting anomalies in import / export behavior attribute graphs.

[0006] In a first aspect, embodiments of this application provide a method for anomaly detection in import / export behavior attribute graphs, the method comprising:

[0007] Multiple subgraphs are generated by sampling from the import and export behavior attribute graph, and each subgraph is associated with a target node;

[0008] Anomaly edge suppression is performed on each subgraph to filter out edges representing abnormal transaction relationships;

[0009] In Euclidean space and hyperbolic space, respectively, the comparison relationship between the target node and its corresponding subgraph after anomaly edge suppression is calculated to extract the local similarity and hierarchical relationship of the target node in transaction behavior; based on the comparison relationship, the anomaly score of each target node in the import and export behavior attribute graph is calculated; and the anomaly node is output according to the anomaly score.

[0010] In one embodiment, the step of sampling and generating multiple sub-graphs from the import / export behavior attribute graph includes:

[0011] A random walk algorithm is used to sample and generate a corresponding subgraph for each target node from the import and export behavior attribute graph; wherein, a target node and its corresponding subgraph constitute a positive sample pair; the target node and the subgraph sampled for other target nodes constitute a negative sample pair.

[0012] In one embodiment, the abnormal edge suppression processing of each subgraph to filter out edges representing abnormal transaction relationships includes:

[0013] The abnormal edge suppression process includes training an edge discriminator and using the edge discriminator to generate a structure mask;

[0014] The step of training the edge discriminator includes:

[0015] An edge discriminator is trained based on a geodesic contrastive loss function, which predicts the connection probability between nodes. The geodesic contrastive loss function is characterized by the following formula:

[0016]

[0017] in, This indicates the geodesic contrast loss value; The subgraph currently being traversed The corresponding target node; N The total number of nodes in the import / export behavior attribute graph; To reach the target node In the same subgraph The adjacent nodes in the data are the positive sample nodes; For other subgraphs The nodes in the list, i.e., the negative sample nodes; is the geodesic distance function in hyperbolic space; , , This represents the embedding representation of the corresponding node in hyperbolic space; This is a temperature hyperparameter used to control the shape of the distribution;

[0018] The step of generating a structure mask using the edge discriminator includes:

[0019] Use a trained edge discriminator to predict the connection probability of each edge;

[0020] A moving average strategy is used to calculate the threshold, which is the average of the predicted probabilities of all edges in the previous training cycle;

[0021] A structure mask is generated based on the threshold, and edges below the threshold are filtered out.

[0022] In one embodiment, the step of calculating the comparison relationship between the target node and its corresponding subgraph after anomaly edge suppression in Euclidean space and hyperbolic space respectively further includes:

[0023] Contrastive learning is performed in Euclidean space to produce Euclidean space contrastive learning results;

[0024] Contrastive learning is performed in hyperbolic space. Feature transformation between hyperbolic space and tangent space is achieved through exponential and logarithmic mappings to capture hierarchical relationships between nodes and produce hyperbolic space contrastive learning results.

[0025] The exponential mapping is characterized by the following formula:

[0026]

[0027] The logarithmic mapping is characterized by the following formula:

[0028]

[0029] in, This represents the vector in the tangent space. Mapped to curvature In hyperbolic space;

[0030] This represents the vector in the hyperbolic space. Mapped into its tangent space;

[0031] Represents the origin of hyperbolic space;

[0032] Represents the curvature of hyperbolic space. It is a hyperparameter greater than 0;

[0033] This represents the Euclidean norm of a vector.

[0034] In one embodiment, calculating the anomaly score of each target node in the import / export behavior attribute graph based on the comparison relationship includes:

[0035] Based on the Euclidean space contrastive learning results, the hyperbolic space contrastive learning results, and the geodesic contrastive loss value generated by the trained edge discriminator, the anomaly score of each target node in the import / export behavior attribute map is calculated:

[0036] The anomaly score includes at least one of a first similarity difference value, a second similarity difference value, and a geodesic contrast loss value.

[0037] The first similarity difference value is calculated based on the Euclidean space similarity score of the positive and negative sample pairs of the target node.

[0038] The second similarity difference value is calculated based on the hyperbolic space similarity score of the positive and negative sample pairs of the target node.

[0039] In one embodiment, the method further includes:

[0040] in, Represents the target node The final abnormal score;

[0041] This represents the outlier score obtained based on Euclidean space contrastive learning.

[0042] This represents the outlier score obtained based on hyperbolic space contrastive learning;

[0043] This represents the anomaly score obtained based on geodesic contrast loss.

[0044] and The hyperparameter used to balance the weights of each score item. and , and This represents the hyperparameters that control the balance between the modules.

[0045] In one embodiment, the import / export behavior attribute graph represents import / export behavior data, wherein:

[0046] The nodes in the import and export behavior attribute graph represent at least one of the following: commodities, ports, and enterprises.

[0047] The edges of the subgraph represent import and export behaviors;

[0048] The attributes of the nodes in the import and export behavior attribute graph represent at least one of the following: transaction amount, commodity category, and port type.

[0049] The abnormal node represents at least one of the following: abnormal commodity, abnormal port, or abnormal enterprise.

