An online estimation method and device for vertex pair reachability of a time-varying interaction graph based on edge similarity attenuation

By introducing edge similarity decay and incremental propagation strategies into the temporal interaction graph, combined with sliding window and Top-tracker, the problem of continuous intensity expression and online updates in the temporal interaction graph is solved, achieving stable operation under low-latency query and bounded memory, and supporting efficient identification and analysis of key relationships.

CN122309564APending Publication Date: 2026-06-30SOUTHEAST UNIV

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
SOUTHEAST UNIV
Filing Date
2026-03-11
Publication Date
2026-06-30

AI Technical Summary

Technical Problem

Existing technologies struggle to simultaneously meet the requirements of continuous intensity representation, online incremental updates, low-latency queries, bounded memory maintenance, and critical relationship fidelity in time-series interaction graphs. In particular, under high-throughput edge-flow conditions, traditional methods suffer from high update overhead and poor result consistency.

Method used

We adopt an online estimation method for the weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay. By introducing a time decay factor and edge feature similarity modeling, and combining an incremental propagation strategy, we establish vertex-edge reachability incremental propagation and vertex pair pre-emphasis maintenance. We also use a sliding window, Top-tracking and count minimum sketch (CMS) collaborative mechanism to achieve both accurate and approximate dual-mode queries.

Benefits of technology

It achieves continuous reachability strength estimation without deviating from temporal constraints, reduces memory overhead, improves query response speed and estimation accuracy, enables near real-time vertex pair reachability analysis under high throughput conditions, and supports the identification of key relationships and the correlation analysis of risk propagation paths.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN122309564A_ABST
    Figure CN122309564A_ABST
Patent Text Reader

Abstract

This invention discloses an online method and apparatus for estimating the weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay. By introducing a time decay factor and an edge feature similarity modeling mechanism, a continuous calculation method for reachability strength is established, and an incremental propagation strategy is combined to achieve online updates. Simultaneously, under memory-constrained conditions, a collaborative mechanism of sliding window, Top-tracking, and minimum-count sketching is employed to prioritize the retention of highly reachable states and compress the estimation of long-tailed states, thus forming a unified weighted reachability query method supporting both exact and approximate modes. This invention significantly reduces storage overhead and query latency while ensuring estimation accuracy, possesses good scalability and high throughput adaptability, and can be widely applied to scenarios such as network security monitoring, risk propagation analysis, abnormal behavior identification, and complex interaction relationship mining.
Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] This invention belongs to the field of computer data processing technology, and relates to graph data processing and streaming computing technology. Specifically, it relates to an online estimation method and apparatus for weighted reachability of vertex pairs in a temporal interactive graph based on edge similarity decay. Background Technology

[0002] With the continuous online operation of business systems such as network communication, transaction activities, content dissemination, and device collaboration, data is increasingly being generated in real time in the form of event streams. This type of data typically includes source entities, target entities, occurrence time, and event attributes, making it naturally suitable for abstraction into time-series interaction graphs with timestamps and edge features. In practical applications, systems not only need to answer whether two vertices are connected, but also need to characterize continuous information such as the strength of connectivity, time freshness, semantic consistency, and sources of propagation contribution. For example, in network security scenarios, alarm correlation and attack chain identification focus on high-intensity, short-latency, and semantically consistent paths; in risk control and anti-fraud scenarios, risk propagation often accumulates gradually through multi-hop relationships, and simple Boolean reachability cannot support refined scoring and priority handling. Therefore, online estimation of vertex pair weighted reachability for time-series edge streams has become an important research direction in the field of graph computing.

