Crowd sensing anomaly detection method fusing liquid neural network and interpretable attribution

Abstract

Mobile crowd sensing is a novel sensing normal form which utilizes public mobile equipment to cooperatively collect environment data, and an open type participation mechanism of the mobile crowd sensing enables the mobile crowd sensing to be easily interfered by malicious users, so that detection of the malicious users is a key problem. However, an existing anomaly detection method is limited in adaptability to continuously evolved data distribution and is often difficult to deal with the problem of concept drift, namely the phenomenon that statistical characteristics of user behavior data dynamically evolve along with time. In order to solve the problem, the invention provides a crowd sensing anomaly detection method fusing a liquid neural network and interpretable attribution. The method comprises the following steps: firstly, mining behavior association between users from a time dimension and a variable dimension, and generating a one-way correlation matrix; secondly, fusing the liquid neural network and the graph convolutional network, constructing a liquid space-time graph network, and describing the evolution process of the user behavior from two dimensions of time dynamic and structural space; and finally, tracing features of the identified malicious users one by one, outputting the influence weight of each feature, and clearly judging the core elements.

Description

Technical Field

[0001] This invention belongs to the field of mobile crowd sensing, specifically relating to a crowd sensing anomaly detection method that integrates liquid neural networks and interpretable attribution. Background Technology

[0002] With the continuous development of mobile devices and communication technologies, Mobile Crowdsensing (MCS) has become an efficient means of acquiring large-scale environmental information, and is widely used in scenarios such as urban management, traffic monitoring, and medical services. This model relies on ordinary users to participate in tasks using their own devices, actively uploading data related to their geographical location, behavioral trajectories, or surrounding environment, to achieve dynamic perception and intelligent feedback of the real-world situation. Compared with traditional sensor networks, MCS has significant advantages such as flexible deployment, wide spatial coverage, and rich sensing dimensions, and therefore has attracted great attention from academia and industry.

[0003] While MCS (Multi-Solution System) demonstrates immense potential for large-scale data collection and intelligent decision-making, its open and decentralized user participation mechanism also presents significant security challenges. For example, attackers can interfere with the system through data forgery, coordinated manipulation, or resource abuse, severely threatening the credibility of perceived data and the accuracy of platform decisions. In this process, users, as the core components of the MCS system, not only undertake data collection and task execution functions but also play a crucial role in the final system reasoning and decision-making.

[0004] However, not all users are genuinely motivated by completing the perception task. Some users may submit false, incomplete, or duplicate data to obtain incentives, circumvent computational costs, or even intentionally disrupt the system. These individuals are collectively referred to as malicious users. The presence of malicious users not only significantly reduces the quality of perception data but may also mislead system models, waste platform resources, and even induce incorrect task allocation and system decisions, thereby posing a serious threat to the stability and reliability of the entire system. More challenging is the fact that such attacks are often highly covert, sudden, and coordinated, rendering traditional detection methods relying on static rules or fixed thresholds ineffective against complex malicious behavior patterns. The challenges of existing detection methods are as follows:

[0005] (1) Existing technologies are unable to effectively characterize the evolving behavioral correlations between users in the MCS system and cannot fully capture changes in the dynamic perception structure, resulting in limited ability to identify malicious behavior.

[0006] (2) In the context of concept drift, existing models are difficult to adapt effectively to changes in user behavior, resulting in low accuracy of anomaly detection. Summary of the Invention

[0007] To address the aforementioned problems, this invention proposes a crowd-based intelligent perception anomaly detection method that integrates liquid neural networks and interpretable attribution. The overall logical framework diagram is as follows: Figure 1 As shown, it is divided into the following three parts:

[0008] (1) For the constructed perceived user behavior sequence, two user node embedding matrices are randomly initialized and combined with the two parallel attention mechanisms designed in this invention. Abnormal users in the group structure are identified through variable dimension analysis and time dimension analysis is combined to assist in detecting sudden behavior and abrupt changes in behavior patterns, so as to learn the behavior correlation matrix (UserBehavioralCorrelationLearning, UBCL) between users.

[0009] (2) The liquid neural network's ability to model temporal dynamics and the graph convolutional network's ability to characterize user spatial correlation are combined and stacked alternately to form a liquid spatiotemporal graph network. The output of the user's single-step prediction value in the future time step is used to identify malicious users.

