Interaction data anomaly detection method based on gated data fusion

Abstract

The application provides an interactive data anomaly detection method based on a gated data fusion, comprising the following steps: extracting original data from network interactive data to obtain topology data and processing the network interactive data to obtain statistical data, wherein the topology data and the statistical data constitute to-be-detected data; constructing a gated fusion reasoning model for performing anomaly classification on the to-be-detected data; training the gated fusion reasoning model and updating model parameters to obtain a trained gated fusion reasoning model as a prediction model for reasoning; and performing anomaly classification prediction on the to-be-detected data by using the prediction model to obtain an anomaly classification result. The method can construct a constrained gated fusion mechanism, can self-adaptively adjust the fusion proportion of a graph representation vector and a statistical feature vector, can prevent extreme weights from occurring, can inhibit over-reliance of anomaly detection on a single feature source, and can improve the robustness of detection when data distribution drifts or noise exists.

Description

Technical Field

[0001] This invention relates to the fields of machine learning and graph neural network technology, and in particular to an interactive data anomaly detection method based on gated data fusion. Background Technology

[0002] In cybersecurity regulatory tasks such as anomaly detection in blockchain transactions and anomaly identification in social networks, anomaly detection usually requires the analysis of two types of heterogeneous information: micro-topological information and data statistical information in network interaction data.

[0003] Existing technologies typically employ graph learning methods to simply concatenate heterogeneous information, classify it after concatenation at the classifier level, or perform multi-model fusion for detection. However, network interaction data is characterized by imbalance and high uncertainty, often containing noise, missing data, and data distribution shifts, and frequently exhibiting extreme data. Existing processing methods struggle to effectively address the characteristics of network interaction data, resulting in poor detection accuracy: they are prone to overfitting or underfitting in the presence of noise or sample distribution shifts; the inconsistent information content and scale of heterogeneous information lead to poor processing stability; and the processing of feature sources during fusion is difficult to control, resulting in weak generalization ability.

[0004] Therefore, it is necessary to provide a new method for fusing topological information and data statistics to improve the accuracy of data anomaly detection in cybersecurity supervision tasks. Summary of the Invention

[0005] The purpose of this invention is to provide an interactive data anomaly detection method based on gated data fusion, so as to improve the accuracy of interactive data anomaly detection.

[0006] In a first aspect, the interactive data anomaly detection method based on gated data fusion provided by the present invention includes: extracting raw data from network interactive data to obtain topological data and processing the network interactive data to obtain statistical data, wherein the topological data and statistical data constitute the data to be detected; constructing a gated fusion inference model for anomaly classification of the data to be detected, including: encoding the topological data to obtain a graph representation vector and encoding the statistical data to obtain a statistical feature vector; and according to the formula Cascaded gating regularization is applied to the graph representation vector and statistical eigenvector to obtain constrained gating coefficients, where, This represents the constrained gating coefficient. This represents the truncation function. This represents the Sigmoid function. This represents the gated vector generated by concatenating the graph representation vector and the statistical feature vector. Indicates the temperature coefficient. The threshold parameter is represented; the graph representation vector and statistical feature vector are weighted and fused based on the gating coefficient to obtain the fused feature vector; the anomaly probability is predicted on the fused feature vector, and the network interaction data is determined to be abnormal based on the anomaly probability prediction result; the gated fusion inference model is trained and the model parameters are updated to obtain the trained gated fusion inference model as the prediction model for inference; the prediction model is used to perform anomaly classification prediction on the data to be detected to obtain the anomaly classification result.

[0007] The beneficial effects of the interactive data anomaly detection method based on gated data fusion provided by this invention are as follows: It constructs a constrained gated fusion mechanism that adaptively adjusts the fusion ratio of graph representation vectors and statistical feature vectors, and prevents extreme weights through parameterized constraints, thereby improving the stability and generalization ability of anomaly detection at the structural level. The specially designed method for calculating the gating coefficients can suppress the risk of low detection accuracy due to over-reliance on a single feature source, improving the robustness of detection in the presence of data distribution drift or noise.

[0008] In one possible implementation, the fused feature vector calculation satisfies the following formula: ,in, Represents the fused feature vector. This represents the constrained gating coefficient. This indicates element-wise multiplication. A graph represents a vector. This represents a statistical eigenvector.

