A social network event anomaly detection method based on dynamic graph atom mining and time sequence comparison

Abstract

The application belongs to the field of communication, and particularly relates to a social network event anomaly detection method based on dynamic graph atomic mining and time sequence comparison, which comprises the steps of data acquisition, construction of a time sequence snapshot of a dynamic event graph, dynamic graph atomic mining and fingerprint generation, identification of structural anomalies, and anomaly tracing and detection, wherein a basic structural unit (atom) with clear physical connection semantics is extracted from a dynamic snapshot through a Boolean matrix decomposition technology, and an efficient time sequence comparison mechanism is constructed in combination with a Weisfeiler-Lehman graph fingerprint algorithm. The application can not only sensitively capture abnormal evolution and mutation of high-order topological structures from a mass of noisy event streams, but also reversely trace abstract calculation results to specific and explainable event signs, so that precise perception and early warning of complex social network event anomalies are realized.

Description

Technical Field

[0001] This invention belongs to the field of communications, specifically a method for detecting anomalies in social network events based on dynamic graph atom mining and time-series comparison. Background Technology

[0002] In today's highly interconnected information society, graph data has become a core carrier for describing complex relationships. Whether it's user interactions in social networks, fund flows in financial systems, device communication in the Internet of Things, or various emergencies in social governance, they can all essentially be modeled as complex networks composed of nodes (entities) and edges (relationships). Compared to traditional structured tabular data or independent time-series data, graph data intuitively maps the multidimensional interactions between entities in the real world through its topological structure. It can explicitly express direct relationships and uncover potential indirect relationship patterns through multi-hop paths. Representing discrete events as graph data can break through the limitations of traditional statistical analysis, capturing systematic relationships such as causality, temporality, and co-occurrence between events in a structured form, transforming isolated event points into knowledge networks with global semantics.

[0003] However, the event networks of social networks are often highly dynamic and adversarial. Their anomalies are often not just manifested as sudden changes in traffic at a single node (such as a user), but more often as abnormal evolutions in local topological patterns. Therefore, event anomaly detection often faces two core challenges: First, the concealment of structural mutations: normal single-point behaviors combined together may constitute abnormal collaborative patterns (for example, multiple previously unrelated groups of accounts suddenly forming a closed loop connection). Such high-order structural changes are key to situational awareness and risk warning, but are extremely difficult to capture by traditional methods based on statistical characteristics (such as degree distribution and average path length). Second, the continuity of temporal evolution: the development of an event is a continuous process. Static slice analysis easily severs the causal relationships between events, making it difficult to reconstruct the structural evolution path "from quantitative change to qualitative change".

[0004] To extract key patterns and detect anomalies from complex social network data, current technologies primarily rely on numerical computation methods such as matrix factorization or graph embedding. For example, traditional matrix factorization or embedding algorithms typically operate in the real number domain, outputting abstract vectors or matrices containing numerous floating-point numbers or even negative numbers. However, in real-world event networks, relationships between entities are usually Boolean (i.e., occurred or not occurred), lacking the physical meaning of 0.5 connections or -1 interactions. This makes it difficult to reconstruct the analysis results into concrete, understandable event subgraph structures, hindering analysts' intuitive interpretation of the core patterns discovered by the model. Furthermore, real-world events often contain multiple types of nodes and edges; existing numerical methods frequently obfuscate heterogeneous information, making it difficult to extract pure structural patterns while preserving their inherent semantics.

[0005] In static graph anomaly detection, existing methods primarily focus on mining the geometric structural features and node attribute information of the graph, identifying anomalies by constructing similarity relationships between data. For example, Xu et al. considered both feature and label correlation to learn the static graph structure, not only extracting features from grid data but also adding additional inferable information to the graph features. Cheng et al. used static graph structural features to control flow-related anomalies, requiring not only discriminant regions to overcome subtle intra-class variations but also iterative enhancement of information elements and suppression of useless elements to improve the model's discriminative ability. Zhang et al. used low-rank representations of graph regularization to preserve structural information, leveraging the geometric structure of the data to understand potential data patterns. Zheng et al. employed graph theory methods, proposing to transform the raw data into a form that can be input into a graph convolutional network for overall representation of the population. Furthermore, some methods determine anomalies by calculating the structural similarity between nodes, such as sampling lower-level nodes based on top-level nodes, using skip links to maintain second-order approximation, or unifying local and global similarity into a graph model. However, these static methods cannot effectively handle the continuous evolution of event patterns in dynamic social networks.

