A multi-model fusion anomaly detection method based on DMH-Motif

Abstract

The application discloses a multi-model fusion anomaly detection method based on DMH-Motif, which is characterized by a method for constructing a user risk prediction model using a graph neural network framework to realize detection of user abnormal behavior, and specifically includes the following steps: construction and preprocessing of graph data, graph structure enhancement, Motif subgraph extraction and structure perception feature coding, MixHop mixed hop number aggregation, cross-Motif time sequence fusion and user embedding generation, and anomaly checking. Through the improved Motif-GNN model and multi-model fusion technology, the method can automatically mine the relationship patterns between entities, reduce the dependence on labeled data, and reduce the difficulty of model training and optimization. Compared with the prior art, the application has improved accuracy and efficiency of abnormal behavior detection, and has strong generalization ability and robustness, is especially suitable for application of the graph neural network technology in the abnormal behavior detection scene, provides a reasonable solution for network security, financial risk control, industrial monitoring and other scenes, and has good application prospect.

Description

Technical Field

[0001] This invention relates to the field of graph neural networks and abnormal behavior detection technology, specifically a multi-model fusion anomaly detection method based on improved DMH-Motif. Background Technology

[0002] In the field of anomaly detection, traditional methods mainly rely on conventional machine learning algorithms and expert rules. In recent years, some institutions with high levels of digitization and modeling have gradually begun research on graph neural networks (GNNs) and applied GNN technology to anomaly detection scenarios. However, current machine learning algorithms such as XGBoost and random forests cannot adequately represent the features of objects when extracting features, resulting in insufficient feature dimensions and low anomaly detection rates. These methods typically assume that the data are independent and identically distributed, making it difficult to capture the complex relationships and dependencies between data, especially in graph-structured data. In recent years, graph neural networks (GNNs) have been widely used in anomaly detection. GNNs can effectively aggregate neighbor information through message passing mechanisms and learn the embedding representation of each node, thus providing a more discriminative feature space for anomaly identification. However, existing GNN technologies still face some challenges:

[0003] 1) Propagation effect limitation: Traditional GNNs are limited by the propagation effect, making it difficult to capture the relationship between distant nodes, which leads to an urgent need to improve the robustness of the model.

[0004] 2) Lack of high-order structure information: Existing methods do not consider the original links of higher-order subgraphs when processing low-order graphs, and directly model based on the low-order topology, resulting in relatively insignificant model performance.

[0005] 3) Insufficient dynamic graph modeling capability: Most GNN methods are mainly designed for static graph structures, which are difficult to handle dynamically evolving graph data and cannot capture the temporal evolution characteristics of abnormal behavior.

[0006] 4) Imbalanced sample problem: In many abnormal behavior detection scenarios, there are relatively few negative samples (abnormal behaviors), resulting in a high imbalanced sample problem, which affects the training effect of the model.

[0007] In recent years, significant progress has been made in the field of anomaly detection. For example, the Microsoft team proposed the Swift Hydra framework for anomaly detection based on self-supervised learning. This framework utilizes reinforcement learning to guide generative models to synthesize diverse and challenging anomaly samples, combined with the hybrid expert structure of the Mamba model for detection. The effectiveness of this framework has been validated on the ADBench benchmark. Other examples include interpretable anomaly detection: the Hoi2Anomaly method achieves a unified approach to anomaly detection and interpretation by constructing a multimodal instruction tuning dataset, training the HOI extractor, and fine-tuning the visual language pre-training framework. Cross-domain anomaly detection: the NAGL framework proposes a general anomaly detection task based on "normal-anomaly joint reference," significantly improving cross-domain anomaly detection performance by mining transferable anomaly features through residual space mining. Finally, temporal anomaly detection: the DMemAD model achieves accurate detection of complex time-series anomalies through the STD Mamba module, dual-domain memory module, and residual update mechanism. Fine-grained anomaly detection: The Ex-VAD method innovatively integrates the Visual Language Model (VLM) and the Large Language Model (LLM) to build the first end-to-end framework that combines high accuracy and interpretability, realizing fine-grained anomaly type identification and detection result interpretation.

