Large language model driven cross-multi-source heterogeneous data platform collaborative abnormal behavior detection method and system

Abstract

The invention discloses a large language model-driven cross-multi-source heterogeneous data platform collaborative abnormal behavior detection method and a large language model-driven cross-multi-source heterogeneous data platform collaborative abnormal behavior detection system. The method comprises the following steps: aiming at a target entity, respectively extracting local dynamic sub-graphs of the target entity in a plurality of heterogeneous data platforms, fusing specific structural relationships, attribute features and text contents of the platforms, and constructing a multi-source heterogeneous time sequence behavior snapshot sequence; a frozen graph encoder and a semantic model are adopted to independently encode each source sub-graph, and multi-channel snapshot embedding in a unified representation space is generated through cross-domain alignment projection under privacy protection constraint; designing a comparative learning strategy of federal perception, and in combination with a cross-platform behavior consistency regular item and a generative classification target, embedding and injecting the snapshots into a large language model in a multi-channel soft prompt form to perform parameter fine tuning; and performing end-to-end collaborative reasoning on the cross-platform behavior sequence by using the fine-tuned model, and outputting an abnormal risk level.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary technical field of artificial intelligence, privacy computing and network security, and specifically relates to a method and system for detecting abnormal behavior across multi-source heterogeneous data platforms driven by a large language model. Background Technology

[0002] With the deep integration of the digital ecosystem, malicious actors are increasingly adopting the "cross-platform collaboration" strategy to carry out covert attacks. For example, they publish inflammatory remarks on social platforms, make small and dispersed transfers on payment platforms, and create false co-occurrence trajectories in map applications to circumvent the detection mechanism of a single platform. Existing technologies have three main limitations: (1) The detection system is limited to a single data source and cannot perceive cross-platform behavior fragmentation and role conflict; (2) Multi-source data fusion relies on centralized raw data aggregation, which violates the compliance requirements of the Data Security Law, the Personal Information Protection Law, etc.; (3) Existing methods based on deep learning, graph neural networks, or complex networks usually assume that the graph structure of each platform is isomorphic and the feature space is consistent, making it difficult to deal with the representation misalignment problem caused by the heterogeneity of node types, edge semantics, and attribute dimensions; more importantly, such methods lack the ability to perform high-order semantic reasoning on "role splitting" abnormal behaviors (such as social activity but empty payment shell).

[0003] While Large Language Models (LLMs) have shown potential in multi-hop reasoning, applying them to cross-platform dynamic graph analysis remains challenging. Existing LLM-based anomaly detection methods typically rely on text logs or single-platform behavior sequences, lacking the ability to effectively model graph structure information and failing to capture hidden cooperative patterns in complex networks. Specifically: How can cross-domain representation alignment be achieved without sharing the original data? How can LLM be guided to understand novel anomaly patterns such as "microblog activity + payment shell + location drift"? Summary of the Invention

[0004] To overcome the shortcomings of the prior art, this invention provides a method and system for detecting collaborative abnormal behavior across multi-source heterogeneous data platforms driven by a large language model. By constructing a multi-source locally enhanced temporal snapshot sequence, introducing a cross-domain alignment mechanism under privacy protection, and using a large language model with efficient parameter fine-tuning for cross-platform collaborative reasoning, it can accurately identify hidden collaborative abnormal behaviors that cannot be detected by a single platform under the premise of legality and compliance.

[0005] The method provided by this invention is applicable to multi-source heterogeneous data environments such as social networking, finance, location, and communication, and is used to achieve cross-platform abnormal user identification, group fraud detection, and collaborative attack early warning. Here, "multi-source heterogeneous data platform" refers to business information systems with independent data management permissions, heterogeneous data structures, and different semantic spaces, including but not limited to social networks, financial payment, location services, and communication record platforms. These platforms do not share raw user data, complying with data minimization and localized processing requirements.

[0006] According to one aspect of the present invention, a method for detecting collaborative abnormal behavior across multi-source heterogeneous data platforms driven by a large language model is provided, comprising: For the target entity, local dynamic subgraphs are extracted from multiple heterogeneous data platforms, and the unique structural relationships, attribute features and text content of each platform are integrated to construct a multi-source heterogeneous time-series behavior snapshot sequence; A frozen graph encoder and semantic model are used to independently encode each source subgraph, and a multi-channel snapshot embedding in a unified representation space is generated through cross-domain aligned projection under privacy protection constraints. We designed a contrastive learning strategy for federated perception, combining cross-platform behavior consistency regularization terms with generative classification objectives, and embedded snapshots into a large language model for parameter fine-tuning in the form of multi-channel soft prompts. The fine-tuned model is used to perform end-to-end collaborative reasoning on cross-platform behavioral sequences and output the anomaly risk level.