[0050] Secondly, this application also proposes an anomaly detection device for import and export behavior attribute maps, comprising:

[0051] A module is used to sample and generate multiple subgraphs from the import and export behavior attribute graph, with each subgraph associated with a target node;

[0052] The suppression module is used to suppress abnormal edges in each subgraph to filter out edges that represent abnormal transaction relationships.

[0053] The learning module is used to calculate the comparison relationship between the target node and its corresponding subgraph after anomaly edge suppression in Euclidean space and hyperbolic space, respectively, so as to extract the local similarity and hierarchical relationship of the target node in transaction behavior; the anomaly calculation module is used to calculate the anomaly score of each target node in the import and export behavior attribute graph based on the comparison relationship; the output module is used to output the anomaly node according to the anomaly score.

[0054] Thirdly, this application also proposes a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described in the first aspect above.

[0055] Fourthly, this application also proposes a computer program product comprising a computer program that, when executed by a processor, implements the steps of the method described in the first aspect above.

[0056] The beneficial effects of this application are as follows: The method for anomaly detection in import and export behavior attribute graphs proposed in this invention includes sampling and generating multiple subgraphs from the import and export behavior attribute graph, each subgraph being associated with a target node; performing anomaly edge suppression processing on each subgraph to filter out edges representing abnormal transaction relationships; calculating the comparison relationship between the target node and its corresponding subgraph after anomaly edge suppression processing in Euclidean space and hyperbolic space respectively, to extract the local similarity and hierarchical relationship of the target node in transaction behavior; and calculating the anomaly score of each target node in the import and export behavior attribute graph based on the comparison relationship and outputting the anomaly node. This invention combines the advantages of Euclidean space and hyperbolic space, maintains a comprehensive representation of anomaly patterns, and addresses the impact of anomaly edges on node representation learning, while introducing a mechanism to suppress anomaly edges. This can effectively alleviate the interference of anomaly nodes on neighbor representation learning, thereby improving the detection accuracy and making the final import and export behavior analysis results more reliable. Attached Figure Description

[0057] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 A flowchart illustrating a main embodiment of the import / export behavior attribute graph anomaly detection method provided in this application;

[0059] Figure 2 A flowchart illustrating another embodiment of the import / export behavior attribute graph anomaly detection method provided in this application;

[0060] Figure 3 This application provides a structural block diagram of an anomaly detection device for import and export behavior attribute graphs.

[0061] Figure 4 This is a schematic diagram of an embodiment of a computer device for performing an anomaly detection method for import and export behavior attribute graphs, as provided in this application. Detailed Implementation

[0062] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0063] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0064] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0065] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0066] In the description of the embodiments of this application, the term "multiple" refers to two or more (including two), unless otherwise expressly and specifically defined.

[0067] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0068] References to "one embodiment" or "some embodiments" in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized.

[0069] The terms “including,” “comprising,” “having,” and variations thereof all mean “including but not limited to,” unless otherwise specifically emphasized.

[0070] Understandably, in today's global trade environment, the scale and complexity of import and export activities have increased dramatically, leading to a surge in the amount of data that customs supervision needs to process. Customs clearance systems contain a wealth of critical information, such as commodity types, transaction amounts, port locations, and the relationships between them. Effectively managing and analyzing this data to identify potential anomalies is a core task in maintaining national economic security and international trade order. Failure to detect anomalies in a timely manner, such as smuggling, tax evasion, and money laundering, can pose a serious threat to the national economy.

[0071] However, detecting anomalies in import and export activities presents numerous challenges. First, with the increasing variety of goods and global ports of entry, the interaction between goods and ports has become more complex and diverse. Normal import and export activities often take place at a specific port or follow a regular pattern; sudden changes in these patterns may indicate potential anomalies. Furthermore, trade patterns for similar or related goods typically exhibit predictable commonalities; deviations from these commonalities may also foreshadow problems. Therefore, the relationship between goods and ports becomes crucial for identifying anomalies.

[0072] Secondly, traditional rule-based and simple statistical analysis-based anomaly detection methods are inadequate for handling today's complex and ever-changing trade environment. They typically focus only on the direct relationship between goods and ports, ignoring more complex interaction patterns and potential connections. For example, some anomalous behaviors may involve deep-seated connections between multiple ports and goods, and relying solely on simple statistical features or rules cannot effectively capture these complex pattern changes.

[0073] To address these issues, a static attribute graph structure has been introduced into import / export anomaly detection systems. Static attribute graphs not only represent the basic relationship between goods and ports, but also display more detailed information (such as commodity category, port type, and transaction amount) through the attributes between nodes (e.g., goods, ports) and edges (e.g., import / export activities). This data structure can comprehensively depict the complex interaction patterns between goods and ports in the trade network, thus providing deeper insights for anomaly detection.

[0074] Building upon static attribute graphs, graph structure analysis can reveal hidden, complex relationships, particularly in anomaly detection tasks. This approach goes beyond simply detecting simple commodity-port correspondences; it can also uncover potential anomalous behaviors through multi-layered interaction patterns. Currently, customs systems have accumulated a vast amount of unlabeled data. Efficiently extracting useful information from this data and automatically identifying complex anomalous behaviors has become a major technical challenge.

[0075] Against this backdrop, self-supervised contrastive learning has emerged as an emerging technology for detecting anomalies in import and export activities. It can automatically learn complex patterns and interaction features from graph data, without relying on large amounts of manually labeled data. Compared to traditional methods, self-supervised contrastive learning can quickly and accurately detect abnormal behavior in complex and ever-changing trade environments, providing strong technical support for customs in addressing trade security issues.