[0003] Traditional methods primarily rely on depth-first search, breadth-first search, and their indexing improvements, with the core objective of improving reachability query efficiency and providing reachability existence results. These methods are applicable to static graphs, low-update-frequency graphs, or offline analysis scenarios, and their implementation paths are clear and their engineering implementation is mature. However, in temporal interaction graphs, continuous edge arrival constantly changes reachability relationships. If traditional search or index rebuilding methods are still used, frequent access to historical data, repeated path expansion, or periodic recalculation are often required, leading to a significant increase in update overhead and response latency. Furthermore, these methods mostly output Boolean values, lacking the ability to distinguish the contributions of different paths and failing to directly reflect which paths are more reliable or which relationships are more critical, thus exhibiting significant limitations in scenarios requiring continuous intensity estimation.

[0004] Existing methods attempt to control state size and computational cost through mechanisms such as time windows, decay modeling, probabilistic sketches, or approximate compression. These methods have better scalability potential in large-scale streaming scenarios and can alleviate the memory and computational pressure caused by full maintenance to some extent. However, several problems still exist in engineering implementation: First, many methods lack hierarchical maintenance mechanisms for high-value vertex pairs and long-tail vertex pairs, which can easily lead to the loss of key relationships during compression; second, time decay, path propagation, and semantic similarity are often modeled separately, making it difficult to simultaneously consider timeliness and semantic consistency in the estimation results; third, online query paths lack a unified expression between precise and approximate structures, affecting result consistency and system stability.

[0005] In summary, existing technologies still struggle to simultaneously meet several core requirements: continuous intensity representation, online incremental updates, low-latency queries, bounded memory maintenance, and fidelity of key relationships. Boolean reachability alone is insufficient for identifying and ranking high-risk relationships; full and accurate maintenance is prohibitively costly under high-throughput edge flow conditions; and single approximate compression may introduce distortion of key relationships and error accumulation. Especially in temporal graph scenarios, path effectiveness depends not only on structural connectivity but also on temporal order, interval decay, and the degree of edge semantic matching. Without a unified estimation framework, it is difficult for the system to achieve a balance between accuracy, efficiency, and resource consumption. Therefore, there is an urgent need for an online method for weighted reachability estimation of vertex pairs in temporal interaction graphs that integrates time decay, path incremental propagation, and edge feature similarity, and supports both accurate and approximate dual-mode collaboration. Summary of the Invention

[0006] Addressing the problems of existing time-series graph reachability analysis, such as reliance on Boolean determinations, difficulty in expressing reachability strength, high online maintenance costs, and significant memory pressure, this invention proposes an online estimation method and apparatus for vertex-pair weighted reachability of time-series interactive graphs based on edge similarity decay, specifically for online processing scenarios of edge flows in time-series interactive graphs. It constructs a unified technical framework encompassing vertex-edge reachability incremental propagation, vertex-pair pre-emphasis maintenance, and both precise and approximate dual-mode queries. This invention establishes a continuous calculation method for reachability strength by introducing a time decay factor and an edge feature similarity modeling mechanism, and achieves online updates by combining an incremental propagation strategy. Furthermore, under memory-constrained conditions, it utilizes a sliding window and Top-... The tracking and counting minimum sketch collaboration mechanism enables priority retention of highly reachable states and compression estimation of long-tail states, thereby forming a unified weighted reachability query method that supports both exact and approximate modes.

[0007] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0008] An online method for estimating the weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay includes the following steps:

[0009] Step 1: Receive time-series sidestream data arriving in order of timestamps and construct a dynamic directed time-series interaction graph. Each time-series edge is denoted as , Indicates time The set of vertices below, Indicates time The following is a set of temporal edges. As the source vertex, For the target vertex, For edge timestamps, The edge feature vector;

[0010] Step 2: Maintain the dynamic graph index structure, which includes an inbound edge index. Outbound index When a new edge is written, both types of indexes are updated simultaneously.

