Operation anomaly detection method and device, equipment and storage medium

Abstract

The invention discloses an operation anomaly detection method and device, equipment and a storage medium. The method comprises the steps of obtaining interactive operation data corresponding to a plurality of accounts; inputting the interactive operation data into a first anomaly detection model obtained by pre-training for local anomaly detection, determining an operation anomaly score corresponding to each piece of operation link data, and determining the operation link data with the anomaly score greater than a preset score threshold as abnormal link data; inputting the abnormal link data and the corresponding abnormal score into a pre-trained second abnormal detection model for global abnormal detection, and determining an operation abnormal probability corresponding to the abnormal link data; and determining an anomaly detection result corresponding to the abnormal operation link based on the operation anomaly score and the operation anomaly probability. According to the method and the device, the operation abnormity can be automatically detected, the detection precision and efficiency of the abnormal operation can be improved, and the safety of user operation is ensured.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, device, and storage medium for detecting operational anomalies. Background Technology

[0002] With the advancement of computer technology, network intrusions have become more diversified, and the requirements for account operation security are becoming increasingly stringent. Therefore, detecting abnormal account operations has become a crucial step in ensuring account security.

[0003] Currently, traditional methods for detecting operational anomalies often involve analyzing historical data to build statistical models, and then using these models to detect anomalies. However, traditional methods have low accuracy and efficiency in detecting abnormal operations, cannot adapt to complex network environments, and therefore cannot guarantee user security, resulting in a poor user experience. Summary of the Invention

[0004] This invention provides a method, apparatus, device, and medium for detecting operational anomalies, enabling automatic detection of operational anomalies. This improves the accuracy and efficiency of detecting abnormal operations, adapts to complex network environments, and thus ensures the security of user operations and enhances user experience.

[0005] According to one aspect of the present invention, an operational anomaly detection method is provided, the method comprising:

[0006] Acquire interactive operation data corresponding to multiple accounts, wherein the interactive operation data includes multiple operation link data, and the operation link data includes multiple node data and interaction data between each node;

[0007] The interactive operation data is input into a pre-trained first anomaly detection model to perform local anomaly detection, determine the operation anomaly score corresponding to each operation link data, and determine the operation link data whose anomaly score is greater than a preset score threshold as an abnormal link data.

[0008] The abnormal link data and the corresponding operation abnormality score are input into a pre-trained second anomaly detection model for global anomaly detection to determine the operation abnormality probability corresponding to the abnormal link data. The second anomaly detection model includes a risk subgraph construction unit and a graph attention unit.

[0009] Based on the operation anomaly score and the operation anomaly probability, the anomaly detection result corresponding to the abnormal operation link is determined.

[0010] According to another aspect of the present invention, an operational anomaly detection device is provided, the device comprising:

[0011] The data acquisition module is used to acquire interactive operation data corresponding to multiple accounts. The interactive operation data includes multiple operation link data, and the operation link data includes multiple node data and interactive data between each node.

[0012] An anomaly score determination module is used to input the interactive operation data into a pre-trained first anomaly detection model to perform local anomaly detection, determine the operation anomaly score corresponding to each operation link data, and determine the operation link data whose anomaly score is greater than a preset score threshold as an anomaly link data.

[0013] An anomaly probability determination module is used to input the abnormal link data and the corresponding operation anomaly score into a pre-trained second anomaly detection model for global anomaly detection and to determine the operation anomaly probability corresponding to the abnormal link data. The second anomaly detection model includes a risk subgraph construction unit and a graph attention unit.

[0014] The detection result determination module is used to determine the anomaly detection result corresponding to the abnormal operation link based on the operation anomaly score and the operation anomaly probability.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] At least one processor; and

[0017] A memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the operation anomaly detection method according to any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the operation anomaly detection method according to any embodiment of the present invention.