[0007] As a further technical solution, the method also includes: A cross-source role consistency verification mechanism is introduced to jointly evaluate the confidence level generated by the large language model and the alignment score of behaviors across multiple platforms. Low consistency predictions trigger manual review or cross-institutional investigation.

[0008] As a further technical solution, the introduced cross-source role consistency verification mechanism also includes: Obtain the prediction probability distribution of the large language model for the anomaly category, and take the maximum probability as the generation confidence score; Calculate the cross-platform behavior alignment score; Set confidence thresholds and alignment score thresholds for evaluating the results of abnormal behavior detection.

[0009] As a further technical solution, the method also includes: If the generated confidence level is greater than or equal to the confidence threshold and the alignment score is greater than or equal to the alignment score threshold, the predicted abnormal risk level is adopted and output; otherwise, manual review or cross-agency investigation is triggered.

[0010] As a further technical solution, generating multi-channel snapshot embeddings in a unified representation space includes: Obtain comprehensive representations of various heterogeneous data platforms; A learnable cross-domain projection matrix is ​​introduced to map the comprehensive representations of various platforms to a unified semantic space; By introducing learnable temporal location encoding and platform type encoding, the embedding mapped to a unified semantic space is added to the encoding vector to generate a multi-channel snapshot embedding.

[0011] As a further technical solution, a comprehensive characterization of various heterogeneous data platforms is obtained, including: If the platform contains graph structures, a pre-trained and frozen graph encoder is used to encode the structure of the subgraphs to obtain a structural representation. If the platform contains text / log content, then a frozen pre-trained language model is used to generate semantic representations; If the attribute is a non-textual numerical attribute, it is mapped to a vector using a learnable MLP. By concatenating and pooling multi-source structural representations, semantic representations, and vectors, a comprehensive representation of the corresponding platform is obtained.

[0012] As a further technical solution, snapshot embedding is injected into a large language model for parameter fine-tuning, including: Construct a cross-platform behavioral consistency loss based on the alignment score, and calculate the alignment loss; Construct negative samples by combining the cross-platform representations of different entities in a mismatched combination and calculate the contrastive loss. The snapshots of all time steps of all platforms are embedded and concatenated in chronological and platform order to form a multi-channel soft cue sequence, which is then mapped to the word embedding space of a large language model through a learnable projection matrix. A fine-tuning dataset is constructed by combining structured natural language instruction templates and question-answer pairs. We use a weighted sum of cross-entropy loss, alignment loss, and contrast loss as the total loss function, freeze the backbone model, and fine-tune the lightweight adaptation parameters.

[0013] According to one aspect of the present invention, a collaborative abnormal behavior detection system driven by a large language model across multi-source heterogeneous data platforms is provided, comprising: The first main module is used to extract local dynamic subgraphs of the target entity from multiple heterogeneous data platforms, integrate the unique structural relationships, attribute features and text content of each platform, and construct a multi-source heterogeneous time-series behavior snapshot sequence. The second main module is used to independently encode each source subgraph using a frozen graph encoder and semantic model, and generate multi-channel snapshot embeddings in a unified representation space through cross-domain aligned projection under privacy protection constraints. The third main module is used to design the contrastive learning strategy of federated perception. It combines cross-platform behavior consistency regularization terms with generative classification objectives and embeds snapshots into the large language model in the form of multi-channel soft prompts for parameter fine-tuning. The fourth main module is used to perform end-to-end collaborative reasoning on cross-platform behavioral sequences using the fine-tuned model and output the anomaly risk level.

[0014] According to one aspect of the present invention, a large language model-driven collaborative abnormal behavior detection device for cross-multi-source heterogeneous data platforms is provided, comprising a memory and a processor, wherein the memory stores program instructions that are executed by the processor, and the processor invokes the program instructions to execute the large language model-driven collaborative abnormal behavior detection method for cross-multi-source heterogeneous data platforms.

[0015] According to one aspect of the present invention, a non-transitory computer-readable storage medium is provided, the non-transitory computer-readable storage medium storing computer instructions that cause the computer to execute the large language model-driven collaborative abnormal behavior detection method across multi-source heterogeneous data platforms.