[0011] Step 3, when the new edge Upon arrival, vertex-edge reachability is established. Create the edge item in the middle and write it into the source node. Single-hop reachability ;

[0012] Step 4: Traverse the vertices within the preset time range. front-wheel drive Calculate the attenuation factor of adjacent edges. and for each source vertex Perform multi-hop incremental propagation to update multi-hop reachability. ,in As the precursor edge source point, For the predecessor edge timestamp;

[0013] Step 5, update the obtained according to Calculated as vertex pair pre-emphasis increment value And write it into the vertex-vertex reachability maintenance structure;

[0014] Step 6: Maintain the vertex-vertex reachability structure according to the operating mode: In exact mode, a vertex pair hash structure is used for maintenance. Top- ; Approximation mode adopts Top- A hybrid structure of tracker and count minimum sketch map CMS, which accurately preserves highly reachable vertex pairs and compresses and accumulates long-tail vertex pairs;

[0015] Step 7, respond to the query In exact mode, read from the vertex pair hash structure In the approximation mode, priority is given to Top- Tracker Read If no match is found, the CMS will estimate the result. And uniformly obtained through de-emphasis recovery. ;

[0016] Step 8: Repeat steps 3 to 7 to achieve online maintenance and low-latency query of the weighted reachability of vertex pairs under the temporal edge flow condition.

[0017] Furthermore, step 1 also includes: preprocessing the input edge flow data and writing the preprocessed edges into the dynamic graph index structure.

[0018] Furthermore, in step 3, the vertex-edge reachability relationship... A two-level hash structure with edge primary keys is adopted: the first-level key is the temporal edge identifier, the second-level key is the source vertex identifier, and the value range is the vertex-edge reachability estimate. It supports constant-time level insertion, lookup, and overwrite updates.

[0019] Furthermore, in step 4, the adjacent edge attenuation factor is calculated using the following formula:

[0020] ,

[0021] in, This is the hop count attenuation coefficient. The time difference between adjacent edges. Let the time interval decay function be... Let the edge feature similarity function be used.

[0022] Multi-hop incremental propagation is calculated using the following formula:

[0023] ,

[0024] The time decay function takes the form of exponential decay. , ;

[0025] Edge feature similarity function Provided by an offline-trained dual-encoder triplet network, the following formula is used for online inference:

[0026] ,

[0027] in, and These correspond to the input-side encoder and the output-side encoder, respectively. It is a Euclidean distance.

[0028] Furthermore, in step 4, the predecessor edge traversal and source point propagation update are performed in parallel.

[0029] Furthermore, in step 5, the vertex-to-vertex reachability maintenance structure is written according to the following rules:

[0030] i) When vertex pairs Before it is written, first let Write again ;

[0031] ii) When vertex pairs If it already exists, first let Write again ;

[0032] in, This is the terminal time decay factor; under the above definition, the existence of vertex pairs is equivalent to execution. .

[0033] Furthermore, the approximate pattern in step 6 specifically includes:

[0034] First, clear the records outside the sliding window, then write the current increment to Top- / CMS, write method is:

[0035] If the fingerprint hits the top If the result is not hit and Top-... If the list is not full, insert a new entry; if no match is found and Top- If the heap is full, first perform a cumulative update using CMS, then compare the estimated value of the vertex pair with the minimum value of the heap top. If the conditions are met, write the top entry back to CMS, perform a swap, and rebuild the min-heap order.

[0036] Furthermore, the sliding window interval in the approximation mode is... ,in The width of the window; when the edge timestamp is less than When this happens, delete the edge and its associated vertex-edge reachable records; window width Based on the minimum retention contribution threshold Determined by the inverse function of the time decay function, satisfying .

[0037] The present invention also provides an online estimation device for the weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay, which is used to implement the online estimation method for the weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay, including: a data access module, a graph index module, a vertex-edge update module, a vertex pair maintenance module, and a query module;

[0038] The data access module is used to receive and cache sidestream data sorted by timestamp;

[0039] The graph index module is used to maintain the in edge index and the out edge index and supports range retrieval.

[0040] The vertex-edge update module is used to maintain vertex-edge reachability relationships and perform single-hop initialization and multi-hop incremental propagation.