[0020] The technical solution of this invention acquires interactive operation data corresponding to multiple accounts. This interactive operation data includes multiple operation link data, which in turn includes multiple node data and interaction data between nodes. This ensures comprehensive data acquisition, avoids isolated analysis of individual operations, and provides a data foundation for subsequent processing. The interactive operation data is input into a pre-trained first anomaly detection model for local anomaly detection, determining the anomaly score for each operation link data. Operation link data with anomaly scores greater than a preset threshold are identified as anomalous link data, thus quickly filtering out obviously anomalous operation data and reducing subsequent computation. The anomalous link data and their corresponding anomaly scores are input into a pre-trained second anomaly detection model for global anomaly detection, determining the anomaly probability corresponding to each anomalous link data. The second anomaly detection model includes a risk subgraph construction unit and a graph attention unit, enabling further global anomaly detection of individual operation links based on the complex relationships between them, improving detection accuracy. Based on the operation anomaly scores and the operation anomaly probabilities, the anomaly detection result corresponding to the anomalous operation link is determined, improving the ability to detect anomalous operations. This invention achieves local and global anomaly detection of operation link data through a first anomaly detection model and a second anomaly detection model. By fusing local and global anomalies, it significantly improves the accuracy and efficiency of operation anomaly detection, can adapt to complex network environments, and thus ensures the security of user operations.

[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart of an operational anomaly detection method provided in Embodiment 1 of the present invention;

[0024] Figure 2 This is a flowchart of an operation anomaly detection method provided according to Embodiment 2 of the present invention;

[0025] Figure 3 This is a schematic diagram of an operational anomaly detection device according to Embodiment 3 of the present invention;

[0026] Figure 4 This is a schematic diagram of the structure of an electronic device that implements the operation anomaly detection method of the present invention. Detailed Implementation

[0027] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first," "second," "target," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0029] Example 1

[0030] Figure 1 This is a flowchart illustrating an operation anomaly detection method according to Embodiment 1 of the present invention. This embodiment is applicable to detecting operation anomalies in user accounts. The method can be executed by an operation anomaly detection device, which can be implemented in hardware and / or software. This operation anomaly detection device can be configured in an electronic device. Figure 1 As shown, the method includes:

[0031] S110. Obtain interactive operation data corresponding to multiple accounts, wherein the interactive operation data includes multiple operation link data, and the operation link data includes multiple node data and the interaction data between each node.

[0032] Interactive operation data can refer to raw operation logs collected from the business system, used to record the complete interaction trajectory of an account within the system. Operation chain data can refer to the complete operation data of a single account or entity completing a specific objective within the system. Node data can refer to the association information of each node in the operation chain. For example, node data can be information such as node name and associated device. Interaction data can refer to the relationships and operation data between nodes in the operation chain.

[0033] Specifically, raw operation logs from multiple accounts can be collected from the business system. Based on the complete trajectory of each operation link (such as user → transaction → merchant), multiple node data corresponding to each operation link and the interaction data between each node can be obtained, that is, the interaction operation data corresponding to multiple accounts. This covers the operation behavior of multiple accounts and multiple scenarios, avoids the limitations of single account detection, and can provide a rich data foundation for subsequent models, making it easier to improve the anomaly identification capability.

[0034] It should be noted that operational data can be categorized into numerical features and categorical features based on feature type. Numerical features refer to quantifiable, comparable continuous or discrete values, typically used to describe measurement or count information in the operational chain. Categorical features refer to non-numerical information representing categories or labels, typically used to describe qualitative attributes in the operational chain. Taking bank account transaction data as an example, numerical features could include transaction amount, time interval, geolocation code, etc. Categorical features could include Merchant Category Code (MCC), transaction device fingerprint, etc.

[0035] S120. Input the interactive operation data into the pre-trained first anomaly detection model to perform local anomaly detection, determine the operation anomaly score corresponding to each operation link data, and determine the operation link data with an anomaly score greater than the preset score threshold as anomaly link data.

[0036] Here, the first anomaly detection model can refer to an unsupervised model used for local anomaly detection. The operation anomaly score can refer to a specific numerical value used to quantitatively evaluate the degree of anomaly in a single operation link. The preset score threshold can refer to a pre-set score threshold used to distinguish between normal and abnormal operations. Abnormal link data can refer to operation link data whose operation anomaly score exceeds the preset score threshold.

[0037] Specifically, the interaction data corresponding to multiple accounts can be input into the pre-trained first anomaly detection model to perform local anomaly detection on each operation link data, determine the operation anomaly score corresponding to each operation link data, and compare the operation anomaly score of each operation link data output by the model with a preset score threshold. Operation link data with anomaly scores greater than the preset score threshold are identified as abnormal link data, thereby quickly filtering out abnormal links and reducing the amount of subsequent calculations.

[0038] For example, the first anomaly detection model is built based on an isolated forest. S120 may include: for each operation link data, determining the average path length of the operation link data in different isolated trees, and determining the operation anomaly score corresponding to the operation link data according to a preset correction coefficient and the average path length.

