An abnormal object dynamic behavior pattern recognition method based on a graph neural network, a medium and equipment

Abstract

The application relates to the technical field of abnormal object recognition, in particular to an abnormal object dynamic behavior pattern recognition method based on a graph neural network, a medium and equipment, through a multi-layer iteration and edge weight-based message passing mechanism, feature representation of each node can continuously fuse weighted information of multi-order neighbors, thereby expanding local and direct correlation into global and potential network mode representation, and behavior coordination of directly / indirectly correlated objects can be captured; through similarity calculation and clustering analysis on the Nth layer intermediate feature vector generated by the graph neural network, nodes with similar behavior patterns and similar structure roles in the network can be automatically collected into a clustering cluster, so that not only individual abnormalities can be determined, but also the whole implicit cooperative abnormal gang without strong direct connection but with high behavior coordination can be accurately locked and pattern classified, and the accuracy and comprehensiveness of the recognition result are greatly improved.

Description

Technical Field

[0001] This invention relates to the field of abnormal object recognition technology, and in particular to a method, medium, and device for recognizing dynamic behavior patterns of abnormal objects based on graph neural networks. Background Technology

[0002] With the development of graph neural network technology, graph neural network-based recognition methods are increasingly being used in tasks involving the identification of dynamic behavior patterns of abnormal objects. Existing techniques typically construct a relationship graph based on the interaction relationships between objects, utilize graph neural networks to aggregate neighbor information to learn the representation vectors of nodes, and determine the abnormal state of individual nodes based on the representation vectors using classifiers or anomaly scoring algorithms.

[0003] However, existing methods often use statically preset edge weights or are simply based on a single dimension during the graph construction phase. This fails to accurately reflect the dynamic synchronicity and potential correlation strength between objects, resulting in insufficient representation capabilities of the graph structure itself for complex abnormal behaviors. Secondly, existing methods primarily focus on anomaly identification of individual nodes. The learning objective and final application of their graph neural network models both serve the determination of nodes. While they show good recognition of obvious, explicit collaborative behavior patterns formed by direct, strong associations between abnormal objects, they struggle to capture subtle, implicit collaborative behavior patterns formed by indirect, weak associations between multiple abnormal objects. For example, in the financial or cybersecurity fields, malicious behavior is often carried out by multiple participants through complex collaboration. These participants may not have strong direct connections in the graph structure, but they form a collaborative group by sharing similar behavioral patterns or network structure roles within a larger neighborhood. Existing node-based methods for identifying dynamic behavior patterns of abnormal objects have limited ability to recognize such surface-level, structured abnormal patterns, resulting in low detection rates for large-scale, organized abnormal collaborative groups.

[0004] Therefore, how to solve the problem of insufficient ability of existing technologies to identify implicit collaborative abnormal behaviors has become an urgent issue. Summary of the Invention

[0005] To address the aforementioned technical problems, the present invention provides a method for identifying dynamic behavior patterns of abnormal objects based on graph neural networks. This method includes the following steps:

[0006] S1. Based on the multi-source behavioral data corresponding to each target monitoring object, obtain the interaction relationship between target monitoring objects and the degree of interaction representing behavioral similarity, as well as the initial feature vector representing the behavioral pattern of each target monitoring object, where the interaction relationship is either directly connected or not connected.

[0007] S2, using the target monitoring object as a node, constructing edges based on directly connected interaction relationships, determining edge weights based on the degree of interaction, and using the initial feature vector as node attributes, an initial behavior relationship graph is constructed.

[0008] S3. Based on the k-th layer of the preset graph neural network and the edge weights in the initial behavior relationship graph, update the intermediate feature vector of the (k-1)-th layer corresponding to each node to obtain the intermediate feature vector of the k-th layer corresponding to each node, where k=1, ..., N, N is the total number of layers in the network, and when k=1, the intermediate feature vector of the (k-1)-th layer is the initial feature vector.

[0009] S4. Based on the intermediate feature vector of the Nth layer corresponding to each node, perform graph clustering analysis on all nodes to obtain several collaborative node clusters, where each collaborative node cluster includes several unconnected nodes.

[0010] S5. Based on the intermediate feature vector of the Nth layer corresponding to each node in each collaborative node cluster, obtain the identification type corresponding to each target monitoring object, where the identification type is an object with abnormal behavior pattern or an object with non-abnormal behavior pattern.

[0011] The present invention also provides a non-transitory computer-readable storage medium storing at least one instruction or at least one program, wherein the at least one instruction or at least one program is loaded and executed by a processor to implement the above-described method for identifying dynamic behavior patterns of abnormal objects based on graph neural networks.

[0012] The present invention also provides an electronic device, including a processor and the aforementioned non-transitory computer-readable storage medium.

[0013] This invention has at least the following beneficial effects: Through a multi-layered iterative, edge-weight-based message passing mechanism, the feature representation of each node can continuously integrate the weighted information of its multi-level neighbors, thereby expanding local, direct associations into global, potential network pattern representations. This enhances the deep features of nodes, thereby capturing the behavioral coordination of directly / indirectly related objects and breaking through the limitations of relying solely on individual features or direct neighbors. By performing similarity calculation and cluster analysis on the intermediate feature vectors generated by the Nth layer of the graph neural network, nodes with similar behavioral patterns and structural roles in the network can be automatically grouped into clusters. This not only enables the identification of individual anomalies but also achieves accurate locking and pattern classification of the entire implicit, highly coordinated, and anomalous group without strong direct connections, greatly improving the accuracy and comprehensiveness of the identification results. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 This is a flowchart of a method for recognizing dynamic behavior patterns of abnormal objects based on graph neural networks, provided in Embodiment 1 of the present invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It is understood that, where appropriate, the terms used to distinguish similar objects can be interchanged so that the invention can also be implemented in other embodiments besides the illustrated or described embodiments. Furthermore, the terms "including," "having," and any variations are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products, or devices.

