E-commerce anomaly detection method based on timing intensity gating and cross-domain interaction GNN

Abstract

This invention belongs to the fields of artificial intelligence, big data analysis, and network security technology. It relates to an e-commerce anomaly detection method based on temporal strength gating and cross-domain interactive GNNs, addressing the problems of insufficient temporal sensitivity, fragmented cross-domain information, weak adaptability to cold-start scenarios, inability to identify unknown anomalies, and lack of cross-platform comparability of anomaly scores in existing technologies. This invention first collects and preprocesses multi-source e-commerce business logs to construct a multi-view dynamic heterogeneous graph. Temporal strength gating encoding is implemented through a state-space model, and cold-start node embedding is completed using a probabilistic encoder. Cross-domain information fusion is achieved using a dual-flow graph neural network, and an open classification framework is constructed by combining momentum prototype updates and pseudo-unknown sample interpolation. Then, a standardized relative anomaly score is generated through a neighborhood reconstruction decoder, and anomaly determination is completed through confidence-weighted fusion. This invention can accurately and efficiently identify e-commerce anomalies, improve the reliability and generalization ability of risk control, and is applicable to e-commerce risk control in multiple scenarios.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence, big data analysis, and network security, specifically to an e-commerce anomaly detection method based on temporal strength gating and cross-domain interaction GNN. Background Technology

[0002] The development of the digital economy has driven the widespread adoption of e-commerce. Simultaneously, cybercrime is becoming increasingly complex, organized, and sophisticated in its disguise. E-commerce anomalies have evolved from single-point fraud to coordinated attacks, with attackers often using normal interactions to conceal malicious intent, posing a significant challenge to e-commerce risk control. Utilizing graph structures to mine entity relationship patterns has become the mainstream technical approach for e-commerce anomaly detection. While Graph Neural Networks (GNNs) excel at aggregating neighbor information and capturing nonlinear features, current technologies still have many limitations when facing the highly dynamic, heterogeneous, and concealed anomalies in e-commerce scenarios.

[0003] 1. Insufficient ability to capture temporal features: Mainstream dynamic graph neural networks treat time information as location encoding or simple sequence features, focusing on the smooth evolution of node states. They cannot explicitly measure temporal intensity deviation. The "temporal burstiness" and "semantic high intensity" signals of e-commerce abnormal behavior are easily diluted by normal interaction information. Furthermore, traditional recurrent neural networks have gradient vanishing or exploding problems when encoding historical sequences, making it difficult to model long-term temporal dependencies. The inference delay also cannot meet the real-time risk control requirements. 2. Shallow cross-domain heterogeneous information fusion: The e-commerce ecosystem contains multi-view data such as transactions and behaviors. Advanced fraudsters often appear normal in a single view but have flaws in cross-view logic. However, existing heterogeneous graph neural networks mostly use meta-paths or simple attention mechanisms to fuse different types of edges, lacking deep cross-domain interaction and conflict verification mechanisms, and cannot effectively identify abnormal behavior disguised across domains. 3. Weak representation ability of cold start nodes: Cold start nodes such as newly registered users of e-commerce and low-frequency active users lack historical interaction records. Traditional GNNs cannot generate effective embeddings through message passing. Existing technologies simply introduce attribute features, ignore the topological information of the global graph structure, and adopt a deterministic mapping method without uncertainty measurement. The feature dimension depends on the structure and is ignored, resulting in extremely poor robustness in detecting cold start nodes. 4. Lack of ability to detect unknown anomalies: Existing methods assume that the anomaly patterns in the test set are distributed in the same way as those in the training set, and can only identify fraud methods that have been "seen". Faced with the continuously evolving unknown attack patterns of black and gray industries, they lack the ability to recognize "unknown" anomalies, and are prone to misjudging new anomalies as normal, resulting in serious underreporting. 5. Abnormal scores lack cross-platform comparability: Existing methods use the absolute value of reconstruction error as the basis for anomaly judgment. This value is greatly affected by the platform's data distribution and business scenarios, and is not comparable across platforms. This results in the need to recalibrate the threshold when the pre-trained model is deployed on different e-commerce platforms, leading to high engineering implementation costs. 6. The model training and decision-making mechanism is imperfect: The existing model has not achieved end-to-end joint optimization of temporal coding, cross-domain fusion, unknown discrimination, and reconstruction detection. Moreover, it adopts "hard switching" judgment logic for unknown anomalies, which can easily lead to an increase in the false positive rate and cannot balance the detection accuracy of known anomalies with the ability to identify unknown anomalies. Therefore, there is an urgent need in this field for an e-commerce abnormal behavior detection method that can explicitly quantify temporal burst intensity deviations, deeply integrate cross-domain heterogeneous patterns, possess long-range dependency perception, unknown anomaly cognition and cold-start robustness, and have cross-platform comparability of anomaly scores and a sound training decision mechanism. Summary of the Invention

[0004] To address the aforementioned problems in existing technologies, namely, the insufficient time sensitivity, cross-domain information fragmentation, cold-start vulnerability, failure to function due to unknown anomalies, and lack of cross-platform comparability of anomaly scores in the processing of dynamic heterogeneous data in e-commerce, the first aspect of this invention proposes an e-commerce anomaly detection method based on temporal strength gating and cross-domain interaction GNN, comprising the following steps: Based on the entity nodes and interaction edges extracted from e-commerce logs, transaction views and behavior views are constructed respectively to form a multi-view dynamic heterogeneous graph. Based on each interaction edge in the multi-view dynamic heterogeneous graph, the historical sequence of entity nodes is encoded using a state-space model to calculate the temporal intensity deviation, and the gated weight adaptive modulation of the original interaction edge features is generated to obtain enhanced interaction edge features. For entity nodes with sparse historical interactions, a probabilistic encoder is constructed and meta-path walk, shortest path distance, and Fourier time features are fused to predict the mean and variance of entity node embeddings. The initial entity node embeddings are obtained through an adaptive sampling and attention fusion mechanism. The enhanced interaction edge features and the entity nodes are initially embedded into the input dual-flow graph network. Attention bias and cross attention are used to realize information interaction within and between views, respectively, to generate a comprehensive embedding of entity nodes. The within-view includes within the transaction view and within the behavior view. The between-view includes between the transaction view and the behavior view. Based on the comprehensive embedding of entity nodes, the known normal prototype and the known abnormal prototype are updated with momentum, and the known class probability and the unknown class probability are output according to the distance of the entity node embedding to the prototype. The degree of the entity node and the feature distribution of its neighboring entity nodes are reconstructed by the decoder. The reconstruction error is calculated and standardized into a relative anomaly score using the mean and standard deviation of the reconstruction error of normal entity nodes in the training set. The unknown class probability and the relative anomaly score are combined to obtain the final anomaly score. When the final anomaly score exceeds the threshold, it is determined to be an abnormal entity node.