[0039] The average path length can refer to the average path length of the operational link data across different isolated trees in the first anomaly detection model.

[0040] Specifically, for each operation link data, it is input into all isolated trees in the first anomaly detection model, and its path length (i.e., the number of edges traversed from the root node to the leaf node) in each tree is recorded. The average path length of a single operation link data in all isolated trees is taken as the average path length of the operation link data. Based on the preset correction coefficient and the average path length, the operation anomaly score corresponding to the operation link data is calculated, thereby enabling efficient and stable identification of local anomalies in interactive operation data.

[0041] For example, the formula for calculating the anomaly score can be as follows:

[0042]

[0043] Where c(n) is the normalization factor (preset correction coefficient), used to adjust the baseline value of path length h(x) under different data scales to ensure that the outlier score S(x) is stable in the range of [0,1], and E(h(x)) is the average path length. For example: if E(h(x)) = 3 and c(n) = 10, then S(x) = 2. -0.3 ≈0.81 (high risk); For example: if E(h(x))=12, c(n)=10, then S(x)=2 -1.2 ≈0.43 (low risk).

[0044] S130. Input the abnormal link data and the corresponding operation abnormality score into the pre-trained second anomaly detection model for global anomaly detection, and determine the operation abnormality probability corresponding to the abnormal link data. The second anomaly detection model includes a risk subgraph construction unit and a graph attention unit.

[0045] Here, the second anomaly detection model can refer to a neural network model used for global anomaly detection. The operational anomaly probability can refer to the quantitative assessment of the degree of anomaly in the abnormal link data by the second anomaly detection model.

[0046] Specifically, abnormal link data and corresponding operation abnormality scores for multiple accounts can be input into a pre-trained first anomaly detection model. The first anomaly detection model analyzes the dependencies between nodes through risk subgraph construction units and graph attention units, thereby obtaining the implicit associations between accounts, realizing global anomaly detection for each abnormal link data, and outputting the operation abnormality probability corresponding to each abnormal link data, which can improve the anomaly detection accuracy.

[0047] S140. Based on the operation anomaly score and operation anomaly probability, determine the anomaly detection result corresponding to the abnormal operation link.

[0048] Among them, the anomaly detection result can refer to the final output detection conclusion, which includes the abnormal link identifier and the degree of anomaly.

[0049] Specifically, the local anomaly score and the global anomaly probability can be weighted and summed, and the weighted summation result can be output as the anomaly detection result corresponding to the anomaly operation link, thereby improving the calibration accuracy and reducing the error.

[0050] For example, S140 may include: in response to an operation anomaly score being less than or equal to a first score threshold, determining a weight coefficient corresponding to the operation anomaly score as a first weight coefficient, and performing weighted fusion of the operation anomaly score and the operation anomaly probability based on the first weight coefficient to determine an anomaly detection result; in response to an operation anomaly score being greater than the first score threshold, determining a weight coefficient corresponding to the operation anomaly score as a second weight coefficient, and performing weighted fusion of the operation anomaly score and the operation anomaly probability based on the second weight coefficient to determine an anomaly detection result.

[0051] The first weight coefficient can be a pre-set weight used to reduce the score of operational anomalies, thereby increasing the probability of operational anomalies and reducing misjudgments caused by model noise. The second weight coefficient can be a pre-set weight used to increase the score of operational anomalies, thereby reducing the probability of operational anomalies and strengthening the determinism of the model.

[0052] Specifically, when the anomaly score is less than or equal to the first score threshold, the uncertainty of the operation link is considered high (it may be on a fuzzy boundary between normal and abnormal). In this case, to reduce the risk of misjudgment, a higher weight (e.g., α) can be assigned to the operation anomaly probability, while the weight of the operation anomaly score is a lower first weight coefficient (e.g., 1-α). The operation anomaly score and operation anomaly probability are then weighted and fused according to the first weight coefficient to determine the anomaly detection result. When the operation anomaly score is greater than the first score threshold, the anomaly of the operation link is considered relatively clear. In this case, to enhance the model's determinism, a higher second weight coefficient (e.g., β) is assigned to the operation anomaly score, while the weight of the operation anomaly probability is lower (e.g., 1-β). The operation anomaly score and operation anomaly probability are then weighted and fused according to the first weight coefficient to determine the anomaly detection result. Through dynamic weight allocation, the bias of a single model can be reduced, and the accuracy of anomaly detection can be improved.