[0076] However, the applicant of this invention notes that, although existing methods for detecting anomalies in import and export behavior based on self-supervised graph contrastive learning have made some progress in practical applications, these methods still have some shortcomings:

[0077] (1) Graph contrastive learning methods typically use random walks to sample positive subgraphs, but the presence of anomalous nodes inevitably leads to these subgraphs containing anomalous edges. In graph neural networks (GNNs), message propagation along these anomalous edges causes the anomalous information to spread, disturbing normal neighboring nodes and weakening the semantic consistency between positive subgraphs and their corresponding target nodes. This problem is exacerbated when edge enhancement mechanisms (such as the random edge perturbation used in the GRADATE method) are applied to create enhanced views.

[0078] (2) Existing conventional methods are limited to learning node representations within Euclidean space. However, the polynomial dimensional growth and geometric properties of Euclidean space are incompatible with the topological properties of real-world graph structures. Specifically, graphs in the real world typically exhibit hierarchical patterns. Embedding hierarchical information into Euclidean space can be efficiently evaluated for local node similarity through linear algebraic computation, but it cannot fully extract the hierarchical semantics of the graph, leading to dimensional distortion. In contrast, hyperbolic space, due to its exponential expansion capability, is better suited for embedding hierarchical data, thus becoming a key technology for graph data mining. How to effectively utilize the respective advantages of both spaces for accurate attribute graph anomaly detection (AGAD) has not been fully studied.

[0079] In summary, due to the limitations of abnormal edge interference and single Euclidean space representation in existing graph anomaly detection methods, the detection accuracy in current import and export behavior analysis schemes is insufficient, resulting in inaccurate final import and export behavior analysis results.

[0080] To address the aforementioned technical problems, this application provides a method for detecting anomalies in import / export behavior attribute graphs. Please refer to [link to relevant documentation]. Figure 1 , Figure 1 This is a flowchart illustrating a first embodiment of an anomaly detection method for import and export behavior attribute graphs provided in this application, mainly targeting data of import and export behavior attribute graphs that include commodities, ports, enterprises and their import and export transaction relationships;

[0081] The import / export behavior attribute graph anomaly detection method in this embodiment mainly includes the following steps S1 to S5:

[0082] Step S1: Sample from the import / export behavior attribute graph to generate multiple subgraphs, each subgraph being associated with a target node;

[0083] It should be noted that the "target node" in this embodiment is a concept with a specific meaning; it specifically refers to a subgraph in the subgraph generation step (S1). The central node surrounding the sampling; this "target node" and the subgraph This constitutes a "positive pair" in contrastive learning;

[0084] In practical applications, the "node" in this application embodiment is used to represent goods, ports, or enterprises;

[0085] The "Import and Export Behavior Attribute Graph" in this embodiment is import and export behavior data. The "Import and Export Behavior Attribute Graph" in this embodiment includes the attributes of each target node. The "attributes of the nodes" can be regarded as a kind of input data, which may include at least one of the following: transaction amount, commodity category or port type. For example, the "attributes of the nodes" can be obtained from the customs database in real time.

[0086] Accordingly, the edges of the subgraph in this embodiment can represent import and export behaviors.

[0087] Understandably, the purpose of step S1 is to extract local structure from the large-scale import and export behavior attribute graph in order to construct the positive and negative sample pairs required for contrastive learning. The goal of graph contrast is to bring nodes closer to their positive pairs and push them further away from their negative pairs, thereby improving the semantic discriminability of nodes.

[0088] In this embodiment, a random walk algorithm can be used to sample and generate a corresponding subgraph for each target node from the import and export behavior attribute graph; wherein, a target node and its corresponding subgraph constitute a positive sample pair; the target node and the subgraph sampled for other target nodes constitute a negative sample pair.

[0089] For example: A subgraph is sampled from the entry / exit behavior attribute graph using a Random Walk with Restart (RWR) algorithm. For the target node... The subgraph obtained by sampling from it These are considered positive sample pairs; while subgraphs sampled from other nodes constitute negative sample pairs. To make the learned node embeddings more discriminative, the attribute information of the target node can be masked in the subgraph (e.g., replaced with a zero vector). Step S1 addresses the efficiency problem of directly performing calculations on a large-scale full graph and focuses on learning local patterns. Step S2: Perform abnormal edge suppression processing on the subgraph to filter out edges representing abnormal transaction relationships;

[0090] It should be noted that the purpose of step S2 is to identify and filter out abnormal edges in the subgraph to prevent abnormal information from polluting the representation of normal nodes during the message propagation process of the graph neural network.

[0091] Understandably, while existing methods for detecting import / export anomalies based on self-supervised graph contrastive learning have made some progress in practical applications, they still have some shortcomings: graph contrastive learning methods typically use random walks to sample positive subgraphs, but the presence of anomalous nodes inevitably leads to these subgraphs containing anomalous edges. In graph neural networks (GNNs), message propagation along these anomalous edges causes the anomalous information to spread, disturbing normal neighboring nodes and weakening the semantic consistency between positive subgraphs and their corresponding target nodes. This problem is exacerbated when edge enhancement mechanisms (such as the random edge perturbation used in the GRADATE method) are applied to create enhanced views.

