Dynamic network anomaly detection method and system based on double autoencoders and medium

Abstract

The application discloses a kind of dynamic network anomaly detection method, system and medium based on double self-encoder: after dynamic network data pre-processing, obtain each time slice and;Structure self-encoder encodes graph structure feature as, decode each time slice, calculate;Attribute self-encoder encodes graph attribute feature as, jointly and decode each time slice, calculate;And weighted summation obtains;The structure reconstruction error and attribute reconstruction error of node are weighted summation, obtain node anomaly score;Model establishes end-to-end training, minimizes, and optimizes model;After training, model in test set dynamic network data inference, obtain final node anomaly detection result.The application is by joint learning the structure and attribute information of dynamic network, combines attention mechanism and captures space-time dynamic characteristics, significantly improves the accuracy and robustness of anomaly detection.

Description

Technical Field

[0001] This invention relates to the field of graph data analysis and machine learning, and more specifically, to a method, apparatus and medium for dynamic network anomaly detection based on dual autoencoders. The dual autoencoder dynamic network anomaly detection method is applicable to scenarios such as social network analysis, network security monitoring, and traffic flow prediction. Background Technology

[0002] With the rapid development of information technology, various network systems are increasingly exhibiting dynamic evolution characteristics, and dynamic networks have become the core carrier for depicting complex relationships in the real world. For example, in social networks, users' following and unfollowing actions cause the network topology to continuously change, while attributes such as user-posted content and account information are constantly updated; in financial transaction networks, the flow of funds between trading accounts increases or decreases in real time with trading activities, and attribute data such as account transaction amounts and frequency change synchronously and dynamically; in the Industrial Internet of Things (IIoT), the connection and disconnection of device nodes form dynamic connection relationships, and attribute information such as device operating parameters and status data also fluctuates in real time. In such dynamic networks, anomaly detection is a key technology for ensuring network security and data reliability. Its core objective is to promptly identify abnormal behaviors that deviate from normal patterns, such as fraudulent activities like fake account registration and malicious marketing in social networks, intrusion activities such as hacking and malicious code propagation in network security, and illegal transactions such as theft and money laundering in financial transactions.

[0003] However, existing dynamic network anomaly detection methods have many technical shortcomings, making it difficult to meet the high-precision detection requirements in practical applications. The specific problems are as follows:

[0004] (1) Limited to static networks or lack of adaptability: Traditional network anomaly detection methods are mostly based on static network model design. Such methods treat the network as a fixed topology for analysis and can only capture the network state under a specific time slice. When facing dynamically evolving networks such as the addition or removal of nodes and changes in edge connection relationships, static detection methods need to frequently rebuild the network model and retrain it. This not only generates a lot of computational overhead, but also fails to effectively correlate network evolution information between different time slices, resulting in a serious lack of ability to capture persistent and sudden anomalies across time dimensions.

[0005] (2) Ignoring the joint learning of structure and attributes: The core features of dynamic networks include two dimensions: structural information composed of the connection relationships between nodes, and attribute information composed of the attribute parameters carried by the nodes themselves, and the two are closely related. For example, malicious accounts in social networks often form dense abnormal connection topologies, and the keywords, posting frequency and other attributes of their published content are significantly different from normal accounts. However, most existing detection methods only focus on the use of single-dimensional information: some methods, such as the NetWalk algorithm, only focus on the structural information of the network, and realize anomaly identification by sampling and feature learning of the neighbor relationships of nodes, but ignore the key abnormal indicators contained in the node attributes; other methods, such as the OCAN algorithm, only build the detection model around the node attribute information, and fail to combine the related features at the structural level, which leads to a significant decrease in the model's recognition accuracy for complex anomalies that are difficult to distinguish by structural anomalies or attribute anomalies alone and require the joint judgment of both.

[0006] (3) Weak Feature Fusion and Dynamic Evolution Capture Capabilities: Most of the few methods that attempt to combine structural and attribute information adopt shallow fusion methods such as simple splicing and weighted summation, failing to delve into the complex interaction mechanisms between the two. At the same time, these methods lack the ability to focus on key evolutionary information in dynamic networks. In scenarios where network structure and attributes change dynamically in sync, they cannot effectively screen out core features that make significant contributions to anomaly detection. Instead, they are easily affected by a large amount of redundant dynamic noise, resulting in a blurred characterization of anomaly patterns by the model, further reducing the accuracy and real-time performance of anomaly detection.

[0007] In summary, the current field of dynamic network anomaly detection urgently needs a technical solution that can efficiently integrate network structure and attribute information, accurately capture the dynamic interaction characteristics of the two, and focus on key information to improve detection accuracy, so as to solve the many technical bottlenecks of existing methods. Summary of the Invention

[0008] The purpose of this invention is to overcome the shortcomings of the prior art and propose a dynamic network anomaly detection method, device and medium based on dual autoencoders. The dual autoencoder dynamic network anomaly detection method significantly improves the accuracy and robustness of anomaly detection by jointly learning the structure and attribute information of the dynamic network and combining the attention mechanism to capture spatiotemporal dynamic features.

[0009] The objective of this invention can be achieved through the following technical solutions.

[0010] A dynamic network anomaly detection method based on dual autoencoders includes the following steps:

[0011] S1: Acquire dynamic network data and preprocess it.

[0012] The raw data of the dynamic network to be tested is obtained, and each time slice is obtained after preprocessing. Weighted adjacency matrix and node attribute matrix The resulting dynamic graph sequence The dataset is divided into training and testing sets in chronological order; among them... The total number of nodes. Weighted adjacency matrix for attribute dimensions Weights in Represents the time step internal nodes With nodes The weights of the edges connecting them;

[0013] S2: Constructing a structural autoencoder

[0014] The structural autoencoder includes a structural encoder and a structural decoder, and the input of the structural autoencoder is each time slice in the training set. Weighted adjacency matrix and node attribute matrix The structural encoder is responsible for encoding the graph structural features into the final latent structural embedding. The structure decoder utilizes Obtain the reconstructed adjacency matrix for each time slice. Reconstructing the adjacency matrix based on all time slices Calculate the structural reconstruction loss The structural reconstruction loss Defined as weighted Frobenius norm loss;

[0015] S3: Building a property autoencoder

[0016] The attribute autoencoder includes an attribute encoder and an attribute decoder, and the input of the attribute autoencoder is each time slice in the training set. Weighted adjacency matrix and node attribute matrix The attribute encoder is responsible for encoding the graph attribute features into the final latent attribute embedding. The attribute decoder jointly utilizes and Obtain the reconstruction attribute matrix for each time slice. Reconstructed attribute matrix based on all time slices Calculate attribute reconstruction loss The attribute reconstruction loss Defined as weighted Frobenius norm loss;

[0017] S4: Construct the joint reconstruction loss function and node anomaly scoring function

[0018] By analyzing structural reconstruction loss and attribute reconstruction loss We perform a weighted summation to obtain the joint reconstruction loss used for training the model. Simultaneously, by weighted summing the structural reconstruction error and attribute reconstruction error of a single node, a node anomaly score for anomaly detection is obtained. ;

[0019] S5: Model Training and Optimization

[0020] The AADDN model is established through steps S1-S4 above. End-to-end training of the AADDN model is then performed to minimize the joint reconstruction loss. The goal is to optimize the model's weights and bias parameters.