[0053] For example, an operation anomaly score of 0.3 (≤ threshold 0.4) and an operation anomaly probability of 0.7 are considered. The system assigns an operation anomaly probability weight of 0.7 and an operation anomaly score weight of 0.3, resulting in a fusion of 0.3*0.3 + 0.7*0.7 = 0.58, which is considered an anomaly (avoiding missed detections due to model noise). An operation anomaly score of 0.9 (> threshold 0.4) and an operation anomaly probability of 0.6 are considered. The system assigns an operation anomaly score weight of 0.8 and an operation anomaly probability weight of 0.2, resulting in a fusion of 0.9*0.8 + 0.6*0.2 = 0.84, which is also considered an anomaly (strengthening model determinism). It should be noted that if the anomaly probability corresponds to a gang fraud pattern (one of the anomaly patterns), the system can assign a third weight coefficient to the operation anomaly score, such as assigning an operation anomaly probability weight of 0.1 and an operation anomaly score weight of 0.9.

[0054] In this embodiment, interactive operation data corresponding to multiple accounts is acquired. This interactive operation data includes multiple operation link data, which in turn includes multiple node data and interaction data between each node. This ensures comprehensive data acquisition, avoids isolated analysis of individual operations, and provides a data foundation for subsequent processing. The interactive operation data is input into a pre-trained first anomaly detection model for local anomaly detection, determining the operation anomaly score corresponding to each operation link data. Operation link data with anomaly scores greater than a preset score threshold are identified as abnormal link data, thereby quickly filtering out obviously abnormal operation data and reducing subsequent computation. The abnormal link data and their corresponding anomaly scores are input into a pre-trained second anomaly detection model for global anomaly detection, determining the operation anomaly probability corresponding to the abnormal link data. The second anomaly detection model includes a risk subgraph construction unit and a graph attention unit, which can further perform global anomaly detection on individual operation links based on the complex relationships between operation links, improving detection accuracy. Based on the operation anomaly score and operation anomaly probability, the anomaly detection result corresponding to the abnormal operation link is determined, improving the detection capability for abnormal operations. This invention achieves local and global anomaly detection of operation link data through a first anomaly detection model and a second anomaly detection model. By fusing local and global anomalies, it significantly improves the accuracy and efficiency of operation anomaly detection, can adapt to complex network environments, and thus ensures the security of user operations.

[0055] Example 2

[0056] Figure 2 This is a flowchart of an operation anomaly detection method provided in Embodiment 2 of the present invention. Based on the above embodiments, this embodiment optimizes the step of "inputting the abnormal link data and the corresponding anomaly score into a pre-trained second anomaly detection model for global anomaly detection, and determining the operation anomaly probability corresponding to the abnormal link data". Explanations of terms that are the same as or corresponding to those in the above embodiments are not repeated here.

[0057] See Figure 2 Another operational anomaly detection method provided in this embodiment specifically includes the following steps:

[0058] S210. Obtain interactive operation data corresponding to multiple accounts, wherein the interactive operation data includes multiple operation link data, and the operation link data includes multiple node data and the interaction data between each node.

[0059] S220. Input the interactive operation data into the pre-trained first anomaly detection model to perform local anomaly detection, determine the operation anomaly score corresponding to each operation link data, and determine the operation link data with an anomaly score greater than the preset score threshold as anomaly link data.

[0060] S230. Input the abnormal link data and the corresponding operation abnormality score into the risk subgraph construction unit to construct the image and generate at least one high-risk subgraph.

[0061] Among them, a high-risk subgraph can refer to a subgraph structure generated by a risk subgraph construction unit that contains densely associated abnormal links.

[0062] Specifically, the input data includes abnormal link data and their corresponding local anomaly scores. Operation nodes are treated as nodes in a graph, and anomaly scores, node data, and interaction data between nodes are treated as additional attributes of the graph nodes. Edges are constructed based on the relationships between nodes, generating at least one high-risk subgraph. Through the high-risk subgraph, isolated abnormal links can be associated with a broader anomaly environment, avoiding missed detections.

[0063] For example, the "risk subgraph construction unit" in S230 is specifically used to: aggregate the abnormal link data with the same node in multiple abnormal link data and the corresponding abnormal scores according to the node data corresponding to the abnormal link data, and generate at least one high-risk subgraph.