[0006] Dynamic graph anomaly detection methods aim to discover anomalous patterns that deviate from the mainstream behavior of a network over time, focusing on challenges such as temporality, non-stationarity, and noise. These methods typically track changes in the network over time and study the evolution of relationships between nodes to detect anomalies. It is crucial to distinguish that benign evolutionary behaviors such as the deletion, addition, alteration, or updating of nodes or edges during dynamic graph evolution should not be considered anomalous. Existing dynamic detection techniques include Fernandes et al.'s use of tensor modeling and adding dimensions to consider attribute information, seeking general patterns from a full graph tensor perspective to detect anomalies. Yang et al. treated model parameters as random variables and used a hierarchical graph model to process these parameters, enabling the system to better handle changing random data. Duan et al. proposed a semi-supervised learning anomaly detection method based on dynamic piecewise linear graph neural networks, which has the advantage of measuring the correlation between nodes to better describe the topological information of the graph structure, but suffers from the problem that local constraints may fail with gradient updates. Sofuoglu et al. introduced an unsupervised tensor-based anomaly detection method that considers both anomalous sparsity and temporal continuity, and used graph total change minimization to approximate rank minimization to reduce optimization complexity.

[0007] In summary, the existing technology has the following main problems:

[0008] Semantic gap and poor interpretability: Traditional decomposition or embedding methods based on the real number field generate a large number of floating-point numbers or negative numbers without physical meaning when processing Boolean event networks. This makes it impossible to intuitively restore the analysis results to the real, discrete event interaction logic, forming a "semantic gap" that makes the detection results difficult for domain experts to understand and trust.

[0009] The dilemma between efficiency and accuracy: Existing structural anomaly detection technologies mainly face a choice between efficiency and accuracy. On the one hand, methods relying on exact subgraph isomorphism algorithms (such as exact matching) are limited by the combinatorial explosion of NP-complete problems, making it difficult to meet the real-time processing needs of massive dynamic data streams; on the other hand, methods relying on coarse static statistical indicators, although highly efficient, lack sensitivity to subtle reorganizations and mutations in high-order topologies, making it difficult to capture hidden cooperative anomaly patterns.

[0010] Insufficient handling of dynamism and heterogeneity: Most methods fail to effectively integrate temporal evolution information, making it difficult to depict the continuous evolution path of events "from quantitative change to qualitative change"; at the same time, for heterogeneous event networks containing multiple node and edge types, there is a lack of effective means to extract pure structural patterns while preserving heterogeneous semantics. Summary of the Invention

[0011] The purpose of this invention is to address the problems existing in the prior art by proposing a social network event anomaly detection method based on dynamic graph atom mining and time-series comparison. This method can balance real-time performance, high accuracy, and strong interpretability, and can effectively handle dynamic evolution and high-order topology structures in social network event anomaly detection, thereby achieving accurate and interpretable network security situation awareness and risk warning.

[0012] To achieve the above objectives, the present invention adopts the following technical solution:

[0013] A method for detecting anomalies in social network events based on dynamic graph atom mining and temporal alignment includes the following steps:

[0014] S1. Data Acquisition: Acquire continuous, dynamic time-series data of social networks;

[0015] S2. Constructing a time-series snapshot of a dynamic event graph: Based on the time-series data obtained in step S1, construct a dynamic social network event graph; deconstruct the dynamic event graph into a sequence of discrete graph snapshots arranged in chronological order;

[0016] S3. Dynamic Graph Atom Mining and Fingerprint Generation: An atom extraction technique based on egocentric network sampling and Boolean matrix factorization is used to extract atoms with explicit connection semantics from discrete graph snapshot sequences; the Weisfeiler-Lehman graph hashing algorithm is used to generate a high-order topological fingerprint with permutation invariance for each atom;

[0017] S4. Identify structural anomalies: Based on the established historical atomic fingerprint paradigm library and the topological fingerprint obtained in step S3... A dual-gating comparison strategy is used to identify structural anomalies;

[0018] S5. Anomaly Tracing and Detection: Construct a multi-level mapping database containing topological fingerprints, atoms, original graph snapshots, and network entities; based on the structural anomaly topological fingerprints output in step S4, retrieve the mapping database to reverse locate one or more key atoms that triggered the anomaly; further trace back to the corresponding original graph snapshots and specific network entities and interactions in step S2; by integrating the attributes of social network entities, the timeline of behavior occurrence, and snapshot sequence information, output semantically interpretable event symptoms, realizing a closed-loop analysis from abstract topological mining to specific social network event anomalies.