[0008] With the rapid development and widespread application of information technology, various systems and platforms have generated a large amount of user behavior data. This data contains rich information, but also hides various abnormal behaviors, such as cyberattacks, financial fraud, and malicious order placement. Abnormal behaviors not only cause economic losses to businesses and users, but also threaten social security and stability. Therefore, timely and accurate detection and identification of abnormal behaviors is of significant practical importance. Currently, abnormal behavior detection mainly employs traditional statistical analysis, machine learning, and deep learning methods. Traditional statistical analysis methods detect anomalies based on the statistical characteristics of the data, such as mean, variance, and standard deviation. However, these methods make strong assumptions about the distribution and characteristics of the data, making them difficult to adapt to complex and ever-changing abnormal behaviors. Machine learning methods, such as support vector machines, decision trees, and random forests, detect anomalies by learning the characteristic patterns of the data. However, these methods are ineffective when dealing with high-dimensional, nonlinear, and dynamically changing data. Deep learning methods, such as convolutional neural networks and recurrent neural networks, have achieved significant results in fields such as image and speech processing, but their expressive and learning capabilities are limited when dealing with behavioral data with complex relationships and structures.

[0009] In summary, existing technologies for anomaly detection suffer from the following limitations: 1) Propagation effect limitations: These limitations are typically caused by the multi-layered structure and information aggregation process of GNNs. In a typical GNN, information propagates from a node's neighbors to the central node, and then aggregates into the central node's representation. Each iteration propagates information from neighboring nodes to the central node. However, due to the limited depth of information propagation, it may fail to capture information from distant nodes, leading to information loss and locality of reference. 2) Poor generalization and robustness: Existing methods perform well on training data, but their generalization and robustness are poor when faced with new anomalies and changes in data distribution, making them prone to false positives and false negatives. 3) High difficulty in model training and optimization: Existing methods require a large amount of labeled data for model training, and the training and optimization process is complex and time-consuming, making it difficult to meet the real-time requirements of anomaly detection scenarios. Summary of the Invention

[0010] The purpose of this invention is to address the shortcomings of existing technologies by providing a multi-model fusion anomaly detection method based on an improved DMH-Motif. This method employs a user risk prediction model built on a graph neural network (GNN) framework to detect abnormal behavior. Through an improved Motif-GNN model and multi-model fusion technology, this method can automatically mine relationship patterns between entities, reducing reliance on labeled data and lowering the difficulty of model training and optimization. Simultaneously, the model update and optimization module can update and optimize the model in real time, improving its adaptability and self-learning ability, and enhancing the accuracy of anomaly detection. This invention considers the original links of higher-order subgraphs and models based on subgraphs of different granularities, improving the accuracy and efficiency of anomaly detection. Furthermore, the model has high training and inference efficiency, meeting the real-time requirements of anomaly detection scenarios. It effectively captures complex relationships and patterns between entities, improving the accuracy and efficiency of anomaly detection, while also possessing strong generalization ability and robustness. It is particularly suitable for the application of graph neural network technology in anomaly detection scenarios, providing a reasonable solution for scenarios such as network security, financial risk control, and industrial monitoring, and has promising application prospects.

[0011] The specific technical solution to achieve the objective of this invention is: a multi-model fusion anomaly detection method based on DMH-Motif, characterized by employing a graph neural network framework to construct a user risk prediction model, thereby detecting abnormal user behavior. The construction of the user risk prediction model specifically includes the following steps:

[0012] (I) Construction and preprocessing of graph data

[0013] Step 1-1: Using user entities as graph nodes and social relationships and other connections as graph edges, construct an initial graph structure containing heterogeneous relationships, and achieve a complete representation of the graph data by fusing node attribute features and edge relationship features;

[0014] Steps 1-2: Perform preprocessing on the constructed graph data, including standardization, feature encoding, and missing value imputation.