[0010] (3) Based on the malicious user detection results of the liquid spatiotemporal graph, the characteristics of each identified malicious user are attributed, the contribution value of each feature is output, and the key influencing factors of the model in judging malicious users are revealed.

[0011] Compared with the prior art, the beneficial effects of the present invention are: (1) It mines the behavioral correlations between users from the time dimension and the variable dimension respectively, constructs and dynamically adjusts the graph structure, enhances the spatial modeling ability, and thus improves the prediction accuracy. (2) In response to the concept drift problem in MCS malicious user detection, the concept of liquid spatiotemporal graph is proposed for the first time. It integrates the modeling ability of liquid neural network for temporal dynamics and the characterization ability of graph convolutional network for user spatial correlation, thereby improving the model's adaptability to dynamic changes in user behavior patterns and detection accuracy. (3) In response to the interpretability requirement of the malicious user detection model, by performing feature attribution analysis on each user identified as malicious, the key influencing factors behind the model's judgment results are revealed, enhancing the model's understandability and credibility. Attached Figure Description

[0012] Figure 1 This is the overall logic diagram of the present invention;

[0013] Figure 2 This is a schematic diagram of UBCL;

[0014] Figure 3 This is a schematic diagram of the interpretability analysis method. Detailed Implementation

[0015] Two user node embedding matrices G1 and G2 are randomly initialized, where T represents the number of users, and d represents the embedding dimension. This invention designs two parallel cross-attention mechanisms, operating on the variable dimension and the time dimension respectively. The variable-dimensional cross-attention is used to mine potential behavioral collaborations among users, which helps to identify abnormal users in the group structure, while the time-dimensional cross-attention emphasizes the temporal consistency of users' own behavior, assisting in the detection of sudden behaviors or abrupt changes in behavioral patterns.

[0016] The calculation of attention for variable dimensions can be formalized as follows: M var =Θ[W v (G1)×F SM (σ(W q (G2)))]

[0017] Attention in the time dimension can be represented as: M var =Θ[W v (G1)×F SM (σ(W q (G2)))]

[0018] Among them, M var ∈T×1,M time ∈1×d, W v and W q Let F represent a 1×1 convolution operation, σ represent a tensor reshaping operation, and F represent a 1×1 convolution operation. SM (·) denotes the normalization operation, × denotes the matrix dot product operation, Θ(·) denotes the sequential execution of 1×1 convolution, ReLU activation, and layer normalization, and F GP (·) represents a global pool operation, F RL (·) represents the ReLU activation function.

[0019] Subsequently, the two parallel attention mechanisms are fused to generate the final user behavior relevance representation vector: M′=M var ⊙G1+M time ⊙G2

[0020] Here, ⊙ represents a channel-wise multiplication operator, and "+" is the element-wise addition operator.

[0021] Based on the fused behavior embedding vector M′, a correlation matrix among users is constructed. Where T represents the number of users. α represents the saturation rate of nonlinear activation, and DynamicTanh(·) represents a dynamically normalized activation operation. The correlation matrix is ​​calculated as follows: M=DynamicTanh(tanh(αM′M′ T ))

[0022] In this invention, the learned user behavior correlation is unidirectional, i.e., M ij This represents the degree of influence user i has on user j's behavior, rather than a symmetric dependency relationship. This asymmetric structure helps to characterize the "influence-being influenced" relationship in MCS scenarios, such as malicious users disturbing or inducing normal user behavior patterns.

[0023] like Figure 1 As shown in Part II, the liquid input synapse focuses on dynamically mapping external inputs to the network, while the liquid synapse representation focuses on the dynamic interaction of states between neurons within the network. The specific expression is as follows:

[0024] Where h(t) is the user u t The state vector is denoted by τ, which is a time constant controlling the state decay rate. I(t) represents the user's current task observation data, f(·) is a parameterized nonlinear function implemented as a multilayer perceptron (MLP) in this invention, A is a bias term, and ⊙ represents element-wise multiplication. In the discrete implementation, the differential equation is approximated using the explicit Euler method, and the update formula is:

[0025] In terms of spatial modeling, this invention employs a Graph Convolutional Network (GCN) structure to capture the spatial dependencies between user nodes. The state vector of each user is used as a column of a matrix to form the initial input state h. in The learned user relevance matrix M is used to perform graph convolution. β controls how much original node information is retained, K represents the depth of graph propagation, and h... 0 =h in , The normalized correlation matrix is ​​updated by the GCN layer as follows:

[0026] The LTC and GCN layers described above are alternately stacked to form a liquid spatiotemporal graph neural network layer. Given historical observation data X and an adjacency matrix M as input, X is first processed through the liquid temporal network to obtain a temporal feature representation Z. Then, for each time step Z, graph convolution is applied to capture spatial information. Specifically, the output of the liquid spatiotemporal graph network layer can be calculated as follows: Z l+1 =GCN(LTC(Z) l ,I l ,t),Θ),l∈{0,...,L}

[0027] The network output Z out =ZL Input state Z 0 This is obtained by mapping X. By stacking multiple such network layers, a liquid spatiotemporal graph network of depth L can be constructed, thereby better capturing complex spatiotemporal patterns in multivariate time series.

[0028] Then, the output state Z is processed by a multilayer perceptron (MLP). out Perform single-step prediction, i.e. W mlp This represents the weight parameters of the MLP.

[0029] Based on the difference between the predicted result and the actual value, let x t Indicates user u t Real-world perception data These are the model predictions. The absolute error between them is defined as:

[0030] Considering the differences in scale and distribution of perceived values ​​among different users, directly using the raw error in this invention would lead to biased scores towards users with larger values. Therefore, this paper introduces a sliding window mechanism to standardize the error. Within a sliding window of length W, user u... t The mean error μ t With standard deviation σ t for:

[0031] After standardizing the current error, the user u is calculated using the cumulative distribution function of the standard normal distribution. t The anomaly score, where Φ(·) represents the cumulative distribution function of the standard normal distribution:

[0032] If the abnormal score is A t If the threshold is exceeded, then determine the current user u. t Users exhibiting unusual behavior are identified as potential malicious users, and this group of malicious users is denoted as […]. The system will promptly remove such malicious users to ensure the stability of subsequent task allocation and data quality.

[0033] For user u t behavioral characteristics The model uses a discriminant function Output the anomaly score for this sample. Based on the anomaly score, identify the set of users deemed anomalous. For each malicious user u k Corresponding feature input This is explained. SHAP treats each feature as a "game player," and by constructing a local linear regression model, it quantifies the marginal contribution of each feature in the model's prediction, outputting attribution values ​​{φ1,φ2,...,φ...}. Q To ensure the stability of the interpretation and computational efficiency, only the Layer-1 neighbor set of the original input is used; that is, a perturbation (retention or removal) is applied to each feature to construct a representative local sample set. The initial attribution value for each feature is defined as follows:

[0034] Q represents the number of feature dimensions, and N = {1, 2, ..., Q} represents the feature set index. This represents the model's predicted output when only the j-th feature is included. This represents the model prediction after removing the j-th feature. Based on this, the final attribution value is obtained through normalization correction:

[0035] This represents the model output when all features are input. This represents the model's prediction when all features in the input are missing. It is the sum of the initial contributions of all features, used for normalization correction.

[0036] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, they are not intended to limit the scope of protection of the present invention. Any changes, substitutions, simplifications, modifications, or combinations made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the scope of protection of the present invention.

Claims

1. A crowd-sensing anomaly detection method integrating liquid neural networks and interpretable attribution, characterized in that, This includes methods for constructing a liquid spatiotemporal graph network and quantifying feature contributions to analyze detection results.

2. The method for detecting malicious users based on liquid spatiotemporal graphs according to claim 1, characterized in that, The concept of liquid spatiotemporal graph is proposed for the first time. It integrates the ability of liquid neural network to model temporal dynamics with the ability of graph convolutional network to characterize the spatial correlation of users. The two are stacked alternately to form liquid spatiotemporal graph network, and the output of user behavior data is used to predict the single step results.

3. The method for detecting malicious users based on liquid spatiotemporal graphs according to claim 1, characterized in that, Malicious users are detected based on the prediction results of the liquid spatiotemporal diagram, and the interpretability of the detection results is analyzed. By attributing the characteristics of each identified malicious user, the contribution value of each feature is output, revealing the key influencing factors of the model in determining malicious users.

Images