[0016] This invention, by constructing a multi-source heterogeneous dynamic graph snapshot sequence and combining privacy-preserving cross-domain alignment with large language model-driven collaborative reasoning, achieves for the first time end-to-end detection of cross-platform covert collaborative attacks under legal and compliant conditions. Compared with existing technologies, the advantages of this invention are: (1) Break through the information silos of a single platform and identify abnormal behaviors of “role splitting”; (2) Supports federal deployment to meet regulatory requirements that data does not leave the domain; (3) Provide interpretable and auditable decision-making basis through a dual-path verification mechanism; (4) The efficient parameter fine-tuning strategy lowers the threshold for large model applications. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating a collaborative abnormal behavior detection method across multi-source heterogeneous data platforms driven by a large language model, provided in an embodiment of the present invention;

[0019] Figure 2 This is a schematic diagram of the structure of a multi-channel soft prompt injection large language model provided in an embodiment of the present invention;

[0020] Figure 3 The decision flowchart for the cross-source role consistency dual-path verification mechanism provided in this embodiment of the invention is shown. Detailed Implementation

[0021] Given that existing LLM-based anomaly detection methods typically rely on text logs or single-platform behavior sequences, lack the ability to effectively model graph structure information, and struggle to capture hidden collaborative patterns in complex networks, there is an urgent need for a new detection framework that balances privacy compliance, multi-source heterogeneous fusion, and LLM high-order inference to address the increasingly intelligent cross-platform collaborative threats.

[0022] Therefore, this invention provides a method for detecting abnormal behavior across multi-source heterogeneous data platforms driven by a large language model, specifically including the following 5 steps:

[0023] Step 1: For the target entity i to be detected, in N heterogeneous data platforms (which may include social platforms, payment platforms, location service platforms, etc.), at each time step t=1,…,T, extract its k-hop neighborhood local subgraph based on the behavioral associations of entity i. Here, k is a preset neighbor layer number (e.g., k=2), used to capture the direct associations and secondary influence circles of entity i, avoiding excessive expansion that could lead to computational complexity explosion. The subgraphs of each platform integrate three types of information: structural information (e.g., follow / transfer / co-occurrence graphs), static attributes (e.g., number of followers, account balance, device model, registration duration), and dynamic content (e.g., published text, transaction amount, location check-in, call logs), constructing a multi-source heterogeneous time-series behavioral snapshot sequence with platform identifiers. .

[0024] Step 2: Take a snapshot at time step t for each platform p∈{1,…,N} in Step 1. Independent multimodal encoding is performed to generate platform-specific embeddings, and representation alignment is achieved through cross-domain projection under privacy protection constraints to form multi-channel snapshot embeddings.

[0025] Step 3: Design a joint optimization training strategy for federated perception. Without exchanging the original data, the model is optimized by cross-platform behavior consistency regularization terms and generative classification objectives to achieve self-supervised learning of hidden collaborative patterns.

[0026] Step 4: Embed the multi-channel snapshot of the entity to be detected into the finely tuned large language model in the form of soft prompts, guide it to perform cross-platform behavior role reasoning through structured natural language instructions, and output the abnormal risk level (0-normal, 1-suspicious, 2-high risk) and the explanatory reason.

[0027] Step 5: Introduce a cross-source role consistency verification mechanism to jointly evaluate the confidence level generated by the large language model and the alignment score of behaviors across multiple platforms. For low consistency predictions, trigger manual review or cross-institutional investigation processes to improve the robustness and auditability of the system.

[0028] This invention effectively models the collaborative evolution law of multi-source heterogeneous dynamic graphs, significantly improving the ability to identify and interpret covert cross-platform collaborative attacks while ensuring data privacy. It can be widely applied in scenarios such as anti-fraud joint prevention, financial risk control, and online public opinion governance, and has outstanding practicality and promotion value.

[0029] The method of this invention can be seamlessly integrated into national-level anti-fraud platforms, bank risk control systems, and internet enterprise alliance governance frameworks, demonstrating significant social benefits and commercial value. The specific embodiments described in this invention are merely illustrative of the technical solution and not intended to limit its scope of protection. This invention is not limited to the specific platform types mentioned above and can be applied to other heterogeneous information systems with independent data management permissions, such as IoT device log platforms and enterprise ERP systems.