[0015] (ii) Graph Structure Enhancement

[0016] Thirteen basic topological structural units were identified and extracted from the original image, generating multiple sets of Motif subgraphs. to This is to enhance the diversity and expressive power of graph structure features.

[0017] (III) Motif Subgraph Extraction and Structure-Aware Feature Encoding

[0018] Motif recognition employs an efficient enumeration algorithm to extract 13 types of directed / undirected triplet topologies, including closed loops, chains, and stars. The structure-aware GAT introduces motif structure encoding by calculating attention coefficients.

[0019] (iv) MixHop hop count aggregation

[0020] The MixHop hop count aggregation module is used to aggregate 1-hop direct neighbor features and 2-hop indirect neighbor features for each node. Learnable weight parameters are used to achieve adaptive fusion of different hop count information, which enhances the interaction capability of local-global information while preserving high-order structural features.

[0021] (v) Cross-Motif temporal fusion and user-embedded generation

[0022] RU temporal modeling is used for motif temporal fusion and user embedding generation. The model input is 13 sets of enhanced motif embeddings {H^1,...,H^13}, which are globally pooled to obtain the sequence {v1,...,v13}. The output is the fused user embedding. The output is the final feature representation, where hu represents the final user representation vector generated by the DMH-Motif module (GAT+MixHop+GRU), Rh represents the h-dimensional real space, and h represents the hidden layer dimension.

[0023] (vi) Abnormal checks

[0024] By using an MLP neural network, based on the feature representation obtained in step (v), the probability value (0-1) of whether it is abnormal is output.

[0025] The construction and preprocessing of the graph data takes the following inputs: user attribute feature matrix X and heterogeneous relation edge set E (including edge type labels); the output is: preprocessed graph G′=(V′,E′,X′), satisfying: node connectivity enhancement, feature distribution normalization, and missing value imputation; where V′ is the node set, E′ is the edge set, and X′ is the node feature matrix; the node feature normalization for node connectivity enhancement is: xi′=(xi-μ) / σ; where xi represents the original node feature vector, μ is the global mean, and σ is the global standard deviation; the adjacency matrix spectrum normalization for feature distribution normalization is: A~=D-1 / 2AD-1 / 2A~=D-1 / 2AD-1 / 2; where A is the original adjacency matrix and D is the degree matrix; the missing feature imputation for missing value imputation is based on the KNN graph diffusion strategy. These two preprocessing steps are the basic operations of GNN (such as the standard procedures of GCN and GAT), ensuring that the input data of subsequent modules such as Motif extraction and GAT feature encoding meet the conditions of stable distribution and reasonable structure.

[0026] The input for the Motif subgraph extraction and structure-aware feature encoding is a preprocessed graph G′; the output is a set of 13 three-node Motif subgraphs {Gm}, each class containing a structural semantic label sm, and each Motif node embedding Hm, where Gm is the set of 13 three-node Motif subgraphs.

[0027] The MixHop hop aggregation uses a MixHop multi-hop fusion mechanism. The inputs are: the embedding Hm for each Motif node and the adjacency matrix Am; the output is: enhanced embedding. ;in, The node embedding matrix represents the m-th class of motifs. Let f(x) represent a 3-row × h-column real matrix, which represents an embedding matrix containing 3 nodes, each with h-dimensional features.

[0028] Compared with the prior art, the present invention has the following beneficial technical effects and significant technical progress:

[0029] 1) Improved DMH-Motif architecture: The abnormal behavior detection method proposed in this technical solution achieves more accurate identification of abnormal behavior by fusing the feature representations of graph neural networks and GRU.

[0030] 2) Higher-order graph structure analysis: The abnormal behavior detection method proposed in this technical solution achieves more accurate feature representation training by analyzing the connection of higher-order graphs.