[0005] The beneficial effects of this invention are: A state-space model is used to replace the traditional recurrent neural network for encoding historical sequences, achieving linear complexity modeling of long-term temporal dependencies. This effectively captures the temporal burstiness and semantic high intensity of abnormal e-commerce behavior. By explicitly calculating the temporal intensity deviation and generating gating weights, high-risk signals are accurately locked out from normal background noise, improving the detection recall rate of time-sensitive fraud. Furthermore, the state-space model supports parallel training, significantly improving training speed and reducing inference latency, thus meeting the real-time risk control needs of e-commerce. A dual-flow graph network architecture is constructed. Attention bias is used to focus on abnormal interactions within the view, and cross-view deep semantic alignment is achieved through cross-attention. At the same time, differential vectors are introduced to explicitly measure cross-view information conflicts, forcing the model to verify the consistency of transaction and behavior patterns. This effectively identifies advanced fraud behaviors such as single-view spoofing and cross-view logical contradictions, and reduces the model's false alarm rate. For cold start nodes, a conditional vector is constructed by fusing global topological features such as metapath, distance, and time. The probability distribution model of node embedding is realized through a probabilistic encoder, rather than traditional deterministic point estimation, which explicitly expresses cognitive uncertainty. Initial embeddings are generated based on covariance adaptive sampling and attention fusion to make up for the lack of local interaction information. This enables the model to still have high detection performance in cold start scenarios such as new users and new devices, and the recall rate is significantly improved. The prototype-driven open-set unknown discrimination mechanism maintains the feature prototypes of known classes through momentum updates, synthesizes reasonable pseudo-unknown samples based on the distance ratio between samples and prototypes, and outputs the probability of unknown classes using the Euclidean distance discrimination function to avoid the theoretical defect of deterministic models misusing entropy maximization. By introducing pseudo-unknown samples during the training phase, the model can learn the ability to discriminate unknown patterns in advance, which can significantly improve the detection effect of new fraud behaviors. The absolute value of the reconstruction error is standardized into a relative anomaly score. This score is based on the reconstruction error distribution of normal nodes in the training set. It has the statistical characteristics of zero mean and unit variance, is not affected by platform data distribution or business scenarios, and is comparable across platforms. This means that the pre-trained model does not need to be recalibrated for thresholds when deployed on different e-commerce platforms, which greatly reduces the cost of engineering implementation. Instead of using the crude rule of "directly blocking unknowns", a confidence-weighted fusion method is adopted to combine the probability of unknown classes with the relative anomaly score to obtain the final anomaly score. This achieves a smooth combination of known anomaly detection and unknown anomaly identification, and significantly reduces the model's false alarm rate while maintaining the unknown anomaly recall rate, which meets the decision-making needs of industrial-grade e-commerce risk control. The design incorporates a total loss function that includes temporal prediction loss, classification loss, open classification loss, and reconstruction loss. It achieves end-to-end joint optimization of all parameters of the state-space model, probabilistic encoder, dual-flow graph network, prototype vector, and decoder, enabling all modules of the model to work together and significantly improving the overall detection performance. The AUC on public datasets significantly surpasses existing state-of-the-art methods. Attached Figure Description

[0006] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a flowchart of the steps of the e-commerce anomaly detection method based on temporal intensity gating and cross-domain interaction GNN of the present invention.

[0007] Figure 2 This is a flowchart of the initial embedding generation process for entity nodes in the e-commerce anomaly detection method based on temporal strength gating and cross-domain interaction GNN of the present invention. Detailed Implementation

[0008] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the invention. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0009] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0010] To more clearly explain the e-commerce anomaly detection method based on temporal intensity gating and cross-domain interaction GNN of this invention, the following will combine... Figures 1 to 2 The steps in the embodiments of the present invention will be described in detail below.

[0011] The first embodiment of this invention is an e-commerce anomaly detection method based on temporal intensity gating and cross-domain interaction GNN, see [link to relevant documentation]. Figure 1 This includes the following steps: S1, based on e-commerce logs, extract entity nodes and interaction edges, construct transaction view and behavior view respectively, and form a multi-view dynamic heterogeneous graph; Specifically: S101 performs preprocessing on e-commerce logs (original business logs of e-commerce platforms) by standardizing the format, filling missing values, and removing outliers. It extracts information on user, product, merchant, and device entity nodes, as well as interaction edge information such as click, favorite, add to cart, purchase, and payment. It assigns a unique identifier to each entity node and marks each interaction edge with the initiating node, receiving node, and occurrence timestamp. Preprocessing operations include: merging raw business logs such as transaction logs, behavior logs, and device logs from the e-commerce platform; using mean imputation to fill missing numerical feature values ​​and mode imputation to fill missing categorical feature values; and using the 3σ principle to remove outliers (σ is the standard deviation of the corresponding feature in the training set, removing outliers exceeding the mean ± 3σ range). A 128-dimensional attribute feature vector is constructed for four types of entity nodes: user, product, merchant, and device, covering core attributes such as user registration duration, consumption level, product category and price, merchant qualifications and ratings, and device model and IP address. A 128-dimensional attribute feature vector is also constructed for interaction edges such as clicks, favorites, adding to cart, browsing (behavioral) and purchases, payments, transfers, and refunds (transactional), containing information such as operation duration, transaction amount, payment method, and logistics status. Continuous features are graded 0-1. Normalization (normalization range is [0,1], calculated based on the maximum and minimum values ​​of the training set features) is performed on discrete features by one-hot encoding and then concatenated to obtain the final edge features. At the same time, each interaction edge is labeled with a unique initiating node ID, receiving node ID and millisecond-level timestamp, so as to achieve accurate mapping between entities and interaction relationships. S102, based on the business attributes of the interaction edges, divide them into transaction edges and behavior edges, and construct transaction views and behavior views respectively; Based on the business type of the interaction edges, all interaction edges are divided into a set E of transaction edges. T With the set of edges E of the behavior class B The two types of views share the same set of entity nodes V, and respectively construct transaction views G. T =(V,E T (T) and behavioral view G B =(V,E B ,T), where T is the time domain, containing millisecond-level timestamp information of all interactive edges; snapshot sampling is performed on the dynamic graph in 1-hour time windows to generate a time series graph snapshot set. Each snapshot retains all nodes, edges and feature information within the corresponding time window, representing the dynamic evolution characteristics of the graph structure over time, and realizing the fusion of the time dimension and the graph structure.