[0064] Specifically, node data, such as user nodes, transaction nodes, and merchant nodes, is extracted from abnormal link data. These nodes represent core entities or attributes in the operation link. Based on multiple node data and the interaction data between each node, the node type, characteristics, edge type, and weight corresponding to the abnormal operation link are determined. Abnormal link data with the same node and corresponding abnormal scores from multiple abnormal link data are aggregated. Data sharing the same node and corresponding abnormal scores from multiple abnormal links are aggregated into the same subgraph, forming a local network centered on that node. This network contains a graph structure with various types of nodes and edges (such as user, transaction, and merchant nodes, and user-transaction and transaction-merchant edges), generating at least one high-risk subgraph. This enables efficient and accurate identification of high-risk nodes and their association patterns in complex operation links, providing a basis for anomaly detection.

[0065] For example, taking a bank account as an example, the above node types and characteristics can be shown in Table 1 below:

[0066] Table 1 Node Types and Characteristics

[0067]

[0068] The edge types and characteristics mentioned above are shown in Table 2 below:

[0069] Table 2 Node Types and Characteristics

[0070]

[0071] Where S(x) is the operation anomaly score.

[0072] S240. Input the high-risk subgraph into the graph attention unit for global anomaly detection and determine the probability of operation anomaly corresponding to the abnormal link data.

[0073] Specifically, the graph attention unit adopts a graph attention network, which includes a multi-layer graph attention mechanism. Each layer aggregates the features of neighboring nodes through learnable weights. The high-risk subgraph is input into the graph attention unit for global anomaly detection. The attention score between each node and its neighboring nodes is calculated. The anomaly scores under the same abnormal operation link are weighted and fused to obtain the operation anomaly probability corresponding to the abnormal operation link, thereby improving the detection accuracy.

[0074] For example, the graph attention unit includes a multi-head attention subunit and an anomaly probability determination subunit. S240 may include: inputting the high-risk subgraph into the multi-head attention subunit for attention calculation, determining the attention scores between adjacent nodes in the abnormal operation link corresponding to the high-risk subgraph; inputting the attention scores between adjacent nodes in the abnormal operation link into the anomaly probability determination subunit for weighted fusion and normalization processing, generating the operation anomaly probability corresponding to the abnormal operation link.

[0075] The attention score can refer to the score used to quantify the strength of the association between nodes in a graph attention network, which can reflect the importance of a node to its neighboring nodes in a specific task.

[0076] Specifically, the high-risk subgraph can be input into the multi-head attention subunit to calculate the attention scores between adjacent nodes in the abnormal operation link corresponding to the high-risk subgraph, obtaining the attention score between every two adjacent nodes in the abnormal operation link. The attention scores between all adjacent nodes in the abnormal operation link are then input into the anomaly probability determination subunit for weighted fusion and normalization to generate the operation anomaly probability corresponding to the abnormal operation link, which directly reflects the anomaly probability of the entire operation link. It should be noted that the association paths of abnormal nodes can also be analyzed based on the high-risk subgraph to quickly locate the source of risk and determine the anomaly pattern corresponding to the abnormal operation link.

[0077] For example, the multi-head attention subunit is specifically used to perform the following operations: based on the high-risk subgraph, determine the node features and edge features corresponding to the abnormal operation link; based on the node features, edge features, and the multi-head attention mechanism, perform multi-head attention calculation on adjacent nodes belonging to the same edge to determine multiple original attention scores for adjacent nodes; perform normalization and weighted average fusion processing on the multiple original attention scores to determine the target attention score corresponding to the adjacent node; perform weighted fusion and normalization processing on the target attention scores of adjacent nodes corresponding to all edges of the abnormal operation link to generate the operation abnormality probability corresponding to the abnormal operation link.

[0078] Specifically, based on the node and edge features corresponding to the anomalous operation links in the high-risk subgraph, for each node in the high-risk subgraph, the node features are mapped to multiple independent attention head spaces through a linear transformation. For each edge (node ​​i and its neighboring node j), an original attention score is calculated, and the attention coefficients are normalized using the Softmax function. The weighted average of the normalized original attention scores from multiple attention heads is then used to generate the final target attention score for the neighboring nodes. The target attention scores of the neighboring nodes corresponding to all edges of the anomalous operation link are then weighted and fused, and the weighted fusion result is normalized to generate the anomalous operation probability corresponding to that anomalous operation link. By aggregating node-level anomalous scores, a link-level probability output is generated, which can directly reflect the anomalous probability of the entire operation link, improving detection accuracy.