[0031] 3) Multi-dimensional feature selection: The abnormal behavior detection method proposed in this technical solution selects a large number of feature variables from multiple aspects, so as to evaluate abnormal behavior in a comprehensive and multi-dimensional way.

[0032] 5) The Boruta algorithm was innovatively applied to the identification process, ensuring the relevance of the selected feature variables.

[0033] 5) It effectively solves the prediction inaccuracies caused by graph data processing methods that rely solely on low-order graphs for direct modeling in existing technical solutions. It achieves more complete data modeling by sampling customer relationship graphs of different orders. In particular, it effectively improves the overfitting problem of the model by adjusting loss function methods and addressing feature representation issues in imbalanced scenarios.

[0034] 6) This solution addresses the lack of processing for customer graphs at different time series in existing technical solutions. Based on GRU, it further models and learns feature representations for customer graphs at different time points, constructing a time series graph training method. It also addresses the issue of insufficient feature selection effectiveness by adopting Boruta's feature selection method to ensure the relevance of the selected features. Attached Figure Description

[0035] Figure 1 This is a flowchart of Example 1. Detailed Implementation

[0036] This invention proposes a user risk prediction model based on multi-dimensional data such as basic information and behavioral information of objects. The model is constructed using a Graph Neural Network (GNN) framework, and its core process can be summarized into the following key steps: 1) Using user entities as graph nodes and social relationships and other connections as graph edges, an initial graph structure containing heterogeneous relationships is constructed, and the graph data is fully represented by fusing node attribute features and edge relationship features; 2) The constructed graph data undergoes preprocessing operations such as standardization, feature encoding, and missing value imputation to optimize the integrity of the graph structure and the rationality of feature distribution; 3) Based on network motif theory, 13 basic topological structural units are further identified and extracted from the original graph to generate multiple sets of motif subgraphs (…). to This invention aims to enhance the diversity and expressive power of graph structure features. In the DMH-Motif module, the 13 generated Motif subgraphs are first input into a Graph Attention Network (GAT) for hierarchical feature extraction. The attention mechanism dynamically captures key interaction patterns between nodes in different topologies. Furthermore, a MixHop hybrid hop count aggregation mechanism is introduced, simultaneously aggregating 1-hop direct neighbor features and 2-hop indirect neighbor features for each node. Learnable weight parameters are used to adaptively fuse different hop count information, effectively enhancing the interaction capability of local-global information while preserving high-order structural features. Subsequently, the 13 Motif graph feature sequences enhanced by MixHop are input into a Gated Recurrent Unit (GRU). Its temporal modeling capability captures the temporal dependencies of the feature sequences, and dynamically assigns contribution weights of different Motif structures to the final user embedding, ultimately outputting a high-quality user embedding vector containing multi-order hybrid structural features and temporal evolution features. Finally, the learned user embedding vector is input into a Multilayer Perceptron (MLP), which maps the high-dimensional structured features to a risk probability space through nonlinear transformation, ultimately outputting anomaly predictions. .

[0037] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0038] See Figure 1 This embodiment employs a graph neural network framework to construct a user risk prediction model, enabling the detection of abnormal user behavior. Specifically, it includes:

[0039] 1) Motif subgraph extraction and feature representation

[0040] Based on the analysis of actual patterns in abnormal behavior detection scenarios, this invention extracts 13 basic three-node motifs (numbered) from heterogeneous graphs. to Each type of motif corresponds to a typical interaction pattern and carries specific semantics in the transmission of abnormal behavior. For example, This indicates a two-way correlation and is often used to identify the mutually reinforcing effect of risks; This represents a closed-loop interaction, which can reflect the potential for abnormal behavior to circulate and spread within a limited scope; This describes the chain relationship, which helps to trace abnormal behavior paths and assess remote dependency risks.