[0092] In some embodiments, reference Figure 2 Step S2 may further include two sub-steps (S2a and S2b):

[0093] S2a (Training Edge Discriminator): The edge discriminator is trained based on the geodesic contrast loss function, enabling the edge discriminator to predict the connection probability between nodes.

[0094] Understandably, the edge discriminator aims to predict the connection probability of nodes in a subgraph. For example, based on the homogeneity assumption, in hyperbolic space, the geodesic distance between connected nodes is less than the geodesic distance between unconnected nodes. Based on this property, this embodiment calculates the geodesic distance between nodes to represent their connection probability. Specifically, this embodiment uses a contrastive learning mechanism to train the edge discriminator, which includes a pair of encoders and decoders. The encoder maps node features to the latent space, and its calculation process is the same as in Equation (1.10), but the trainable parameters are different. The decoder uses a Fermi-Dirac decoder to estimate the connection probability between node embeddings, as defined in Equation (1.15). (The text then repeats the process of selecting nodes.) Local subgraph For example, this process can be represented as:

[0095]

[0096] in Subgraph The adjacency matrix, This represents the matrix dot product, ensuring that only edges already present in the subgraph are evaluated, without introducing additional edges. , Represents nodes in a subgraph and The connection probability.

[0097] Since the network is trained in mini-batch mode, this embodiment gradually obtains the predicted probabilities of all edges in the entire graph within one training cycle. It is composed of the concatenation of the connection probability matrices of all subgraphs, and can be expressed as follows:

[0098]

[0099] Where i belongs to N;

[0100] Subsequently, in this embodiment, the geodesic contrast loss defined in the following formula (1.19) is used as the objective function to train the edge discriminator for the target node. It forms a direct line with its adjacent node, while originating from another subgraph. The nodes form negative pairs:

[0101]

[0102] in, This indicates the geodesic contrast loss value; The subgraph currently being traversed The corresponding target node; N The total number of nodes in the import / export behavior attribute graph; To and In the same subgraph The adjacent nodes in the data are the positive sample nodes; For other subgraphs The nodes in the list, i.e., the negative sample nodes; is the geodesic distance function in hyperbolic space; , , This represents the embedding representation of the corresponding node in hyperbolic space; This is a temperature hyperparameter used to control the shape of the distribution.

[0103] S2b (Generate a structure mask using the edge discriminator): Predict the connection probability of each edge using the trained edge discriminator; dynamically calculate a threshold using a moving average strategy, the threshold being the average of the predicted probabilities of all edges in the previous training cycle; generate a structure mask based on the threshold, and filter out edges below the threshold.

[0104] Understandably, this involves obtaining the predicted connection probability matrix for all edges. A key challenge then lies in designing a reliable thresholding strategy to construct the structure mask. ,in Represents the adjacency matrix of a subgraph The corresponding edge is hidden. This indicates that the threshold is reserved. Considering that each training cycle involves random subgraph sampling and continuous parameter updates, this embodiment can employ a simple and effective moving average strategy to dynamically adjust the threshold. Specifically, at the end of each cycle, the average predicted edge probability is calculated and used as the threshold for generating the structure mask in the next cycle. The specific process can be described as follows:

[0105]

[0106]

[0107] in Indicates the flattening operation. Indicates the training round.

[0108] Subsequently, before the subgraph enters the dual-space contrastive learning module, anomaly edges are filtered out using a mask matrix, i.e., in equations (1.1) and (1.10), using... replace .

[0109]

[0110] Furthermore, to ensure the reliability of the structural mask, during edge discriminator training... The above process is executed only after the round. Step S3: Calculate the comparison relationship between the target node and its corresponding subgraph after anomaly edge suppression in Euclidean space and hyperbolic space, respectively, to extract the local similarity and hierarchical relationship of the target node in transaction behavior;

[0111] It should be noted that the purpose of this step S3 is to simultaneously utilize the geometric advantages of Euclidean space and hyperbolic space to learn the local similarity and hierarchical relationship of node representations, respectively.

[0112] Understandably, existing methods are limited to learning node representations within Euclidean space. However, the polynomial dimensional growth and geometric properties of Euclidean space are incompatible with the topological properties of real-world graph structures; specifically, real-world graphs often exhibit hierarchical patterns. Embedding hierarchical information into Euclidean space allows for efficient evaluation of local node similarity through linear algebraic computation, but it fails to fully extract the hierarchical semantics of the graph, leading to dimensional distortion. Conversely, hyperbolic space, due to its exponential expansion capability, is better suited for embedding hierarchical data, thus becoming a key technique in graph data mining. How to effectively utilize the respective advantages of both spaces for accurate attribute graph anomaly detection (AGAD) has not been fully investigated.

[0113] In some embodiments, reference Figure 2 Step S3 may further include two sub-steps (S3a and S3b):

[0114] S3a (Euclidean Space Contrast Learning): Contrast learning is performed in Euclidean space to produce Euclidean space contrast learning results; wherein, the Euclidean space contrast learning results in this embodiment specifically include node-subgraph similarity scores;

[0115] This step involves contrastive learning in Euclidean space to capture the local neighborhood similarity of nodes.