[0009] In another possible embodiment, anomaly probability prediction of the fused feature vector includes: mapping the fused feature vector to the class probability space using a fully connected layer; and using an activation function to perform nonlinear activation on the class probability to obtain the anomaly probability prediction value.

[0010] In other possible embodiments, training the gated fusion inference model includes: constructing a training dataset, wherein the samples in the training dataset include topological data of network interactions, statistical data, and the true class labels of the samples; constructing training batches, randomly sampling samples from the training dataset according to the batch size to obtain training data for multiple training batches, setting optimizer parameters and training epochs; in each training epoch, generating gating coefficients based on the data in the applied training batch, injecting noise into the gating coefficients to obtain perturbation coefficients, calculating a fusion feature vector based on the perturbation coefficients for anomaly prediction, calculating the main loss and optional additional regularization terms based on the anomaly prediction results, and using the main loss and optional additional regularization terms for backpropagation to jointly update the model parameters; and using the parameters obtained after completing the set number of training epochs as the fixed parameters of the model to obtain a gated fusion inference model with fixed parameters as the prediction model.

[0011] The main loss calculation satisfies the following formula: ,in, Indicates the main loss. Represents the cross-entropy loss function. This represents the initial value for class prediction when the classification unit maps the fused feature vectors to the class probability space. This represents the true class label of the sample; the optional additional regularization term is calculated according to the following formula: ,in, This indicates optional additional regular expression terms. The hyperparameter represents the control of the gating regularization strength. The penalty function represents the constraint-gated distribution. This represents the constrained gating coefficient.

[0012] Using a gated fusion inference model as the base model, different training data, training rounds, and initial parameters are configured for the base model to train multiple prediction models. Multiple prediction models are used to perform anomaly classification prediction on the data to be detected. The anomaly classification results of multiple prediction models are integrated to further perform anomaly classification prediction to obtain the final anomaly classification result.

[0013] The process of integrating the anomaly classification results of multiple prediction models to further perform anomaly classification prediction to obtain the final anomaly classification result includes: using multiple prediction models to perform anomaly classification prediction on the data to be detected; collecting the anomaly classification results of multiple prediction models as meta-features; using the meta-features to train a meta-learning model to learn the combination relationship between the prediction results of different models; stopping training when the meta-learning model converges or reaches a preset number of training rounds to obtain the trained meta-learning model. The meta-features include the initial prediction values, constrained gating coefficients, and anomaly probability prediction values ​​obtained when multiple prediction models perform anomaly classification prediction; and using the trained meta-learning model to perform anomaly classification prediction based on the meta-features to obtain the final anomaly classification result.

[0014] The process of integrating the anomaly classification results of multiple prediction models to further perform anomaly classification prediction to obtain the final anomaly classification result includes: using multiple prediction models to perform anomaly classification prediction on the data to be detected; calculating a weighted average of the initial prediction values ​​obtained when performing anomaly classification prediction on multiple prediction models, mapping the weighted average result to anomaly probability prediction values, and determining whether the data is anomaly data based on the prediction probability prediction values. Attached Figure Description

[0015] Figure 1 A flowchart illustrating an interactive data anomaly detection method based on gated data fusion provided in an embodiment of the present invention;

[0016] Figure 2This is a schematic diagram of an electronic device structure provided in an embodiment of the present invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions in the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed following the word and its equivalents, but do not exclude other elements or objects.

[0018] This embodiment provides a method for detecting anomalies in interactive data based on gated data fusion. See the appendix to the specification. Figure 1 The method includes:

[0019] S101: Extract raw data from network interaction data to obtain topology data and process the network interaction data to obtain statistical data. The topology data and statistical data constitute the data to be tested.