[0041] For each identified motif subgraph, a graph attention network (GAT) is used for independent feature extraction. Unlike ordinary GAT, the attention weight quantization in this method not only depends on node features but also explicitly introduces the topological structure of the motif as a constraint. Specifically, for a given motif subgraph, the attention coefficient of node pair (i,j) is... The attention weights are calculated jointly from node features and the structural features of the motif they belong to, and then normalized using the Softmax function. This mechanism can dynamically evaluate the differences in association between the same node pair under different semantic environments, thereby achieving true structure-aware feature encoding.

[0042] 2) MixHop Feature Fusion

[0043] The Mixhop graph neural network architecture is an innovative solution to the limited expressive power of traditional graph convolutional networks (GCNs) when dealing with complex neighborhood structures (such as heterogeneous information networks). Its core idea lies in explicitly modeling and mixing neighborhood information at different distances (hop counts) to capture richer local graph structure patterns, surpassing the limitation of standard GCNs that only aggregate direct (1-hop) neighbor information. In conventional anomaly detection, the single-hop neighborhood aggregation paradigm of traditional graph convolution operations faces significant challenges: First, single-hop aggregation can only capture local information of direct neighbors, making it difficult to model higher-order structural patterns such as triangular closure relationships and long-range propagation paths; second, the fixed-weight aggregation mechanism cannot adapt to the feature propagation patterns of different types of topologies (such as scale-free networks and small-world networks); finally, indirect relationships (such as the behavioral patterns of second-order neighbors) are not explicitly modeled, leading to incomplete identification of information transmission paths. To overcome the above limitations, this invention introduces an improved MixHop feature fusion mechanism, whose core innovations are reflected in multiple dimensions: in terms of the processing object, it expands from a single homogeneous graph to multiple heterogeneous motif subgraphs; in terms of information scale, it adopts dynamic adaptive fusion instead of a fixed hop count set; in terms of structure awareness, it uses motif-specific parameters instead of globally uniform weights; in terms of feature interaction, it introduces a nonlinear gating mechanism instead of linear combination; and in terms of regularization strategy, it combines spectral normalization and L2 constraints to replace single Dropout. Based on network motif theory, it further identifies and extracts 13 basic topological structural units from the original graph, generating multiple sets of motif subgraphs ( to To enhance the diversity and expressive power of graph structure features, the DMH-Motif module first inputs the generated 13 sets of Motif subgraphs into a Graph Attention Network (GAT) for hierarchical feature extraction. The attention mechanism dynamically captures key interaction patterns between nodes in different topologies. Furthermore, a MixHop hybrid hop count aggregation mechanism is introduced, simultaneously aggregating 1-hop direct neighbor features and 2-hop indirect neighbor features for each node. Learnable weight parameters are used to adaptively fuse information from different hop counts, effectively enhancing the interaction capabilities of local and global information while preserving high-order structural features.

[0044] 3) Cross-Motif Feature Fusion and User Embedding Vector Generation

[0045] To fuse multi-view Motif structural information into a unified, high-quality representation, this invention introduces a gated recurrent unit (GRU) for temporal feature fusion across Motifs. Specifically, it fuses the 13 Motif map features enhanced by MixHop (i.e., to The node features learned by the subgraph are treated as a sequence and input into the Gated Recurrent Unit (GRU) in a fixed order. With its powerful temporal dependency modeling capabilities, the GRU treats this sequence as a continuous process of "time steps", dynamically updating and fusing information.

[0046] 4) Imbalanced sample handling

[0047] In abnormal behavior detection scenarios, negative samples are relatively few, resulting in a high degree of sample imbalance. This invention uses a dynamic focus loss method to dynamically adjust the parameters of the focus loss, enhancing its attention to samples that are difficult to classify. Therefore, this paper improves the loss function of the GNN model by introducing a dynamic focus loss function. Dynamic focus loss is one of the improved methods of traditional focus loss, aiming to dynamically adjust the parameters of the focus loss according to the difficulty of each sample. Such dynamic adjustment allows the model to adapt more flexibly to samples of varying difficulty, enhancing its attention to samples that are difficult to classify. The traditional focus loss is shown in the following formula:

[0048] .