[0116] For example, embodiments of this application employ a GCN-based encoder to extract subgraphs. Hidden layer representation The formula is as follows:

[0117]

[0118] in, Let represent the adjacency matrix of a subgraph with self-loops. Degree matrix, Indicates the first The trainable parameters of the layer, This represents an activation function, such as ReLU;

[0119] target node The hidden layer representation is denoted as This is obtained through an MLP that shares parameters with the aforementioned GCN, and the process can be represented as:

[0120]

[0121] To convert the subgraph representation to the same shape as the node representation, this embodiment reads the subgraph embedding vector using average pooling. It can be expressed as the following formula:

[0122]

[0123] in, It represents the number of nodes in the subgraph.

[0124] Finally, a bilinear layer was used. As a discriminator, it calculates the discrimination scores between positive and negative samples, defined as follows:

[0125]

[0126] in For trainable network parameters, It is the sigmoid activation function.

[0127] Finally, we use the following binary cross-entropy loss as the objective function for contrastive learning, encouraging the target node to have a similarity score close to 1 with its positive samples and a similarity score close to 0 with its negative samples:

[0128]

[0129] Among them, in the center In the negative pair .

[0130] S3b (Hyperbolic Space Contrast Learning): Contrast learning is performed in hyperbolic space. Feature transformation between hyperbolic space and tangent space is achieved through exponential and logarithmic mappings to capture the hierarchical relationship between nodes and produce hyperbolic space contrast learning results. Specifically, the hyperbolic space contrast learning results in this embodiment include node-subgraph geodesic distance and similarity score.

[0131] For example, embodiments of this application employ a Poincaré sphere model for hyperbolic representation learning, leveraging gradient descent for effective optimization. The Poincaré sphere model embeds the hyperbolic space into... Dimensional unit sphere In the middle. It is defined as having a constant negative curvature. The Riemannian manifolds are as follows:

[0132]

[0133] in, Representing vectors The Euclidean norm.

[0134] For example, this application embodiment uses geodesic distance. In hyperbolic geometry, geodesic distance is similar to straight-line distance in Euclidean space, representing the shortest path between two points, and is often used as a key optimization objective in graph representation learning. This application embodiment is suitable for graphs with constant negative curvature. Two points in the Poincaré sphere model and The geodesic distance is defined as:

[0135]

[0136] in, It is an inverse hyperbolic cosine function.

[0137] For example, embodiments of this application employ exponential and logarithmic mappings: in the case of contrastive learning in hyperbolic space, feature transformation between hyperbolic space and tangent space is achieved through exponential and logarithmic mappings to capture hierarchical relationships between nodes. Assume... It is a curvature The origin is hyperbolic space, It is in The tangent space at the given point. and its tangent space projection The exponential and logarithmic mapping is defined as follows:

[0138]

[0139]

[0140] in, This represents the vector in the tangent space. Mapped to curvature In hyperbolic space;

[0141] This represents the vector in the hyperbolic space. Mapped into its tangent space;

[0142] Represents the origin of hyperbolic space;

[0143] Represents the curvature of hyperbolic space. It is a hyperparameter greater than 0;

[0144] This represents the Euclidean norm of a vector.

[0145] Furthermore, this embodiment also requires graph contrast learning. This embodiment performs graph contrast learning in hyperbolic space, detecting anomalies by capturing the hierarchical relationships between nodes and subgraphs. For example, before inputting the subgraph into the hyperbolic space graph encoder, this embodiment uses the exponential mapping in the aforementioned formula (1.8) to transform the original features of the subgraph into hyperbolic space, and then follows the formula... In the tangent space, neighborhood message aggregation similar to that in Euclidean space can be represented as follows:

[0146]

[0147] in and Let represent the subgraph hidden layer representations in the tangent space and hyperbolic space, respectively. The tangent space features are exponentially mapped before being input to subsequent network layers, and then mapped again to the hyperbolic space, i.e.:

[0148]

[0149] Then, in this embodiment, the same readout function as in Euclidean space is used to read out the subgraph embedding vector. This process can be described as follows:

[0150]

[0151] target node Hidden representation Obtained by a hyperbolic layer with the same weight matrix as the encoder described by formula (1.10), it can be expressed as:

[0152]

[0153] This embodiment performs contrastive learning in hyperbolic space, aiming to minimize the geodesic distance between the target node and its positive counterpart subgraph, while maximizing the geodesic distance between it and its negative counterpart subgraph. According to formula (1.7), the distance between the target node and the subgraph is calculated as follows:

[0154]

[0155] The Fermi-Dirac decoder can then be used to convert geodesic distance relationships into similarity scores, a process that can be described as follows:

[0156]

[0157] in, and These are hyperparameters that control offset and sharpness, respectively.

[0158] Similar to Euclidean space, this example uses binary cross-entropy loss as the objective function for contrastive learning.

[0159]

[0160] Step S4: Based on the comparison relationship, calculate the anomaly score of each target node in the import and export behavior attribute graph;

[0161] In this embodiment, based on the Euclidean space contrast learning results and hyperbolic space contrast learning results obtained in step S3, and the geodesic contrast loss value generated by training the edge discriminator in step S2, at least one of the following (first similarity difference value, second similarity difference value, and the geodesic contrast loss value) is calculated:

[0162] For the target node, the first similarity difference value is calculated as its anomaly score based on the Euclidean space similarity score of its positive and negative sample pairs.