[0018] Example 1

[0019] This embodiment provides a method for identifying dynamic behavior patterns of abnormal objects based on graph neural networks, such as... Figure 1 As shown, the abnormal object dynamic behavior pattern recognition method based on graph neural network includes the following steps:

[0020] S1. Based on the multi-source behavioral data corresponding to each target monitoring object, obtain the interaction relationship between target monitoring objects and the degree of interaction representing behavioral similarity, as well as the initial feature vector representing the behavioral pattern of each target monitoring object, where the interaction relationship is either directly connected or not connected.

[0021] The target monitoring object is the entity whose abnormal behavior pattern needs to be identified, such as accounts in the financial field, or devices or users in the cybersecurity field. Multi-source behavioral data is data obtained from different channels that describes different aspects of the target monitoring object, including social interaction records reflecting relationship networks, transaction links reflecting transaction behavior, behavioral logs reflecting the object's habits, and travel trajectory data reflecting spatiotemporal behavior. Together, they constitute a holistic profile of the object, ensuring the comprehensiveness of the features.

[0022] The initial feature vector is a fixed-length numerical vector representing the behavioral pattern of the target monitoring object after feature extraction and encoding of multi-source behavioral data.

[0023] Interaction relationships are business-meaning connections between nodes, categorized into direct connections (explicit interaction, such as account A transferring funds to account B in a financial scenario) and non-connections (no direct interaction, but potentially indirect connections, such as both A and B transferring funds to account C). For example, in an anti-fraud scenario, a direct connection exists if two monitored targets have a transaction involving goods; similarly, two monitored targets sharing the same emergency contact person also constitute a direct connection.

[0024] Interaction level is an indicator that quantifies the similarity of behavior between target monitoring objects. For example, in financial scenarios, the transaction time, amount, and counterparty overlap between A and B; in network scenarios, the similarity of device access time, IP address, and operation type. The value range is 0-1, and the closer to 1, the higher the similarity. It provides a dynamic calculation basis for the edge weights of the subsequent graph structure, solves the defects of static preset edge weights, and accurately reflects the potential correlation strength.

[0025] The above-mentioned method constructs feature vectors, identifies interaction relationships, and quantifies the degree of interaction from multi-source behavioral data of the target monitoring objects, providing basic data for the subsequent construction of behavioral relationship graphs, including node attributes, edge connections, and edge weights. This method breaks through the limitation of a single data dimension, accurately captures explicit associations and implicit similarities between objects, and lays a data foundation for identifying implicit collaborative anomalies.

[0026] In one specific embodiment, S1 includes the following steps:

[0027] S11, extract features from the multi-source behavioral data of each target monitoring object to obtain the initial feature vector corresponding to each target monitoring object. The types of multi-source behavioral data include social interaction records, transaction links, behavior logs and travel trajectory data.

[0028] S12, based on the multi-source behavioral data of each target monitoring object, identify direct social behavior, direct transaction behavior and trajectory overlap behavior between target monitoring objects, and obtain the interaction relationship between target monitoring objects.

[0029] S13, calculate the first similarity between the initial feature vectors corresponding to each pair of directly connected nodes to obtain the degree of interaction between the target monitoring objects.

[0030] In particular, by analyzing the multi-source behavioral data of the target monitoring objects, the direct and explicit relationships are identified, and the states of direct interaction and non-direct interaction between objects are distinguished, providing a basis for judging the existence of edges in the subsequent graph structure.

[0031] Specifically, direct social behavior refers to explicit social interactions between the target monitoring subjects (e.g., rules such as: A and B are friends, A sends a message to B, or A and B are in the same social group), used to identify direct associations in the social dimension. Direct transaction behavior refers to explicit transaction links between the target monitoring subjects (e.g., rules such as: A transfers money to B, A and B have a record of buying and selling goods, or A and B share a payment account), used to identify direct associations in the transaction dimension. Trajectory overlap behavior refers to significant overlap in the travel trajectories of the target monitoring subjects in time and space (e.g., rules such as: A and B appear at the same location at the same time, or the overlap rate of A and B's frequently visited locations is ≥70%), used to identify direct associations in the physical space dimension.

[0032] Interaction relationship is a binary state that characterizes whether there is a direct connection between the target monitoring objects. "Directly connected" means that there is at least one direct behavior among direct social behavior, direct transaction behavior, and trajectory overlap behavior. "Not connected" means that there is no direct behavior. This lays the foundation for constructing a behavior relationship diagram that conforms to the actual relationship.

[0033] The first similarity is used to measure the similarity of the initial feature vectors between connected nodes, thereby quantifying the edge strength and assisting in the discovery of potential collaborators with synchronized behavioral patterns. Those skilled in the art will recognize that any prior art similarity calculation method falls within the scope of this invention, such as cosine similarity, and will not be elaborated upon here.