[0012] S103 integrates two views into a multi-view dynamic heterogeneous graph that includes a set of nodes, a set of edges, and a time domain; Isolated nodes (nodes without any interaction edges) and self-loop edges (edges where the initiating and receiving nodes are the same node) are deleted from both views. L2 normalization is then applied to both node and edge features (the feature vector of each node / edge is normalized individually, with the magnitude normalized to 1 to eliminate feature scale differences). The final result is a multi-view dynamic heterogeneous graph G=(V,E,T), where E=E T ∪E B, to provide standardized and structured graph structure data for subsequent model training; S2. Based on each interaction edge in the multi-view dynamic heterogeneous graph, use a state space model to encode the historical sequence of entity nodes to calculate the temporal intensity deviation, and generate a gated weight to adaptively modulate the original interaction edge features to obtain enhanced interaction edge features; Specifically: S201. When an entity node initiates an interaction, update the hidden state of the entity node according to the time interval and the current interaction edge attribute using a state space model; In this embodiment, the state space model includes a linear Gaussian state space model and a gated linear unit state space model (GLU-SSM), and its update method is as follows: For the linear Gaussian state space model, define a learnable state transition matrix related to the interaction time interval, update the current hidden state according to the hidden state at the previous interaction moment, the current interaction edge attribute, and the time interval, and linearly map the current hidden state to the predicted distribution of the current interaction feature through a learnable emission matrix; use the negative log-likelihood of the predicted distribution and the true interaction feature as the sequence modeling loss; For the gated linear unit state space model, use a gated recurrent unit or a gated linear unit as the state updater, splice and input the hidden state at the previous interaction moment, the original feature of the current interaction edge, and the time interval encoding to update the current hidden state; use an emission network to non-linearly map the current hidden state to obtain the predicted distribution of the current interaction feature; in this embodiment, it is preferably to use the gated linear unit state space model (GLU-SSM) as the state updater. The specific update process is: splice and input the hidden state at the previous interaction moment, the original feature of the current interaction edge, and the time interval encoding to update the current hidden state; use an emission network to non-linearly map the current hidden state to obtain the predicted distribution of the current interaction feature, and use the negative log-likelihood of the predicted distribution and the true interaction feature as the sequence modeling loss to achieve accurate encoding of temporal features and self-supervised learning of the model. Specifically: for each interaction edge in the edge set E , ( is the initiating node, is the receiving node), with the initiating node [[ID=X]] as the target, extract its historical interaction sequence before time t , corresponding to time stamps t1 < t2 <... < tk < t, and each historical interaction edge satisfies , ( is the receiving node of the th interaction); calculate the time interval between each historical interaction and the current interaction , and encode into a 64-dimensional time feature vector through a Fourier time encoding function, and combine it with the historical interaction edge feature Concatenate into a 128-dimensional input vector Initialize the Mamba block, set the state dimension N=64, and the expansion factor. = 2, kernel size K = 4, activation function is SiLU, maximum sequence length is set to 1000, and the excess part is handled by a sliding window (e.g., window size 500, stride 250); the sequence Input Mamba blocks, using selective state-space parameters based on input dependencies. , This enables selective memorization of historical events and outputs the hidden states at each time step. Take the hidden state at the last time step. As a node Historical encoding Simultaneously, a two-layer fully connected transmission network is adopted to... Mapping to the interaction feature prediction distribution, calculating the predicted distribution and the true feature (current interaction edge) Features The negative log-likelihood of () is used as the sequence modeling loss. ; S202, the current hidden state of the initiating entity node and the current interaction edge are... Features By concatenating the input intensity function consisting of two fully connected layers, the theoretical condition intensity is obtained through mapping. In this embodiment, the current hidden state is... With the current interaction edge Original feature vector The vector is concatenated along the feature dimension to form a 256-dimensional vector. The input is an intensity function consisting of two 256-dimensional fully connected layers (ReLU activation), which maps to obtain the non-negative theoretical conditional intensity. ;in, For activation function, For historical information items, the learnable weight vector is... This is the learnable weight vector for the current semantic feature term. For vector transpose, This is the embedding vector of the current edge feature. For bias terms; S203, based on the historical interaction timestamp set of entity nodes, uses kernel density estimation to fit the time distribution of interaction events, and uses the kernel density value corresponding to the current interaction timestamp as the baseline strength; In this embodiment, based on the initiating node Historical interaction timestamps collection (Corresponding interaction edge) The temporal distribution of the interaction events was fitted using Gaussian kernel density estimation (the kernel function was a Gaussian kernel, the window size was 5 time units, and the kernel bandwidth was set to 0.1). The kernel density value corresponding to the current interaction timestamp t was taken as the baseline intensity. As a benchmark reference value for the normal timing interaction behavior of nodes, it provides a basis for comparison in subsequent timing deviation calculations; S204, Input the difference between the theoretical condition intensity and the baseline intensity into the Tanh activation function to obtain the temporal intensity deviation vector; In this embodiment, the difference between the theoretical condition strength and the baseline strength is calculated. ,Will Inputting the Tanh activation function yields a 128-dimensional temporal intensity bias vector with the same dimension as the hidden state. This vector quantifies the temporal burstiness of the node's current interaction behavior. The larger the value, the more significant the deviation from the normal temporal pattern and the higher the risk of anomaly. S205, the temporal intensity deviation vector is concatenated with the hidden state and then fed into a gated network composed of a linear layer and a sigmoid, and the output is a modulation weight with the same dimension as the original features of the interaction edge; In this embodiment, the temporal intensity deviation vector With the current hidden state The vector is concatenated along the feature dimension to form a 256-dimensional vector, which is then fed into a gated network consisting of a 128-dimensional linear layer and a sigmoid activation function. The output is a 128-dimensional modulated weight with the same dimension as the original features of the interaction edges. The weight values ​​are in the range of [0,1], which realizes differentiated modulation of edge features with different deviation levels. High deviation interaction edges correspond to high weights, and low deviation interaction edges correspond to low weights. S206, Multiply the modulation weights element-wise with the original interaction edge features to obtain the enhanced interaction edge features; In this embodiment, the modulation weights and interaction edges are... Features Element-wise multiplication yields the enhanced interaction edge features: ; Where ⊙ represents element-wise multiplication, and α is a learnable scaling factor (initial value set to 1.0), which amplifies and enhances the edge features of temporally sudden anomalies, allowing high-biased interaction edges to obtain higher weights in subsequent attention allocation and feature learning of the graph network, thereby improving the recognition of abnormal interaction features. S3: For entity nodes with sparse historical interactions, a probabilistic encoder is constructed and meta-path walk, shortest path distance, and Fourier time features are fused to predict the mean and variance of entity node embeddings. The initial entity node embeddings are obtained through an adaptive sampling and attention fusion mechanism. See Figure 2 Specifically: S301, for entity nodes with sparse historical interactions, perform a meta-path-based random walk, compress the node embedding sequence on each path into a path embedding through a sequence aggregator, and perform attention fusion on all path embeddings to obtain the meta-path walk embedding. In this embodiment, nodes with fewer than 5 historical interactions are defined as sparse historical interaction nodes (denoted as ). ), three predefined core metapaths: (User-Merchant-User) (User-Device-User) (User-Product-User), covering the core business relationships in e-commerce scenarios; for each sparse node Perform a random walk of length 5, generating 10 paths per metapath, for a total of 30 paths. Each path is represented as... ( For the first in the path (number of nodes), capturing sparse nodes The global topological association features are obtained; the node embeddings on each path (randomly initialized to 64 dimensions) are compressed into 64-dimensional path embeddings using an LSTM sequence aggregator, and a 64-dimensional learnable query vector is set. Attention is fused on 30 path embeddings to obtain a 128-dimensional meta-path walk embedding. This enables accurate extraction of global topological features; S302, extract the shortest path distance feature of the entity node and encode it into a distance embedding using radial basis function; In this embodiment, sparse nodes are calculated. To the two endpoints of its associated edge within the subgraph (originating node) Receiver node The shortest path distance between the two values ​​is taken as the minimum of the two values ​​as the relative distance feature, and then encoded into a 128-dimensional distance embedding using a radial basis function (RBF, 16 kernel centers, 0.2 kernel width). sparse nodes The local topological location features are transformed into learnable low-dimensional vector representations to make up for the lack of local features of sparse nodes; S303, using the difference between the most recent interaction time of the entity node and the current time as input, Fourier time features are generated through Fourier feature mapping; In this embodiment, sparse nodes are used. The most recent interaction edge Interaction time The difference from the current time is used as input, and Fourier transforms are performed using 64 sets