[0021] S6: Obtain node anomaly detection results

[0022] Using the trained AADDN model, inference is performed on the dynamic network data in the test set to obtain the final node anomaly detection results.

[0023] Furthermore, the acquisition and preprocessing of dynamic network data in step S1 specifically includes the following processes:

[0024] Obtain the original dynamic graph sequence of the dynamic network to be tested. ; among them, each time slice Snapshot It defines the network topology, which contains a shared, fixed set of nodes. and time-varying edge sets Each node in the time slice It also contains related attribute data;

[0025] According to the edge set Build each time slice Weighted adjacency matrix ;

[0026] Each time slice The node attribute data is organized into a node attribute matrix. ,in The total number of nodes is given; the node attribute matrix is ​​standardized, including imputing any missing values ​​and normalizing the attribute values; if some nodes in the dynamic network do not have original attributes, a one-hot encoded vector or identity matrix is ​​used as the initial node attribute matrix. ;

[0027] The entire dynamic graph sequence will be obtained by following the preprocessing steps described above. Then, it is divided into different stages according to time sequence: the first Sequence data at each time step As a training set, used for model training, the sequence data for subsequent time steps As a test set, it is used for model performance evaluation.

[0028] Furthermore, the structural encoder described in step S2 includes a structural attention layer and a temporal attention layer;

[0029] The structural attention layer obtains the structural embedding of each node in each time step after attention coefficient calculation, Softmax normalization, single-head structural embedding generation, and multi-head attention mechanism operation.

[0030] Among them, the attention coefficient is calculated as follows: the attention coefficient between each node and its neighboring nodes in each time slice is calculated according to the following formula (1);

[0031] (1),

[0032] In the formula, It is a time film internal nodes Its neighboring nodes Attention coefficient between them It is the LeakyReLU activation function. It is the edge weight, in time step slice internal nodes With nodes The weight of the edges connecting them. These are the attention parameters, where F is the output dimension defined by the structural attention layer. This represents vector concatenation. Indicates transpose. It is a shared weight matrix. It is a time film internal nodes The D-dimensional original attribute vector, It is a time film internal nodes The D-dimensional original attribute vector, and They come from the node attribute matrix respectively The row and number OK;

[0033] Among them, Softmax normalization: The attention coefficients calculated in each time slice are normalized by Softmax according to the following formula (2) to obtain the attention weight of each node and its arbitrary neighboring points in each time slice;

[0034] (2),

[0035] In the formula, For time slices internal nodes Its neighboring nodes Attention weights It is an exponential function. For time slices internal nodes Its neighboring nodes Attention coefficient between them For nodes The set of all neighboring nodes in the current time slice;

[0036] Among them, the single-head structure embedding generation is as follows: according to formula (3), the single-head structure embedding of each node at each time step is generated by weighted summation and application of ELU activation function;

[0037] (3),

[0038] In the formula, For nodes In time slice Single-head structure embedding;

[0039] Among them, the multi-head attention mechanism adopts: The independent attention heads are computed in parallel, and their outputs are concatenated to obtain the structural embedding of each node at each time step according to formula (4), thereby obtaining the structural embedding time series of each node;

[0040] (4),

[0041] In the formula, For nodes In time slice The structure embedded on, For attention head The output results, , Indicates splicing;

[0042] Embed the structure of each node into the time series. The input to the temporal attention layer is added to the positional encoding. The temporal attention layer obtains the latent structural embedding of each node after processing through self-attention calculation and multi-head temporal attention mechanism operation. The latent structural embedding of all nodes constitutes the final latent structural embedding.

[0043] Among them, self-attention calculation: a masked scaling dot product attention mechanism is used to calculate the potential embedding of each node in all time slices according to formula (5);

[0044] (5),

[0045] (6),

[0046] (7),

[0047] In the formula, Representative node Potential embeddings at all time steps It is a matrix The Middle Line 1 Column elements; , , These three matrices are linear projection matrices of the query, key, and value. Used to project the input Pv into the query space. Used to project the input Pv into the key space. Used to input Projected onto the value space; It is a mask matrix. It is a mask matrix The first in Line 1 Column elements; The embedding dimension of the temporal attention layer output;

[0048] Among them, the multi-head temporal attention mechanism adopts: Each independent attention head is computed in parallel, and their outputs are concatenated to obtain the potential structure embedding of each node according to formula (8);

[0049] (8)

[0050] In the formula, For nodes Potential structural embeddings, For attention head The output results, ; Latent structural embedding of all nodes This constitutes the final potential structural embedding. ;

[0051] The structure decoder described in step S2 receives the final latent structure embedding output by the structure encoder. The reconstructed adjacency matrix for each time slice is obtained through self-multiplication. As shown in formula (9):

[0052] (9),

[0053] In the formula, Map the output value to , representing the probability of a connection between nodes; T represents the transpose;

[0054] The structural reconstruction loss described in step S2 Defined as the weighted Frobenius norm loss, as shown in formula (10):

[0055] (10)

[0056] In the formula, It is the Hadamard product; It is the adjacency matrix tensor of the original dynamic network, which is the weighted adjacency matrix of all time slices. Along the time dimension A stacked three-dimensional tensor; It is a weighted matrix or tensor used to penalize reconstruction errors of non-zero elements to address the sparsity of the adjacency matrix, and is specifically defined as:

[0057] (11),

[0058] In the formula, It is a hyperparameter. yes One of the elements, It is used to penalize the original adjacency matrix. Corresponding element The weight value of the reconstruction error; It is the adjacency matrix tensor of the original dynamic network. One of the elements, representing all time slices Above, node and nodes The weights of the connections between them.

[0059] Furthermore, the attribute encoder described in step S3 includes two MLP layers and a temporal attention layer;

[0060] The mapping process of the two-layer MLP is as follows: for each time slice Node attribute matrix The time slices are obtained by mapping and encoding through two layers of MLP. The attribute embedding result is shown in the following formula:

[0061] (12),

[0062] (13)

[0063] in: It is the bias vector of the first layer MLP. The meaning is the bias vector of the second-layer MLP; It is a time film Node attribute matrix The result after the first layer of MLP encoding is used as the input of the second layer of MLP; It is the time slice of the second-layer MLP output. The attribute embedding result; and This is the weight matrix; It is a non-linear activation function;

[0064] The attribute embeddings of all time slices are stacked along the time axis and used as input to the temporal attention layer in the attribute encoder. The temporal attention layer captures the evolution patterns of node attributes across multiple time slices and outputs the final latent attribute embeddings. The temporal attention layer of the attribute encoder and the temporal attention layer of the structure encoder have the same structure but independent parameters.