[0163] For the target node, a second similarity difference value is calculated as its anomaly score based on the hyperbolic space similarity score of its positive and negative sample pairs.

[0164] The geodesic comparison loss value corresponding to the target node is directly used as its anomaly score.

[0165] For example, in the training phase of this embodiment, the advantages of dual spatial graph contrastive learning and edge discriminator can be combined to derive the joint objective function as follows:

[0166]

[0167] in, and This represents the hyperparameters that control the balance between the modules.

[0168] Furthermore, for the final calculated anomaly scores, this embodiment also weights the anomaly score types for each part. In the contrastive learning framework, normal nodes have high similarity to positive pair subgraphs and low similarity to negative pair subgraphs, while anomaly nodes have weak distinguishability between both. Therefore, the node anomaly score is calculated as follows:

[0169]

[0170]

[0171] For the geodesic contrastive loss function, normal nodes have a smaller geodesic distance from their positive sample pairs and a larger geodesic distance from their negative sample pairs, resulting in a lower loss value. Conversely, outlier nodes lack clearly distinguishable positive and negative samples, leading to a higher loss value. Therefore, a node's outlier score is directly derived from its geodesic contrastive loss.

[0172]

[0173] After obtaining the outlier scores from each module, we normalize them to address the scaling issues, and then aggregate them into the final score.

[0174]

[0175] in, Represents the target node The final abnormal score;

[0176] This represents the outlier score obtained based on Euclidean space contrastive learning.

[0177] This represents the outlier score obtained based on hyperbolic space contrastive learning;

[0178] This represents the anomaly score obtained based on geodesic contrast loss.

[0179] and The hyperparameter used to balance the weights of each score item. and , and This represents the hyperparameters that control the balance between the modules.

[0180] In this embodiment, during the inference process, multiple rounds of sampling can be performed on each target node, different subgraphs are used to calculate the anomaly score for each round, and the average value is taken as the final result. Step S5: Output the anomaly node according to the anomaly score, wherein the anomaly node represents a list of (suspicious) abnormal goods, ports, or enterprises.

[0181] In its implementation, the system can calculate the values ​​of all target nodes. The system sorts the data and outputs a list of nodes with the highest anomaly scores. In import and export inspection scenarios, this list identifies suspicious goods, ports, or companies for customs officials to conduct focused checks, thereby achieving precise and efficient intelligent supervision.

[0182] The beneficial effects of this application's embodiments are as follows: The method embodiments proposed in this invention employ a groundbreaking dual-space contrastive learning framework for anomaly detection in import / export behavior attribute graphs. This effectively combines the advantages of Euclidean space and hyperbolic space, maintaining a comprehensive representation of anomalous patterns and thus significantly improving anomaly detection capabilities. Simultaneously, this embodiment addresses the impact of anomalous edges on node representation learning and introduces a mechanism to suppress anomalous edges. This effectively mitigates the interference of anomalous nodes on neighbor representation learning, thereby improving detection accuracy and making the final import / export behavior analysis results more reliable.

[0183] The above-described implementation methods of this application demonstrate superior performance. This verifies the effectiveness of the anomaly edge suppression mechanism and the dual-space contrastive learning framework. Working together, they reduce interference from anomalous information and more comprehensively capture complex patterns, ultimately significantly improving the accuracy and robustness of anomaly detection in complex scenarios such as import / export behavior analysis.

[0184] Furthermore, to verify the above-mentioned beneficial effects of the import and export behavior attribute graph anomaly detection method of this embodiment, the following experimental methods can be used to obtain corresponding evidence:

[0185] Table 1 Detailed information about the benchmark dataset

[0186]

[0187] Datasets: This application uses six benchmark datasets commonly used in the field of anomaly detection to evaluate the effectiveness of the proposed technique. These datasets are shown in Table 1.

[0188] Experimental setup and baseline methods: For all datasets, the number of layers in the GCN was set to 1, and the hidden layer dimension was 64. AUC was used as the evaluation metric. Baseline methods included: traditional shallow methods AMEN, Radar, and ANOMALOUS; autoencoder-based method DOMINANT; and deep neural network graph contrastive learning methods CoLA, ANEMONE, SL-GAD, Sub-CR, GRADATE, NLGAD, and SAMCL.

[0189] Experimental Results: To demonstrate the effectiveness of the proposed import / export behavior attribute graph anomaly detection method, it is compared with the aforementioned AGAD method. The results are shown in Table 2. The proposed method performs excellently on all datasets. Specifically, on the Cora, CiteSeer, ACM, Citation, and DBLP datasets, its performance is 2.08%, 0.77%, 0.73%, 6.63%, and 1.60% higher than the best baseline, respectively, and it also achieves competitive results on the PubMed dataset. The proposed method captures comprehensive node representations from a dual-space perspective while mitigating the interference of anomalous nodes on their normal neighbors, thereby improving anomaly detection performance.

[0190] Compared to methods that construct additional views through edge perturbation (Sub-CR and GRADATE), DC-AES achieves a significant improvement. This improvement can be attributed to using geodesic distance to measure node connectivity probabilities and combining it with a structure masking strategy to effectively filter out anomalous edges in the subgraph. This process significantly reduces the impact of anomalous nodes on the learning of representations of their neighbors.