[0020] In one possible embodiment, the topology data specifically includes entity information and attribute information extracted from the original network interaction data, and the statistical data specifically includes transaction-level statistical information obtained from the original network interaction data. Based on the topology data, an interaction behavior graph can be constructed with entities in the network interaction as nodes and interaction relationships as edges. Specifically, this includes a set of nodes, a set of edges, and corresponding node and edge features. The node set, edge set, and their node and edge features are all derived from the structured extraction results of the original network interaction data. Nodes correspond to entities in the original data, edges correspond to interaction relationships, node features correspond to entity attribute information, and edge features correspond to interaction behavior attribute information. The statistical data consists of statistical features or transaction-level features related to the overall interaction behavior graph, represented in the form of a fixed-length vector. This feature corresponds to transaction-level statistical information related to a single interaction, behavior sequence, or the overall interaction behavior graph.

[0021] For example, scenarios where network interaction anomaly detection is performed by analyzing topological and statistical data of network interactions are mainly in blockchain transaction anomaly detection and social network anomaly identification. Taking blockchain transaction anomaly detection as an example, specific application scenarios include network security supervision, supply chain finance risk prevention and control, and cross-border data flow security. In these scenarios, the topological data is specifically represented as an interaction behavior graph with account addresses, contract addresses, IoT devices, or transaction entities as nodes, and asset transfers, data exchanges, and contract call relationships as edges. Node characteristics include attributes such as historical interaction frequency, credit status statistics, and contract type encoding, while edge characteristics include transaction behavior attributes such as asset value, time interval, and instruction type identifier. Statistical data includes, but is not limited to, total asset transfer volume, computing resource consumption statistics, call chain depth, and cross-domain / contract call counts.

[0022] S102: Construct a gated fusion inference model for anomaly classification of the data to be detected.

[0023] In one possible embodiment, the specific process of anomaly classification in the gated fusion inference model includes: encoding topological data to obtain a graph representation vector, and encoding statistical data to obtain a statistical feature vector. According to the formula... Cascaded gating regularization is applied to the graph representation vector and statistical eigenvector to obtain constrained gating coefficients, where, Represents the constrained gating coefficient. This represents the truncation function. This represents the Sigmoid function. This represents the gated vector generated by concatenating the graph representation vector and the statistical feature vector. Indicates the temperature coefficient. This represents the threshold parameter. The threshold parameter is a preset hyperparameter used to limit the lower bound of the fusion weights, preventing the weights from approaching 0 or 1 when weighting the graph representation vector and statistical feature vector based on the gating coefficient, thus avoiding excessive bias towards either the graph representation vector or the statistical feature vector, leading to model degradation. The value of the threshold parameter is determined based on the constraint requirement of minimizing the contribution of a single feature source in practical applications.

[0024] A fused feature vector is obtained by weighting and fusing the graph representation vector and statistical feature vector based on a gating coefficient. Anomaly probability prediction is then performed on the fused feature vector, and the anomaly probability prediction result is used to determine whether the network interaction data is anomalous.

[0025] In one possible embodiment, the gated fusion inference model includes a feature encoding unit, a gating constraint unit, a feature fusion unit, and a classification unit. Each unit is designed to execute the processing steps within the gated fusion inference model. Specifically, the feature encoding unit uses a graph neural network encoder to encode the topological data to obtain a graph representation vector, and uses a multilayer perceptron encoder to encode the statistical data to obtain a statistical feature vector. The gating constraint unit concatenates the graph representation vector and the statistical feature vector and uses a gating generation network to generate a gating vector. After performing temperature scaling and sigmoid mapping on the gating vector, a linear interval mapping is performed to obtain constrained gating coefficients. The feature fusion unit performs weighted fusion of the graph representation vector and the statistical feature vector based on the gating coefficients to obtain a fused feature vector. The classification unit performs anomaly probability prediction on the fused feature vector and determines whether the network interaction data is anomalous based on the anomaly probability prediction result.

[0026] The process of predicting the anomaly probability of the fused feature vector includes: mapping the fused feature vector to the class probability space using a fully connected layer, and using an activation function to perform non-linear activation on the class probability to obtain the anomaly probability prediction value.