[0041] The vertex pair maintenance module is used to perform pre-emphasis value hash maintenance in exact mode, or to perform pre-emphasis accumulation and Top-level operation in approximate mode. Tracking and CMS compression;

[0042] The query module is used to directly query the vertex pair hash structure in exact mode, or to perform Top-down operations in approximate mode. Hit detection, CMS backoff estimation, and unified execution of de-emphasis output.

[0043] The present invention also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the online estimation method for weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay provided by the present invention.

[0044] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0045] 1. This invention achieves continuous estimation of reachability strength without deviating from temporal constraints through vertex-edge reachability incremental propagation, vertex pair pre-emphasis maintenance, and a unified query technique combining precise and approximate modes; wherein the approximate mode utilizes a sliding window, Top-... The collaborative mechanism with CMS ensures that critical highly reachable relationships are retained while compressing long-tail states, thus achieving stable online operation within bounded memory.

[0046] 2. The method of this invention features high online update efficiency, fast query response, low memory overhead, and stable estimation accuracy. It overcomes the problems of insufficient Boolean reachability representation, high computational and storage costs of full maintenance, and insufficient fidelity of key relationships in approximate compression in existing methods. It can achieve near real-time estimation of vertex pair reachability strength under the condition of continuous edge reachability. Simultaneously, it possesses capabilities such as key vertex pair identification and continuous tracking, risk propagation path association analysis, and scalable querying, enabling reachability estimation and downstream analysis tasks to be completed collaboratively within the same framework. Experimental results show that this scheme can significantly reduce resource overhead while maintaining high estimation accuracy on real datasets. Index storage can be reduced by up to approximately 98%, and query latency can reach the microsecond level. For example, on the DN dataset, the index size can be reduced from 192MB to 3.75MB to 51.69MB (saving more than 73%), demonstrating superior comprehensive performance compared to traditional full maintenance or non-indexed methods. It has good scalability and high throughput adaptability, and can be widely applied to scenarios such as network security monitoring, risk propagation analysis, abnormal behavior identification, and complex interaction relationship mining. Attached Figure Description

[0047] Figure 1 This is a schematic diagram of the edge similarity triplet network learning and calculation process of the present invention.

[0048] Figure 2 This is a schematic diagram of the index structure in the precise mode of the present invention.

[0049] Figure 3 For the approximate mode of this invention, sliding window truncation and Top- / CMS compression process diagram.

[0050] Figure 4 This is a graph showing the results of the parameter sensitivity analysis of this invention.

[0051] Figure 5 This is a comparison chart of the results of the present invention and the baseline method in terms of runtime, index size, query latency, and accuracy. Figure 6 This is a diagram showing the ablation experiment results of this invention. Detailed Implementation

[0052] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0053] This invention proposes an online method for estimating the weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay. Essentially, in scenarios with continuous arrival of temporal edge flows, it unifies path propagation relationships, time interval decay, and edge feature semantic similarity into a single weighted reachability modeling framework, achieving continuous estimation of vertex pair reachability through incremental state maintenance. This method links vertex-edge reachability relationships with vertex-vertex reachability relationships: the former accumulates single-hop and multi-hop propagation contributions when a new edge is triggered, while the latter merges edge-level contributions into the pre-emphasized state of the vertex pair and supports rapid recovery during queries. For different resource constraints, the system provides both precise and approximate path maintenance; the approximate path employs a sliding window and Top-... The combined min-heap and CMS structure compresses the size of long-tail states while maintaining the ability to track high-value vertex pairs. Through a unified query interface and de-emphasis computation, both modes can output reachability estimates with consistent semantics, thus meeting the engineering requirements of continuous updates, controllable memory, and low query latency in online scenarios.

[0054] For ease of explanation, the present invention can be implemented in a device-based manner, that is, it provides an online estimation device for the weighted reachability of vertex pairs in a temporal interactive graph based on edge similarity decay. The overall process of the method can be completed collaboratively by a data access module, a graph index module, a vertex-edge update module, a vertex pair maintenance module, and a query module.