[0034] In another embodiment, the first similarity integrates behavioral similarity and attribute similarity. Behavioral similarity measures whether the behavioral patterns of two target monitoring objects are similar, such as whether the two target monitoring objects have high-frequency transactions at similar times or whether their travel trajectories highly overlap. This is obtained by calculating the similarity of the initial feature vectors corresponding to the two target monitoring objects. Attribute similarity measures whether the basic attributes of two target monitoring objects are similar. This can be obtained by acquiring the basic attributes of the target monitoring objects, such as whether their age, occupation, and registered devices are similar. This is obtained by calculating the similarity of these basic attributes. The first similarity is then obtained by weighted averaging of the behavioral similarity and attribute similarity.

[0035] As described above, by extracting initial feature vectors from multi-source behavioral data, the behavioral patterns of the target monitoring object are transformed from heterogeneous data descriptions into unified vector representations. This retains multi-dimensional information such as social interaction, transactions, behavior, and trajectory, while providing standardized input for subsequent quantitative analysis. By identifying overlapping behaviors in direct social interaction, transactions, and trajectories to determine interaction relationships, the edge connections of the graph structure can comprehensively reflect the multi-dimensional direct associations between objects, breaking through the limitation of focusing only on a single interaction type and ensuring the integrity of interaction relationships. By calculating the first similarity of the initial feature vectors to obtain the degree of interaction, the edge weights are upgraded from static presets to dynamic calculations based on behavioral similarity. This accurately reflects the synchronicity and association strength of behaviors between objects, improves the representational ability of the graph structure's edge weights, and provides a high-quality data foundation for subsequent behavioral relationship graph construction with "accurate node attributes, comprehensive edge connections, and dynamic edge weights." This enhances the representational ability of implicit collaborative behaviors from the source and lays a data foundation for identifying indirectly related abnormal groups.

[0036] In one specific embodiment, S11 includes the following steps:

[0037] S111: For any target monitoring object, extract the interaction frequency feature and interaction duration feature from the social interaction records corresponding to the current target monitoring object.

[0038] S112, extract transaction volume features and transaction frequency features from the transaction link corresponding to the current target monitoring object.

[0039] S113, extract operation type features and operation time interval features from the behavior logs corresponding to the current target monitoring object.

[0040] S114 Extract trajectory overlap features and dwell time features from the travel trajectory data corresponding to the current target monitoring object.

[0041] S115, standardize and concatenate all extracted features to obtain the initial feature vector corresponding to the current target monitoring object.

[0042] The interaction frequency feature is obtained by statistically analyzing the average number of social interactions (such as calls and messages) that occur within a specific time period (such as a day or a week). A high interaction frequency may indicate social activity or the existence of a strong relationship circle. The interaction duration feature is obtained by statistically analyzing the average duration of a single social interaction (such as the average number of minutes of a call). A longer duration may indicate a closer social relationship or business dealings.

[0043] Transaction volume characteristics are obtained by statistically analyzing the total or average transaction volume within a specific time period, reflecting the target's transaction scale and level of economic activity. Transaction frequency characteristics are obtained by statistically analyzing the number of transactions within a specific time period, reflecting the frequency of transactions.

[0044] Operation type features represent the distribution of various operations performed by the target (such as login, query, modification, and authorization). They are typically transformed into vectors through embedding or one-hot encoding, reflecting behavioral preferences. Operation time interval features are obtained by statistically analyzing the distribution of time intervals between two consecutive operations (such as average interval and interval variance), reflecting the continuity, urgency, or scripted nature of the operations.

[0045] Trajectory overlap characteristics are obtained by statistically analyzing the similarity between the target's trajectory and that of a specific group (such as colleagues or known at-risk groups) or a specific pattern (such as commuting routes), reflecting the correlation between the target's activity range and a specific area. Dwell time characteristics are obtained by statistically analyzing the average dwell time at a specific geographical location (such as a business district or residential area), reflecting the importance of that location to the target or the nature of the behavior (such as workplace or temporary residence).

[0046] Features with different dimensions and distribution ranges (e.g., transaction volume may be in the millions, while the number of operations may be in the tens) are normalized or standardized to scale to the same numerical range, preventing certain features from dominating model training due to excessively large values. Then, all the standardized feature vectors from different data sources are concatenated into a unified one-dimensional vector, which is the initial feature vector.

[0047] The above-mentioned approach, through targeted feature extraction and fusion of four types of key behavioral data, generates a multi-dimensional comprehensive feature vector for the target monitoring object, which integrates its social activity, fund flow patterns, operational habits and spatiotemporal movement patterns. This provides a high-quality, high-information-density input foundation for subsequent graph neural networks to accurately characterize node attributes and identify abnormal patterns.

[0048] S2, using the target monitoring object as a node, constructing edges based on directly connected interaction relationships, determining edge weights based on the degree of interaction, and using the initial feature vector as node attributes, an initial behavior relationship graph is constructed.

[0049] In this process, each target monitoring object is used as a node, and the initial feature vector of each target monitoring object is used as the node attribute of the corresponding node. An edge is constructed between the nodes corresponding to two target monitoring objects that have a direct connection relationship, and the degree of interaction between them is used as the edge weight of the edge.