[0019] Furthermore, step S2 specifically includes the following sub-steps:

[0020] S21. Based on the time series data obtained in step S1, construct a dynamic social network event graph. ,in and It is the set of all nodes and edges that have appeared. Is with the edge or node Associated timestamp and duration information;

[0021] S22. Define the analysis time window Based on the selected analysis time window , the entire continuous time domain Divide the time into T consecutive and non-overlapping time intervals, with each time interval denoted as . ;

[0022] S23. Define each time interval after division using a left-closed, right-open interval form: ;

[0023] S24. For each time interval divided according to the left-closed-right-open rule... Construct the corresponding static graph snapshot This will enable the dynamic event graph to be displayed. Deconstructed into a discrete graph snapshot sequence arranged in chronological order .

[0024] Furthermore, in step S3, the process of extracting atoms with explicit connection semantics from the discrete graph snapshot sequence specifically includes:

[0025] Extracting atoms with explicit connection semantics from a discrete graph snapshot sequence; the specific implementation process includes:

[0026] For static image snapshots Each node in Extract from this node A subgraph with a central node, containing itself, its neighbors, and all edges connecting these nodes, is named an egocentric network. ;

[0027] Each egocentric network is represented as a two-dimensional adjacency matrix. The elements in the matrix are either 0 or 1, where 0 indicates no interaction between nodes and 1 indicates interaction. By introducing a vectorization operator, each two-dimensional adjacency matrix is ​​transformed. The column vectors are concatenated end-to-end to obtain the corresponding one-dimensional column vector. Within the same time slice, the column vectors of all nodes Concatenate them according to their node numbers to construct the sampling matrix for the current time slice;

[0028] Based on a nonnegative Boolean matrix, a greedy iterative strategy is used to decompose the sampling matrix round by round: in each round, the difference between the original matrix and the reconstructed part is calculated as the current residual matrix, and the outer product of the column vector and the row vector that maximizes the coverage of the remaining 1 element is selected as the new atom. This process is iterated until the stopping condition is met, resulting in a dictionary matrix. With sparse code matrix ;

[0029] For each atom column vector in the dictionary matrix D, it is inverse vectorized to restore it to a two-dimensional adjacency matrix and reconstructed into an atom; graph isomorphism detection is performed to remove duplicate structures, and finally a unique set of atoms for the current time slice is formed.

[0030] Furthermore, the specific process of generating a high-order topological fingerprint with permutation invariance for each atom using the Weisfeiler-Lehman graph hashing algorithm includes:

[0031] For each atom Each node in Initial labels are assigned to combine and map the entity type of a node with its degree information; the initial labels are identified as follows:

[0032] ;

[0033] in, Indicates the initial label. Represents the degree information of a node;

[0034] For each atom, the iteration round is determined by the atom's diameter. , Perform on all nodes within the atom Round tag propagation and aggregation operations enable each node to aggregate its tags. Structural and semantic information within the skip neighborhood; where, the first In the round of iteration, For each node v within the atom, perform the following update operation in sequence:

[0035] Neighborhood aggregation: collecting nodes All neighboring nodes In the previous round of labeling, multiple sets were formed. ;

[0036] Sorting and Normalization: For Multisets The labels in the nodes are sorted to obtain an ordered sequence of neighbor labels; hash compression: [This process is repeated in the original text, so the translation ends here.] The previous label of oneself The node is obtained by concatenating the sorted neighbor label sequence with the sorted neighbor label sequence and mapping the concatenation result using a deterministic hash function. The Wheel Label The mapping relationship is as follows:

[0037] ;

[0038] in Represents a deterministic hash function. For sorting operations, The update / assignment symbol is used to formally define the result of the hash calculation as a node. The attribute state in this iteration;

[0039] Finish After rounds of iteration, count the final labels of all nodes in atom a. The frequency of occurrence is used to construct a histogram vector. ,in The histogram vector For the topological fingerprint of atoms.

[0040] Furthermore, the historical atomic fingerprint paradigm library is a persistent and dynamically updated atomic fingerprint library. Its initial state is an empty set, and it is configured to receive atoms that are determined to be non-structural anomalous by a dual-gated comparison strategy, and incorporate them as new normal patterns into the historical atom fingerprint paradigm library.