[0065] The attribute decoder described in step S3 jointly utilizes the final latent structure embedding. and final latent attribute embedding The reconstructed attribute matrix for each time slice is obtained by decoding using the following formula. :

[0066] (14)

[0067] The attribute reconstruction loss of the attribute autoencoder described in step S3 Defined as the weighted Frobenius norm loss, as shown in Equation (15):

[0068] (15)

[0069] In the formula, It is the Hadamard product; It is the attribute matrix tensor of the original dynamic network, which is the node attribute matrix of all time slices. Along the time dimension A stacked three-dimensional tensor; It is a weighting matrix used to introduce additional penalties for reconstruction errors of non-zero elements, specifically defined as:

[0070] (16)

[0071] In the formula, It is a hyperparameter. yes One of the elements, It is used to penalize the original attribute matrix. Corresponding element The weight value of the reconstruction error; It is the original dynamic network attribute matrix tensor One of the elements, representing all time slices Above, node and nodes The weights of the connections between them.

[0072] Furthermore, the joint reconstruction loss described in step S4 The definition is as follows:

[0073] (17)

[0074] In the formula, It is a balance parameter;

[0075] For a single node Its abnormal score It is defined as the weighted sum of its structural reconstruction loss and attribute reconstruction loss, and the definition is as follows:

[0076] (18)

[0077] In the formula, and These are the adjacency matrices. and attribute matrix Corresponding node The row vector, and These are reconstructing the adjacency matrix. and reconstructing the attribute matrix The corresponding reconstructed row vector; For nodes Structural reconstruction error, node The attribute reconstruction error.

[0078] Furthermore, in step S5, the joint reconstruction loss is minimized. The following formula is used to optimize the weights and bias parameters of the AADDN model:

[0079] (19)

[0080] During the training and optimization of the AADDN model, the AdamW optimizer is used to update the model parameters, and L2 regularization is introduced to prevent overfitting.

[0081] Furthermore, the process of obtaining the node anomaly detection result in step S6 is as follows:

[0082] Using the definition of node anomaly scoring in step S4, for each time slice in the test set Each node on Calculate anomaly scores ;

[0083] By sorting the anomaly scores of nodes, the top-K nodes with the highest scores are identified as anomalous nodes; or by setting an anomaly threshold. To determine abnormal nodes;

[0084] Analyze the anomaly types based on the structural reconstruction error and attribute reconstruction error of each node.

[0085] The objective of this invention can also be achieved through the following technical solutions.

[0086] An anomaly detection system based on a dual autoencoder dynamic network using an attention mechanism includes:

[0087] Data acquisition and preprocessing module: Obtains the raw data of the dynamic network to be tested, and obtains the data for each time slice after preprocessing. Weighted adjacency matrix and node attribute matrix The resulting dynamic graph sequence The dataset is divided into training and testing sets in chronological order; among them... The total number of nodes. For attribute dimensions, the node attribute matrix Weights in Represents the time step internal nodes With nodes The weights of the edges connecting them;

[0088] Structural Autoencoder Construction Module: The structural autoencoder includes a structural encoder and a structural decoder. The input of the structural autoencoder is each time slice in the training set. Weighted adjacency matrix and node attribute matrix The structural encoder is responsible for encoding the graph structural features into the final latent structural embedding. The structure decoder utilizes Obtain the reconstructed adjacency matrix for each time slice. Reconstructing the adjacency matrix based on all time slices Calculate the structural reconstruction loss The structural reconstruction loss Defined as weighted Frobenius norm loss;

[0089] Attribute Autoencoder Construction Module: The attribute autoencoder includes an attribute encoder and an attribute decoder. The input of the attribute autoencoder is each time slice in the training set. Weighted adjacency matrix and node attribute matrix The attribute encoder is responsible for encoding the graph attribute features into the final latent attribute embedding. The attribute decoder jointly utilizes and Obtain the reconstruction attribute matrix for each time slice. Reconstructed attribute matrix based on all time slices Calculate attribute reconstruction loss The attribute reconstruction loss Defined as weighted Frobenius norm loss;

[0090] Function building blocks: By analyzing the structural reconstruction loss and attribute reconstruction loss We perform a weighted summation to obtain the joint reconstruction loss used for training the model. Simultaneously, by weighted summing the structural reconstruction error and attribute reconstruction error of a single node, a node anomaly score for anomaly detection is obtained. ;

[0091] Model Training and Optimization Module: After completing the AADDN model through the above modules, the AADDN model is trained end-to-end to minimize the joint reconstruction loss. The goal is to optimize the model's weights and bias parameters.

[0092] Node anomaly detection module: Using the trained AADDN model, inference is performed on the dynamic network data in the test set to obtain the final node anomaly detection results.

[0093] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-described dynamic network anomaly detection method based on dual autoencoders.

[0094] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described dynamic network anomaly detection method based on dual autoencoders.

[0095] Compared with the prior art, the beneficial effects of the technical solution of the present invention are as follows:

[0096] (1) This invention constructs a structural autoencoder and an attribute autoencoder. By jointly learning structural and attribute information through a dual autoencoder architecture, it overcomes the limitations of traditional methods that model single information.

[0097] (2) This invention introduces a multi-head attention mechanism to capture the dynamic evolution characteristics of the network from multiple dimensions, thereby enhancing the expressive power of the model.

[0098] (3) The present invention significantly outperforms existing methods (such as FALCON, AnomalyDAE, etc.) in terms of AUC, Precision@K and Recall@K on multiple real datasets (such as Enron, METR-LA, etc.).

[0099] Instruction manual illustrations

[0100] Figure 1 This is a flowchart of the dynamic network anomaly detection method based on dual autoencoders according to the present invention.

[0101] Figure 2 This is a model framework diagram of the dynamic network anomaly detection method based on dual autoencoders of the present invention.

[0102] Figure 3 These are the experimental results of this invention and other anomaly detection methods on an Email dataset.

[0103] Figure 4 These are the experimental results of this invention and other anomaly detection methods on the Enron dataset.

[0104] Figure 5 These are the experimental results of this invention and other anomaly detection methods on the METR-LA dataset.

[0105] Figure 6 These are the experimental results of this invention and other anomaly detection methods on the UCI dataset.

[0106] Figure 7 These are the experimental results of this invention and other anomaly detection methods on the Gowalla dataset.