of sine and cosine functions of different frequencies. The resulting data are then concatenated to obtain a 128-dimensional Fourier time feature. Effectively capture sparse nodes The temporal interaction pattern characteristics allow us to uncover temporal patterns even when node historical interactions are sparse, using limited temporal information. S304, the meta-path walk embedding, the distance embedding, and the Fourier time feature are concatenated into a conditional vector; In this embodiment, metapath traversal is embedded. Distance embedding With Fourier time characteristics Concatenating along the feature dimensions yields a 384-dimensional conditional vector. merging sparse nodes The global topology, local location, and temporal interaction features provide a comprehensive feature foundation for probabilistic embedding modeling. S305, the condition vector (corresponding to sparse nodes) is projected through a reversible projection layer. Mapping to the uniform cumulative distribution function space yields uniformly distributed sampling points; In this embodiment, a linear reversible projection layer is used to transform the 384-dimensional conditional vector. Mapping to the uniform cumulative distribution function space in the interval [0,1] yields 384-dimensional uniformly distributed sampling points, which prepares for the subsequent generation of Gaussian distributed latent variables with a preset correlation structure, thus realizing the standardized transformation of the probability distribution; S306, The uniform sampling points are linearly transformed by the Cholesky decomposition of the learnable correlation matrix to generate Gaussian distributed latent variables with a preset correlation structure; In this embodiment, the standard normal inverse cumulative distribution function is applied element-wise to the 384-dimensional uniformly distributed sampling points to obtain independent standard normal latent variables, and a learnable 128×128 correlation matrix is ​​introduced. via Cholesky decomposition To ensure its positive definiteness ( Using a lower triangular matrix (diagonal elements initialized to 1, off-diagonal elements initialized to 0.01), a linear transformation is performed on the standard normal latent variables to generate a 128-dimensional Gaussian distributed latent variable Z with a pre-defined correlation structure. This explicitly models the dependencies between feature dimensions and improves the efficiency of sparse nodes. The rationality of probabilistic embedding; calculating the likelihood loss of the Gaussian distributed latent variable Z generated by the probabilistic encoder relative to the preset Gaussian copula distribution. ,in, The learnable parameters of the copula distribution are used to constrain the rationality of the latent variable distribution and improve the probabilistic modeling effect of sparse node embedding. S307, The Gaussian distributed latent variable is input into two independent multilayer sensing heads to predict the embedded mean and log-variance respectively; In this embodiment, the Gaussian distributed latent variable Z is input into two independent multilayer sensing heads (both are 2-layer 256-dimensional fully connected layers with ReLU activation), and sparse nodes are predicted respectively. 128-dimensional embedding mean vector With log-variance vector ,pass Obtain the standard deviation vector to achieve sparse nodes. Embedded probability distribution modeling quantifies the uncertainty of sparse node features; S308, the initial sampling embedding is obtained based on reparameterized adaptive sampling; In this embodiment, the multivariate Gaussian distribution is based on reparameterization. In adaptive sampling, the number of samples is determined by the trace of the covariance matrix. ,in, For learnable temperature parameters, sparse nodes The greater the feature uncertainty, the more samples are taken, and the better the final result. A 128-dimensional initial sampling embedding is used to compensate for the lack of feature information in sparse nodes through multiple sampling. S309, the meta-path walking embedding, the distance embedding, and the initial sampling embedding are fused through an attention mechanism to output the initial embedding of the entity node; In this embodiment, metapath traversal is embedded. Distance embedding and Concatenate the initial sampled embeddings, set a 128-dimensional learnable attention query vector, and calculate the attention weights for each embedding: ; Calculate the weighted sum of all embeddings to obtain sparse nodes. Initial embedding of 128-dimensional entity nodes The initial embedding of non-sparse nodes directly adopts the fusion vector of their attribute features and historical interaction features, with a unified dimension of 128, to ensure the consistency of the embedding dimension of all nodes. S4, the enhanced interaction edge features and the entity nodes are initially embedded into the input dual-flow graph network, and information interaction within and between views is realized by attention bias and cross attention respectively, generating a comprehensive embedding of entity nodes; the within-view includes within the transaction view and within the behavior view; the between-view includes between the transaction view and the behavior view. Specifically: S41, information interaction within the view is achieved using attention bias, and the method is as follows: S4011, In each layer of the dual-flow graph network, for the edges formed by nodes inside the transaction view or behavior view and their neighboring nodes, a graph attention network is used to calculate the dot product similarity between the query vector and the key vector. In this embodiment, a dynamic graph Transformer two-stream network driven by edge features is constructed, with a total of 3 layers. Each layer includes an in-view edge-gated attention module, a cross-view attention module, and a residual fusion module. The node embedding dimension is fixed at 128 dimensions, the number of multi-head attention heads is set to 8, and each head has a feature dimension of 16 dimensions. The activation function is SiLU. In each layer of the network, in-view information aggregation is performed on the transaction view and the behavior view, respectively. For in-view nodes... and its neighboring nodes (Among them, nodes within the view) Specifically, it refers to the central node currently performing attention calculations. It is a specific entity selected from the set of entity nodes, such as a user, product, merchant, or device. Neighboring nodes are those... (There are receiving / initiating nodes with direct interaction edges), which will display the characteristics of the current layer nodes. The inputs are fed into the linear projection layer to obtain a 128-dimensional query vector. Key vector Calculate the dot product similarity between the two. (Dividing by the square root of the feature dimension alleviates gradient vanishing); S4012, the enhanced interaction edge features corresponding to the edge are reduced to scalar bias through linear mapping, and added as additive bias terms to the dot product similarity; In this embodiment, the node and its neighboring nodes Enhanced interaction edge features between (Corresponding interaction edge) , For the initiating node, Input a 1D linear mapping layer to the receiving node to generate a scalar attention bias. This is added as an additive bias term to the dot product similarity of the query-key vectors to obtain... This allows the anomalous information of enhanced edges to directly affect the attention allocation within the view, thus affecting the neighbor nodes corresponding to high-bias edges. Gain higher attention weight; S4013, apply nonlinear activation to the dot product similarity after adding bias, and perform normalization on the set of neighbor nodes to obtain the attention coefficient of each neighbor node; In this embodiment, the dot product similarity after adding bias is... Apply Softmax nonlinear activation and at nodes set of all neighboring nodes Perform normalization to obtain neighbor nodes. Attention coefficient The sum of attention coefficients is 1, which enables the aggregation of differentiated information from neighboring nodes; S4014, The value vectors of neighboring nodes are weighted and summed using the attention coefficients to obtain the updated embedding representation of the node in the current layer; In this embodiment, the current layer neighbor nodes Features The input linear projection layer yields a 128-dimensional value vector. Attention coefficient The node is obtained by weighted summation of the value vectors of all its neighbors. Embedded after update This enables the differentiated aggregation of neighbor node features; S4015, the updated embedding representations of all nodes constitute the node embedding matrix of the view in the current layer, and the node embedding matrix is ​​used for cross-attention calculation between views in the same layer; after multiple iterations, the final layer node embedding matrix of the transaction view and the final layer node embedding matrix of the behavior view are obtained. In this embodiment, the updated embeddings of all nodes within the view are integrated into a node embedding matrix for that view at the current layer, which serves as the input for cross-attention calculation between views at the same layer; for nodes... The updated embedding uses residual connections and layer normalization to alleviate the gradient vanishing problem in deep networks; after three layers of network iteration, the final layer embedding matrix of the transaction view is obtained. Embedding matrix with final layer of behavior view To achieve deep feature learning within a single view; S42 uses cross-attention to achieve information interaction between views, and the method is as follows: S4021, in each layer of the dual-flow graph network, obtain the node embedding matrix after the transaction view and behavior view are passed through the graph message; In this embodiment, in each layer of the network, the transaction view embedding matrix obtained by extracting in-view information aggregation and residual fusion is used. (Each row corresponds to one node) (Transaction view embedding) and behavior view embedding matrix (Each row corresponds to the same node) (Behavioral view embeddings) serve as the foundational data for cross-view cross-attention computation, ensuring the robustness of input features; S4022: Using the node embedding matrix of the transaction view as the query and the node embedding matrix of the behavior view as the key and value, calculate the long-term cross attention and output the transaction view embedding matrix enhanced by the behavior view information. In this embodiment, For query matrix, Given a key / value matrix, we compute an 8-head cross-attention mechanism to capture the feature supplement of the behavioral view to the transaction view (such as abnormal user purchase behavior corresponding to abnormal browsing / add-to-cart behavior), resulting in a transaction view embedding matrix enhanced with behavioral view information. ; Each row corresponds to the same node. Enhanced post-transaction view embedding; S4023: Using the node embedding matrix of the behavior view as the query and the node embedding matrix of the transaction view as the key and