[0027] A gated fusion inference model is constructed to process the data to be detected. It fuses topological and statistical data from the data to generate comprehensive features for anomaly detection, and then predicts the anomaly probability of these features to obtain the anomaly identification result. For example, when processing the data to be detected, the data is input into the gated fusion inference model. The model encodes the topological and statistical data using a feature encoding unit to obtain graph representation vectors and statistical feature vectors. A gate constraint unit generates constrained gate coefficients based on the graph representation vectors and statistical feature vectors. A feature fusion unit determines the fusion weights based on these constrained gate coefficients to perform weighted fusion of the graph representation vectors and statistical feature vectors to obtain a fused feature vector. A classification unit maps the fused feature vector to an anomaly probability prediction value within the range [0, 1]. The anomaly probability prediction value is used to determine whether the corresponding network interaction data belongs to anomaly data.

[0028] In one possible embodiment, the specific processing flow executed by the gated fusion inference model through each functional module is as follows:

[0029] The feature encoding unit uses a graph neural network encoder to process the topological data, propagating and aggregating information about nodes and their neighborhood relationships in the topological data, and obtaining a graph representation vector through global pooling. The multilayer perceptron encoder is used to process the statistical data to complete the linear mapping of the statistical data to obtain a statistical feature vector. The graph representation vector and the statistical feature vector are normalized to ensure that the statistical feature vector and the graph representation vector are at the same feature space scale, providing dimensionally consistent and numerically stable input conditions for subsequent gating fusion.

[0030] The gating constraint unit concatenates the graph representation vector and statistical feature vector generated by the feature encoding unit, and inputs them into the gating generation network for processing to obtain the gating vector. After performing temperature scaling and sigmoid mapping on the gating vector, it is then linearly mapped to an interval determined based on the threshold parameter. The constrained gating coefficients are obtained by using a generative gating network, which is a feedforward neural network structure containing at least one fully connected layer and a nonlinear activation function. This function performs a nonlinear mapping on the cascaded features to output a gating vector with the same dimension as the features. Specifically, the gating coefficients can be calculated using the following formula: ,in, Indicates the gating coefficient. This represents the truncation function. This represents the Sigmoid function. This represents the gated vector generated by concatenating the graph representation vector and the statistical feature vector. Indicates the temperature coefficient. This represents the threshold parameter. It should be noted that temperature scaling is used to control the gradient sensitivity of the gating coefficients. The temperature coefficient must be within the range of [0.1, 1] to avoid the gating coefficients becoming almost binary due to a too small temperature coefficient, or the gating degenerating into uniform weighting due to a too large temperature coefficient. The design of the gating constraint unit forces the gating coefficients out of the saturation region. By forcing the gating output to not touch the 0 / 1 boundary, it ensures that there is always an effective gradient flow on the backpropagation path, ensuring that the network remains trainable even when facing extreme numerical outliers. The design of the gating constraint unit avoids the problems existing in the prior art, such as the gating coefficients entering the saturation region or gradient vanishing during backpropagation due to extreme numerical characteristics of the data to be detected (such as sudden large transactions in blockchain or explosive traffic in social networks), which prevents the weights from being adjusted according to the error when fusing topological and statistical data, and leads to overfitting to a single strong statistical feature. The gating coefficients generated by the gating constraint unit also correspond one-to-one with the graph representation vector and statistical feature vector in terms of feature dimension.

[0031] The feature fusion unit performs a weighted fusion of the graph representation vector and the statistical feature vector based on a gating coefficient to obtain a fused feature vector. The calculation of the fused feature vector specifically satisfies the following formula: Where fused represents the fused feature vector. Represents the constrained gating coefficient This indicates element-wise multiplication. A graph represents a vector. This represents a statistical feature vector. The fused feature vector integrates topological and statistical data, and the strength of the feature values ​​in different dimensions, determined by gating coefficients, reflects the comprehensive contribution of each heterogeneous feature source to the current network interaction data sample under gating constraints. Compared with existing technologies that use scalar gating or simple splicing to fuse heterogeneous data, which implicitly assume that the importance of heterogeneous information is equal or changes synchronously across all feature dimensions; and the attention mechanism weighting method often leads to information competition, i.e., winner-takes-all, making it difficult to retain the features of both types of data simultaneously; and the method of introducing multi-channel mechanisms for processing has many problems, such as graph representation vectors usually undergoing multiple nonlinear transformations, resulting in distribution drift between their numerical distribution and the transaction features that have only undergone simple statistical analysis, and direct fusion leading to features with large values ​​dominating the network during gradient updates and masking topological features, the gated fusion inference model designed in this embodiment can simultaneously retain heterogeneous feature evidence for classification prediction, solving the problem of heterogeneous information fusion.