[0055] The data access module receives and caches edge stream data sorted by timestamp; the graph index module maintains the inbound and outbound edge indices and supports range retrieval; the vertex-edge update module maintains... It performs single-hop initialization and multi-hop incremental propagation; the vertex pair maintenance module is used to perform pre-emphasis value hash maintenance in exact mode, or pre-emphasis accumulation and Top-level operation in approximate mode. Tracing and CMS compression; the query module is used to directly query the vertex pair hash structure in exact mode, or to perform Top-down operations in approximate mode. The system performs hit detection, CMS backoff estimation, and unified de-emphasis output. The vertex pair maintenance module supports switching between exact and approximate modes, with switching conditions including one or more of memory thresholds, edge reachability thresholds, or target query latency thresholds. The corresponding program for the online vertex pair weighted reachability estimation device based on edge similarity decay in temporal interaction graphs provided by this invention can be deployed on an electronic device processor and stored in a computer-readable storage medium.

[0056] The actual execution order of the online estimation method for weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay, provided by this invention, is described in detail below, using the online estimation device for weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay. It should be noted that the modules that function in the steps are merely examples, and the module names and functional assignments can be renamed and reclassified as needed. The method of this invention can also be implemented independently without relying on the device.

[0057] (1) The data access module receives time-series sidestream data that arrives in order according to timestamps, and constructs a dynamic directed time-series interaction graph based on the sidestream data. .in, Indicates time The set of vertices below, Indicates time The set of temporal edges below. Each temporal edge is represented as... ,in As the source vertex, For the target vertex, For edge timestamps, This represents the edge feature vector. During the access phase, preprocessing of the input edge stream data can be completed simultaneously, including but not limited to: performing sequential verification on timestamps, filling or removing missing edge features, normalizing numerical features, and encoding categorical features; and writing the preprocessed edges into the dynamic graph index structure.

[0058] (2) The graph index module maintains the dynamic graph index structure, which includes at least the inbound edge index. outgoing edge index When a new edge is written, both types of indexes are updated simultaneously to ensure that candidate predecessor and candidate successor edges can be quickly retrieved within a given time interval.

[0059] (3) When the new side Upon arrival, the vertex-edge update module updates the vertex-edge reachability relationship. The edge item is established and single-hop reachability is written in the middle, that is, in Write source point initial reachability 1. As an initial contribution for subsequent multi-hop propagation. In implementation, A two-level hash structure with edge primary keys is adopted: the first-level key is the temporal edge identifier, the second-level key is the source vertex identifier, and the value range is the vertex-edge reachability estimate. It supports constant-time level insertion, lookup, and overwrite updates.

[0060] (4) The vertex-edge update module traverses the vertices within a preset time range. front-wheel drive ,in As the precursor edge source point, Use the predecessor edge timestamp and perform multi-hop incremental propagation on the source reachable record under each predecessor edge. Adjacent edge attenuation factors are calculated as follows:

[0061] ,

[0062] Calculation, where This is the hop count attenuation coefficient. The time difference between adjacent edges. Let the time interval decay function be... Let be the edge feature similarity function. For any predecessor edge... and its reachable source points Propagation updates multi-hop edge reachability by:

[0063] ,

[0064] Execution. In this embodiment, the time decay function takes the form of exponential decay. ( Edge feature similarity function Provided by a dual-encoder triplet network trained offline. Used for online inference:

[0065] ,

[0066] in and These correspond to the input-side encoder and the output-side encoder, respectively. It is a Euclidean distance.

[0067] Triple training samples are sampled according to temporal adjacency relationships and include anchor edges, positive sample edges, and negative sample edges. Positive sample edges satisfy the constraints of sharing the same intermediate vertex and temporal feasibility, while negative sample edges satisfy at least one of the following: non-adjacent vertices, temporal reversal, or inconsistent semantic labels. Figure 1 The process of training triplet networks and calculating edge similarity is demonstrated.