value, calculate the multi-head cross attention and output the behavior view embedding matrix enhanced with transaction view information. In this embodiment, For query matrix, Given a key / value matrix, calculate 8-head cross-attention to capture the feature complements of the transaction view to the behavior view (such as abnormal browsing behavior of users corresponding to their subsequent abnormal transaction behavior), resulting in a behavior view embedding matrix enhanced with transaction view information: ; Each row corresponds to the same node. Enhanced post-behavior view embedding; S4024, the transaction view embedding matrix and the behavior view embedding matrix are respectively connected through residual connections and layer normalization, and then input into the feedforward network to obtain the final dual-view node embedding matrix of the layer. The dual-view node embedding matrix is ​​used as the input feature for message passing in the next layer view, and then the multi-layer iteration is performed. In this embodiment, for and Residual connections and layer normalization are performed separately to alleviate the gradient vanishing problem. Then, a feedforward network consisting of two 256-dimensional fully connected layers (ReLU activation) is input to perform deep learning on the fused cross-view features, resulting in the final dual-view node embedding matrix of this layer (each row corresponds to a node). The dual-view fusion embedding serves as the input feature for message passing within the next layer of view, completing cross-view information interaction within one layer; after three iterations, deep complementary fusion of dual-view features is achieved. S43, the method for generating the comprehensive embedding of entity nodes is as follows: S4031, For the same entity node, extract the embedding vector of the node from the final layer node embedding matrix of the transaction view, and extract the embedding vector of the node from the final layer node embedding matrix of the behavior view. In this embodiment, for the same entity node Embedded matrix from the final layer of the transaction view Extract its 128-dimensional transaction view embedding vector Embedded matrix from the final layer of the behavior view Extract its 128-dimensional behavior view embedding vector This ensures the consistency of the two vector dimensions; S4032, subtract the two embedding vectors element by element and take the absolute value to obtain the difference vector; In this embodiment, the node The absolute value of the element-wise subtraction between the transaction view embedding vector and the behavior view embedding vector yields a 128-dimensional difference vector. Explicit metric nodes The degree of conflict between cross-view features can capture disguised anomalies that are difficult to detect in a single view (such as normal transaction view features corresponding to abnormal behavior view features). S4033, the difference vector is concatenated with the two embedding vectors to form a joint feature representation; In this embodiment, the node of By splicing along the feature dimensions, a 384-dimensional joint feature representation is formed, which integrates dual-view depth features and cross-view conflict features to achieve the integration of multi-dimensional anomaly features; S4034, the joint feature representation is input into a feedforward network consisting of two linear layers and a ReLU activation function, and the output is a mapping vector with the same dimension as the node embedding dimension; In this embodiment, the node The 384-dimensional joint feature representation input is a feedforward network consisting of two linear layers (256-dimensional → 128-dimensional, ReLU activation), which performs feature dimensionality reduction and deep fusion to obtain a 128-dimensional mapping vector, which is consistent with the original node embedding dimension to ensure input compatibility of subsequent modules. S4035, Perform L2 Euclidean normalization on the mapping vector to obtain the comprehensive embedding of the entity node; In this embodiment, for nodes The 128-dimensional mapping vector is subjected to L2 Euclidean normalization (modulus normalized to 1) to eliminate the influence of feature scale, resulting in the final entity node integrated embedding. This provides core and robust node features for subsequent unknown discrimination and abnormal score calculation; S5, based on the comprehensive embedding of entity nodes, updates the known normal prototype and the known abnormal prototype with momentum, and outputs the known class probability and the unknown class probability according to the distance of the entity node embedding to the prototype; specifically including the following steps: S501 maintains known normal prototype vectors and known abnormal prototype vectors using momentum update. In each training batch, the mean of the comprehensive embedding of all normal nodes and the mean of the comprehensive embedding of all abnormal nodes in the current batch are calculated respectively, and the prototype vectors are updated by moving average according to the momentum coefficient. In this embodiment, the prototype of a known normal class is initialized. With known exception class prototypes Set the momentum coefficient for a 128-dimensional zero vector. (Empirical values ​​to ensure the smoothness and robustness of prototype updates); In each training batch, if there are labels, the known normal node set is directly partitioned according to the labels. With known abnormal node set If no labels are provided, nodes are sorted by reconstruction error, with the bottom 50% considered normal nodes and the top 5% considered abnormal nodes; calculations are then performed separately. and Middle node The mean of the overall embedding is calculated using the formula: ; ; The prototype vector is updated by moving average, which allows the prototype to adapt to changes in feature distribution during training, ensuring the prototype's dynamic adaptability and robustness. S502, For the pseudo-unknown entity node to be synthesized, randomly sample a comprehensive embedding from the set of known normal nodes and sample a comprehensive embedding from the set of known abnormal nodes; In this embodiment, in each training batch, to synthesize pseudo-unknown samples with semantic plausibility, samples are randomly selected from the known set of normal nodes. Sampling a node Integrated Embedding From the known set of abnormal nodes Sampling a node Integrated Embedding This is to prepare for the subsequent linear interpolation synthesis of pseudo-unknown samples; S503, calculate the Euclidean distance of the sampled normal nodes to the known normal prototype and the Euclidean distance of the sampled abnormal nodes to the known normal prototype, and use the ratio of the Euclidean distance of the sampled abnormal nodes to the known normal prototype to the sum of the two distances as the hybrid weight. In this embodiment, the computing node Integrated Embedding To the known normal prototype Euclidean distance ,node Integrated Embedding arrive Euclidean distance ; Calculate the mixed weights This allows mixed samples to move away from known normal prototypes and naturally fall into feature regions outside known categories, thus ensuring the unknown nature of the features of pseudo-unknown samples. S504, Based on the hybrid weight, perform linear interpolation on the sampled normal node comprehensive embedding and abnormal node comprehensive embedding to generate the comprehensive embedding of pseudo-unknown entity nodes. In this embodiment, based on the mixed weights For nodes Integrated Embedding With nodes Integrated Embedding Perform linear interpolation to generate a comprehensive embedding of pseudo-unknown entity nodes. This ensures both the semantic rationality of pseudo-unknown samples (based on real sample interpolation) and the unknown nature of their features (far from known prototypes). S505, the comprehensive embedding of the pseudo-unknown entity nodes is used to train the unknown category detection branch to optimize the probability of the unknown class; In this embodiment, the pseudo-unknown entity node is comprehensively embedded. Assign unknown class labels and add them to the training batch for training the unknown class detection branch. The optimization objective is to maximize the unknown class probability. Calculate the open classification loss. ,in, The expected value is the average of the nodes in the specified set, used to balance the loss calculation. It can be any entity node (specifically, a pseudo-unknown entity node). It is a set of pseudo-unknown entity nodes (a set of all pseudo-unknown samples generated by linear interpolation). For nodes The probability of the unknown class (with values ​​in the range [0,1]). This refers to the set of unknown categories (i.e., the collective term for anomaly categories that the model has not seen, such as new types of fraud, new types of attacks by black and gray industries, and other unlabeled anomaly types in e-commerce scenarios). S506, output the known class probability and the unknown class probability based on the distance of the entity node embedded in the prototype; In this embodiment, for any entity node Integrated Embedding Calculate its distance to the known normal prototype respectively. Known anomaly prototype Euclidean distance , The smaller the distance, the more likely it is to be a node. The higher the similarity to the corresponding prototype, the better; the distance is transformed using Softmax normalization to obtain the node. The known normal probability: Compared with known anomaly probability ; Calculate nodes using the Sigmoid activation function Unknown class probability All three probability values ​​are in the range of [0,1], which realizes the probabilistic determination of the category to which a node belongs, supporting both accurate detection of known anomalies and effective identification of unknown anomalies. S6, reconstruct the degree of the entity node and the feature distribution of its neighboring entity nodes using the decoder, calculate the reconstruction error, and standardize it into a relative outlier score using the mean and standard deviation of the reconstruction error of normal entity nodes in the training set; specifically including the following steps: S601 starts from the comprehensive embedding of entity nodes, predicts the out-degree and in-degree of the node through the first branch network, and uses the mean square error between the predicted value and the true value as the degree reconstruction loss. In this embodiment, a neighborhood reconstruction decoder with two branches—inclusion degree reconstruction and neighbor feature distribution reconstruction—is constructed, both based on the comprehensive embedding of entity nodes. For input; the degree reconstruction branch is a two-layer fully connected network (128-dimensional → 64-dimensional → 2-dimensional, ReLU activation), from Predicting nodes The out-degree (number of initiated interaction edges) and in-degree (number of received interaction edges) are denoted by the predicted value. The actual value is Calculate the mean square error between the predicted and actual values, and use it as the degree reconstruction loss. Quantization nodes The degree feature deviates from the reconstruction of normal nodes; the larger the