[0041] Furthermore, the dual-gating comparison strategy in step S4 includes:

[0042] First layer of isomorphic precise matching gating: based on historical atomic paradigm fingerprint database In the hash table, check if the hash topological fingerprint corresponding to the atom obtained in step S3 exists. If it exists, determine that the corresponding atom a is a known pattern.

[0043] Second similarity fuzzy filtering gate: If the first isomorphic exact matching gate does not find a match, the similarity between the hash topological fingerprint obtained in step S3 and the historical atomic paradigm fingerprint is calculated; if any similarity is higher than a preset threshold, the atom a corresponding to the hash topological fingerprint is determined to be a non-topological isomorphic variant of a known pattern and is filtered; otherwise, the atom a corresponding to the hash topological fingerprint is determined to be an event anomaly.

[0044] This invention proposes a method for detecting anomalies in social network events based on dynamic graph atom mining and temporal alignment. This method overcomes the shortcomings of traditional numerical computation in processing discrete social network event networks. It extracts fundamental structural units (atoms) with clear physical connectivity semantics from dynamic snapshots using Boolean matrix factorization and constructs an efficient temporal alignment mechanism using the Weisfeiler-Lehman graph fingerprint algorithm. This method can not only keenly capture anomalous evolutions and mutations in high-order topologies from massive, noisy event streams, but also trace abstract computational results back to specific, interpretable event symptoms, achieving accurate perception and early warning of anomalies in complex social network events.

[0045] Compared with the prior art, the present invention has the following beneficial effects:

[0046] 1. This invention utilizes Boolean matrix factorization technology to ensure that each extracted atom corresponds to a real, existing pattern subgraph with clear interaction relationships, possessing certain physical meaning and semantic interpretability, so that the analysis results are no longer abstract mathematical vectors, but directly understandable pattern results;

[0047] 2. This invention introduces the Weisfeiler-Lehman graph hashing algorithm, transforming complex graph structure comparisons into linear vector fingerprint calculations, significantly reducing time complexity. Simultaneously, combined with a flexible gating mechanism based on cosine similarity, the system can effectively tolerate data noise and normal structural variations, significantly reducing the false alarm rate while maintaining high detection sensitivity.

[0048] 3. This invention establishes a bidirectional mapping mechanism from atomic structure to original graph entities. When the system detects a topological anomaly, it can immediately use the mapping table to reverse locate the specific entity constituting the anomaly pattern (such as a specific account or specific behavior at a specific location), realizing a complete source tracing loop from abstract topological anomalies to specific social network event anomalies. Attached Figure Description

[0049] Figure 1This is a schematic diagram of the social network event anomaly detection method based on dynamic graph atom mining and time-series comparison of the present invention;

[0050] Figure 2 This describes the Boolean matrix modeling process in the example. Detailed Implementation

[0051] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and embodiments.

[0052] like Figure 1 As shown in the figure, this embodiment provides a method for detecting anomalies in social network events based on dynamic graph atomic mining and time-series comparison, which includes the following steps:

[0053] S1. Data Acquisition: Acquire continuous, dynamic time-series data of social networks;

[0054] The time-series data includes attribute information of entities in the social network, information on related events between entities, and timestamps and durations of the related events.

[0055] S2. Constructing a Temporal Snapshot of the Dynamic Event Graph: In dynamic event analysis, the evolution of social network events is essentially a continuous evolution of a graph structure. However, directly performing pattern mining on the evolution of graph topology in the continuous time domain presents computational complexity and is difficult to implement. Therefore, in order to effectively extract semantically valuable structured patterns from unstructured, asynchronous, continuous event streams and reveal their evolutionary patterns over time, it is first necessary to perform temporal discretization on the dynamic event graph, deconstructing it into a series of computable discrete units, i.e., a temporal snapshot of the dynamic event graph. The specific implementation process is as follows:

[0056] Define the dynamic social network event network as a tuple. ,in and It is the set of all nodes and edges that have appeared. Is with the edge or node Associated timestamp and duration information.