[0068] (5) The vertex pair maintenance module converts the updated vertex-edge reachability into vertex pair pre-emphasis increments and writes them into the vertex pair maintenance structure. The conversion relationship is as follows: For newly encountered vertex pairs, pre-emphasis values ​​are generated directly based on the current edge contribution; for existing vertex pairs, time alignment is performed first, and then the current contribution is added. Precise writing rules fall into two categories:

[0069] i) When vertex pairs When it first appears before it has been written:

[0070] shilling Write again ,

[0071] ii) When vertex pairs If it already exists:

[0072] shilling Write again ,

[0073] The update in ii) can be equivalently written as:

[0074] ,

[0075] This is the terminal time decay factor. Under the above definition, the existence of vertex pairs is equivalent to execution. This avoids the need to explicitly maintain and independently update the timestamp for each vertex pair.

[0076] (6) The vertex pair maintenance module maintains the vertex-vertex reachability structure according to the following operating mode:

[0077] i) In precise mode, a vertex-pair hash structure is used to maintain the full state. , Figure 2 The precise index structure is given;

[0078] ii) In approximation mode, a sliding window and Top-Screen layout are used. The tracker employs a hybrid structure with Count-MinSketch (CMS) to precisely preserve highly reachable vertex pairs and compress and accumulate long-tail vertex pairs. Specifically, it first cleans up records outside the window, compresses vertex-edge reachability records by truncating the window, and then writes the current increment to Top- / CMS. The sliding window interval in the approximate mode is... ,in The width of the window; when the edge timestamp is less than When this happens, delete the edge and its associated vertex-edge reachable records to ensure that memory is bounded. Window width Based on the minimum retention contribution threshold Determined by the inverse function of the time decay function, satisfying This is used to limit the upper bound of the impact of historical paths outside the window on the current estimation result. The Top- The tracker consists of a min-heap With index table The minimum heap storage does not exceed [a certain value]. One entry fingerprints The index table is used to achieve constant-time localization based on fingerprints. The CMS is... A counting matrix, where each row is addressed by an independent hash function; when a vertex pair has not entered the Top-... When the fingerprint hits the Top, its increment is written to the CMS, and the minimum value of the multi-line counter is used as an approximate pre-emphasis estimate. If a match is found and the heap is not full, the entry is directly accumulated and rearranged. If a match is found but the heap is not full, a new entry is inserted. If a match is found but the heap is full, the CMS is first updated, then compared with the minimum value at the top of the heap. If the condition is met (the new value is larger), the top entry is written back to the CMS, the new entry is swapped in, and the heap is rearranged to rebuild the min-heap order. The window truncation and compression processes can be combined. Figure 3 (a)- Figure 3 (c) Understanding.

[0079] (7) The query module responds to queries. hour:

[0080] i) In precise mode, if If it does not exist, return 0; otherwise, read the pre-stamped value from the vertex pair hash structure. If no corresponding record exists, return 0.

[0081] ii) In approximation mode, press your fingerprint first. Query Top- Determine if the index table is hit; if so, return Top-. Store the value, and when a miss occurs, roll back to CMS and take the minimum count estimate. The CMS rollback estimate can be expressed as:

[0082] .

[0083] Then, a unified process of de-emphasis and recovery is performed, and the output time is determined. De-emphasis on reachability .

[0084] (8) Repeat steps (3) to (7) to achieve online maintenance and low-latency querying of the weighted reachability of vertex pairs under the temporal edge flow condition. The storage complexity in the approximate mode is... And the window width can be adjusted. The settings are configured to control the impact of historical contributions on the upper bound, among which... The edge arrival rate per unit time. For window width, For Top- capacity, and These represent the number of rows and columns in the CMS, respectively.