degree feature deviation, the more abnormal the node topology. S602, the distribution parameters of the embedding of each neighbor node in the neighborhood of the node are predicted by the second branch network. It is assumed that the neighbor embedding follows a Gaussian distribution, and the negative log-likelihood of the predicted distribution and the real neighbor embedding is used as the neighbor feature distribution reconstruction loss. In this embodiment, the neighbor feature distribution reconstruction branch is a two-layer fully connected network (128-dimensional → 128-dimensional → 256-dimensional, ReLU activation), from the node of Predict the multivariate Gaussian distribution parameters of the embeddings of its neighboring nodes, and output a 128-dimensional mean vector. diagonal elements of the 128-dimensional covariance matrix , constitute the predicted distribution Compute nodes Real neighbor nodes Embedded mean vector With covariance matrix To obtain the true distribution Calculate the KL divergence between the two distributions and use it as the reconstruction loss of the neighbor feature distributions. Quantization nodes The deviation of the neighbor feature distribution from that of normal nodes indicates that the neighbor association of the node is more abnormal. S603, the degree reconstruction loss and the neighbor feature distribution reconstruction loss are weighted and summed to obtain the total reconstruction error; In this embodiment, the degree reconstruction loss and the neighbor feature distribution reconstruction loss are weighted and summed with equal weights (1:1) to obtain the node. Total reconstruction error: The larger the value, the more likely the node is to be larger. The more the degree feature and neighborhood feature distribution deviate from the normal pattern, the higher the risk of anomaly, thus realizing a quantitative measurement of node topology anomalies. S604 calculates the mean and standard deviation using the reconstruction error of normal samples in the training set, standardizes the reconstruction error of the test sample, and obtains the relative anomaly score. In this embodiment, during the model training phase, the total reconstruction error of all normal nodes in the training set is collected to construct an error set. ; Calculate the mean of the error set with standard deviation And solidify it; the node to be tested The total reconstruction error is standardized using Z-score to obtain the relative outlier score. The score has the statistical characteristics of zero mean and unit variance, which eliminates the differences in feature scale under different datasets and e-commerce scenarios, realizes the cross-platform universality of abnormal scores, and the score value is positively correlated with the degree of node abnormality. S7, the unknown class probability and the relative anomaly score are combined to obtain the final anomaly score. When the final anomaly score exceeds a threshold, it is determined to be an abnormal entity node; specifically, this includes the following steps: S701, the final abnormal score is obtained by fusing the unknown class probability with the relative abnormal score; In this embodiment, the node Unknown class probability As a confidence weight, the product of a preset high-confidence anomaly constant and the probability of the unknown class is added to the product of the relative anomaly score and (1 - the probability of the unknown class) to obtain the final anomaly score, thus achieving a smooth integration of probabilistic unknown judgment and standardized reconstruction error; specifically: based on the risk preference of the e-commerce platform's risk control, a preset high-confidence anomaly constant is used. This value corresponds to a threshold of 3 standard deviations of the relative outlier score, representing a statistically strong anomaly signal. It can be dynamically adjusted based on actual business needs (such as the stringency of risk control). A confidence-weighted fusion strategy is used to calculate the node... Final abnormal score: ; For an unknown abnormal node, its unknown class probability Approaching 1, the final anomaly score approaches the high-confidence anomaly constant, achieving effective determination of unknown anomalies; for known anomaly nodes, their unknown class probability... The score is relatively low, and the final anomaly score is determined by the reconstruction error, achieving accurate identification of known anomalies (note the pseudo-unknown entity nodes). The probability of the unknown class corresponds to General entity node The probability of the unknown class corresponds to (Symbols adapt to node types, no obfuscation); S702, when the final abnormal score exceeds the threshold, it is determined to be an abnormal entity node; In this embodiment, a grid search method is used to determine the optimal anomaly detection threshold on the validation set (which accounts for 20% of the training set and is divided according to time series to avoid data leakage). In this embodiment, the search range is [0.5, 3.0], the step size is 0.1, and the optimal threshold is 1.5; for the entity nodes to be tested... If its final abnormal score If so, it is determined to be an abnormal entity node; if If the threshold is not met, it is determined to be a normal entity node, completing the final determination of e-commerce anomaly detection; this threshold can be flexibly adjusted according to the risk control needs of the e-commerce platform (such as recall rate and precision rate requirements); S8, after determining that a node is an abnormal entity, also includes: performing end-to-end joint optimization of network parameters by minimizing the total loss function; Specifically, the following steps are included: S801, determine the composition of the total loss function, which includes state space model sequence modeling, known class cross-entropy classification loss, open classification loss, and decoder reconstruction error loss; In this embodiment, the loss terms of each module of the fusion model are used to construct a joint total loss function for multiple tasks: ;in, The sequence modeling loss for the state-space model is used to optimize the temporal coding module; Given the cross-entropy classification loss for the known classes, , They are nodes The known normal / abnormal probabilities are used to optimize the known category determination module; Open classification loss for pseudo-unknown nodes (i.e. ), used to optimize the unknown category determination module; This represents the total reconstruction error of the decoder, used to optimize the topology reconstruction module. Gaussian copula likelihood loss is used to optimize the probabilistic encoding module; weights of the loss terms are set. , It can be dynamically adjusted based on the performance of the validation set to achieve collaborative optimization of each module; S802, the total loss is obtained by weighting the above loss items according to preset weights; In this embodiment, based on the set weighting coefficient The total loss function is obtained by weighted summation of each loss term according to the formula, and is used as the objective function for optimizing the model parameters. The smaller the total loss value, the better the overall performance of the model. S803 calculates gradients through backpropagation and uses an optimizer to jointly iteratively update all learnable parameters of the state-space model, probabilistic encoder, dual-flow graph network, prototype vector, and decoder. In this embodiment, the Adam optimizer is used for end-to-end optimization of model parameters. The initial learning rate is set to 1e-4, the weight decay is 1e-5 (to alleviate overfitting), the training batch size is 256, and the total training epochs are 100. A step-wise learning rate decay strategy is adopted, multiplying the learning rate by 0.5 every 20 epochs, so that the decayed learning rate is no less than 1e-6, which reduces the oscillations in later training and improves the convergence speed. An early stopping strategy is set, if the AUC index on the validation set does not improve for 10 consecutive epochs, training is stopped immediately to avoid model overfitting. The constructed multi-view dynamic heterogeneous graph data is input into the model in batches. The model is trained by forward propagation to obtain the values ​​of each loss term and then calculating the total loss function. Backpropagation is used to calculate the gradient of the total loss function with respect to all learnable parameters of the model, including the state-space model parameters, the correlation matrix of the probabilistic encoder and the parameters of the perceptron, the projection matrix and attention parameters of the dual-flow graph network, and the fully connected layer parameters of the decoder. The prototype vector is updated via momentum and is not included in the gradient calculation. The Adam optimizer is used to iteratively update all learnable parameters based on the gradient values ​​until the model training converges, resulting in the final e-commerce anomaly detection model, achieving end-to-end joint optimization of the model. Thus, through a neural implicit field architecture coupled with global sharing and local refinement, accurate representation of anatomical structures is achieved, significantly improving the localization accuracy of key anatomical regions compared to the sampling errors and detail loss problems of traditional explicit mesh models. By leveraging topological intent primitive parsing and semantic constraint energy term construction, high-level semantic intent is accurately captured, breaking through the limitations of traditional low-level geometric interactions and greatly improving human-computer collaboration efficiency. A hierarchical coupling optimization mechanism enables efficient updating of processing parameters, dynamically matching system resources with an adaptive rendering strategy, balancing real-time interaction and visualization effects, and avoiding the efficiency shortcomings of traditional full-scene recalculation. Based on a dual-channel anatomical prior field dynamic switching design, it accurately adapts to complex data scenarios such as local grayscale anomalies and imaging artifacts, solving the adaptation problem of traditional global consistency assumptions. With the on-demand fine-tuning of the local refinement network and a feedback-driven iteration mechanism, global reconstruction resource waste is avoided, improving the system's adaptation efficiency to different pathological scenarios and anatomical variations. Simultaneously, multi-channel fusion rendering and multi-view linkage achieve deep visualization of reference planes, anatomical details, and decision-making basis, while graph neural network arbitration ensures the reliability of multi-intent collaborative optimization, significantly reducing manual trial operations and result verification workload. Furthermore, this method is compatible with conventional image formats and general-purpose hardware, lowering the threshold for engineering applications and providing reliable technical support for scenarios such as preoperative planning and intraoperative navigation of precise anatomical structures, thus promoting the intelligent upgrade of medical image processing from geometry-driven to semantic-driven.