[0032] The fused feature vector is input into the classification unit, which includes at least one fully connected layer and a sigmoid activation function. The classification unit maps the fused feature vector to anomaly probability prediction values ​​within the range [0,1]. During binary classification, the anomaly probability prediction values ​​are compared with a preset anomaly discrimination threshold to determine the classification result of the network interaction data samples. Specifically, the fully connected layer maps the fused feature vector input to the classification unit to the class probability space to obtain the initial class prediction value. , This represents the initial value for class prediction, which maps the fused feature vector to the class probability space. This represents the weight matrix of the fully connected layer. Represents the fused feature vector. This represents the bias vector of the fully connected layer. The Sigmoid activation function performs a non-linear activation on the initial values ​​for class prediction to obtain the anomaly probability prediction values: , This represents the predicted anomaly probability. The Sigmoid activation function maps the linear output of the fully connected layer to an interpretable probability value. When the predicted anomaly probability exceeds a set anomaly threshold, the network interaction data sample is classified as an anomaly; otherwise, it is classified as normal.

[0033] In one possible implementation, the gated fusion inference model outputs a judgment result and derives a gating coefficient. A secondary strategy can be applied to the samples based on the gating coefficient, which is beneficial for model decision source analysis, anomaly detection, and human-computer interaction auditing. The risk control intervention method is guided by the tendency of the gating coefficient: for anomaly samples with high gating coefficient values, subsequent strategies trigger correlation graph analysis, focusing on investigating contextual information; for anomaly samples with low gating coefficient values, subsequent strategies trigger indicator auditing, focusing on verifying the compliance of statistical indicators. Manual review is triggered when the gating coefficient is close to 0 or 1.

[0034] S103: Train the gated fusion inference model and update the model parameters to obtain the trained gated fusion inference model as a prediction model for inference.

[0035] In one possible embodiment, training the gated fusion inference model includes: constructing a training dataset, wherein the sample data in the training dataset includes topological data of network interactions, statistical data, and true class labels of the samples; constructing training batches, randomly sampling samples from the training dataset according to the batch size to obtain training data for multiple training batches, setting optimizer parameters and training epochs; in each training epoch, generating gating coefficients based on the data in the applied training batch, injecting noise into the gating coefficients to obtain perturbation coefficients, calculating fusion feature vectors based on the perturbation coefficients for anomaly prediction, calculating the main loss and optional additional regularization terms based on the prediction results, and using the main loss and optional additional regularization terms for backpropagation to jointly update the model parameters, the updated parameters including graph neural network encoder parameters, multilayer perceptron encoder parameters, gated generative network parameters, temperature coefficient, and classification unit parameters; and using the parameters obtained after completing the set number of training epochs as the fixed parameters of the model to obtain a gated fusion inference model with fixed parameters as the prediction model.

[0036] The main loss is calculated according to the following formula: , Indicates the main loss. Represents the cross-entropy loss function. This represents the initial value for class prediction when the classification unit maps the fused feature vectors to the class probability space. This represents the true class label of the sample; the optional additional regularization term is calculated according to the following formula: , This indicates optional additional regular expression terms. The hyperparameter represents the control of the gating regularization strength. The penalty function represents the constraint-gated distribution. This represents the constrained gating coefficient.

[0037] In one possible embodiment, the gated fusion inference model is trained by injecting controlled noise during the training process so that the model learns the joint distribution of topological data and statistical data simultaneously to suppress the model's overfitting dependence on a single strong statistical feature and improve the model's robustness.

[0038] In one specific embodiment, the training data for training the gated fusion inference model includes topological data, statistical data, and sample true class labels. Complete samples are randomly selected from the training data according to a set batch size to construct training batches. In the parameter settings: the temperature coefficient is randomly selected with an initial value within a preset range (0.5–1.0) and remains fixed during training; the threshold parameter is randomly selected with an initial value within a preset range (0.1–0.2) and remains fixed during training; the initial noise value is set to 0.05 and can be gradually decreased with increasing training rounds.