[0057] Define the analysis time window Analysis time window The selection of [atom] is a crucial trade-off decision, and its rationality will directly affect the mining results of subsequent event atoms. If the value is too small, although it can capture high-frequency instantaneous events, it will result in an extremely large number of graph snapshots being generated, and each snapshot will be too sparse, containing only a small amount of activity information for nodes and edges, significantly increasing the resource overhead of computation and storage, as well as data noise interference; if While excessively large values ​​can achieve data smoothing, they can also "compress" a large number of originally unrelated short-term events into a single snapshot, causing "event confusion" and rendering the system insensitive to the timing of evolution details. Therefore, based on event characteristics, values ​​are typically set... For one day, at the same time, The settings are not fixed and can be dynamically adjusted based on the intensity of current network traffic and the frequency of events.

[0058] Based on the selected analysis time window , the entire continuous time domain Divide the time into T consecutive and non-overlapping time intervals, with each time interval denoted as . To ensure continuity and unambiguity in time coverage, each time interval is defined using a left-closed, right-open interval format: ;

[0059] For each time interval divided according to the left-closed and right-open rule Construct the corresponding static graph snapshot This snapshot precisely encapsulates the... All graph activities within the interval:

[0060] Node set : Included in this time interval All nodes that have active behavior (such as sending / receiving information, or undergoing displacement) or have been newly created. ;

[0061] Edge set : Included in this time interval All edges that occur within a given timeframe (such as a momentary transaction) or persist (such as a continuous relationship). ;

[0062] Through the above process, the originally continuous and complex dynamic event diagram... It was successfully deconstructed into a discrete sequence of time-ordered image snapshots. Each of the sequences These represent state slices of the system within a specific time window. This discretization process forms the basis for subsequent periodic atomic mining and anomaly time series comparison calculations.

[0063] S3. Dynamic Graph Atom Mining and Fingerprint Generation:

[0064] S31. Dynamic Graph Atom Mining: After obtaining a temporal snapshot of the dynamic event graph, in order to mine fundamental patterns (atoms) with universal significance and clear physical semantics from the complex network structure, this embodiment abandons the traditional real-domain matrix factorization method and proposes an atom extraction technique based on egocentric network sampling and Boolean matrix factorization. This process transforms the pattern mining of the graph structure into a Boolean matrix sparse representation problem. The specific implementation process is as follows:

[0065] To achieve large-scale static graph snapshots An effective representation of first requires decomposing it into a set of local structures and mapping it to a vector space, such as Figure 2 As shown. Specifically:

[0066] For static image snapshots Each node in Extract from this node A subgraph with a central node, containing itself, its neighbors, and all edges connecting these nodes, is named an egocentric network. ;

[0067] Each egocentric network Represented as a two-dimensional adjacency matrix Due to the sparsity of the event graph, the two-dimensional adjacency matrix... The elements in the matrix are either 0 or 1, representing either no interaction event between nodes or the presence of an interaction event, respectively. Vectorization operators are introduced to perform matrix operations. . The two-dimensional adjacency matrix The column vectors are concatenated end to end to form a one-dimensional column vector. For a network with N nodes, generate all column vectors. By concatenating the data in chronological order, the sampling matrix of the current time slice is constructed. .

[0068] After obtaining the sampling matrix, traditional sparse representations (such as K-SVD) will produce floating-point numbers and negative numbers (such as 0.5 or -1.5) during decomposition, which cannot be interpreted in Boolean logic describing whether an event has occurred. Therefore, this embodiment addresses the sampling matrix... Perform nonnegative sparse decomposition. The goal of the Boolean matrix factorization algorithm is to decompose the input sample matrix. Decompose into the product of two Boolean matrices. ;in Represents a dictionary matrix. This represents a sparse code matrix. During the decomposition process, the dictionary matrix is ​​subject to strict constraints. Sparse code matrix all elements The objective of decomposition is equivalent to finding the matrix. The goal is to find the "non-contiguous all-1 rectangle" with the largest coverage area. This embodiment employs a greedy strategy, in each iteration, mining the rectangular pattern (i.e., column vector) from the residual matrix that maximizes the coverage of the remaining 1 elements. with row vectors The outer product of the two atoms is added to the dictionary as a new atom until the reconstruction error meets the preset threshold.