[0013] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process and related explanations of the methods described above can be found in the corresponding processes in the foregoing system embodiments, and will not be repeated here.

[0014] Those skilled in the art will recognize that the modules and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. The programs corresponding to the software modules and method steps can be placed in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the art. To clearly illustrate the interchangeability of electronic hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in electronic hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the invention.

[0015] The terms “first”, “second”, etc., are used to distinguish similar objects, not to describe or indicate a specific order or sequence.

[0016] The term "comprising" or any other similar term is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus / device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent in such process, method, article, or apparatus / device.

[0017] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after such changes or substitutions will all fall within the scope of protection of the present invention.

Claims

1. An e-commerce anomaly detection method based on temporal intensity gating and cross-domain interaction GNN, characterized in that, Includes the following steps: Based on the entity nodes and interaction edges extracted from e-commerce logs, transaction views and behavior views are constructed respectively to form a multi-view dynamic heterogeneous graph. Based on each interaction edge in the multi-view dynamic heterogeneous graph, the historical sequence of entity nodes is encoded using a state-space model to calculate the temporal intensity deviation, and the gated weight adaptive modulation of the original interaction edge features is generated to obtain enhanced interaction edge features. For entity nodes with sparse historical interactions, a probabilistic encoder is constructed and meta-path walk, shortest path distance, and Fourier time features are fused to predict the mean and variance of entity node embeddings. The initial entity node embeddings are obtained through an adaptive sampling and attention fusion mechanism. The enhanced interaction edge features and the entity nodes are initially embedded into the input dual-flow graph network. Attention bias and cross attention are used to realize information interaction within and between views, respectively, to generate a comprehensive embedding of entity nodes. The within-view includes within the transaction view and within the behavior view. The between-view includes between the transaction view and the behavior view. Based on the comprehensive embedding of entity nodes, the known normal prototype and the known abnormal prototype are updated with momentum, and the known class probability and the unknown class probability are output according to the distance of the entity node embedding to the prototype. The degree of the entity node and the feature distribution of its neighboring entity nodes are reconstructed by the decoder. The reconstruction error is calculated and standardized into a relative anomaly score using the mean and standard deviation of the reconstruction error of normal entity nodes in the training set. The unknown class probability and the relative anomaly score are combined to obtain the final anomaly score. When the final anomaly score exceeds the threshold, it is determined to be an abnormal entity node.

2. The e-commerce anomaly detection method based on temporal intensity gating and cross-domain interaction GNN as described in claim 1, characterized in that, The method for obtaining the initial embedding of entity nodes is as follows: For entity nodes with sparse historical interactions, perform a meta-path-based random walk, compress the node embedding sequence on each path into path embeddings using a sequence aggregator, and perform attention fusion on all path embeddings to obtain the meta-path walk embeddings. The shortest path distance feature of the entity node is extracted and encoded into a distance embedding using a radial basis function. Simultaneously, the difference between the entity node's most recent interaction time and the current time is used as input to generate Fourier time features through Fourier feature mapping. The metapath walk embedding, the distance embedding, and the Fourier time feature are concatenated into a conditional vector; the conditional vector is mapped to the uniform cumulative distribution function space through an invertible projection layer to obtain uniformly distributed sampling points; the uniformly distributed sampling points are linearly transformed by the Cholesky decomposition of the learnable correlation matrix to generate Gaussian distributed latent variables with a preset correlation structure. The Gaussian distributed latent variables are input into two independent multilayer sensing heads to predict the mean and log-variance of the embeddings, respectively; the initial sampling embedding is obtained based on reparameterized adaptive sampling. The meta-path walking embedding, the distance embedding, and the initial sampling embedding are fused through an attention mechanism to output the initial embedding of the entity node.