[0050] As described above, by systematically integrating nodes, edges, node features, and edge weights, a complete and standardized graph data object is constructed, providing standardized and structured input for the subsequent loading and computation of graph neural network models.

[0051] S3. Based on the k-th layer of the preset graph neural network and the edge weights in the initial behavior relationship graph, update the intermediate feature vector of the (k-1)-th layer corresponding to each node in the initial behavior relationship graph to obtain the intermediate feature vector of the k-th layer corresponding to each node, where k=1, ..., N, N is the total number of network layers, and when k=1, the intermediate feature vector of the (k-1)-th layer is the initial feature vector.

[0052] The pre-designed graph neural network is a multi-layer graph neural network model, such as a weighted graph convolutional network (GCN), a graph attention network (GAT), or a weighted aggregation model defined by the implementer. It includes an input layer, N network layers, batch normalization and dropout layers, and an output layer. The input layer receives structured data from the initial behavioral relationship graph. Specifically, the input can be a node attribute matrix (initial feature vector, shape [r, d0], where r is the number of nodes and d0 is the dimension of the initial feature vector) and a weighted adjacency matrix (shape [r, r], elements being edge weights). Each network layer is based on 3-5 convolutional layers and aggregates neighbor information according to node relationships, achieving deep updates of node features. Specifically, the unit structure includes a weighted aggregation layer: calculating a weighted sum of neighbor features based on edge weights; a feature fusion layer: concatenating its own features with aggregated features; a linear transformation layer: reducing / increasing dimensionality through a learnable weight matrix; and an activation function introducing non-linearity to enhance expressive power. Batch normalization is added after each layer's output to stabilize the training process and accelerate convergence. Dropout is used to randomly deactivate some neurons during training to prevent overfitting. The output layer is used to output the intermediate feature vector of the Nth layer (with shape [n, dN], where dN is the dimension of the final feature vector).

[0053] Each node in the initial behavioral relationship graph learns global graph structure information from local information by exchanging information with its neighboring nodes and updating its own state. This process is iterative. With each iteration (at each layer), the node can obtain information from more distant neighbors (k-order neighbors), thus gradually fusing information from more distant neighbors through multi-layer transmission, capturing long-distance association information. Ultimately, the representation of each node incorporates the topological structure and feature information of its subgraph.

[0054] The above-mentioned multi-layer network structure guides the differentiated aggregation of neighbor node information through edge weights, realizing the layer-by-layer update of node features. This allows each node's features to not only include its own behavioral patterns but also integrate the association information of multi-hop neighbors, thereby capturing the behavioral coordination of directly / indirectly related objects. This breaks through the limitations of relying solely on individual features or direct neighbors, laying a feature foundation for identifying implicit coordination anomalies.

[0055] In one specific embodiment, S3 includes the following steps:

[0056] S31. Determine the total number of network layers N based on the nodes and edges in the initial behavior graph.

[0057] S32, when k=1, the initial feature vector of each node is used as the intermediate feature vector of the 0th layer. Based on the edge weight of each edge in the initial behavioral relationship graph, the first-order neighbor nodes directly connected to each node are determined.

[0058] S33, according to the edge weight, the intermediate feature vectors of the first-order neighbor nodes of each node are weighted and aggregated. The aggregation result and the concatenated vector corresponding to the intermediate feature vector of the first-order neighbor nodes of each node are processed according to the first-order network layer in the preset graph neural network to obtain the intermediate feature vector of the first-order neighbor nodes of each node.

[0059] S34. When k=2 to k=N, determine the k-order neighbor nodes of each node according to the edge weight of each edge in the initial behavior relationship graph. The k-order neighbor nodes are nodes indirectly connected through k edges.

[0060] S35, according to the edge weight, the intermediate feature vectors of the (k-1)th layer corresponding to the k-th order neighbor nodes of each node are weighted and aggregated. The aggregation result and the concatenated vector corresponding to the intermediate feature vector of the (k-1)th layer of each node are processed according to the k-th layer of the preset graph neural network to obtain the intermediate feature vector of the k-th layer corresponding to each node.

[0061] The total number of network layers, N, determines the size of the receptive field of the graph neural network. When N=1, a node only perceives its direct neighbors; when N=2, a node can perceive its neighbor's neighbor (second-order neighbor), and so on. In this embodiment, the specific total number of network layers can be set according to the number of nodes and edges in the initial behavioral relationship graph to determine the number of layers that can cover effective indirect associations without introducing too much noise.

[0062] First-order neighbor nodes are nodes that are directly connected to the current node through one edge (i.e., nodes with direct edges in the initial behavioral relationship graph). They can provide direct association information of the nodes and are the first layer of external information source for feature updates, reflecting explicit cooperative relationships.

[0063] k-order neighbor nodes are nodes that are indirectly connected to the current node through k edges (e.g., a 2-order neighbor is a "neighbor's neighbor", and a 3-order neighbor is a "neighbor's neighbor's neighbor"). They can provide indirect association information between nodes and are key to capturing implicit collaborative behavior (e.g., members of abnormal gangs are mostly 2-3 order neighbors).

[0064] Weighted aggregation is a method that sums the feature vectors of neighboring nodes based on the weights of the connecting edges. The higher the edge weight, the greater the influence of that neighboring node on the target node. This achieves information fusion with differentiated association strength, avoiding the ambiguity in the characterization of association strength caused by treating all neighbors equally.