[0085] In engineering deployment, predecessor edge traversal and source node propagation updates support parallel execution. Under parallel conditions, the time complexity of single-edge updates can be transformed from being primarily linearly related to the number of predecessor edges to being primarily linearly related to the number of active source nodes. The system can switch between exact and approximate modes based on available memory thresholds, edge arrival rate thresholds, and target query latency thresholds.

[0086] The present invention also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the online estimation method for weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay provided by the present invention.

[0087] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the online estimation method for weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay provided by the present invention.

[0088] The following combination Figures 4-6 The performance of the present invention will be described.

[0089] Figure 4 The error and efficiency trends of this method were compared under different parameter settings, showing that within the commonly used parameter range, the estimation error and runtime latency remain stable, which can be used to complete window width, Top- Engineering selection of capacity and sketch size.

[0090] Figure 5 The differences between our proposed method and the baseline method in terms of runtime, index size, latency over 2000 queries, and accuracy metrics were compared. Results show that our proposed method exhibits better online scalability while maintaining controllable estimation error; specifically, on the typical dataset DN, the approximation model can compress the index size from 192MB to 3.75MB to 51.69MB (saving over 73%), while maintaining microsecond-level latency per query.

[0091] Figure 6 Ablation experiments on a dataset containing edge features are presented to evaluate the contribution of key components. Significant numerical instability occurs after removing the jump count decay term; for example, the mean absolute error (MAE) on the CT dataset can reach [value missing]. After removing the edge similarity attenuation term, MAE also increases significantly. In non-Top- In the comparison of compressed structures, CMS showed the most stable overall performance, with a corresponding MAE of approximately 0.77, which is better than PS ( The results show that attenuation modeling combined with CMS compression is necessary to maintain accuracy and stability in this method.

[0092] This invention can be applied to various scenarios such as network security monitoring, risk propagation analysis, abnormal behavior identification, and complex interaction relationship mining. For example, the intrusion detection system running this invention collects real-time traffic from a CTU-13 botnet through traffic mirroring, extracts sideflow data to construct a dynamic temporal interaction graph, and triggers physical defense mechanisms based on the estimated reachability of point pairs. Actual testing shows that among the first 1000 highly reachable vertex pairs output by the system, up to 97.5% of the nodes are accurately identified as bot hosts, thus allowing the firewall or SDN controller to issue Access Control List (ACL) rules to physically block their communication channels.

[0093] It should be noted that the above content merely illustrates the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. For those skilled in the art, various improvements and modifications can be made without departing from the principle of the present invention, and all such improvements and modifications fall within the scope of protection of the claims of the present invention.

Claims

1. An online estimation method for the weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay, characterized in that, Includes the following steps: Step 1: Receive time-series sidestream data arriving in order of timestamps and construct a dynamic directed time-series interaction graph. Each time-series edge is denoted as , Indicates time The set of vertices below, Indicates time The following is a set of temporal edges. As the source vertex, For the target vertex, For edge timestamps, The edge feature vector; Step 2: Maintain the dynamic graph index structure, which includes an inbound edge index. Outbound index When a new edge is written, both types of indexes are updated simultaneously. Step 3, when the new edge Upon arrival, vertex-edge reachability is established. Create the edge item in the middle and write it into the source node. Single-hop reachability ; Step 4: Traverse the vertices within the preset time range. front-wheel drive Calculate the attenuation factor of adjacent edges. and for each source vertex Perform multi-hop incremental propagation to update multi-hop reachability. ,in As the precursor edge source point, For the predecessor edge timestamp; Step 5, update the obtained according to Calculated as vertex pair pre-emphasis increment value And write it into the vertex-vertex reachability maintenance structure; Step 6: Maintain the vertex-vertex reachability structure according to the operating mode: In exact mode, a vertex pair hash structure is used for maintenance. Top- ; Approximation mode adopts Top- A hybrid structure of tracker and count minimum sketch map CMS, which accurately preserves highly reachable vertex pairs and compresses and accumulates long-tail vertex pairs; Step 7, respond to the query In exact mode, read from the vertex pair hash structure In the approximation mode, priority is given to Top- Tracker Read If no match is found, the CMS will estimate the result. And uniformly obtained through de-emphasis recovery. ; Step 8: Repeat steps 3 to 7 to achieve online maintenance and low-latency query of the weighted reachability of vertex pairs under the temporal edge flow condition.