3. The e-commerce anomaly detection method based on temporal intensity gating and cross-domain interaction GNN as described in claim 1, characterized in that, The enhanced interaction edge features are obtained using the following method: When an entity node initiates an interaction, the hidden state of the entity node is updated using a state-space model based on the time interval and the attributes of the current interaction edge. The current hidden state of the initiating entity node is concatenated with the features of the current interaction edge, and then input into the intensity function consisting of two fully connected layers to obtain the theoretical conditional intensity. Based on the historical interaction timestamp set of entity nodes, kernel density estimation is used to fit the temporal distribution of interaction events, and the kernel density value corresponding to the current interaction timestamp is used as the baseline intensity. The difference between the theoretical condition intensity and the baseline intensity is input into the Tanh activation function to obtain the temporal intensity bias vector; The temporal intensity deviation vector is concatenated with the hidden state and then fed into a gated network consisting of a linear layer and a sigmoid, outputting modulation weights of the same dimension as the original features of the interaction edges. The modulation weights are multiplied element-wise with the original interaction edge features to obtain the enhanced interaction edge features.

4. The method according to claim 3, characterized in that, When an entity node initiates an interaction, its hidden state is updated using a state-space model based on the time interval and the attributes of the current interaction edge. The state-space model includes a linear Gaussian state-space model and a gated linear unit state-space model, and its update method is as follows: For the linear Gaussian state-space model, a learnable state transition matrix related to the interaction time interval is defined. The current hidden state is updated based on the hidden state at the previous interaction time, the current interaction edge attributes, and the time interval encoding. The current hidden state is linearly mapped to the predicted distribution of the current interaction features through the learnable emission matrix. The negative log-likelihood between the predicted distribution and the real interaction features is used as the sequence modeling loss. For the gated linear unit state space model, a gated cyclic unit or a gated linear unit is used as the state updater. The hidden state at the previous interaction time, the original features of the current interaction edge, and the time interval are encoded and concatenated and then input to update the current hidden state. The current hidden state is nonlinearly mapped by the emission network to obtain the predicted distribution of the current interaction features.

5. The e-commerce anomaly detection method based on temporal intensity gating and cross-domain interaction GNN as described in claim 1, characterized in that, After outputting the known class probability and the unknown class probability based on the distance of the entity node embedded in the prototype, the method further includes: mixing known normal entity nodes and known abnormal entity nodes according to the distance ratio from the entity node to the prototype to synthesize pseudo-unknown entity nodes. The pseudo-unknown entity nodes are used to optimize the unknown class probability, and the method is as follows: The known normal prototype vector and the known abnormal prototype vector are maintained by momentum update. In each training batch, the mean of the comprehensive embedding of all normal nodes and the mean of the comprehensive embedding of all abnormal nodes in the current batch are calculated respectively, and the prototype vector is updated by moving average according to the momentum coefficient. For the pseudo-unknown entity node to be synthesized, a comprehensive embedding is randomly sampled from the set of known normal nodes, and a comprehensive embedding is sampled from the set of known abnormal nodes. Calculate the Euclidean distance between the sampled normal nodes and the known normal prototype, and the Euclidean distance between the sampled abnormal nodes and the known normal prototype. Use the ratio of the Euclidean distance between the sampled abnormal nodes and the known normal prototype to the sum of the two distances as the hybrid weight. Based on the aforementioned hybrid weights, linear interpolation is performed on the sampled normal node comprehensive embedding and abnormal node comprehensive embedding to generate the comprehensive embedding of pseudo-unknown entity nodes. The comprehensive embedding of the pseudo-unknown entity nodes is used to train the unknown category detection branch to optimize the probability of the unknown class.

6. The method according to claim 1, characterized in that, The method for achieving in-view information interaction using attention bias is as follows: In each layer of the dual-flow graph network, for the edges formed by nodes inside the transaction view or behavior view and their neighboring nodes, a graph attention network is used to calculate the dot product similarity between the query vector and the key vector. The enhanced interaction edge features corresponding to this edge are reduced to scalar bias through linear mapping and added as additive bias terms to the dot product similarity. A nonlinear activation is applied to the dot product similarity after biasing, and normalization is performed on the set of neighbor nodes to obtain the attention coefficient of each neighbor node; The value vectors of neighboring nodes are weighted and summed using the attention coefficients to obtain the updated embedding representation of the node in the current layer. The updated embedding representations of all nodes constitute the node embedding matrix of the view in the current layer. The node embedding matrix is ​​used for cross-attention calculation between views in the same layer. Through multiple iterations, the final layer node embedding matrix of the transaction view and the final layer node embedding matrix of the behavior view are obtained.

7. The e-commerce anomaly detection method based on temporal intensity gating and cross-domain interaction GNN as described in claim 6, characterized in that, The method for achieving information interaction between views using cross-attention is as follows: In each layer of the dual-flow graph network, the node embedding matrix of the transaction view and behavior view after in-graph message passing is obtained respectively; Using the node embedding matrix of the transaction view as the query and the node embedding matrix of the behavior view as the key and value, calculate the long-short cross attention and output the transaction view embedding matrix enhanced with behavior view information. Using the node embedding matrix of the behavior view as the query and the node embedding matrix of the transaction view as the key and value, calculate the multi-head cross attention and output the behavior view embedding matrix enhanced with transaction view information. The transaction view embedding matrix and the behavior view embedding matrix are respectively normalized by residual connection and input into the feedforward network to obtain the final dual-view node embedding matrix of the layer. The dual-view node embedding matrix is ​​used as the input feature for message passing in the next layer view, and then the multi-layer iteration is performed.

8. The method according to claim 1, characterized in that, The method for generating the comprehensive embedding of entity nodes is as follows: For the same entity node, extract the node's embedding vector from the final layer node embedding matrix of the transaction view, and extract the node's embedding vector from the final layer node embedding matrix of the behavior view. Subtract the two embedding vectors element by element and take the absolute value to obtain the difference vector; The difference vector is concatenated with the two embedding vectors to form a joint feature representation; The joint feature representation is input into a feedforward network consisting of two linear layers and a ReLU activation function, and the output is a mapping vector with the same dimension as the node embedding dimension. The mapping vector is subjected to L2 Euclidean normalization to obtain the comprehensive embedding of the entity node.

9. The method according to claim 1, characterized in that, The decoder reconstructs the degree of entity nodes and the feature distribution of neighboring entity nodes using the following method: Starting from the comprehensive embedding of entity nodes, the out-degree and in-degree of the node are predicted through the first branch network, and the mean square error between the predicted value and the true value is used as the degree reconstruction loss. The distribution parameters of the embedding of each neighbor node in the neighborhood of the node are predicted by the second branch network. It is assumed that the neighbor embedding follows a Gaussian distribution, and the negative log-likelihood of the predicted distribution and the true neighbor embedding is used as the neighbor feature distribution reconstruction loss. The total reconstruction error is obtained by weighting and summing the degree reconstruction loss with the neighbor feature distribution reconstruction loss. The mean and standard deviation of the reconstruction error of normal samples in the training set are calculated, and the reconstruction error of the test sample is standardized to obtain the relative outlier score.

10. The method according to claim 1, characterized in that, After identifying an abnormal entity node, the process also includes: performing end-to-end joint optimization of network parameters by minimizing the total loss function; The total loss function includes state-space model sequence modeling, known class cross-entropy classification loss, open classification loss, and decoder reconstruction error loss; The total loss is obtained by weighting and summing the above loss terms according to preset weights. The gradient is calculated by backpropagation algorithm, and the optimizer is used to jointly iteratively update all learnable parameters of the state space model, probabilistic encoder, dual-flow graph network, prototype vector and decoder.

Images