[0191] Deep learning-based methods outperform shallow methods on all datasets, indicating that shallow mechanisms cannot effectively embed the high-dimensional features and complex structural information of nodes in attribute graphs.

[0192] Table 2 Comparison of DC-AES and some baseline methods in terms of AUC metric

[0193]

[0194] Please see Figure 4 , Figure 4 A schematic diagram of an embodiment of a computer device for an anomaly detection method of import and export behavior attribute graphs provided in this application is shown below. Figure 4 As shown, the computer device 1 of this embodiment includes: at least one processor 10 ( Figure 4 (Only one is shown in the image) a processor 10, a memory 11, and a computer program 12 stored in the memory 11 and executable on the at least one processor 10. When the processor 10 executes the computer program 12, it implements the steps in the embodiment of the import / export behavior attribute graph anomaly detection method of this application.

[0195] The computer device may be a desktop computer, laptop, smartphone, PDA, or other computing device.

[0196] Figure 4The computer device shown may include, but is not limited to, processor 10 and memory 11. Those skilled in the art will understand that... Figure 4 The computer device 1 is merely an example and does not constitute a limitation on the computer device 1. It may include more or fewer components than shown in the figure, or combine certain components, or different components, such as input / output devices, network access devices, etc.

[0197] The processor 10 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0198] In some embodiments, the memory 11 may be an internal storage unit of the computer device 1, such as a hard disk or memory of the computer device 1. In other embodiments, the memory 11 may be an external storage device of the computer device 1, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 1. Furthermore, the memory 11 may include both internal and external storage units of the computer device 1. The memory 11 is used to store the operating system, applications, bootloader, data, and other programs, such as the program code of the computer program. The memory 11 can also be used to temporarily store data that has been output or will be output.

[0199] Furthermore, in one embodiment, as Figure 3 As shown, the present invention also provides an anomaly detection device for import and export behavior attribute graphs, comprising:

[0200] Module 10 is used to sample and generate multiple subgraphs from the import / export behavior attribute graph, with each subgraph associated with a target node;

[0201] The suppression module 20 is used to suppress abnormal edges in each subgraph to filter out edges that represent abnormal transaction relationships.

[0202] The learning module 30 is used to calculate the comparison relationship between the target node and its corresponding subgraph after anomaly edge suppression in Euclidean space and hyperbolic space, respectively, so as to extract the local similarity and hierarchical relationship of the target node in transaction behavior; the anomaly calculation module 40 is used to calculate the anomaly score of each target node in the import and export behavior attribute graph based on the comparison relationship; the output module 50 is used to output the anomaly node according to the anomaly score.

[0203] It should be noted that the import / export behavior attribute graph anomaly detection device in this embodiment can be understood as a virtual device that can be installed in the computer device of the aforementioned embodiment. The computer device calls the import / export behavior attribute graph anomaly detection device through the processor, and then runs the specific implementation scheme in the above import / export behavior attribute graph anomaly detection method embodiment.

[0204] The information interaction and execution process between the above-mentioned devices / units are based on the same concept as the method embodiments of this application. For details on their specific functions and the resulting technical effects, please refer to the method embodiments section.

[0205] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0206] This application also provides a computer program that, when executed by a processor, implements the steps in the various method embodiments described above.

[0207] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps described in the various method embodiments above.

[0208] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of this application can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a photographing device / terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.

[0209] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0210] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method of import / export behavior attribute graph anomaly detection, characterized in that, The method comprises: sampling a plurality of subgraphs from the import and export behavior attribute graph, each subgraph being associated with a target node; performing abnormal edge suppression processing on each subgraph to filter out edges representing abnormal transaction relationships; wherein the abnormal edge suppression processing comprises training an edge discriminator and generating a structure mask using the edge discriminator; wherein the step of training the edge discriminator comprises training the edge discriminator based on a geodesic contrast loss function to make the edge discriminator predict the connection probability between nodes; wherein the step of generating a structure mask using the edge discriminator comprises predicting the connection probability of each edge using the trained edge discriminator; calculating a threshold value using a sliding average strategy, the threshold value being the average of the predicted probabilities of all edges in the previous training period; generating a structure mask according to the threshold value to filter out edges below the threshold value; respectively in Euclidean space and hyperbolic space, calculating the contrast relationship between the target node and its corresponding subgraph after abnormal edge suppression processing to extract the local similarity and hierarchical relationship of the target node in transaction behavior; wherein the step of calculating the contrast relationship between the target node and its corresponding subgraph after abnormal edge suppression processing in Euclidean space and hyperbolic space respectively further comprises: performing contrast learning in Euclidean space to output a Euclidean space contrast learning result; performing contrast learning in hyperbolic space to realize feature conversion between hyperbolic space and tangent space through exponential mapping and logarithmic mapping to capture the hierarchical relationship between nodes to output a hyperbolic space contrast learning result; based on the contrast relationship, calculating the abnormal score of each target node in the import and export behavior attribute graph; comprising: based on the Euclidean space contrast learning result, the hyperbolic space contrast learning result, and the geodesic contrast loss value generated by the edge discriminator, calculating the abnormal score of each target node in the import and export behavior attribute graph; wherein the abnormal score comprises at least one of a first similarity difference value, a second similarity difference value and the geodesic contrast loss value; wherein the first similarity difference value is calculated based on the Euclidean space similarity score of the positive and negative sample pairs of the target node; the second similarity difference value is calculated based on the hyperbolic space similarity score of the positive and negative sample pairs of the target node; outputting an abnormal node according to the abnormal score; wherein the import and export behavior attribute graph represents import and export behavior data, wherein: the nodes in the import and export behavior attribute graph represent at least one of commodities, ports and enterprises; the edges of the subgraph represent import and export behavior; the attributes of the nodes in the import and export behavior attribute graph represent at least one of transaction amount, commodity category and port type; the abnormal node represents at least one of abnormal commodities, abnormal ports or abnormal enterprises.