[0065] The concatenation vector is formed by concatenating the target node's previous feature vector with the aggregated neighbor information vector, ensuring that the node does not lose its original features when receiving new information.

[0066] The k-th layer of a network typically refers to a learnable transformation, such as a fully connected layer with a non-linear activation function (e.g., ReLU), which is responsible for compressing and transforming the spliced ​​fused information to generate new, higher-level feature representations for the nodes.

[0067] As described above, determining the network layer N through graph topology ensures that the aggregation range of neighbor information can adapt to the sparseness / density of the graph, avoiding the loss of implicit associations due to too few layers or the introduction of noise due to too many layers, thus ensuring the effectiveness of feature updates. By fusing first-order neighbor information when k=1, node features are introduced with direct association and collaborative information for the first time, moving beyond purely individual behavior. This lays the foundation for capturing more complex associations and overcomes the limitations of relying solely on individual features. Expanding to k-order neighbors when k≥2 allows node features to cover multi-hop objects with indirect associations, effectively capturing the implicit collaborative patterns of "weak associations and long paths" among members of abnormal groups, breaking through the bottleneck of identifying direct associations. Weighted aggregation guided by edge weights ensures that neighbors with high association strength and strong behavioral similarity contribute more to the features, avoiding the ambiguity in the characterization of association strength caused by treating all neighbors equally, and improving the accuracy of collaborative features. By splicing its own features with the aggregation results, node features retain their core behavioral patterns while fusing group association information, avoiding the masking of individual abnormal features due to excessive grouping, and balancing the feature expression of "group collaboration" and "individual abnormality."

[0068] In one specific embodiment, S31 includes the following steps:

[0069] S311. Based on the total number of nodes and the total number of edges in the initial behavioral relationship graph, obtain the complexity feature set. The complexity feature set is used to describe the complexity of the initial behavioral relationship graph. The complexity feature set includes the total number of nodes, the total number of edges, the network density, and the average degree.

[0070] S312, based on the preset mapping rules of the maximum neighbor order range, complexity feature set and network layer number, obtain the preset total number of network layers N of the graph neural network.

[0071] Network density is the ratio of the actual number of edges in a graph to the maximum possible number of edges. The formula can be 2 × total number of edges / (total number of nodes × (total number of nodes - 1)). It measures the density of the graph, and the higher the density, the tighter the connection between nodes.

[0072] The average degree is the average degree of all nodes in a graph, where the degree of a node is the number of edges connected to it. The average degree reflects the average number of connections each node has.

[0073] The complexity feature set is a collection of the total number of nodes, the total number of edges, the network density, and the average degree, which together characterize the overall structural complexity of a graph from multiple dimensions such as scale, connectivity, and density.

[0074] The preset maximum neighbor order range is an empirical safety boundary, such as setting it to 3 to 5 layers, to prevent setting an overly deep network regardless of the size of the graph.

[0075] Mapping rules are a decision-making logic. For example, if the average degree is high and the network density is high (very dense graph), a smaller N (e.g., 2 layers) is chosen because information propagates quickly in dense graphs, and too many layers can lead to oversmoothing. If the average degree is low but the total number of nodes is large (sparse large-scale graph), a larger N (e.g., 4-5 layers) is chosen to ensure that information can be passed from sufficiently distant neighbors. A linear or piecewise function can be established to map features such as average degree and total number of nodes to the suggested number of layers N, and finally, the minimum value is taken from the maximum range.

[0076] The above-mentioned complexity feature set is constructed by extracting the total number of nodes, the total number of edges, the network density, and the average degree, providing comprehensive and quantitative graph structure information for subsequent decision-making, so that the determination of network depth is based on objective data. The total number of network layers N is determined by an adaptive mapping rule based on graph complexity features, so that the receptive field of the preset graph neural network can be adapted to the actual diameter and connectivity of the graph, thereby achieving the best balance between capturing effective information and preventing information redundancy / oversmoothing, and improving the generalization performance and robustness of the preset graph neural network on graph data with different structures.

[0077] S4. Based on the intermediate feature vector of the Nth layer corresponding to each node, perform graph clustering analysis on all nodes to obtain several collaborative node clusters, where each collaborative node cluster includes several unconnected nodes.

[0078] The second similarity measure is used to assess the similarity between the intermediate feature vectors of the Nth layer of two nodes. Its value ranges from -1 to 1, with values ​​closer to 1 indicating greater similarity in behavioral patterns. Commonly used calculation methods include cosine similarity (which measures the consistency of vector directions) and the reciprocal of Euclidean distance (which measures the absolute distance in the vector space).

[0079] The intermediate feature vector of a node at layer N already contains the node's own attributes and its structural information within its multi-hop neighborhood. In this high-dimensional embedding space, nodes with similar attributes and playing similar roles in the graph (i.e., structurally equivalent) will have vector representations that are close to each other. By calculating the similarity between nodes and performing clustering, these nodes that cluster in the embedding space can be grouped into the same cooperative node cluster, which often corresponds to a group with cooperative behavior patterns.

[0080] As described above, by performing similarity calculation and cluster analysis on the intermediate feature vectors of the Nth layer generated by the graph neural network, nodes with similar potential behavioral patterns and structural roles in the network can be automatically grouped into collaborative node clusters, thereby achieving data-driven mining of collaborative node clusters, which surpasses the identification methods that rely solely on direct connection relationships.