[0107] Figure 8 These are the ROC-AUC results of this invention and other anomaly detection methods on different datasets.

[0108] Figure 9This refers to the parameter sensitivity of the present invention for anomaly detection on different datasets. Detailed Implementation

[0109] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below.

[0110] This invention proposes a dynamic network anomaly detection method based on dual autoencoders. The core of this method lies in learning the structural and attribute features of the dynamic network through structural autoencoders and attribute autoencoders respectively, and combining this with a multi-head attention mechanism to capture spatiotemporal dynamic patterns. Finally, anomaly detection is achieved through a joint reconstruction loss. (See attached figure.) Figure 1 The detailed implementation process of this method includes the following steps:

[0111] S1: Acquire dynamic network data and preprocess it.

[0112] The raw data of the dynamic network to be tested is obtained, and each time slice is obtained after preprocessing. Weighted adjacency matrix and node attribute matrix The resulting dynamic graph sequence The dataset is divided into training and testing sets in chronological order; among them... The total number of nodes. For attribute dimensions, the node attribute matrix Weights in Represents the time step internal nodes With nodes The weights of the edges connecting them;

[0113] S2: Constructing a structural autoencoder

[0114] The structural autoencoder includes a structural encoder and a structural decoder, and the input of the structural autoencoder is each time slice in the training set. Weighted adjacency matrix and node attribute matrix The structural encoder is responsible for encoding the graph structural features into the final latent structural embedding. The structure decoder utilizes Obtain the reconstructed adjacency matrix for each time slice. Reconstructing the adjacency matrix based on all time slices Calculate the structural reconstruction loss The structural reconstruction loss Defined as weighted Frobenius norm loss;

[0115] S3: Building a property autoencoder

[0116] The attribute autoencoder includes an attribute encoder and an attribute decoder, and the input of the attribute autoencoder is each time slice in the training set. Weighted adjacency matrix and node attribute matrix The attribute encoder is responsible for encoding the graph attribute features into the final latent attribute embedding. The attribute decoder jointly utilizes and Obtain the reconstruction attribute matrix for each time slice. Reconstructed attribute matrix based on all time slices Calculate attribute reconstruction loss The attribute reconstruction loss Defined as weighted Frobenius norm loss;

[0117] S4: Construct the joint reconstruction loss function and node anomaly scoring function

[0118] By analyzing structural reconstruction loss and attribute reconstruction loss We perform a weighted summation to obtain the joint reconstruction loss used for training the model. Simultaneously, by weighted summing the structural reconstruction error and attribute reconstruction error of a single node, a node anomaly score for anomaly detection is obtained. ;

[0119] S5: Model Training and Optimization

[0120] The AADDN model (i.e., an anomaly detection model based on a dual autoencoder dynamic network with an attention mechanism) is completed through the above steps S1-S4. Figure 2 As shown in the diagram, the AADDN model is trained end-to-end to minimize the joint reconstruction loss. The goal is to optimize the model's weights and bias parameters.

[0121] S6: Obtain node anomaly detection results

[0122] Using the trained AADDN model, inference is performed on the dynamic network data in the test set to obtain the final node anomaly detection results.

[0123] In one possible implementation, preferably, the acquisition and preprocessing of dynamic network data in step S1 specifically includes the following processes:

[0124] Obtain the original dynamic graph sequence of the dynamic network to be tested. ; among them, each time slice Snapshot It defines the network topology, which contains a shared, fixed set of nodes. and time-varying edge sets Each node in the time slice It also contains related attribute data.

[0125] According to the edge set Build each time slice Weighted adjacency matrix Weights in the matrix Represents the time step internal nodes With nodes The weight of the edge connecting the two nodes is the number of times the connection between the two edges (two nodes) occurs within that time step.

[0126] Each time slice The node attribute data is organized into a node attribute matrix. ,in The total number of nodes is given; the node attribute matrix is ​​standardized, including imputing any missing values ​​and normalizing the attribute values; if some nodes in the dynamic network do not have the original attributes (i.e., D=0), a one-hot encoding vector or an identity matrix is ​​used as the initial node attribute matrix. This is to ensure that the structural attention layer has input features.

[0127] The entire dynamic graph sequence will be obtained by following the preprocessing steps described above. Then, it is divided into different stages according to time sequence: the first Sequence data at each time step As a training set, used for model training, the sequence data for subsequent time steps As a test set, it is used for model performance evaluation.

[0128] In one possible implementation, preferably, the structural encoder in step S2 is used to learn the evolutionary characteristics of the dynamic network topology, mainly including a structural attention layer and a temporal attention layer.

[0129] The structural attention layer, through attention coefficient calculation, Softmax normalization, single-head structural embedding generation, and multi-head attention mechanism processing, obtains the structural embedding of each node at each time step. This layer is applied in each network snapshot. The above application is used to capture the local neighborhood structure features of nodes and generate new node representations. .

[0130] Among them, the attention coefficient is calculated as follows: the attention coefficient between each node and its neighboring nodes in each time slice is calculated according to the following formula (1);

[0131] (1),

[0132] In the formula, It is a time film internal nodes Its neighboring nodes Attention coefficient between them; It is the LeakyReLU activation function; It is the edge weight, in time step slice internal nodes With nodes The weights of the edges connecting them; These are the attention parameters; F is the output dimension defined by the structural attention layer. This indicates vector concatenation; Indicates transpose; It is a shared weight matrix, which is the parameter matrix that the model needs to learn during training. It is globally shared, randomly initialized at the beginning of model training, and then minimized through backpropagation and gradient descent algorithms. What we learn is for the purpose of achieving our goals; It is a time film internal nodes The D-dimensional original attribute vector, It is a time film internal nodes The D-dimensional original attribute vector, and They come from the node attribute matrix respectively The row and number OK;

[0133] Among them, Softmax normalization: The attention coefficients calculated in each time slice are normalized by Softmax according to the following formula (2) to obtain the attention weight of each node and its arbitrary neighboring points in each time slice;

[0134] (2),

[0135] In the formula, For time slices internal nodes Its neighboring nodes Attention weights It is an exponential function. For time slices internal nodes Its neighboring nodes Attention coefficient between them For nodes The set of all neighboring nodes in the current time slice. The attention coefficients calculated within the current time slice. Normalization is performed to ensure that each node is normalized within the same slice at the same time. The sum of the attention coefficients between the molecule and all its neighbors, after being processed by an exponential function, is 1. (Normalized result) Representing neighboring nodes For nodes In its respective time slot Importance weight within.

[0136] Among them, the single-head structure embedding generation is as follows: according to formula (3), the single-head structure embedding of each node at each time step is generated by weighted summation and application of ELU activation function;

[0137] (3),

[0138] In the formula, For nodes In time slice The single-head structure is embedded.