[0049] in, It is the predicted probability of the model, and This is the adjustment factor for focus loss. In dynamic focus loss, this adjustment factor... It is no longer a fixed value, but is dynamically adjusted according to the difficulty of the sample.

[0050] A common dynamic adjustment method is based on the predicted probability of the sample. To calculate a new adjustment factor The adjustment factor Calculated by the following formula:

[0051] .

[0052] Here, α and β are hyperparameters that control the adjustment factors. Sensitivity to different samples. Thus, when the model's predicted probability for a particular sample is low, It will be closer to α; while when the predicted probability is high... It will be closer to β.

[0053] The specific steps to implement abnormal user behavior detection are as follows:

[0054] 1) Determine the target customer group and time window

[0055] First, the research subjects were selected, and a specific time point was chosen as the cutoff point. The period preceding this cutoff point (6 months) was designated as the observation period, and the period following it (3 months) as the performance period. Behavioral data from the observation period was used to analyze any abnormal behaviors observed during the performance period. Furthermore, a sliding window approach was employed, shifting both the performance and observation periods forward by one month to construct multiple test and validation sets.

[0056] 2) Graph Construction

[0057] The behavioral data of the object during the observation period is selected as the independent variable. A graph is constructed based on the relationship between the objects. The basic information and behavioral information of the objects are included. The graph is preprocessed with basic data and then output to the next layer DMH-Motif structure.

[0058] 3) Data preprocessing

[0059] Since the quality of the acquired data cannot be guaranteed, data cleaning is the first step after obtaining the data. First, missing value imputation is performed. For discrete data, the mode of the values ​​in each column is used to fill missing values; for continuous data, the mean of the values ​​in each column is used. Next, duplicate data is removed. Then, the data undergoes format and logical error cleaning, removing data whose format does not conform to expectations (e.g., monetary data should be in numeric format, but some data is in character format); and data that does not conform to the logical relationship between variables is also removed (e.g., the amount spent in the past 12 months is less than the amount spent in the past 6 months). Finally, outlier handling is performed. Here, box plots are used to identify outliers in continuous data; values ​​that meet the following formula are considered outliers:

[0060] .

[0061] Where Q is the data to be detected, Q1 is the first quartile, Q3 is the third quartile, and IQR is the interquartile range (IQR = Q3 - Q1).

[0062] After data cleaning, high-quality data was obtained and used for subsequent work.

[0063] 4) Feature Filtering

[0064] To reduce the risk of overfitting, these thousands of variables cannot be directly used in model construction. Therefore, it is necessary to select variables that are strongly correlated with overdue payments. Here, the Boruta algorithm is used for feature selection, and the algorithm process is as follows:

[0065] The original dataset R has m columns of features. The row order of each column of features is randomly shuffled to obtain m shaded features, which constitute the shaded feature set S.

[0066] After horizontally concatenating the shadow feature set S to the original dataset R, a new dataset N = [R, S] is formed, containing 2m features, including m true features from the original dataset R and m shadow features from the shadow feature set S.

[0067] Using a new dataset N as input, a decision tree model is trained, outputting the importance of 2m feature variables. The maximum importance of the m shaded feature variables is calculated and denoted as . .

[0068] For the i-th true feature in dataset N (i is between 1 and m), if the feature importance Greater than If the i-th feature is significant, then the i-th feature is marked as important; otherwise, it is marked as unimportant.

[0069] To avoid the influence of randomness, steps (1)-(4) need to be repeated n times to ensure more reliable results. Record the number of times each true feature is marked as significant in the n experiments.

[0070] Assuming each feature has a probability of being labeled as important (0.5), then Following a binomial distribution, the distribution can be truncated at both ends and divided into three regions by setting a confidence interval threshold (e.g., p=0.05). This is based on the number of times each variable is labeled. Based on the region, we can obtain three types of variables: one type is the variables that the Boruta algorithm believes need to be retained, i.e., the rightmost green area; another type is the variables that are questionable, i.e., the middle purple area; and the third type is the variables that need to be excluded, i.e., the leftmost red area. Here, only the first type of variables that need to be retained are retained and used as input variables for subsequent modeling.