[0081] In one specific embodiment, S4 includes the following steps:

[0082] S41, calculate the second similarity between the intermediate feature vectors of the Nth layer of any two nodes.

[0083] S42, nodes with a second similarity greater than a preset similarity threshold are divided into the same candidate cluster.

[0084] S43, calculate the modularity of each candidate cluster, and determine the candidate clusters with modularity greater than the preset modularity threshold as collaborative node clusters.

[0085] The preset similarity threshold is an adjustable parameter used to control the minimum similarity between nodes required to form a community. A higher threshold results in more similar members within the community, but the community may be more fragmented; a lower threshold may result in a larger community, but internal heterogeneity may increase. In this embodiment, the preset similarity threshold is set to 0.7.

[0086] Modularity is an indicator of the quality of community partitioning. It is obtained by comparing the actual number of edges within a community with the expected number of edges within a community in a random graph. The value of modularity ranges from -1 to 1. A higher modularity (usually greater than 0.3 is considered a better partition) indicates that the connections within a community are much denser than in the random case. That is, the connections within a community are tight, while the connections between communities are loose, indicating that the community is a structurally tight and meaningful group.

[0087] The preset modularity threshold is used to determine whether a candidate cluster is of sufficiently high quality. Only communities with a modularity greater than this threshold are ultimately confirmed as valid collaborative node clusters. In this embodiment, the preset modularity threshold is set to 0.3.

[0088] As described above, by calculating the second similarity, the node clustering basis shifts from topological connectivity to behavioral pattern features, breaking through the limitation of traditional graph clustering that can only identify directly connected nodes, and providing a quantitative tool for discovering hidden groups that are not connected but have coordinated behaviors. By dividing candidate clusters based on similarity thresholds, nodes with highly similar behavioral patterns can be initially aggregated, ensuring that potential coordinated groups are not missed. By screening coordinated clusters through modularity evaluation, the final result can filter out noisy groups (such as randomly similar nodes), ensuring that the clusters have statistically significant strong internal coordination, and improving the reliability of hidden coordinated pattern recognition. By allowing nodes within a cluster to be unconnected, the method can effectively identify abnormal groups formed through indirect associations, such as account groups in financial fraud that do not trade directly but have highly synchronized behaviors, significantly improving the detection rate of hidden coordinated anomalies.

[0089] S5. Based on the intermediate feature vector of the Nth layer corresponding to each node in each collaborative node cluster, obtain the identification type corresponding to each target monitoring object, where the identification type is an object with abnormal behavior pattern or an object with non-abnormal behavior pattern.

[0090] In one specific embodiment, S5 includes the following steps:

[0091] S51, cluster the intermediate feature vectors of the Nth layer of several historical abnormal objects to obtain several abnormal feature template vectors, where each abnormal feature template vector corresponds to an abnormal behavior pattern.

[0092] S52, for any collaborative node cluster, compare the intermediate feature vector of the Nth layer corresponding to each node in the current collaborative node cluster with each abnormal feature template vector to obtain the identification type corresponding to each target monitoring object in each collaborative node cluster.

[0093] Among them, historical abnormal objects are target monitoring objects that have been marked as abnormal through other means (such as manual confirmation or case verification), which constitute the seeds or knowledge sources for supervised learning.

[0094] Clustering is an unsupervised machine learning algorithm (such as K-Means, DBSCAN) used to automatically group a large number of data points (feature vectors of historical anomalous objects in this embodiment) so that data points within the same group are similar to each other. Clustering yields a central vector that can represent the common features of a certain type of anomalous behavior, which serves as an anomalous feature template vector. Each anomalous feature template vector abstractly defines an anomalous behavior pattern, such as a small-amount high-frequency trading pattern or a late-night trajectory anomaly pattern.

[0095] Whether an object is abnormal is determined by comparing the intermediate feature vector of the Nth layer corresponding to each node with the abnormal feature template vector corresponding to the known abnormal behavior pattern.

[0096] As described above, by clustering the high-dimensional features of historical abnormal objects, several representative abnormal behavior pattern templates are automatically extracted, transforming scattered and specific abnormal cases into reusable and generalized abnormal pattern knowledge, providing an accurate comparison benchmark for online real-time detection; by efficiently comparing the features of the object to be tested with the preset abnormal templates, rapid and automated anomaly screening and classification of large-scale target monitoring objects are achieved, greatly improving monitoring efficiency.

[0097] In one specific embodiment, S52 includes the following steps:

[0098] S521, calculate the first matching degree between the intermediate feature vector of the Nth layer and the template vector of each abnormal feature corresponding to each node in the current collaborative node cluster.

[0099] S522, based on all the first matching degrees corresponding to the current collaborative node cluster, obtain the second matching degree between the current collaborative node cluster and each abnormal feature template vector.

[0100] S523, if the second matching degree between the current collaborative node cluster and any abnormal feature template vector is greater than the preset matching degree threshold, then the identification type corresponding to each target monitoring object in the current collaborative node cluster is determined to be an abnormal behavior pattern object, and the abnormal type of the current collaborative node cluster is determined to be the abnormal behavior pattern corresponding to the abnormal feature template vector.