[0139] Among them, multi-headed attention mechanism: adopts Each independent attention head is computed in parallel, and their outputs (denoted as...) are processed. By piecing them together, the structural embedding of each node at each time step can be obtained according to formula (4). This leads to the structural embedding time series of each node. .

[0140] (4),

[0141] In the formula, For nodes In time slice The structure embedded on, For attention head The output results, , Indicates splicing. Structure embedding. for The row vector.

[0142] The temporal attention layer is used to capture the evolution patterns of node structural features over the entire time series. It embeds the structure of each node into the time series. The input to the temporal attention layer is added to the positional encoding. The temporal attention layer obtains the latent structural embedding of each node after processing through self-attention computation and multi-head temporal attention mechanism operation. The latent structural embedding of all nodes constitutes the final latent structural embedding.

[0143] Among them, self-attention calculation: the scaled dot-product attention mechanism with mask is adopted to calculate the potential embedding of each node in all time slices according to formula (5);

[0144] (5),

[0145] (6),

[0146] (7),

[0147] In the formula, Representative node The latent embedding at all time steps is the temporal attention layer's response to the input sequence. (The output after performing time series modeling on F-dimensional features containing T time steps). It is a matrix The Middle Line 1 Column elements, Define matrix How is each element in the calculation performed, and The use of these weight elements is described in the form of matrix multiplication. The final output is obtained by weighted summation of the value vectors at all time steps. ; , , These three matrices are linear projection matrices of the query, key, and value. Used to project the input Pv into the query space. Used to project the input Pv into the key space. Used to input Projected onto the value space; It is a mask matrix, which ensures the time step We can only focus on history and the current time step This information will prevent future data leaks. when hour), and For time step index, It is a mask matrix The first in Line 1 Column elements; Embedding dimension of the output of the temporal attention layer.

[0148] Among them, the multi-head temporal attention mechanism adopts: Each independent attention head is computed in parallel, and their outputs (denoted as...) are processed. By piecing them together, the potential structural embedding of each node can be obtained according to formula (8);

[0149] (8)

[0150] In the formula, For nodes Potential structural embeddings, For attention head The output results, ; Latent structural embedding of all nodes This constitutes the final potential structural embedding. .

[0151] In one possible implementation, preferably, the structure decoder in step S2 receives the final latent structure embedding output by the structure encoder. The reconstructed adjacency matrix for each time slice is obtained through self-multiplication. As shown in formula (9):

[0152] (9),

[0153] In the formula, Map the output value to , represents the probability of connection between nodes; T represents the transpose.

[0154] In one possible implementation, the structural reconstruction loss described in step S2 Defined as a weighted Frobenius norm loss to address the sparsity problem of the adjacency matrix, as shown in Equation (10):

[0155] (10)

[0156] In the formula, It is the Hadamard product (element-wise multiplication). It is the adjacency matrix tensor of the original dynamic network, which is the weighted adjacency matrix of all time slices. Along the time dimension A stacked three-dimensional tensor; It is a weighted matrix or tensor used to penalize reconstruction errors of non-zero elements to address the sparsity of the adjacency matrix, and is specifically defined as:

[0157] (11),

[0158] In the formula, It is a hyperparameter. yes One of the elements, It is used to penalize the original adjacency matrix. Corresponding element The weight value of the reconstruction error; It is the adjacency matrix tensor of the original dynamic network. One of the elements, representing all time slices Above, node and nodes The weight of the connections (the number of times a connection occurs).

[0159] In one possible implementation, preferably, the attribute autoencoder in step S3 is used to learn the dynamic evolution features of node attributes and jointly complete attribute reconstruction with structural information. The attribute autoencoder includes an attribute encoder and an attribute decoder, respectively used to generate the final latent attribute embeddings of the node attributes. And decode to obtain the reconstructed attribute matrix .

[0160] The attribute encoder includes two MLP (Multilayer Perceptron) layers and a temporal attention layer. The two MLP layers are used to perform nonlinear mapping on the node attribute matrix of each time slice, and then the temporal attention layer is used to capture the attribute evolution pattern.

[0161] The mapping process of the two-layer MLP is as follows: for each time slice Node attribute matrix The time slices are obtained by mapping and encoding through two layers of MLP. The attribute embedding result is shown in the following formula:

[0162] (12),

[0163] (13)

[0164] in: It is a non-linear activation function; It is the bias vector of the first layer MLP, used to... The result is shifted and used as input to a nonlinear activation function; It is the bias vector of the second-layer MLP, used to... The result is shifted to obtain the final time slice. Attribute embedding results ; It is a time film Node attribute matrix The result after the first layer of MLP encoding is used as the input of the second layer of MLP; It is the time slice of the second-layer MLP output. The attribute embedding result; and This is the weight matrix. The first layer of the MLP uses a non-linear activation function. (e.g., ReLU), the second layer of the MLP is a linear transformation and does not use an activation function.

[0165] Embed all time slice attributes into the result (e.g.) Stacked along the timeline, these layers serve as input to the temporal attention layer in the attribute encoder. The temporal attention layer captures the evolution patterns of node attributes across multiple time slices, outputting the final latent attribute embeddings. The temporal attention layer of the attribute encoder and the temporal attention layer of the structure encoder have the same structure, independent parameters, and the same processing principle, so they will not be described in detail here.

[0166] The attribute decoder described in step S3 aims to reconstruct the original attribute matrix by jointly utilizing structural embedding and attribute embedding, emphasizing the complex relationship between structure and attributes.

[0167] The attribute decoder jointly utilizes the final latent structure embedding. and final latent attribute embedding The reconstructed attribute matrix for each time slice is obtained by decoding using the following formula. :

[0168] (14)

[0169] The attribute decoder does not use an activation function (unlike the structure decoder). (Different), to support the reconstruction of property values ​​of arbitrary range and type. T is the transpose.

[0170] In one possible implementation, preferably, the attribute reconstruction loss of the attribute autoencoder described in step S3 is... Defined as a weighted Frobenius norm loss to address potential missing or sparsity in attribute data, the definition is as follows:

[0171] (15)

[0172] In the formula, It is the Hadamard product (element-wise multiplication). It is the attribute matrix tensor of the original dynamic network, which is the node attribute matrix of all time slices. Along the time dimension A stacked three-dimensional tensor; It is a weighting matrix used to introduce additional penalties for reconstruction errors of non-zero elements, specifically defined as:

[0173] (16)

[0174] In the formula, It is a hyperparameter. yes One of the elements, It is used to penalize the original attribute matrix. Corresponding element The weight value of the reconstruction error; It is the original dynamic network attribute matrix tensor One of the elements, representing all time slices Above, node and nodes The weight of the connections (the number of times a connection occurs).