[0069] After matrix factorization, the dictionary matrix The dictionary matrix D stores atoms in column vector form; therefore, it is necessary to reconstruct each atom column vector in the dictionary matrix D into a graph structure and then simplify it. This embodiment addresses the dictionary matrix... Each column vector in Through inverse vectorization, the atom is restored to a two-dimensional adjacency matrix and reconstructed into specific event atoms. Simultaneously, since different dictionary vectors may represent subgraphs with identical topological structures but different node numbers (i.e., isomorphic graphs), graph isomorphism detection is performed on the reconstructed atom set to ensure the conciseness and uniqueness of the atom library. Atoms with duplicate structures are removed, and finally, only the following remain: Each unique atom forms the set of atoms for the current time slice. Fingerprint generation: After extracting the set of atoms from the graph snapshot, the core challenge of the system is how to efficiently determine whether the currently extracted atom is isomorphic to atoms in the historical database, or to calculate the similarity between the current atom and historical atoms. Accurate subgraph isomorphic matching is an NP-complete problem, which is difficult to meet the needs of real-time monitoring. Therefore, this embodiment uses the Weisfeiler-Lehman (WL) graph hashing algorithm, which has strong discriminative power in the field of graph representation learning. Through an iterative topological information aggregation mechanism, it maps complex atomic structures into unique and normalized vector fingerprints. The specific implementation process is as follows:

[0070] For each node in each atom An initial label is assigned to map the node's entity type (e.g., "account", "IP", "organization") to the node's degree information; this ensures that the subsequently generated fingerprint not only reflects the topological structure but also contains the node's semantic information; the initial label is set as an encoded combination of node attributes, rather than a single index value; the initial label is identified as:

[0071] ;

[0072] in, Indicates the initial label. This indicates the degree information of a node.

[0073] For each atom, let the diameter of the atomic subgraph be d. Set the total number of iterations for message passing to K, and let K = d. Under this setting, after K iterations, each node will be able to aggregate its K-hop neighborhood, i.e., the information within the entire atomic subgraph. The specific iteration process is as follows: For the k-th iteration, k = 1, 2, ..., K, perform the following update operation on each node v:

[0074] Neighborhood aggregation: collecting nodes All neighboring nodes The previous round of tags formed a multiset:

[0075] ;

[0076] in, The multiset consisting of the labels of all neighboring nodes. Indicates a label, Indicates the center The set of neighboring nodes in the neighborhood set. Let be any one of the neighboring nodes.

[0077] Sorting and Normalization: To ensure the algorithm is insensitive to the order of nodes, i.e., satisfies permutation invariance, it is necessary to perform sorting and normalization on multisets. Sort the labels in the array in ascending order to obtain an ordered sequence;

[0078] Hash compression: [This refers to the process of compressing nodes] The previous label of oneself The label is then concatenated with the sorted list of neighboring node labels in an ordered manner, and the concatenation result is mapped to a new integer label using a deterministic hash function. , so as to use nodes Centered The subtree structure compression, for a concise hash value, has the following mapping formula:

[0079] ;

[0080] Once the preset number of iterations is reached or the label states converge, the final labels of all nodes in the atom are transformed into a global feature vector. First, the atoms are statistically analyzed. Final label of all nodes The frequency of occurrence. Then, a histogram vector is constructed based on the statistical results. ,in It is a specific tag The number of times it appears in this atom. This vector. This is the "topological fingerprint" of the atom. It has two key characteristics: first, uniqueness and robustness: two isomorphic graphs will almost always produce the same fingerprint (the probability of hash collisions is extremely low), while the fingerprints of non-isomorphic graphs differ significantly; second, computational efficiency: by transforming graph structure comparison into vector space comparison, the computational complexity is reduced from exponential to linear. It supports real-time processing of large-scale data.

[0081] S4. Identifying Structural Anomalies: After obtaining the topological fingerprints of atoms, this embodiment, based on a set historical atom fingerprint paradigm library, uses a dual-gating comparison strategy to quickly identify novel structures that deviate from the norm in massive amounts of data. The specific implementation process includes:

[0082] Define a persistent, dynamically updated historical atomic paradigm fingerprint database. Its initialization is empty, and the update rule is: as monitoring proceeds, new atomic fingerprints that are judged to be normal will be continuously absorbed into the library, thereby possessing the ability to adapt to environmental changes and continuously learn.

[0083] For each atom extracted from the current time slice Utilizing its topological fingerprint fingerprint database of historical atomic paradigms An anomaly is determined by executing a dual-gating comparison strategy. The dual-gating comparison strategy is a combination of isomorphic precise matching and similarity fuzzy filtering; its implementation method is as follows:

[0084] Isomorphic precise matching: in the historical atomic paradigm fingerprint database Search the hash table for the topological fingerprint corresponding to the current atom 'a'. Does it exist? Since WL fingerprints are unique, a hash hit means that the current atom is topologically isomorphic to a historical atom.