[0079] For example, the formula for calculating the original attention score is as follows:

[0080]

[0081] Among them, e ij W represents the raw attention score between node i and its neighboring node j. q W k Let h be the learnable parameter matrix, and h be the feature dimension; i h is the feature vector composed of the node features corresponding to node i; j s(x) is the feature vector composed of the node features corresponding to node j; λ is the preset bias coefficient; j ) represents the operational anomaly score of the abnormal link where node i and its neighboring node j are located.

[0082] The formula for normalizing the above raw attention scores is shown below:

[0083]

[0084] Where, α ij This is the result after normalizing the original attention scores between node i and its neighboring node j.

[0085] The formula for weighted averaging the original attention scores of multiple attention heads after normalization is shown below:

[0086]

[0087] Among them, h ' i Let k be the target attention score, k be the number of attention heads, σ be the activation function, and α be the value of the attention score. ij The normalized original attention score. The transformation matrix for the value of the k-th head (learnable parameter matrix).

[0088] The formula for weighted fusion and normalization of the target attention scores is shown below:

[0089] P GAT =sigmoid(∑W c h ' i +b)

[0090] Where Wc is the classifier weight matrix and b is the bias term, used to adjust the model's output baseline.

[0091] S250. Based on the operation anomaly score and operation anomaly probability, determine the anomaly detection result corresponding to the abnormal operation link.

[0092] The technical solution of this embodiment constructs an image by inputting abnormal link data and corresponding abnormal scores into a risk subgraph construction unit, generating at least one high-risk subgraph. This associates isolated abnormal links with a wider range of abnormal patterns, avoiding missed detections and reducing computational load. The high-risk subgraph is then input into a graph attention unit for global anomaly detection, determining the probability of operational anomalies corresponding to the abnormal link data and improving detection accuracy. This invention, through high-risk subgraphs, can associate isolated abnormal links with a wider range of attack patterns, avoiding missed detections while reducing computational load. It also automatically focuses on key nodes and edges in the high-risk subgraph based on an attention mechanism, improving detection accuracy.

[0093] Example 3

[0094] Figure 3 This is a schematic diagram of an operational anomaly detection device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a data acquisition module 310, an anomaly score determination module 320, an anomaly probability determination module 330, and a detection result determination module 340;

[0095] The data acquisition module 310 is used to acquire interactive operation data corresponding to multiple accounts. The interactive operation data includes multiple operation link data, which includes multiple node data and interactive data between each node.

[0096] Anomaly score determination module 320 is used to input the interactive operation data into a pre-trained first anomaly detection model to perform local anomaly detection, determine the operation anomaly score corresponding to each operation link data, and determine the operation link data whose anomaly score is greater than a preset score threshold as an anomaly link data.

[0097] Anomaly probability determination module 330 is used to input the abnormal link data and the corresponding operation anomaly score into a pre-trained second anomaly detection model for global anomaly detection and to determine the operation anomaly probability corresponding to the abnormal link data. The second anomaly detection model includes a risk subgraph construction unit and a graph attention unit.

[0098] The detection result determination module 340 is used to determine the anomaly detection result corresponding to the abnormal operation link based on the operation anomaly score and the operation anomaly probability.

[0099] In this embodiment, interactive operation data corresponding to multiple accounts is acquired. This interactive operation data includes multiple operation link data, which in turn includes multiple node data and interaction data between nodes. This ensures comprehensive data acquisition, avoids isolated analysis of individual operations, and provides a data foundation for subsequent processing. The interactive operation data is input into a pre-trained first anomaly detection model for local anomaly detection, determining the operation anomaly score corresponding to each operation link data. Operation link data with anomaly scores greater than a preset score threshold are identified as anomaly link data, thereby quickly filtering out obviously abnormal operation data and reducing subsequent computation. The abnormal link data and their corresponding anomaly scores are input into a pre-trained second anomaly detection model for global anomaly detection, determining the operation anomaly probability corresponding to the abnormal link data. The second anomaly detection model includes a risk subgraph construction unit and a graph attention unit, enabling further global anomaly detection of individual operation links based on the complex relationships between operation links, improving detection accuracy. Based on the operation anomaly scores and operation anomaly probabilities, the anomaly detection result corresponding to the abnormal operation link is determined, improving the ability to detect abnormal operations. This invention achieves local and global anomaly detection of operation link data through a first anomaly detection model and a second anomaly detection model. By fusing local and global anomalies, it significantly improves the accuracy and efficiency of operation anomaly detection, can adapt to complex network environments, and thus ensures the security of user operations.