[0030] The terms “comprising” and “having”, and any variations thereof, in the specification, claims, and accompanying drawings of this invention are intended to cover a non-exclusive inclusion, such as a process, method, system, product, or apparatus that includes a series of steps or units, not necessarily limited to those explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0031] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. In addition, the technical features of the various embodiments or individual embodiments provided by the present invention can be arbitrarily combined to form new technical solutions. Such combinations are not bound by the order of steps and / or structural composition patterns, but must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0032] This invention provides a method for detecting collaborative abnormal behavior across multi-source heterogeneous data platforms driven by a large language model. (See also...) Figures 1 to 3 The method includes:

[0033] Step 1: For the target entity i to be detected, in N heterogeneous data platforms, at each time step t=1,…,T, extract its k-hop neighborhood local subgraph based on the behavioral associations of entity i. Here, k is a preset neighbor layer number (e.g., k=2), used to capture the direct associations and secondary influence circles of entity i, avoiding excessive expansion that could lead to computational complexity explosion. The subgraphs of each platform integrate three types of information: structural information (e.g., follow / transfer / co-occurrence graph), static attributes (e.g., number of followers, account balance, device model, registration duration), and dynamic content (e.g., published text, transaction amount, location check-in), constructing a multi-source heterogeneous time-series behavioral snapshot sequence with platform identifiers. .

[0034] Specifically, in one implementation, the collaborative anomaly detection of three platforms—social, payment, and location—is taken as an example. N=3 heterogeneous data platforms are selected: Weibo social platform P1, Alipay payment platform P2, and Gaode Map location service platform P3. The user ID to be detected is "user_12345". The user's behavioral data includes a time-series social graph structure (follow / followed relationships), payment transfer records, and location check-in sequences, with a time span of T=7 days. Each record contains static attributes such as the number of followers, account balance, and device model, as well as dynamic content such as daily posted text, transaction amount, and latitude / longitude. For the target entity i, at each time step t, a two-hop subgraph of the user and their friends is extracted, i.e., a neighborhood subgraph with k=2 hops. The subgraphs of all time steps are then organized sequentially to form a multi-source heterogeneous time-series behavioral snapshot sequence. .

[0035] Step 2: Take a snapshot at time step t for each platform p ∈ {1,…,N} from Step 1. Independent multimodal encoding is performed to generate platform-specific embeddings, and representation alignment is achieved through cross-domain projection under privacy protection constraints to form multi-channel snapshot embeddings.

[0036] Specifically, in one implementation, it includes: Step 2.1: Pair subgraphs with pre-trained and frozen GraphSAGE Perform structural encoding to obtain structural representation : , The published text content is processed using frozen Sentence-BERT to obtain semantic representations. ; An attribute vector composed of platform attribute information such as: number of followers, verification status, account balance, latitude and longitude. The MLP maps the vectors to attribute representations. : , After concatenating the above multi-source features, a comprehensive representation of platform p at time t is obtained through learnable attention pooling fusion. .

[0037] , in, These are the attention weights for each modality, satisfying... The attention weights for each modality are labeled as follows: It is calculated in the following way, where W m It is a learnable vector.

[0038] .

[0039] Step 2.2: Introduce a learnable cross-domain projection matrix The comprehensive representation of each platform Mapping to a unified semantic space: , The projection process satisfies differential privacy constraints or runs in a trusted execution environment to ensure that the original data does not leave the domain. The projection operation can be completed locally on each platform, with only the aligned embedded data uploaded. This achieves the goal of "data being usable but not visible".

[0040] Step 2.3: Introduce learnable temporal location coding Platform type encoding ,Will Adding the encoded vector to generate the final multi-channel snapshot embedding: , Among them, time location coding This is achieved through a learnable time embedding table, with a pre-defined maximum time step. Initialize the embedding matrix For any time step t, take The embedded Automatic end-to-end optimization during model training eliminates the need for manual design, enabling the model to perceive the temporal semantics of behavior (such as periodicity and suddenness), thereby more accurately identifying the evolutionary trajectory of cross-platform collaborative anomalies.

[0041] Platform type coding This is achieved through a learnable embedding table: a unique ID is pre-assigned to each platform (1=social, 2=payment, 3=location), and then the corresponding d-dimensional vector is obtained by looking up the table. This embedding is automatically optimized during training, enabling the model to understand the semantic differences in behavior across different platforms.