[0085] Similarity fuzzy filtering: After isomorphic exact matching fails, the similarity calculation formula is used to calculate the current topological fingerprint. fingerprint database of historical atomic paradigms The fingerprint similarity of all historical vectors in the dataset; the similarity calculation formula is:

[0086] ;

[0087] in, For atoms The topological fingerprint vector, Let be the dimension of the fingerprint vector. Representing vectors In the The values ​​can be taken in each dimension.

[0088] When any historical atomic paradigm fingerprint has a similarity to the current atom 'a' higher than a preset threshold. The threshold in this embodiment If the value is 0.95, the current atom 'a' is determined to be a minor change within a known pattern, considered a normal sample, and filtered out; otherwise, the current atom 'a' is marked as an event anomaly, indicating the emergence of a new event pattern. In this embodiment, a minor change refers to changes such as the addition of an insignificant noise edge or a slight drift in node labels.

[0089] S5. Source Mapping: By utilizing the mapping relationship between the original graph and atoms in sparse decomposition, the anomalies identified in step S4 are reversed to the specific nodes and edges of the original snapshot, thereby anchoring the source of the anomalies; by using source mapping analysis to analyze the causal and temporal relationships between these located anomaly nodes and edges, they are restored into actionable event clues, ultimately achieving accurate detection of social network event anomalies.

[0090] In summary, the social network event anomaly detection method of this embodiment, in dynamic graph atom mining, employs an atom extraction technique based on egocentric network sampling and Boolean matrix factorization to extract a set of binary atoms with clear physical semantics, achieving accurate extraction and reconstruction of the key interaction patterns, i.e., atoms, hidden in the event network. In fingerprint generation, the Weisfeiler-Lehman graph hashing algorithm is used to generate a unique fingerprint for each atom, transforming the highly complex graph isomorphism comparison into efficient vector numerical computation, achieving efficient topological encoding that maps discrete event subgraphs to fixed-dimensional numerical vectors. In the process of identifying anomalies, a dual-gating comparison strategy is designed to filter out conventional patterns while performing fault-tolerant identification and precise locking of structural mutations in event evolution, combined with reverse tracing to locate specific anomalies, thereby achieving highly robust and accurate detection of social network event anomalies.

Claims

1. A method for detecting anomalies in social network events based on dynamic graph atomic mining and temporal alignment, characterized in that, Includes the following steps: S1. Data Acquisition: Acquire continuous, dynamic time-series data of social networks; S2. Constructing a time-series snapshot of a dynamic event graph: Based on the time-series data obtained in step S1, construct a dynamic social network event graph; deconstruct the dynamic event graph into a discrete graph snapshot sequence arranged in chronological order; S3. Dynamic Graph Atom Mining and Fingerprint Generation: Employing an atom extraction technique based on egocentric network sampling and Boolean matrix factorization, atoms with explicit connection semantics are extracted from discrete graph snapshot sequences according to the following steps: Extracting atoms with explicit connection semantics from a discrete graph snapshot sequence; the specific implementation process includes: For static image snapshots Each node in Extract from this node A subgraph with a central node, containing itself, its neighbors, and all edges connecting these nodes, is named an egocentric network. ; Each egocentric network is represented as a two-dimensional adjacency matrix. The elements in the matrix are either 0 or 1, where 0 indicates no interaction between nodes and 1 indicates interaction. By introducing a vectorization operator, each two-dimensional adjacency matrix is ​​transformed. The column vectors are concatenated end-to-end to obtain the corresponding one-dimensional column vector. Within the same time slice, the column vectors of all nodes Concatenate them according to their node numbers to construct the sampling matrix for the current time slice; Based on a nonnegative Boolean matrix, a greedy iterative strategy is used to decompose the sampling matrix round by round: in each round, the difference between the original matrix and the reconstructed part is calculated as the current residual matrix, and the outer product of the column vector and the row vector that maximizes the coverage of the remaining "1" elements is selected as the new atom. This process is iterated until the stopping condition is met, resulting in a dictionary matrix. With sparse code matrix ; For each atom column vector in the dictionary matrix D, it is inverse vectorized to restore it to a two-dimensional adjacency matrix and reconstructed into an atom; graph isomorphism detection is performed to remove duplicate structures, and finally a unique set of atoms for the current time slice is formed. The Weisfeiler-Lehman graph hashing algorithm is used to generate a high-order topological fingerprint with permutation invariance for each atom; S4. Identify structural anomalies: Based on the established historical atomic fingerprint paradigm library and the topological fingerprint obtained in step S3... A dual-gating comparison strategy is used to identify structural anomalies; S5. Anomaly Tracing and Detection: Construct a multi-level mapping database containing topological fingerprints, atoms, original graph snapshots, and network entities; based on the structural anomaly topological fingerprints output in step S4, retrieve the mapping database to reverse locate one or more key atoms that triggered the anomaly; further trace back to the corresponding original graph snapshots and specific network entities and interactions in step S2; by integrating the attributes of social network entities, the timeline of behavior occurrence, and snapshot sequence information, output semantically interpretable event symptoms to achieve closed-loop analysis from abstract topological mining to specific social network event anomalies.