[0100] Optionally, the anomaly score determination module 320 is specifically used to: for each operation link data, determine the average path length of the operation link data in different isolated trees, and determine the operation anomaly score corresponding to the operation link data according to a preset correction coefficient and the average path length.

[0101] Optionally, the anomaly probability determination module 330 includes:

[0102] The subgraph generation unit is used to input the abnormal link data and the corresponding operation abnormality score into the risk subgraph construction unit to construct an image and generate at least one high-risk subgraph.

[0103] The probability determination unit is used to input the high-risk subgraph into the graph attention unit for global anomaly detection and determine the operation anomaly probability corresponding to the abnormal link data.

[0104] Optionally, the risk subgraph construction unit is specifically used to: aggregate abnormal link data with the same node and the corresponding abnormal score in multiple abnormal link data according to the node data corresponding to the abnormal link data, and generate at least one high-risk subgraph.

[0105] Optionally, the graph attention unit includes: a multi-head attention subunit and an anomaly probability determination subunit, wherein the probability determination subunit includes:

[0106] The score determination subunit is used to input the high-risk subgraph into the multi-head attention subunit for attention calculation, and to determine the attention score between adjacent nodes in the abnormal operation link corresponding to the high-risk subgraph.

[0107] The probability determination subunit is used to input the attention scores between adjacent nodes in the abnormal operation link into the abnormal probability determination subunit for weighted fusion and normalization processing to generate the operation abnormality probability corresponding to the abnormal operation link.

[0108] Optionally, the multi-head attention subunit is specifically used to perform the following operations: determining the node features and edge features corresponding to the abnormal operation link based on the high-risk subgraph; performing multi-head attention calculation on adjacent nodes belonging to the same side based on the node features, the edge features, and the multi-head attention mechanism to determine multiple original attention scores for the adjacent nodes; performing normalization and weighted average fusion processing on the multiple original attention scores to determine the target attention score corresponding to the adjacent nodes; and performing weighted fusion and normalization processing on the target attention scores of adjacent nodes corresponding to all edges of the abnormal operation link to generate the operation anomaly probability corresponding to the abnormal operation link.

[0109] Optionally, the detection result determination module 340 is specifically configured to: in response to the operation anomaly score being less than or equal to a first score threshold, determine the weight coefficient corresponding to the operation anomaly score as a first weight coefficient, and perform weighted fusion of the operation anomaly score and the operation anomaly probability according to the first weight coefficient to determine an anomaly detection result; in response to the operation anomaly score being greater than the first score threshold, determine the weight coefficient corresponding to the operation anomaly score as a second weight coefficient, and perform weighted fusion of the operation anomaly score and the operation anomaly probability according to the second weight coefficient to determine an anomaly detection result.

[0110] The above-described device can execute the operation anomaly detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing the operation anomaly detection method.

[0111] Example 4

[0112] Figure 4 This is a schematic diagram of the structure of an electronic device implementing the operational anomaly detection method of this invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0113] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0114] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0115] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as operational anomaly detection methods.

[0116] In some embodiments, the operation anomaly detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the operation anomaly detection method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the operation anomaly detection method by any other suitable means (e.g., by means of firmware).

[0117] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication unit 19, or installed from storage unit 18, or installed from ROM 12. When the computer program is executed by processor 11, it performs the functions defined in the methods of the embodiments of the present invention.

[0118] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0119] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0120] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0121] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0122] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0123] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0124] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0125] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for detecting operational anomalies, characterized in that, include: Acquire interactive operation data corresponding to multiple accounts, wherein the interactive operation data includes multiple operation link data, and the operation link data includes multiple node data and interaction data between each node; The interactive operation data is input into a pre-trained first anomaly detection model to perform local anomaly detection, determine the operation anomaly score corresponding to each operation link data, and determine the operation link data whose anomaly score is greater than a preset score threshold as an abnormal link data. The abnormal link data and the corresponding operation abnormality score are input into a pre-trained second anomaly detection model for global anomaly detection to determine the operation abnormality probability corresponding to the abnormal link data. The second anomaly detection model includes a risk subgraph construction unit and a graph attention unit. Based on the operation anomaly score and the operation anomaly probability, the anomaly detection result corresponding to the abnormal operation link is determined.