[0175] In one possible implementation, preferably, the joint reconstruction loss described in step S4... For subsequent model training, the definition is as follows:

[0176] (17)

[0177] In the formula, It is a balancing parameter used to adjust the relative importance of structural and attribute information in model learning. For vectors, the Frobenius norm is equivalent to... Norm.

[0178] For a single node Its abnormal score It is defined as the weighted sum of its structural reconstruction loss and attribute reconstruction loss, and the definition is as follows:

[0179] (18)

[0180] In the formula, and These are the adjacency matrices. and attribute matrix Corresponding node The row vector, and These are reconstructing the adjacency matrix. and reconstructing the attribute matrix The corresponding reconstructed row vector; For nodes Structural reconstruction error, node The attribute reconstruction error. For a vector, the Frobenius norm is equivalent to... Norm.

[0181] Scoring Explanation: The higher the score of a node, the greater its structure or properties deviate from the normal pattern learned by the model, and therefore the higher the likelihood of it being identified as an anomalous node.

[0182] In one possible implementation, preferably, the structural reconstruction loss is minimized in step S5. and attribute reconstruction loss The weighted sum, i.e., minimizing the joint reconstruction loss. The loss is used to optimize the weights and bias parameters of the AADDN model, as defined below. The model aims to learn normal patterns of the input dynamic network by minimizing this loss.

[0183] (19)

[0184] Optimizer and Regularization: During the training and optimization of the AADDN model, the AdamW optimizer is used to update the model parameters, and L2 regularization (weight decay) is introduced to prevent overfitting.

[0185] Training details: In a preferred embodiment, model training typically lasts for a fixed number of epochs and uses a fixed learning rate.

[0186] In one possible implementation, preferably, the process of obtaining the node anomaly detection result in step S6 is as follows:

[0187] Identify anomalous nodes: Using the definition of node anomaly scoring in step S4, i.e., formula (18), for each time slice in the test set. Each node on Calculate anomaly scores .

[0188] Results Analysis: The model outputs not only the final list of anomalous nodes, but also the structural reconstruction error and attribute reconstruction error for each node, which helps in further analyzing the anomaly types. Specifically, this can be achieved by sorting the anomaly scores of the nodes and identifying the Top-K nodes with the highest scores as anomalous nodes; or by setting an anomaly threshold. To identify abnormal nodes, analyze the anomaly type based on the structural reconstruction error and attribute reconstruction error of each node:

[0189] High structural reconstruction error: tends to structural anomalies (such as sudden changes in connection patterns).

[0190] High attribute reconstruction error: tends to attribute anomalies (such as attribute value mutations).

[0191] High error rates for both types of errors indicate a tendency towards mixed anomalies.

[0192] Based on the principles of the aforementioned dynamic network anomaly detection methods, this invention also proposes a dynamic network anomaly detection system based on dual autoencoders, which mainly includes:

[0193] Data acquisition and preprocessing module: Obtains the raw data of the dynamic network to be tested, and obtains the data for each time slice after preprocessing. Weighted adjacency matrix and node attribute matrix The resulting dynamic graph sequence The dataset is divided into training and testing sets in chronological order; among them... The total number of nodes. For attribute dimensions, the node attribute matrix Weights in Represents the time step internal nodes With nodes The weights of the edges connecting them;

[0194] The structural autoencoder construction module includes a structural encoder and a structural decoder. The input of the structural autoencoder is each time slice in the training set. Weighted adjacency matrix and node attribute matrix The structural encoder is responsible for encoding the graph structural features into the final latent structural embedding. The structure decoder utilizes Obtain the reconstructed adjacency matrix for each time slice. Reconstructing the adjacency matrix based on all time slices Calculate the structural reconstruction loss The structural reconstruction loss Defined as weighted Frobenius norm loss;

[0195] Attribute Autoencoder Construction Module: The attribute autoencoder includes an attribute encoder and an attribute decoder. The input of the attribute autoencoder is each time slice in the training set. Weighted adjacency matrix and node attribute matrix The attribute encoder is responsible for encoding the graph attribute features into the final latent attribute embedding. The attribute decoder jointly utilizes and Obtain the reconstruction attribute matrix for each time slice. Reconstructed attribute matrix based on all time slices Calculate attribute reconstruction loss The attribute reconstruction loss Defined as weighted Frobenius norm loss;

[0196] Function building blocks: By analyzing the structural reconstruction loss and attribute reconstruction loss We perform a weighted summation to obtain the joint reconstruction loss used for training the model. Simultaneously, by weighted summing the structural reconstruction error and attribute reconstruction error of a single node, a node anomaly score for anomaly detection is obtained. ;

[0197] Model Training and Optimization Module: After completing the AADDN model through the above modules, the AADDN model is trained end-to-end to minimize the joint reconstruction loss. The goal is to optimize the model's weights and bias parameters.

[0198] Node anomaly detection module: Using the trained AADDN model, inference is performed on the dynamic network data in the test set to obtain the final node anomaly detection results.

[0199] Based on the principle of the above-mentioned dynamic network anomaly detection method, this invention also proposes an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-mentioned dynamic network anomaly detection method based on dual autoencoders.

[0200] Based on the principle of the above-mentioned dynamic network anomaly detection method, this invention also proposes a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, the above-mentioned dynamic network anomaly detection method based on dual autoencoders is implemented.

[0201] like Figure 3 , Figure 4 , Figure 5 , Figure 6 , Figure 7 The embodiments of the present invention shown were experimentally validated on multiple real-world dynamic network datasets, including Email, Enron, METR-LA, UCI, and Gowalla. The model performance was evaluated using metrics such as AUC, Precision@K, and Recall@K. Figure 8As shown, the ROC curve is a commonly used evaluation tool in anomaly detection, plotting the relationship between the true positive rate (reflecting the proportion of correctly identified anomalies) and the false positive rate (reflecting the proportion of normal nodes misclassified as anomalies). AUC (area under the ROC curve) represents the probability that a randomly selected anomaly node scores higher than a randomly selected normal node. The closer the AUC value is to 1, the better the method's performance. Each anomaly detection method generates a sorted list based on the node's anomaly score. Precision@K is used to calculate the proportion of true anomaly nodes among the top K nodes in the list. Recall@K: evaluates the proportion of true anomaly nodes accurately detected by the method out of all actual anomaly nodes. The results show that AADDN significantly outperforms existing mainstream methods in all metrics, exhibiting higher detection accuracy and stability.

[0202] like Figure 9 As shown in the figure, parameter sensitivity analysis was also performed in the experiment to verify the robustness of the model to hyperparameters (such as hidden layer dimension, number of attention heads, learning rate, etc.). In multiple independent runs, the proposed method showed a small standard deviation, demonstrating its good stability and generalization ability.