[0042] Step 3: Design a joint optimization training strategy for federated perception. Without exchanging original data, achieve self-supervised learning of hidden collaborative patterns by co-optimizing the model with cross-platform behavior consistency regularization terms and generative classification objectives. Specifically, in one implementation, Step 3.1: For the same entity i at time step t, calculate its platform representation. The pairwise cosine similarity mean is used to define the alignment score. : A t ( i ) = [ 2 N ( N − 1 ) ] ⋅ ∑ 1 ≤ p ≤ q ≤ N cos_ sim ( z t ( p ) , z t ( q ) ) , To maximize As a self-supervised signal, it encourages normal users to maintain consistent behavior and roles across platforms. (Define alignment loss.) The average alignment score is negative, meaning minimizing this loss is equivalent to maximizing consistency. Based on this, a cross-platform behavioral consistency loss is constructed: L align =− ( 1 | D normal | ) ⋅ ∑ i ∈ D normal [ 1 T ⋅ ∑ t = 1 T A t ( i ) ] , in The set of known normal users can be obtained in advance through weak supervision methods such as whitelists and low-risk labels, and is used to guide the model to learn the cross-platform consistency of normal user behavior.

[0043] Step 3.2: Construct negative samples by mismatching and combining cross-platform representations of different entities. Specifically, different platform representations of the same entity i are used as positive samples; another entity j (j ≠ i) is randomly selected, and any platform representation of j is paired with the representation of i to form a negative sample.

[0044] Loss estimation using information noise contrast To enhance the model's discriminative ability, the calculation method is as follows: , in, Let i be the representation of entity i on platform p. Let i be the representation of entity i on platform q. Let be any platform representation for other entity j (j ≠ i); sim is the cosine similarity function. , For temperature coefficient, Let represent the contrast set consisting of positive samples (representations of the same entity i on other platforms) and K randomly sampled negative samples (representations of other entities j ≠ i).

[0045] Step 3.3: Embedding all platforms and all time steps The sequence is concatenated according to time and platform order to form a multi-channel soft cue sequence. S = [ e 1 ( 1 ) , e 1 ( 2 ) ,..., e 1 ( N ) ] And through a learnable projection matrix Mapped to the LLM word embedding space.

[0046] Step 3.4: Design a structured natural language instruction template, along with labeled anomaly risk level data (0-normal, 1-suspicious, 2-high risk) and structured explanations based on multi-platform behavioral facts, to construct question-answer pairs in the LLM fine-tuning training dataset. This template consists of three parts: Task description prefix: "You are a cross-platform security analyst. Users exhibit [behavioral summary] on social platforms, [behavioral summary] on payment platforms, and [behavioral summary] on location platforms." Behavioral placeholders: dynamically filled by the soft cue sequence S, representing the actual observed cross-platform collaborative behavior trajectories; Output instruction suffix: "Please determine whether it participated in abnormal collaborative activities and explain the reason."

[0047] A final, complete prompt sequence example is as follows: "You are a cross-platform security analyst. A user's behavior is summarized as [behavioral summary] on a social platform, [behavioral summary] on a payment platform, and [behavioral summary] on a location platform. Please determine whether they are involved in coordinated abnormal activities and explain your reasoning."

[0048] The [behavioral summary] is dynamically filled by soft prompts and does not undergo discrete word segmentation.

[0049] Step 3.5: The total loss function of the LLM fine-tuning process is defined as the weighted sum of cross-entropy loss, alignment loss, and contrast loss: , in These are weight hyperparameters, selected and adjusted based on the specific task scenario. Calculate the cross-entropy loss based on the labeled data in the fine-tuned dataset and the model training predictions. According to the calculation in step 3.1, Calculate according to step 3.2.

[0050] During fine-tuning, the backbone of the large language model is frozen. LLM only fine-tunes lightweight modules: cross-domain projection matrices for each platform. Time and location coding Platform type encoding LoRA adapter (inserting attention layer, rank r = 8), soft cue projection matrix .

[0051] Furthermore, the fine-tuned dataset is constructed using QA pairs as follows: Input (Q): Soft prompt sequence S + instruction template; Output (A): Manually labeled anomaly risk levels (0-normal, 1-suspicious, 2-high risk) and structured explanations based on multi-platform behavioral facts. The explanations clearly relate to the abnormal behavior characteristics of each platform and are used to guide the large language model in learning the criteria for judging cross-platform collaborative anomalies and the ability to generate interpretable anomalies.