2. The method according to claim 1, characterized in that, The first anomaly detection model is built based on an isolated forest. The step of inputting the interaction data into the pre-trained first anomaly detection model for local anomaly detection, and determining the operation anomaly score corresponding to each operation link data, includes: For each operation link data, the average path length of the operation link data in different isolated trees is determined, and the operation anomaly score corresponding to the operation link data is determined according to the preset correction coefficient and the average path length.

3. The method according to claim 1, characterized in that, The step of inputting the abnormal link data and the corresponding operation anomaly score into a pre-trained second anomaly detection model for global anomaly detection, and determining the operation anomaly probability corresponding to the abnormal link data, includes: The abnormal link data and the corresponding operation abnormality score are input into the risk subgraph construction unit to construct an image and generate at least one high-risk subgraph. The high-risk subgraph is input into the graph attention unit for global anomaly detection to determine the probability of operational anomalies corresponding to the abnormal link data.

4. The method according to claim 3, characterized in that, The risk subgraph construction unit is specifically used to: aggregate abnormal link data with the same node and the corresponding abnormal score in multiple abnormal link data according to the node data corresponding to the abnormal link data, and generate at least one high-risk subgraph.

5. The method according to claim 3, characterized in that, The graph attention unit includes a multi-head attention subunit and an anomaly probability determination subunit. The step of inputting the high-risk subgraph into the graph attention unit for global anomaly detection and determining the operation anomaly probability corresponding to the anomaly link data includes: The high-risk subgraph is input into the multi-head attention subunit for attention calculation to determine the attention score between adjacent nodes in the abnormal operation link corresponding to the high-risk subgraph. The attention scores between adjacent nodes in the abnormal operation link are input into the abnormal probability determination subunit for weighted fusion and normalization to generate the operation abnormal probability corresponding to the abnormal operation link.

6. The method according to claim 5, characterized in that, The multi-head attention subunit is specifically used to perform the following operations: Based on the high-risk subgraph, determine the node features and edge features corresponding to the abnormal operation link; based on the node features, the edge features, and the multi-head attention mechanism, perform multi-head attention calculation on adjacent nodes belonging to the same side to determine multiple original attention scores of the adjacent nodes; The original attention scores are normalized and weighted average fusion is performed on multiple original attention scores to determine the target attention scores corresponding to the adjacent nodes; The target attention scores of the adjacent nodes corresponding to all edges of the abnormal operation link are weighted, fused, and normalized to generate the operation abnormality probability corresponding to the abnormal operation link.

7. The method according to claim 1, characterized in that, The step of determining the anomaly detection result corresponding to the abnormal operation link based on the operation anomaly score and the operation anomaly probability includes: In response to the operation anomaly score being less than or equal to a first score threshold, the weight coefficient corresponding to the operation anomaly score is determined as a first weight coefficient, and the operation anomaly score and the operation anomaly probability are weighted and fused according to the first weight coefficient to determine the anomaly detection result; In response to the operation anomaly score being greater than a first score threshold, the weight coefficient corresponding to the operation anomaly score is determined as a second weight coefficient, and the operation anomaly score and the operation anomaly probability are weighted and fused according to the second weight coefficient to determine the anomaly detection result.

8. An operational anomaly detection device, characterized in that, include: The data acquisition module is used to acquire interactive operation data corresponding to multiple accounts. The interactive operation data includes multiple operation link data, and the operation link data includes multiple node data and interactive data between each node. An anomaly score determination module is used to input the interactive operation data into a pre-trained first anomaly detection model to perform local anomaly detection, determine the operation anomaly score corresponding to each operation link data, and determine the operation link data whose anomaly score is greater than a preset score threshold as an anomaly link data. An anomaly probability determination module is used to input the abnormal link data and the corresponding operation anomaly score into a pre-trained second anomaly detection model for global anomaly detection and to determine the operation anomaly probability corresponding to the abnormal link data. The second anomaly detection model includes a risk subgraph construction unit and a graph attention unit. The detection result determination module is used to determine the anomaly detection result corresponding to the abnormal operation link based on the operation anomaly score and the operation anomaly probability.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the operation anomaly detection method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the operation anomaly detection method according to any one of claims 1-7.

Images