[0071] 5) Model building and training

[0072] After data preprocessing and feature selection, a relationship graph is constructed based on the existing data. The original graph is then input into the DMH-Motif model. The MixHop module is used to extract motif subgraphs and perform multi-motif fusion for feature extraction. The extracted features are then input into the GRU model for temporal feature fusion. The contribution weights of different motif structures to the final user embedding are dynamically allocated. The final output is a high-quality user embedding vector containing multi-level hybrid structure features and temporal evolution features. Finally, the fused features are input into the MLP network. After parameter tuning, the initial model construction is completed.

[0073] This embodiment uses a dynamic focus loss function to train the model, dynamically adjusting the parameters of the focus loss to enhance attention to samples that are difficult to classify. 6) Effectiveness Evaluation

[0074] To fully demonstrate the effectiveness of the user risk prediction model based on DMH-Motif (Dynamic Multi-Hop Motif), this embodiment selects three representative datasets. The Ethereum-Fraud dataset originates from the transaction network on the Ethereum blockchain. This dataset contains 10,000 nodes (wallet addresses) and 200,000 edges (transaction records), with each node having a 128-dimensional feature vector. Nodes are labeled as either "fraudulent" or "non-fraudulent." This dataset is constructed based on publicly available transaction records on the Ethereum blockchain, identifying addresses exhibiting fraudulent behavior through analysis of transaction patterns by domain experts. The Ethereum-Fraud dataset holds a significant position in the field of financial risk detection, especially in identifying fraudulent behavior on the blockchain; the model's performance on this dataset fully reflects its ability to capture abnormal transaction patterns. The Twitter-Loan dataset is a synthetic dataset constructed by integrating Twitter social network data and loan default data. This dataset contains 5,000 nodes (users) and 80,000 edges (social relationships and financial behavior relationships), with each node having a 300-dimensional feature vector. Nodes are categorized as either "loan default" or "non-default". This dataset was constructed by matching Twitter users' social relationships with financial behavior data from lending platforms using user IDs, forming a heterogeneous information network. The Twitter-Loan dataset is significant in the research of social-financial hybrid networks, enabling the validation of models' ability to integrate multimodal information (social + financial).

[0075] These datasets are widely recognized in the field because they provide risk labels (such as default and fraudulent behavior) verified by domain experts, thus ensuring the reliability of the experimental results. AUC and Pre are used as evaluation metrics for model performance. Comparisons are made with currently open-source models such as ST-GNN and XgBoost on the same dataset. The proposed model achieves significant performance improvements, as detailed in Table 1 below:

[0076] Table 1. Model Performance Validation and Comparison

[0077]

[0078] To further verify the model's universality in different scenarios, this embodiment supplements the testing on the ImageNet, DoTA, and UBnormal datasets. Specifically: ImageNet is a landmark image classification dataset in computer vision, created by Fei-Fei Li's team at Stanford University (started in 2009); DoTA is an authoritative dataset for aerial image target detection, covering 2,806 high-resolution aerial images (800×800~4000×4000 pixels), 188,282 instances, and 15 target classes (aircraft, ships, vehicles, etc.); UBnormal is a synthetic dataset for video anomaly detection (released at CVPR 2022), designed specifically for weakly supervised / semi-supervised learning, using virtual animated characters in Cinema 4D to synthesize anomalous events (such as fighting, running, falling), avoiding the challenges of labeling real surveillance data; the training set mainly consists of normal videos, while the test set includes detailed frame-level anomaly annotations. The model's performance is detailed in Table 2 below, demonstrating its universality.

[0079] Table 2 Model Universality Validation

[0080]

[0081] Through the effect evaluation of the above different model performance verification and model generality verification, it can be seen that the model has significant improvements in generalization and universality, especially in some imbalanced sample areas.