[0052] The labeled data can be obtained in the following ways: extracting labeled samples from historical audit cases; generating simulated abnormal samples through red team / blue team exercises; or using a semi-automatic labeling method, in which the basic LLM first performs preliminary reasoning on the unlabeled data, and then the security experts review and correct it to ensure the accuracy and consistency of the labeling.

[0053] Step 4: Embed the multi-channel snapshot of the entity to be detected into the finely tuned large language model in the form of soft prompts, guide it to perform cross-platform behavior role reasoning through structured natural language instructions, and output the abnormal risk level (0-normal, 1-suspicious, 2-high risk) and the explanatory reason.

[0054] Specifically, in one implementation, based on a structured natural language instruction template and combined with a cross-platform collaborative anomaly detection task in a multi-source heterogeneous platform, a prompt word instruction sequence Q based on an anomaly risk level prediction task is formed. A snapshot of the new user "user_67890" is embedded into the finely tuned LLM input S_new; the output is: "2: High risk. Social media platform rhetoric is highly inflammatory, payment platform accounts are not real-name verified and transactions are scattered, location platform trajectory jumps abnormally, suspected of collaborative fraud."

[0055] Step 5: Introduce a cross-source role consistency verification mechanism to jointly evaluate the confidence level generated by the large language model and the alignment score of behaviors across multiple platforms. For low consistency predictions, trigger manual review or cross-institutional investigation processes to improve the robustness and auditability of the system.

[0056] Specifically, including: Step 5.1: Obtain the probability distribution of LLM predictions for anomaly categories, and take the highest probability as the generated confidence score C. gen .

[0057] Step 5.2: Calculate the cross-platform behavior alignment score: C align = 1 T ⋅ ∑ t = 1 T [ 2 N ( N − 1 ) ⋅ ∑ 1 ≤ p ≤ q ≤ N (cos_sim( z t {( p )} , z t {( q )} )) ] , Step 5.3: Set dual thresholds and .like and If the prediction is correct, it will be adopted; otherwise, it will be marked as "cross-platform role conflict," triggering manual review or sending a request for assistance to a partner organization. Among these, a dual threshold... and It can be dynamically adjusted according to business scenarios.

[0058] In one implementation, the LLM output confidence score Cgen = 0.85 (maximum probability) is obtained; the alignment score is then calculated. = 0.3 (low, due to behavior fragmentation). Setting = 0.8, = 0.6. Because but This triggers the "cross-platform role conflict" flag and sends a request for assistance.

[0059] This invention effectively models the collaborative evolution law of multi-source heterogeneous dynamic graphs, significantly improving the ability to identify and interpret covert cross-platform collaborative attacks while ensuring data privacy. It can be widely applied in scenarios such as anti-fraud joint prevention, financial risk control, and online public opinion governance, and has outstanding practicality and promotion value.

[0060] The implementation of the various embodiments of the present invention is based on programmed processing through a device with processor functionality. Therefore, in practical engineering, the technical solutions and functions of the various embodiments of the present invention are encapsulated into various modules. Based on this reality, and building upon the above embodiments, the embodiments of the present invention provide a large language model-driven collaborative abnormal behavior detection system for cross-multi-source heterogeneous data platforms. This system is used to execute a large language model-driven collaborative abnormal behavior detection method for cross-multi-source heterogeneous data platforms as described in the above method embodiments.

[0061] The system comprises: a first main module, used to extract local dynamic subgraphs of target entities from multiple heterogeneous data platforms, and to integrate the unique structural relationships, attribute features, and text content of each platform to construct a multi-source heterogeneous temporal behavior snapshot sequence; a second main module, used to independently encode each source subgraph using a frozen graph encoder and semantic model, and to generate multi-channel snapshot embeddings in a unified representation space through cross-domain aligned projection under privacy protection constraints; a third main module, used to design a federated perception contrastive learning strategy, combining cross-platform behavior consistency regularization terms and generative classification objectives, and injecting the snapshot embeddings into a large language model for parameter fine-tuning in the form of multi-channel soft prompts; and a fourth main module, used to perform end-to-end collaborative reasoning on cross-platform behavior sequences using the fine-tuned model, and output anomaly risk levels.