[0039] After completing the training batch construction, optimizer parameter settings, and training epoch settings, model training begins. In each training epoch, the following steps are performed sequentially on each training batch: encoding the topological and statistical data; generating gating vectors and calculating constrained gating coefficients based on the encoded graph representation vectors and statistical feature vectors. Under the constrained gating coefficient The coefficients after perturbation are obtained by injecting controlled noise. , For noise, the coefficients after disturbance Perform a hard capture again to bring it back to the preset range. The final perturbation coefficient is obtained. The fused feature vector is recalculated based on the perturbation coefficient. Anomaly prediction results are obtained by predicting anomaly probabilities based on the fused feature vectors. The main loss, optional additional regularization term, and total loss are calculated based on the anomaly prediction results. The main loss and optional additional regularization term are then used to jointly update the graph encoder parameters, gating generation network parameters, and classification unit parameters through backpropagation. The main loss is: The cross-entropy loss measures the difference between the predicted and true distributions, while the main loss is the core loss that drives the model to complete the classification task. Optional additional regularization terms are: The optional additional regularization term is used to prevent the gating coefficient from remaining close to the threshold parameter for an extended period. or To prevent the model from relying on only a single feature source; the total loss is: .

[0040] After completing a set number of training rounds, the graph encoder parameters, gating network parameters, temperature coefficient, threshold parameters, and classification head parameters are obtained as the final fixed parameters. These fixed parameters are used as the parameters for the fixed application of the gating fusion inference model to obtain a prediction model for anomaly classification prediction of the dataset to be detected.

[0041] In situations where network interaction data is frequently imbalanced, and anomalous patterns undergo structural shifts (such as from single-indicator anomalies to hidden structural anomalies), existing technologies suffer from a strong feature dependency trap. Even after randomly discarding some neurons, the remaining strong features are still sufficient to dominate decision-making, causing the model to guess directly instead of exploring deep, weak features. This poses the problem of the model completely failing due to over-reliance on historical features. This embodiment, based on a specially designed gating coefficient generation method, further designs a process that injects controlled noise into the gating coefficients during the training phase and limits the range of the resulting perturbation coefficient clipping values, thereby improving robustness to pattern shifts.

[0042] S104: Use the prediction model to perform anomaly classification prediction on the dataset to be detected and obtain the anomaly classification result.

[0043] In one possible embodiment, using a prediction model to perform anomaly classification prediction on the data to be detected can be either by using a single prediction model to directly process the dataset to be detected to obtain the anomaly classification result, or by using an ensemble mechanism to process the dataset to be detected: that is, introducing multiple models for prediction and integrating the prediction results of multiple models to obtain the anomaly classification result.

[0044] In one possible embodiment, a gated fusion inference model is used as the base model. Different training data, training rounds, and initial parameters of the model are configured for the base model to train multiple prediction models. The multiple prediction models are used to perform anomaly classification prediction on the dataset to be detected. The anomaly classification prediction results of the multiple prediction models are integrated to further perform anomaly classification prediction to obtain the final anomaly classification result.

[0045] For example, the integration mechanism for processing the dataset to be detected refers to: using a gated fusion inference model as the base model, training multiple prediction models with the same structure by configuring different training data, training epochs, and initial parameters of the model. When performing anomaly classification prediction on the data to be detected, the data to be detected is processed separately by the above multiple prediction models, and the processing results of the multiple prediction models are integrated to obtain an enhanced prediction result.

[0046] The integration of multiple prediction models can be achieved in several ways: When using a weighted average method, the initial prediction values ​​obtained from anomaly classification prediction by multiple models are weighted and averaged. The weighted average result is then mapped to anomaly probability prediction values, and the data is determined to be anomalous based on these prediction probabilities. When using a stacking method, the anomaly classification results from multiple prediction models are collected as meta-features. These meta-features are used to train a meta-learning model to learn the combination relationships between the prediction results of different models. Training stops when the meta-learning model converges or reaches a preset number of training rounds, resulting in a trained meta-learning model. This trained meta-learning model is then used to perform anomaly classification prediction based on the meta-features to obtain the final anomaly classification result. The collected meta-features include the initial prediction values ​​obtained from anomaly classification prediction by multiple prediction models, constrained gating coefficients, and anomaly probability prediction values.