[0101] S524, if the second matching degree of the current collaborative node cluster and each abnormal feature template vector is less than or equal to the preset matching degree threshold, then the identification type corresponding to each target monitoring object in the current collaborative node cluster is determined to be a non-abnormal object in behavior pattern.

[0102] The first matching degree is the similarity score (such as cosine similarity) between the intermediate feature vector of the Nth layer of a single node in the collaborative node cluster and a certain abnormal feature template vector, which reflects the degree of consistency between the individual behavior of the node and a certain abnormal pattern.

[0103] The second matching degree is the overall matching degree score between the entire collaborative node cluster and a certain abnormal feature template vector. It is an aggregation index, and the specific aggregation strategy can be the mean aggregation, maximum value aggregation, ratio aggregation, etc.

[0104] The preset matching threshold is a decisive boundary for judging whether the community as a whole is abnormal, and it may need to be determined based on business security requirements and historical data verification.

[0105] As described above, by calculating the first matching degree of each node in the community with all abnormal patterns, detailed data on the abnormal situations of members within the community were obtained, providing a fine-grained data foundation for subsequent assessment of the overall tendency of the community; by aggregating the matching degrees of individual nodes into a second matching degree at the community level, the feature transformation from micro-level individual characteristics to macro-level group behavior was realized, enabling risk assessment at the group level rather than just the individual level; through group consistency judgment, the detection rate of collaborative groups with high concealment, insignificant individual node characteristics but abnormal overall behavior patterns was greatly improved.

[0106] The above-mentioned approach, by constructing feature vectors, identifying interaction relationships, and quantifying interaction levels from multi-source behavioral data of the target monitoring object, provides foundational data for subsequent behavioral relationship graph construction, including node attributes, edge connections, and edge weights. Through the systematic integration of nodes, edges, node features, and edge weights, a complete and standardized graph data object is constructed. This allows subsequent graph neural networks to learn within a unified representation space that simultaneously includes entity features and relationship strength, laying a data foundation for uncovering potential and complex collaborative behavioral patterns from a global network perspective rather than an isolated individual perspective. Furthermore, through a multi-layered iterative, edge-weight-based message passing mechanism, the feature representation of each node can continuously integrate the weighted information of its multi-level neighbors, thereby expanding local, direct associations to global ones. The latent network pattern representation enhances the deep features of nodes, thereby capturing the behavioral coordination of directly / indirectly related objects, breaking through the limitations of relying solely on individual features or direct neighbors. By performing similarity calculation and cluster analysis on the intermediate feature vectors of the Nth layer generated by the graph neural network, nodes with similar behavioral patterns and structural roles in the network can be automatically grouped into clusters, thus accurately revealing potential risk groups with highly coordinated behavior but no strong direct connections. Through the intermediate feature vectors of the Nth layer corresponding to each node in the coordinated node cluster, accurate and interpretable identification and classification of abnormal behavior are achieved. This not only determines individual abnormalities but also accurately locks down and classifies the patterns of the entire coordinated abnormal group, greatly improving the accuracy and comprehensiveness of the identification results.

[0107] Example 2

[0108] Embodiment 2 of the present invention provides a non-transitory computer-readable storage medium, which can be disposed in an electronic device to store at least one instruction or at least one program related to implementing a method in the method embodiment. The at least one instruction or at least one program is loaded and executed by the processor to implement the abnormal object dynamic behavior pattern recognition method based on graph neural network provided in the above embodiment.

[0109] Example 3

[0110] Embodiment 3 of the present invention provides an electronic device, which includes a processor and the non-transitory computer-readable storage medium of Embodiment 2 of the present invention.

[0111] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A method for recognizing dynamic behavior patterns of abnormal objects based on graph neural networks, characterized in that, The method includes the following steps: S1, based on the multi-source behavioral data corresponding to each target monitoring object, obtain the interaction relationship between the target monitoring objects and the degree of interaction representing the similarity of behavior, as well as the initial feature vector representing the behavioral pattern of each target monitoring object, where the interaction relationship is either directly connected or not connected; S2, using the target monitoring object as a node, constructing edges based on interaction relationships, using the degree of interaction as edge weights, and using the initial feature vector as node attributes, an initial behavior relationship graph is constructed. S3, based on the k-th layer of the preset graph neural network and the edge weights in the initial behavior relationship graph, update the intermediate feature vector of the (k-1)-th layer corresponding to each node to obtain the intermediate feature vector of the k-th layer corresponding to each node, where k=1, ..., N, N is the total number of network layers, and when k=1, the intermediate feature vector of the (k-1)-th layer is the initial feature vector. S3 includes the following steps: S31, Determine the total number of network layers N based on the nodes and edges in the initial behavior relationship graph; S32, when k=1, the initial feature vector of each node is used as the intermediate feature vector of the 0th layer, and the first-order neighbor nodes directly connected to each node are determined according to the edge weight of each edge in the initial behavior relationship graph. S33, according to the edge weight, the intermediate feature vector of the first-order neighbor node corresponding to each node is weighted and aggregated. The aggregation result and the concatenated vector corresponding to the intermediate feature vector of the first-order neighbor node of each node are processed according to the first-order network layer in the preset graph neural network to obtain the intermediate feature vector of the first-order neighbor node corresponding to each node. S34, when k=2 to k=N, determine the k-order neighbor nodes of each node according to the edge weight of each edge in the initial behavior relationship graph, where the k-order neighbor nodes are nodes indirectly connected through k edges; S35, according to the edge weight, the intermediate feature vectors of the (k-1)th layer corresponding to the k-th order neighbor nodes of each node are weighted and aggregated. The aggregation result and the concatenated vector corresponding to the (k-1)th layer intermediate feature vector of each node are processed according to the k-th layer network layer in the preset graph neural network to obtain the intermediate feature vector of the k-th layer corresponding to each node. S4. Based on the intermediate feature vector of the Nth layer corresponding to each node, perform graph clustering analysis on all nodes to obtain several collaborative node clusters, where each collaborative node cluster includes several unconnected nodes. S5. Based on the intermediate feature vector of the Nth layer corresponding to each node in each collaborative node cluster, obtain the identification type corresponding to each target monitoring object, wherein the identification type is an object with abnormal behavior pattern or an object with non-abnormal behavior pattern.