2. The method for detecting anomalies in social network events based on dynamic graph atom mining and temporal comparison according to claim 1, characterized in that, Step S2 specifically includes the following sub-steps: S21. Based on the time-series data obtained in step S1, construct a dynamic social network event graph. ,in and It is the set of all nodes and edges that have appeared. Is with the edge or node Associated timestamp and duration information; S22. Define the analysis time window Based on the selected analysis time window , the entire continuous time domain Divide the time into T consecutive and non-overlapping time intervals, with each time interval denoted as . ; S23. Define each time interval after division using a left-closed, right-open interval form: ; S24. For each time interval divided according to the left-closed-right-open rule... Construct the corresponding static graph snapshot This will enable the dynamic event graph to be displayed. Deconstructed into a discrete graph snapshot sequence arranged in chronological order .

3. The method for detecting anomalies in social network events based on dynamic graph atomic mining and temporal comparison according to claim 1, characterized in that, The specific process of generating a high-order topological fingerprint with permutation invariance for each atom using the Weisfeiler-Lehman graph hashing algorithm includes: For each atom Each node in Initial labels are assigned to combine and map the entity type of a node with its degree information; the initial labels are identified as follows: ； in, Indicates the initial label. Represents the degree information of a node; For each atom, the iteration round is determined by the atom's diameter. , Perform on all nodes within the atom Round tag propagation and aggregation operations enable each node to aggregate its tags. Structural and semantic information within the skip neighborhood; where, the first In the round of iteration, For each node v within the atom, perform the following update operation in sequence: Neighborhood aggregation: collecting nodes All neighboring nodes In the previous round of labeling, multiple sets were formed. ; Sorting and Normalization: For Multisets The labels in the nodes are sorted to obtain an ordered sequence of neighbor labels; hash compression: [This process is repeated in the original text, so the translation ends here.] The previous label of oneself The node is obtained by concatenating the sorted neighbor label sequence with the sorted neighbor label sequence and mapping the concatenation result using a deterministic hash function. The Wheel Label The mapping relationship is as follows: ； in Represents a deterministic hash function. For sorting operations, The update / assignment symbol is used to formally define the result of the hash calculation as a node. The attribute state in this iteration; Finish After rounds of iteration, count the final labels of all nodes in atom a. The frequency of occurrence is used to construct a histogram vector. ,in The histogram vector For the topological fingerprint of atoms.

4. The method for detecting anomalies in social network events based on dynamic graph atomic mining and temporal comparison according to claim 1, characterized in that, The historical atomic fingerprint paradigm library is a persistent and dynamically updated atomic fingerprint library. Its initial state is an empty set, and it is configured to receive atoms that are determined to be non-structural anomalous by a dual-gated comparison strategy, and incorporate them as new "normal" modes into the historical atom fingerprint paradigm library.

5. A method for detecting anomalies in social network events based on dynamic graph atom mining and temporal comparison according to any one of claims 1 to 4, characterized in that, The dual-gating comparison strategy in step S4 includes: First layer of isomorphic precise matching gating: based on historical atomic paradigm fingerprint database In the hash table, check if the hash topological fingerprint corresponding to the atom obtained in step S3 exists. If it exists, determine that the corresponding atom a is a known pattern. Second similarity fuzzy filtering gate: If the first isomorphic exact matching gate does not find a match, the similarity between the hash topological fingerprint obtained in step S3 and the historical atomic paradigm fingerprint is calculated; if any similarity is higher than a preset threshold, the atom a corresponding to the hash topological fingerprint is determined to be a non-topological isomorphic variant of a known pattern and is filtered; otherwise, the atom a corresponding to the hash topological fingerprint is determined to be an event anomaly.

Images