[0203] Experimental results fully demonstrate that by introducing a dual autoencoder architecture and attention mechanism, this invention can effectively capture the complex interaction between structure and attributes in dynamic networks, significantly improving the accuracy and robustness of anomaly detection.

[0204] Unless otherwise specified, the model numbers of the various devices in this embodiment of the invention are not limited, and any device that can perform the above functions is acceptable.

[0205] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of a preferred embodiment, and the sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0206] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0207] Although the functions and working processes of the present invention have been described above in conjunction with the accompanying drawings, the present invention is not limited to the specific functions and working processes described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims, and all of these are within the protection scope of the present invention.

Claims

1. A dynamic network anomaly detection method based on dual autoencoders, characterized in that, Includes the following steps: S1: Acquire dynamic network data and preprocess it. The raw data of the dynamic network to be tested is obtained, and after preprocessing, each time slice is obtained. Weighted adjacency matrix and node attribute matrix The resulting dynamic graph sequence The dataset is divided into training and testing sets in chronological order; among them... The total number of nodes. Weighted adjacency matrix for attribute dimension Weights in Represents the time step internal nodes With nodes The weights of the edges connecting them; S2: Constructing a structural autoencoder The structural autoencoder includes a structural encoder and a structural decoder, and the input of the structural autoencoder is each time slice in the training set. Weighted adjacency matrix and node attribute matrix The structural encoder is responsible for encoding the graph structural features into the final latent structural embedding. The structure decoder utilizes Obtain the reconstructed adjacency matrix for each time slice. Reconstructing the adjacency matrix based on all time slices Calculate the structural reconstruction loss The structural reconstruction loss Defined as weighted Frobenius norm loss; The structure encoder includes a structure attention layer and a temporal attention layer; The structural attention layer obtains the structural embedding of each node in each time step after attention coefficient calculation, Softmax normalization, single-head structural embedding generation, and multi-head attention mechanism operation. Among them, the attention coefficient is calculated as follows: the attention coefficient between each node and its neighboring nodes in each time slice is calculated according to the following formula (1); （1）， In the formula, It is a time film internal nodes Its neighboring nodes Attention coefficient between them It is the LeakyReLU activation function. It is the weight of the edge in time step slice internal nodes With nodes The weight of the edges connecting them. These are the attention parameters, where F is the output dimension defined by the structural attention layer. This represents vector concatenation. Indicates transpose. It is a shared weight matrix. It is a time film internal nodes The D-dimensional original attribute vector, It is a time film internal nodes The D-dimensional original attribute vector, and They come from the node attribute matrix respectively The row and number OK; Among them, Softmax normalization: The attention coefficients calculated in each time slice are normalized by Softmax according to the following formula (2) to obtain the attention weight of each node and its arbitrary neighboring points in each time slice; （2）， In the formula, For time slices internal nodes Its neighboring nodes Attention weights It is an exponential function. For time slices internal nodes Its neighboring nodes Attention coefficient between them For nodes The set of all neighboring nodes in the current time slice; Among them, the single-head structure embedding generation is as follows: according to formula (3), the single-head structure embedding of each node at each time step is generated by weighted summation and application of ELU activation function; （3）， In the formula, For nodes In time slice Single-head structure embedding; Among them, the multi-head attention mechanism adopts: The independent attention heads are computed in parallel, and their outputs are concatenated to obtain the structural embedding of each node at each time step according to formula (4), thereby obtaining the structural embedding time series of each node; （4）， In the formula, For nodes In time slice On the structure embedding, For attention head The output result, , Indicates splicing; Embed the structure of each node into the time series. The input to the temporal attention layer is added to the positional encoding. The temporal attention layer obtains the latent structural embedding of each node after processing through self-attention calculation and multi-head temporal attention mechanism operation. The latent structural embedding of all nodes constitutes the final latent structural embedding. Among them, self-attention calculation: adopts the scaled dot product attention mechanism with mask, and calculates the potential embedding of each node in all time slices according to formula (5); （5）， （6）， （7）， In the formula, Representative node Potential embeddings at all time steps It is a matrix The Middle Line 1 Column elements; , , These three matrices are linear projection matrices of the query, key, and value. Used to project the input Pv into the query space. Used to project the input Pv into the key space. Used to input Projected onto the value space; It is a mask matrix. It is a mask matrix The first in Line 1 Column elements; The embedding dimension of the temporal attention layer output; Among them, the multi-head temporal attention mechanism adopts: Each independent attention head is computed in parallel, and their outputs are concatenated to obtain the potential structure embedding of each node according to formula (8); （8） In the formula, For nodes Potential structural embeddings, For attention head The output result, ; Latent structural embedding of all nodes This constitutes the final potential structural embedding. ; The structure decoder described in step S2 receives the final latent structure embedding output by the structure encoder. The reconstructed adjacency matrix for each time slice is obtained through self-multiplication. As shown in formula (9): （9）， In the formula, Map the output value to , representing the probability of a connection between nodes; T represents the transpose; The structural reconstruction loss described in step S2 Defined as the weighted Frobenius norm loss, as shown in formula (10): （10）， In the formula, It is the Hadamard product; It is the adjacency matrix tensor of the original dynamic network, which is the weighted adjacency matrix of all time slices. Along the time dimension A stacked three-dimensional tensor; It is a weighted matrix or tensor used to penalize reconstruction errors of non-zero elements to address the sparsity of the adjacency matrix, and is specifically defined as: （11）， In the formula, It is a hyperparameter. yes One of the elements, It is used to penalize the original adjacency matrix. Corresponding element The weight value of the reconstruction error; It is the adjacency matrix tensor of the original dynamic network. One of the elements, representing all time slices Above, node and nodes The weights of the connections between them; S3: Building an attribute autoencoder The attribute autoencoder includes an attribute encoder and an attribute decoder, and the input of the attribute autoencoder is each time slice in the training set. Weighted adjacency matrix and node attribute matrix The attribute encoder is responsible for encoding the graph attribute features into the final latent attribute embedding. The attribute decoder jointly utilizes and Obtain the reconstruction attribute matrix for each time slice. Reconstructed attribute matrix based on all time slices Calculate attribute reconstruction loss The attribute reconstruction loss Defined as weighted Frobenius norm loss; The attribute encoder includes two MLP layers and a temporal attention layer. The mapping process of the two-layer MLP is as follows: for each time slice Node attribute matrix The time slices are obtained by mapping and encoding through two layers of MLP. The attribute embedding result is shown in the following formula: （12）， （13）， in: It is the bias vector of the first layer MLP. The meaning is the bias vector of the second-layer MLP; It is a time film Node attribute matrix The result after the first layer of MLP encoding is used as the input of the second layer of MLP; It is the time slice of the second-layer MLP output. The attribute embedding result; and This is the weight matrix; It is a non-linear activation function; The attribute embeddings of all time slices are stacked along the time axis and used as input to the temporal attention layer in the attribute encoder. The temporal attention layer captures the evolution patterns of node attributes across multiple time slices and outputs the final latent attribute embeddings. The temporal attention layer of the attribute encoder and the temporal attention layer of the structure encoder have the same structure but independent parameters. The attribute decoder described in step S3 jointly utilizes the final latent structure embedding. and final latent attribute embedding The reconstructed attribute matrix for each time slice is obtained by decoding using the following formula. : （14）， The attribute reconstruction loss of the attribute autoencoder described in step S3 Defined as the weighted Frobenius norm loss, as shown in Equation (15): （15）， In the formula, It is the Hadamard product; It is the attribute matrix tensor of the original dynamic network, which is the node attribute matrix of all time slices. Along the time dimension A stacked three-dimensional tensor; It is a weighting matrix used to introduce additional penalties for reconstruction errors of non-zero elements, specifically defined as: （16）， In the formula, It is a hyperparameter. yes One of the elements, It is used to penalize the original attribute matrix. Corresponding element The weight value of the reconstruction error; It is the original dynamic network attribute matrix tensor One of the elements, representing all time slices Above, node and nodes The weights of the connections between them; S4: Construct the joint reconstruction loss function and node anomaly scoring function By analyzing structural reconstruction loss and attribute reconstruction loss We perform a weighted summation to obtain the joint reconstruction loss used for training the model. Simultaneously, by weighted summing the structural reconstruction error and attribute reconstruction error of a single node, a node anomaly score for anomaly detection is obtained. ; Wherein, the joint reconstruction loss The definition is as follows: （17）， In the formula, It is a balance parameter; For a single node Its abnormal score It is defined as the weighted sum of its structural reconstruction loss and attribute reconstruction loss, and the definition is as follows: （18）， In the formula, and These are the adjacency matrices. and attribute matrix Corresponding node The row vector, and These are reconstructing the adjacency matrix. and reconstructing the attribute matrix The corresponding reconstructed row vector; For nodes Structural reconstruction error, node Attribute reconstruction error; S5: Model Training and Optimization The AADDN model is established through steps S1-S4 above. End-to-end training of the AADDN model is then performed to minimize the joint reconstruction loss. The goal is to optimize the model's weights and bias parameters. S6: Obtain node anomaly detection results Using the trained AADDN model, inference is performed on the dynamic network data in the test set to obtain the final node anomaly detection results.