2. The method for identifying dynamic behavior patterns of abnormal objects based on graph neural networks according to claim 1, characterized in that, S1 includes the following steps: S11, extract features from the multi-source behavioral data of each target monitoring object to obtain the initial feature vector corresponding to each target monitoring object. The types of multi-source behavioral data include social interaction records, transaction links, behavior logs and travel trajectory data. S12, Based on the multi-source behavioral data of each target monitoring object, identify direct social behavior, direct transaction behavior and trajectory overlap behavior between target monitoring objects, and obtain the interaction relationship between target monitoring objects; S13, calculate the first similarity between the initial feature vectors corresponding to each pair of directly connected nodes to obtain the degree of interaction between the target monitoring objects.

3. The method for identifying dynamic behavior patterns of abnormal objects based on graph neural networks according to claim 2, characterized in that, S11 includes the following steps: S111, for any target monitoring object, extract the interaction frequency feature and interaction duration feature from the social interaction records corresponding to the current target monitoring object; S112, Extract transaction volume features and transaction frequency features from the transaction chain corresponding to the current target monitoring object; S113, Extract operation type features and operation time interval features from the behavior logs corresponding to the current target monitoring object; S114, Extract trajectory overlap features and dwell time features from the travel trajectory data corresponding to the current target monitoring object; S115, standardize and concatenate all extracted features to obtain the initial feature vector corresponding to the current target monitoring object.

4. The method for identifying dynamic behavior patterns of abnormal objects based on graph neural networks according to claim 1, characterized in that, S31 includes the following steps: S311, Based on the total number of nodes and the total number of edges in the initial behavioral relationship graph, a complexity feature set is obtained, wherein the complexity feature set is used to describe the complexity of the initial behavioral relationship graph, and the complexity feature set includes the total number of nodes, the total number of edges, the network density, and the average degree. S312, based on the preset maximum neighbor order range, the mapping rule between the complexity feature set and the number of network layers, obtain the total number of network layers N of the preset graph neural network.

5. The method for identifying dynamic behavior patterns of abnormal objects based on graph neural networks according to claim 1, characterized in that, S4 includes the following steps: S41, calculate the second similarity between the intermediate feature vectors of the Nth layer of any two nodes; S42, Nodes with a second similarity greater than a preset similarity threshold are divided into the same candidate cluster; S43, calculate the modularity of each candidate cluster, and determine the candidate clusters with modularity greater than the preset modularity threshold as collaborative node clusters.

6. The method for identifying dynamic behavior patterns of abnormal objects based on graph neural networks according to claim 1, characterized in that, S5 includes the following steps: S51, cluster the intermediate feature vectors of the Nth layer of several historical abnormal objects to obtain several abnormal feature template vectors, where each abnormal feature template vector corresponds to an abnormal behavior pattern. S52, for any collaborative node cluster, compare the intermediate feature vector of the Nth layer corresponding to each node in the current collaborative node cluster with each abnormal feature template vector to obtain the identification type corresponding to each target monitoring object in each collaborative node cluster.

7. The method for identifying dynamic behavior patterns of abnormal objects based on graph neural networks according to claim 6, characterized in that, S52 includes the following steps: S521, calculate the first matching degree between the intermediate feature vector of the Nth layer and the template vector of each abnormal feature corresponding to each node in the current collaborative node cluster; S522, based on all the first matching degrees corresponding to the current collaborative node cluster, obtain the second matching degree between the current collaborative node cluster and each abnormal feature template vector; S523, if the second matching degree between the current collaborative node cluster and any abnormal feature template vector is greater than the preset matching degree threshold, then the identification type corresponding to each target monitoring object in the current collaborative node cluster is determined to be an abnormal behavior pattern object, and the abnormal type of the current collaborative node cluster is determined to be the abnormal behavior pattern corresponding to the abnormal feature template vector. S524, if the second matching degree of the current collaborative node cluster and each abnormal feature template vector is less than or equal to the preset matching degree threshold, then the identification type corresponding to each target monitoring object in the current collaborative node cluster is determined to be a non-abnormal object in behavior pattern.

8. A non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores at least one instruction or at least one program segment, characterized in that, The at least one instruction or the at least one program segment is loaded and executed by the processor to implement the abnormal object dynamic behavior pattern recognition method based on graph neural network as described in any one of claims 1-7.

9. An electronic device, characterized in that, Includes a processor and the non-transitory computer-readable storage medium as described in claim 8.

Images