[0082] The above is merely a further description of the present invention and is not intended to limit the scope of this patent. Any equivalent implementation of the present invention should be included within the scope of the claims of this patent.

Claims

1. A multi-model fusion anomaly detection method based on DMH-Motif, characterized in that, A method for constructing a user risk prediction model using a graph neural network framework to detect abnormal user behavior is presented. The construction of the user risk prediction model specifically includes the following steps: (I) Construction and preprocessing of graph data Step 1-1: Using user entities as graph nodes and social relationships and other connections as graph edges, construct an initial graph structure containing heterogeneous relationships, and achieve a complete representation of the graph data by fusing node attribute features and edge relationship features; Steps 1-2: Perform preprocessing on the constructed graph data, including standardization, feature encoding, and missing value imputation. (ii) Graph Structure Enhancement Thirteen basic topological structural units were identified and extracted from the original image to generate multiple sets of Motif subgraphs. to To enhance the diversity and expressive power of graph structural features; (III) Motif Subgraph Extraction and Structure-Aware Feature Encoding Motif recognition employs an efficient enumeration algorithm to extract 13 directed / undirected triplet topologies, including closed loops, chains, and stars. The structure-aware GAT introduces motif structure encoding by calculating attention coefficients. (iv) MixHop hop count aggregation The MixHop hybrid hop count aggregation module is used to aggregate 1-hop direct neighbor features and 2-hop indirect neighbor features for each node. The adaptive fusion of different hop count information is achieved through learnable weight parameters, which enhances the interaction capability of local-global information while preserving high-order structural features. (v) Cross-Motif temporal fusion and user-embedded generation RU temporal modeling is used for temporal fusion of motifs and generation of user embeddings. The model input is 13 sets of enhanced motif embeddings {H^1,...,H^13}, which are globally pooled to obtain the sequence {v1,...,v13}. The output is the fused user embedding hu∈Rh, which is the final feature representation. Here, hu is the user representation vector, Rh is an h-dimensional real space, and h represents the hidden layer dimension. (vi) Abnormal checks By using an MLP neural network, based on the feature representation obtained in step (v), the probability value (0-1) of whether it is abnormal is output.

2. The multi-model fusion anomaly detection method based on DMH-Motif according to claim 1, characterized in that, The construction and preprocessing of the graph data takes the following inputs: user attribute feature matrix X and heterogeneous relation edge set E (including edge type labels); the output is: preprocessed graph G′=(V′,E′,X′), satisfying: node connectivity enhancement, feature distribution normalization, and missing value imputation; where V′ is the node set, E′ is the edge set, and X′ is the node feature matrix; the node feature normalization for node connectivity enhancement is: xi′=(xi-μ) / σ; where xi is the original node feature vector, μ is the global mean, and σ is the global standard deviation; the adjacency matrix spectrum normalization for feature distribution normalization is: A~=D-1 / 2AD-1 / 2A~=D-1 / 2AD-1 / 2; where A is the original adjacency matrix and D is the degree matrix; the missing feature imputation for missing value imputation is based on the KNN graph diffusion strategy.

3. The multi-model fusion anomaly detection method based on DMH-Motif according to claim 1, characterized in that, The input for the Motif subgraph extraction and structure-aware feature encoding is a preprocessed graph G′; the output is a set of 13 three-node Motif subgraphs {Gm}, each class containing a structural semantic label sm, and each Motif node embedding Hm; where Gm is a set of 13 three-node Motif subgraphs.

4. The multi-model fusion anomaly detection method based on DMH-Motif according to claim 1, characterized in that, The MixHop hop aggregation uses a MixHop multi-hop fusion mechanism. The inputs are: the embedding Hm for each Motif node and the adjacency matrix Am; the output is: enhanced embedding. ;in, Let m be the node embedding matrix of the m-th motif. It is a 3-row × h-column real matrix, representing an embedding matrix containing 3 nodes, each with h-dimensional features.

Images