[0062] This invention provides a large language model-driven cross-platform collaborative anomaly detection system. Addressing the limitations of existing LLM-based anomaly detection methods, which typically rely on text logs or single-platform behavior sequences and lack effective modeling capabilities for graph structure information, making it difficult to capture hidden collaborative patterns in complex networks, this system employs several modules. It constructs multi-source locally enhanced temporal snapshot sequences, introduces a privacy-preserving cross-domain alignment mechanism, and utilizes a large language model with efficient parameter fine-tuning for cross-platform collaborative reasoning. This allows for accurate identification of hidden collaborative anomalies that are undetectable by a single platform while remaining legal and compliant.

[0063] It should be noted that the system embodiments provided by the present invention are used not only to implement the methods in the above method embodiments, but also to implement the methods in other method embodiments provided by the present invention. The only difference is that corresponding functional modules are set. The principle is basically the same as that of the above system embodiments provided by the present invention. As long as those skilled in the art can improve the modules in the above system embodiments by referring to the specific technical solutions in other method embodiments and combining technical features to obtain corresponding technical means and technical solutions composed of these technical means, on the basis of the above system embodiments, and on the premise of ensuring the practicality of the technical solutions, they can obtain corresponding system-like embodiments for implementing the methods in other method-like embodiments.

[0064] Based on the same inventive concept as any of the foregoing embodiments, this embodiment of the invention also provides a large language model-driven cross-multi-source heterogeneous data platform collaborative abnormal behavior detection device, including a memory and a processor. The memory stores program instructions that are executed by the processor, and the processor calls the program instructions to execute the large language model-driven cross-multi-source heterogeneous data platform collaborative abnormal behavior detection method.

[0065] Based on the same inventive concept as any of the foregoing embodiments, this embodiment of the invention also provides a non-transitory computer-readable storage medium that stores computer instructions that cause the computer to execute the large language model-driven collaborative abnormal behavior detection method across multi-source heterogeneous data platforms.

[0066] In summary, this invention provides a method for detecting abnormal behavior across multiple heterogeneous data platforms driven by a large language model. First, for the target entity, local dynamic subgraphs are extracted from multiple heterogeneous data platforms, and the unique structural relationships, attribute features, and text content of each platform are integrated to construct a multi-source heterogeneous temporal behavior snapshot sequence. Second, a frozen graph encoder and semantic model are used to independently encode each source subgraph, and a multi-channel snapshot embedding in a unified representation space is generated through cross-domain alignment projection under privacy constraints. Third, a federated perception contrastive learning strategy is designed, combining cross-platform behavior consistency regularization terms and generative classification objectives, and injecting the embeddings into the large language model for efficient parameter fine-tuning in the form of multi-channel soft prompts. Subsequently, the fine-tuned model is used to perform end-to-end collaborative inference on the cross-platform behavior sequence, outputting the abnormal risk level. Finally, a cross-source role consistency verification mechanism is introduced to jointly evaluate the confidence level generated by the large language model and the multi-platform behavior alignment score, triggering manual review or cross-institutional investigation for low consistency predictions. This invention effectively models the collaborative evolution law of multi-source heterogeneous dynamic graphs, significantly improving the ability to identify and interpret covert cross-platform collaborative attacks while ensuring data privacy. It can be widely applied in scenarios such as anti-fraud joint prevention, financial risk control, and online public opinion governance, and has outstanding practicality and promotion value.

[0067] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting collaborative abnormal behavior across multi-source heterogeneous data platforms driven by a large language model, characterized in that, include: For the target entity, local dynamic subgraphs are extracted from multiple heterogeneous data platforms, and the unique structural relationships, attribute features and text content of each platform are integrated to construct a multi-source heterogeneous time-series behavior snapshot sequence; A frozen graph encoder and semantic model are used to independently encode each source subgraph, and a multi-channel snapshot embedding in a unified representation space is generated through cross-domain aligned projection under privacy protection constraints. We designed a contrastive learning strategy for federated perception, combining cross-platform behavior consistency regularization terms with generative classification objectives, and embedded snapshots into a large language model for parameter fine-tuning in the form of multi-channel soft prompts. The fine-tuned model is used to perform end-to-end collaborative reasoning on cross-platform behavioral sequences and output the anomaly risk level.

2. The method for detecting collaborative abnormal behavior across multi-source heterogeneous data platforms driven by a large language model according to claim 1, characterized in that, The method further includes: A cross-source role consistency verification mechanism is introduced to jointly evaluate the confidence level generated by the large language model and the alignment score of behaviors across multiple platforms. Low consistency predictions trigger manual review or cross-institutional investigation.