2. The dynamic network anomaly detection method based on dual autoencoders according to claim 1, characterized in that, The step S1, which involves acquiring and preprocessing dynamic network data, specifically... The process includes the following: Obtain the original dynamic graph sequence of the dynamic network to be tested. ; among them, each time slice Snapshot It defines the network topology, which contains a shared, fixed set of nodes. and time-varying edge sets Each node in the time slice It also contains related attribute data; According to the edge set Build each time slice Weighted adjacency matrix ; Each time slice The node attribute data is organized into a node attribute matrix. ,in The total number of nodes is given; the node attribute matrix is ​​standardized, including imputing any missing values ​​and normalizing the attribute values; if some nodes in the dynamic network do not have original attributes, a one-hot encoded vector or identity matrix is ​​used as the initial node attribute matrix. ; The entire dynamic graph sequence will be obtained by following the preprocessing steps described above. Then, it is divided into different stages according to time sequence: the first Sequence data at each time step As a training set, used for model training, the sequence data for subsequent time steps As a test set, it is used for model performance evaluation.

3. The dynamic network anomaly detection method based on dual autoencoders according to claim 1, characterized in that, In step S5, the joint reconstruction loss is minimized. The following formula is used to optimize the weights and bias parameters of the AADDN model: （19）， During the training and optimization of the AADDN model, the AdamW optimizer is used to update the model parameters, and L2 regularization is introduced to prevent overfitting.

4. The dynamic network anomaly detection method based on dual autoencoders according to claim 1, characterized in that, The process of obtaining the node anomaly detection result in step S6 is as follows: Using the definition of node anomaly scoring in step S4, for each time slice in the test set Each node on Calculate anomaly scores ; By sorting the anomaly scores of nodes, the top-K nodes with the highest scores are identified as anomalous nodes; or by setting an anomaly threshold. To determine abnormal nodes; Analyze the anomaly types based on the structural reconstruction error and attribute reconstruction error of each node.

5. A dynamic network anomaly detection system based on dual autoencoders, according to any one of claims 1 to 4, characterized in that, include: Data acquisition and preprocessing module: Obtains the raw data of the dynamic network to be tested, and obtains the data for each time slice after preprocessing. Weighted adjacency matrix and node attribute matrix The resulting dynamic graph sequence The dataset is divided into training and testing sets in chronological order; among them... The total number of nodes. For attribute dimensions, the node attribute matrix Weights in Represents the time step internal nodes With nodes The weights of the edges connecting them; Structural Autoencoder Construction Module: The structural autoencoder includes a structural encoder and a structural decoder. The input of the structural autoencoder is each time slice in the training set. Weighted adjacency matrix and node attribute matrix The structural encoder is responsible for encoding the graph structural features into the final latent structural embedding. The structure decoder utilizes Obtain the reconstructed adjacency matrix for each time slice. Reconstructing the adjacency matrix based on all time slices Calculate the structural reconstruction loss The structural reconstruction loss Defined as weighted Frobenius norm loss; Attribute Autoencoder Construction Module: The attribute autoencoder includes an attribute encoder and an attribute decoder. The input of the attribute autoencoder is each time slice in the training set. Weighted adjacency matrix and node attribute matrix The attribute encoder is responsible for encoding the graph attribute features into the final latent attribute embedding. The attribute decoder jointly utilizes and Obtain the reconstruction attribute matrix for each time slice. Reconstructed attribute matrix based on all time slices Calculate attribute reconstruction loss The attribute reconstruction loss Defined as weighted Frobenius norm loss; Function building blocks: By analyzing the structural reconstruction loss and attribute reconstruction loss We perform a weighted summation to obtain the joint reconstruction loss used for training the model. Simultaneously, by weighted summing the structural reconstruction error and attribute reconstruction error of a single node, a node anomaly score for anomaly detection is obtained. ; Model Training and Optimization Module: After completing the AADDN model through the above modules, the AADDN model is trained end-to-end to minimize the joint reconstruction loss. The goal is to optimize the model's weights and bias parameters. Node anomaly detection module: Using the trained AADDN model, inference is performed on the dynamic network data in the test set to obtain the final node anomaly detection results.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the dynamic network anomaly detection method based on dual autoencoders as described in any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the dynamic network anomaly detection method based on dual autoencoders as described in any one of claims 1 to 4.

Images