2. The method of claim 1, wherein, The sampling a plurality of subgraphs from the import and export behavior attribute graph comprises: A random walk algorithm is used to sample a corresponding subgraph for each target node from the import and export behavior attribute graph; wherein, a target node and its corresponding subgraph constitute a positive sample pair; the target node and the subgraphs sampled for other target nodes constitute negative sample pairs.

3. The method of claim 1, wherein, The geodesic contrast loss function is represented by the following formula: wherein, denotes the geodesic contrast loss value; is the subgraph currently traversed corresponding target node; N is the total number of nodes in the import-export behavior attribute graph; is the target node adjacent node in the same subgraph , i.e. positive sample node; is the node in other subgraphs , i.e. negative sample node; is the geodesic distance function in hyperbolic space; , , is the embedding representation of the corresponding node in hyperbolic space; is a temperature hyperparameter used to control the shape of the distribution.

4. The method of claim 3, wherein, The exponential mapping is represented by the following formula: The logarithmic mapping is represented by the following formula: wherein, represents mapping of a vector in the tangent space to a hyperbolic space with curvature of -1. denotes mapping a vector in the hyperbolic space into its tangent space; denotes the origin of the hyperbolic space; denotes the curvature of the hyperbolic space, is a hyperparameter greater than 0; denotes the Euclidean norm of a vector.

5. The method of claim 1, wherein, The method further comprises: wherein, denotes the final anomaly score of the target node ; denotes the anomaly score based on Euclidean space contrast learning; denotes the anomaly score based on hyperbolic space contrast learning; denotes the anomaly score based on geodesic contrast loss; and are hyperparameters for balancing the weights of each score, and , and denote hyperparameters that control the balance between the modules.

6. An import / export behavior attribute graph anomaly detection apparatus characterized by comprising: The device comprises: An adoption module is configured to sample a plurality of subgraphs from an import and export behavior attribute graph, each subgraph being associated with a target node; wherein, the import and export behavior attribute graph represents import and export behavior data; the nodes in the import and export behavior attribute graph represent at least one of commodities, ports and enterprises; the edges of the subgraphs represent import and export behaviors; the attributes of the nodes in the import and export behavior attribute graph represent at least one of transaction amounts, commodity categories and port types; an abnormal node represents at least one of an abnormal commodity, an abnormal port or an abnormal enterprise; An inhibition module is configured to perform abnormal edge inhibition processing on each subgraph to filter out edges representing abnormal transaction relationships; wherein, the abnormal edge inhibition processing comprises training an edge discriminator and generating a structure mask using the edge discriminator; wherein, the step of training the edge discriminator comprises training the edge discriminator based on a geodesic contrast loss function to make the edge discriminator predict the connection probability between nodes; wherein, the step of generating a structure mask using the edge discriminator comprises predicting the connection probability of each edge using the trained edge discriminator; a sliding average strategy is used to calculate a threshold value, which is the average of the predicted probabilities of all edges in the previous training period; a structure mask is generated according to the threshold value, and edges below the threshold value are filtered out. The learning module is configured to calculate a contrast relationship between a target node and a corresponding subgraph of the target node after the abnormal edge suppression in Euclidean space and hyperbolic space, respectively, to extract local similarity and hierarchical relationship of the target node in transaction behavior; wherein the step of calculating the contrast relationship between the target node and the corresponding subgraph of the target node after the abnormal edge suppression in Euclidean space and hyperbolic space, respectively, further comprises: performing contrast learning in Euclidean space to output a Euclidean space contrast learning result; performing contrast learning in hyperbolic space, and realizing feature conversion between hyperbolic space and tangent space through exponential mapping and logarithmic mapping to capture hierarchical relationship between nodes, to output a hyperbolic space contrast learning result; the abnormality calculation module is configured to calculate an abnormal score of each target node in the import and export behavior attribute graph based on the contrast relationship; comprising: calculating the abnormal score of each target node in the import and export behavior attribute graph based on the Euclidean space contrast learning result, the hyperbolic space contrast learning result, and the geodesic contrast loss value generated by the edge discriminator; wherein the abnormal score comprises at least one of a first similarity difference value, a second similarity difference value and the geodesic contrast loss value; wherein the first similarity difference value is obtained based on Euclidean space similarity score of positive and negative sample pairs of the target node; the second similarity difference value is obtained based on hyperbolic space similarity score of positive and negative sample pairs of the target node; and the output module is configured to output an abnormal node according to the abnormal score.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the computer program to realize the steps of the method of any one of claims 1 to 5.

8. A computer program product, characterised in that, The computer program product comprises a computer program, and the computer program is executed by the processor to realize the steps of the method of any one of claims 1 to 5.

Images