3. The method for detecting collaborative abnormal behavior across multi-source heterogeneous data platforms driven by a large language model according to claim 2, characterized in that, The introduced cross-source role consistency verification mechanism also includes: Obtain the prediction probability distribution of the large language model for the anomaly category, and take the maximum probability as the generation confidence score; Calculate the cross-platform behavior alignment score; Set confidence thresholds and alignment score thresholds for evaluating the results of abnormal behavior detection.

4. The method for detecting collaborative abnormal behavior across multi-source heterogeneous data platforms driven by a large language model according to claim 3, characterized in that, The method further includes: If the generated confidence level is greater than or equal to the confidence threshold and the alignment score is greater than or equal to the alignment score threshold, the predicted abnormal risk level is adopted and output; otherwise, manual review or cross-agency investigation is triggered.

5. The method for detecting collaborative abnormal behavior across multi-source heterogeneous data platforms driven by a large language model according to claim 1, characterized in that, Generate multi-channel snapshot embeddings in a unified representation space, including: Obtain comprehensive representations of various heterogeneous data platforms; A learnable cross-domain projection matrix is ​​introduced to map the comprehensive representations of various platforms to a unified semantic space; By introducing learnable temporal location encoding and platform type encoding, the embedding mapped to a unified semantic space is added to the encoding vector to generate a multi-channel snapshot embedding.

6. The method for detecting collaborative abnormal behavior across multi-source heterogeneous data platforms driven by a large language model according to claim 5, characterized in that, Obtain comprehensive characterizations of various heterogeneous data platforms, including: If the platform contains graph structures, a pre-trained and frozen graph encoder is used to encode the structure of the subgraphs to obtain a structural representation. If the platform contains text / log content, then a frozen pre-trained language model is used to generate semantic representations; If the attribute is a non-textual numerical attribute, it is mapped to a vector using a learnable MLP. By concatenating and pooling multi-source structural representations, semantic representations, and vectors, a comprehensive representation of the corresponding platform is obtained.

7. The method for detecting collaborative abnormal behavior across multi-source heterogeneous data platforms driven by a large language model according to claim 1, characterized in that, Snapshot embeddings are injected into large language models for parameter fine-tuning, including: Construct a cross-platform behavioral consistency loss based on the alignment score, and calculate the alignment loss; Construct negative samples by combining the cross-platform representations of different entities in a mismatched combination and calculate the contrastive loss. The snapshots of all time steps of all platforms are embedded and concatenated in chronological and platform order to form a multi-channel soft cue sequence, which is then mapped to the word embedding space of a large language model through a learnable projection matrix. A fine-tuning dataset is constructed by combining structured natural language instruction templates and question-answer pairs. We use a weighted sum of cross-entropy loss, alignment loss, and contrast loss as the total loss function, freeze the backbone model, and fine-tune the lightweight adaptation parameters.

8. A collaborative abnormal behavior detection system across multi-source heterogeneous data platforms driven by a large language model, characterized in that, include: The first main module is used to extract local dynamic subgraphs of the target entity from multiple heterogeneous data platforms, integrate the unique structural relationships, attribute features and text content of each platform, and construct a multi-source heterogeneous time-series behavior snapshot sequence. The second main module is used to independently encode each source subgraph using a frozen graph encoder and semantic model, and generate multi-channel snapshot embeddings in a unified representation space through cross-domain aligned projection under privacy protection constraints. The third main module is used to design the contrastive learning strategy of federated perception. It combines cross-platform behavior consistency regularization terms with generative classification objectives and embeds snapshots into the large language model in the form of multi-channel soft prompts for parameter fine-tuning. The fourth main module is used to perform end-to-end collaborative reasoning on cross-platform behavioral sequences using the fine-tuned model and output the anomaly risk level.

9. A collaborative abnormal behavior detection device across multi-source heterogeneous data platforms driven by a large language model, characterized in that, The method includes a memory and a processor, wherein the memory stores program instructions that are executed by the processor, and the processor invokes the program instructions to execute the method for detecting collaborative abnormal behavior across multi-source heterogeneous data platforms driven by a large language model as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores computer instructions that cause the computer to execute the large language model-driven collaborative abnormal behavior detection method across multi-source heterogeneous data platforms as described in any one of claims 1 to 7.

Images