2. The online estimation method for weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay as described in claim 1, characterized in that, Step 1 also includes: preprocessing the input edge flow data and writing the preprocessed edges into the dynamic graph index structure.

3. The online estimation method for weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay as described in claim 1, characterized in that, In step 3, vertex-edge reachability relationships A two-level hash structure with edge primary keys is adopted: the first-level key is the temporal edge identifier, the second-level key is the source vertex identifier, and the value range is the vertex-edge reachability estimate. It supports constant-time level insertion, lookup, and overwrite updates.

4. The online estimation method for weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay as described in claim 1, characterized in that, In step 4, the adjacent edge attenuation factor is calculated using the following formula: , in, This is the hop count attenuation coefficient. The time difference between adjacent edges. Let the time interval decay function be... Let the edge feature similarity function be used. Multi-hop incremental propagation is calculated using the following formula: , The time decay function takes the exponential decay form. , ; Edge feature similarity function Provided by an offline-trained dual-encoder triplet network, the following formula is used for online inference: , in, and These correspond to the input-side encoder and the output-side encoder, respectively. It is a Euclidean distance.

5. The online estimation method for weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay as described in claim 1 or 4, characterized in that, In step 4, the predecessor edge traversal and source point propagation update are performed in parallel.

6. The online estimation method for weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay as described in claim 1, characterized in that, In step 5, the vertex-to-vertex reachability maintenance structure is written according to the following rules: i) When vertex pairs Before it is written, first let Write again ; ii) When vertex pairs If it already exists, first let Write again ; in, This is the terminal time decay factor; under the above definition, the existence of vertex pairs is equivalent to execution. .

7. The online estimation method for weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay as described in claim 1, characterized in that, The approximate pattern in step 6 specifically includes: First, clear the records outside the sliding window, then write the current increment to Top- / CMS, write method is: If the fingerprint hits the top If the result is not hit and Top-... If the list is not full, insert a new entry; if no match is found and Top- If the heap is full, first perform a cumulative update using CMS, then compare the estimated value of the vertex pair with the minimum value of the heap top. If the conditions are met, write the top entry back to CMS, perform a swap, and rebuild the min-heap order.

8. The online estimation method for weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay as described in claim 1, characterized in that, The sliding window interval in the approximation mode is: ,in The width of the window; when the edge timestamp is less than When this happens, delete the edge and its associated vertex-edge reachable records; Window width Based on the minimum retention contribution threshold Determined by the inverse function of the time decay function, satisfying .

9. An online estimation device for the weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay, characterized in that, The method for implementing the online estimation method for weighted reachability of vertex pairs in a temporal interactive graph based on edge similarity decay as described in any one of claims 1-8 includes: a data access module, a graph indexing module, a vertex-edge update module, a vertex pair maintenance module, and a query module; The data access module is used to receive and cache sidestream data sorted by timestamp; The graph index module is used to maintain the in edge index and the out edge index and supports range retrieval. The vertex-edge update module is used to maintain vertex-edge reachability relationships and perform single-hop initialization and multi-hop incremental propagation. The vertex pair maintenance module is used to perform pre-emphasis value hash maintenance in exact mode, or to perform pre-emphasis accumulation and Top-level operation in approximate mode. Tracking and CMS compression; The query module is used to directly query the vertex pair hash structure in exact mode, or to perform Top-down operations in approximate mode. Hit detection, CMS backoff estimation, and unified execution of de-emphasis output.

10. The present invention also provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes a computer program, it implements the online estimation method for weighted reachability of vertex pairs in a temporal interaction graph based on edge similarity decay, as described in any one of claims 1-8.