[0047] In a specific embodiment, a K-fold cross-validation mechanism is used to perform cross-validation on each prediction model. The initial value of the category prediction, the gating coefficient, and the anomaly probability prediction value of the classification unit output by each prediction model are collected and mapped to the category probability space as features for training the meta-learning model. This enables the meta-learning model to learn the combination relationship between the prediction results of different models. The training process of the meta-learning model stops when the preset training rounds or the validation loss convergence condition is reached, and the trained meta-learning model is obtained.

[0048] This invention provides an interactive data anomaly detection method based on gated data fusion. It designs a gated regularization operator structure that resists saturation and ensures gradient survival. The method utilizes a temperature coefficient to scale the gated vector through division to smooth the input distribution, uses the sigmoid function for mapping, and forces the output to be confined to a symmetric closed interval through linear transformation and the clamp function, thus forcing the gated coefficients out of the saturation region and ensuring a constant effective gradient flow along the backpropagation path. This addresses the problem that existing technologies struggle to adapt to sudden large transactions in blockchains or explosive traffic in social networks, where sudden data spikes quickly enter the saturation region, leading to gradient vanishing during backpropagation and preventing the model from adjusting weights based on errors. Furthermore, the method designs a process that injects controlled noise into the gated coefficients during model training and clips the resulting perturbation coefficients to a defined range. By incorporating noise injection and clipping as structured sub-steps in gated learning, the model is forced to simultaneously learn the joint distribution of graph structure and statistical features, improving robustness to pattern transfer.

[0049] The gating coefficients calculated by this invention correspond one-to-one with the graph representation vector and the statistical feature vector in terms of feature dimensions. The calculation of the fused feature vector is to perform element-wise weighted fusion in each dimension so that the generated fused feature vector can rely on topological data and statistical data in different dimensions respectively, and can simultaneously retain the feature evidence of both for classification prediction.

[0050] The anomaly interaction detection method based on graph embedding and graph-level feature gating fusion of the present invention forms a processing sequence of [independent normalization → gating → fusion → post-processing], which breaks with conventional practices. Before the necessary information is identified and enters the gating network, its norm is forcibly flattened, ensuring that the gating decision is based on the feature change pattern rather than absolute value. Even if the statistical value of a certain dimension is huge, if it does not have statistical anomalies in the normalized distribution, the gating network can still assign higher weights to graph structure features, thereby accurately capturing structural anomalies in the context of high data, and fundamentally preventing the gating network from degenerating into a simple numerical comparator.

[0051] Furthermore, the abnormal interaction detection method based on graph embedding and graph-level feature gating fusion of the present invention is compatible with various GNN backbones (such as SAGE, GAT, GCN, etc.) and graph-level feature representations, and is easy to integrate into existing training / inference pipelines.

[0052] All relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0053] In other embodiments of this application, an electronic device is disclosed, such as... Figure 2 As shown, the electronic device 200 may include: one or more processors 201; a memory 202; a display 203; one or more application programs (not shown); and one or more computer programs 204. These devices can be connected via one or more communication buses 205. The one or more computer programs 204 are stored in the memory and configured to be executed by the one or more processors 201. The one or more computer programs 204 include instructions that can be used to perform actions such as... Figure 1 And the steps in the corresponding embodiments.

[0054] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0055] In the embodiments of this application, the functional units can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0056] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as flash memory, portable hard disk, read-only memory, random access memory, magnetic disk, or optical disk.

[0057] The above description is merely a specific implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application. Therefore, the protection scope of the embodiments of this application should be determined by the protection scope of the claims.

Claims

1. A method for detecting anomalies in interactive data based on gated data fusion, characterized in that, include: Raw data is extracted from network interaction data to obtain topology data, and statistical data is obtained by processing the network interaction data. The topology data and the statistical data constitute the data to be detected. A gated fusion inference model is constructed for anomaly classification of the data to be detected, including: encoding the topological data using a graph neural network encoder to obtain a graph representation vector, and encoding the statistical data using a multilayer perceptron encoder to obtain a statistical feature vector; according to the formula... The graph representation vector and the statistical feature vector are subjected to cascaded gating regularization to obtain constrained gating coefficients, wherein, This represents the constrained gating coefficient. This represents the truncation function. This represents the Sigmoid function. This represents the gated vector generated by concatenating the graph representation vector and the statistical feature vector. Indicates the temperature coefficient. The threshold parameter is used to represent the threshold parameter; the graph representation vector and the statistical feature vector are weighted and fused based on the threshold coefficient to obtain a fused feature vector; the fused feature vector is used to predict the anomaly probability, and the network interaction data is determined to be abnormal based on the anomaly probability prediction result; A gated fusion inference model is trained and its parameters are updated to obtain a trained gated fusion inference model used as a prediction model for inference. Training the gated fusion inference model includes: constructing a training dataset, where samples include network interaction topology data, statistical data, and the true class labels of the samples; constructing training batches, randomly selecting samples from the training dataset according to batch size to obtain multiple training batches of training data, setting optimizer parameters and training epochs; in each training epoch, generating gating coefficients based on the data in the applied training batch, injecting noise into the gating coefficients to obtain perturbation coefficients, calculating a fusion feature vector based on the perturbation coefficients for anomaly prediction, calculating the main loss and optional additional regularization terms based on the anomaly prediction results, and using the main loss and optional additional regularization terms for backpropagation to jointly update the model parameters; the parameters obtained after completing the set number of training epochs are used as the fixed parameters of the model, resulting in a gated fusion inference model with fixed parameters used as the prediction model. An anomaly classification result is obtained by using a prediction model to predict anomalies in the data to be detected. The calculation of the fused feature vector satisfies the following formula: ,in, Represents the fused feature vector. This represents the constrained gating coefficient. This indicates element-wise multiplication. A graph represents a vector. Represents a statistical eigenvector; The main loss calculation satisfies the following formula: ,in, Indicates the main loss. Represents the cross-entropy loss function. This represents the initial value for class prediction when the classification unit maps the fused feature vectors to the class probability space. Indicates the true category label of the sample; The optional additional regularization term is calculated according to the following formula: ,in, This indicates optional additional regular expression terms. The hyperparameter represents the control of the gating regularization strength. The penalty function represents the constraint-gated distribution. This represents the constrained gating coefficient.

2. The method according to claim 1, characterized in that, Performing anomaly probability prediction on the fused feature vector includes: Fully connected layers are used to map the fused feature vectors to the class probability space; Anomaly probability predictions are obtained by applying a non-linear activation function to the class probabilities.

3. The method according to claim 1, characterized in that, Using a gated fusion inference model as the base model, different training data, training rounds, and initial parameters of the model are configured for the base model to train multiple prediction models. Multiple prediction models are used to perform anomaly classification prediction on the data to be detected. The anomaly classification results of multiple prediction models are integrated to further perform anomaly classification prediction to obtain the final anomaly classification result.

4. The method according to claim 3, characterized in that, The anomaly classification results from integrating multiple prediction models are further used for anomaly classification prediction to obtain the final anomaly classification result, including: Multiple prediction models are used to perform anomaly classification prediction on the data to be detected. The anomaly classification results of multiple prediction models are collected as meta-features. Meta-learning models are trained using meta-features to learn the combination relationship between the prediction results of different models. Training is stopped when the meta-learning model converges or the training reaches the preset training rounds, and the trained meta-learning model is obtained. The meta-features include the initial prediction values, constrained gating coefficients and anomaly probability prediction values ​​obtained when multiple prediction models perform anomaly classification prediction processing. The trained meta-learning model is used to predict anomalies based on meta-features to obtain the final anomaly classification result.

5. The method according to claim 3, characterized in that, The anomaly classification results from integrating multiple prediction models are further used for anomaly classification prediction to obtain the final anomaly classification result, including: Multiple prediction models are used to perform anomaly classification prediction on the data to be detected. When performing anomaly classification prediction on multiple prediction models, the initial predicted values ​​are calculated by weighted averaging. The weighted average result is then mapped to anomaly probability prediction values. Based on the predicted probability prediction values, it is determined whether the data is anomalous.

Images