A method for training a security detection model based on graph neural networks
By combining the ChebNet backbone network with delayed fragment insertion and mirror node propagation, the problem of insufficient graph structure representation in existing security detection models is solved, and high-precision detection of multi-device linkage anomalies is achieved.
Patent Information
- Application Number
- CN202610513565.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-04-17
- Publication Date
- 2026-06-30
AI Technical Summary
Existing security detection models have shortcomings in graph structure representation and intermediate feature transfer, making it difficult to effectively reflect the sequential transfer process along the path chain, which affects the modeling accuracy of multi-device linkage security detection.
A security detection model based on graph neural networks is constructed by combining the ChebNet backbone network with fragment late insertion, mirror node propagation, and path chain sequential transmission. Graph convolution propagation is performed through the ChebNet backbone network, and the node feature representation is enhanced by fragment late insertion blocks and mirror node layers. The hidden layer features of nodes are transmitted sequentially along the path chain.
It enhances the ability to segment and organize internal features of security equipment nodes and express path relationships, improves the ability to identify anomalies in multi-device linkage, and enhances the accuracy and stability of detection.
Smart Images
Figure CN122311289A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of security monitoring, and in particular to a method for training a security detection model based on a graph neural network. Background Art
[0002] With the continuous deployment of cameras, access control devices, infrared detectors, and environmental sensors in scenarios such as industrial parks, buildings, and communities, security detection has gradually developed from single-device alarm to multi-device collaborative analysis. In the prior art, the common practice is to separately extract features from the data collected by various security devices, and then use a convolutional neural network, a recurrent neural network, or a basic graph neural network to complete anomaly recognition. Among them, the graph neural network can model multi-device linkage information by using the connection relationship between devices, and thus has been used in security detection tasks. Edge computing nodes are also used to receive the data uploaded from the device side and complete part of the graph construction and model inference to reduce the transmission pressure and response latency on the central side.
[0003] Existing security detection models still have deficiencies in graph structure expression and intermediate feature transmission. Most existing graph neural networks adopt a conventional node propagation method, where the hidden layer features of nodes are advanced synchronously between layers, making it difficult to perform delayed processing on different segments within the same node; the construction of the adjoint expression during the propagation of a single node is insufficient, making it difficult to form a corresponding mirror propagation link outside the original node propagation; for security scenarios with clear path sequences such as park passages, floor corridors, and entrances and exits, existing methods usually only perform propagation based on general adjacency relationships, making it difficult to reflect the sequential transmission process along the path chain, affecting the modeling accuracy of multi-device linkage security detection.
[0004] Therefore, how to provide a method for training a security detection model based on a graph neural network is an urgent problem to be solved by those skilled in the art. Summary of the Invention
[0005] An object of the present invention is to propose a method for training a security detection model based on a graph neural network. The present invention combines the ChebNet backbone network, fragment delayed feedback insertion, mirror node propagation, and path chain sequential transmission to model and train the associated data of multiple security devices, and can achieve security anomaly detection in an edge computing scenario, with the advantages of strong association modeling ability, clear path expression, and high detection accuracy.
[0006] A method for training a security detection model based on a graph neural network according to an embodiment of the present invention includes the following steps:
[0007] Obtain the operation data of security devices, extract the device features corresponding to the security devices, and generate an event marker sequence;
[0008] Based on the relationships between security devices, a device diagram is constructed. The device diagram is then segmented according to time windows to generate a sample set of diagram snapshots.
[0009] Construct the ChebNet backbone network, input the graph snapshot sample set into the ChebNet backbone network to perform front-end graph convolutional propagation, and generate hidden layer features of the middle node;
[0010] The hidden layer features of the middle node are input into the late-injection block of the segment. The hidden layer vector of the node is split into segments. The split delayed segments are written into the buffer line. The remaining segments are input into the next segment graph for convolution propagation. The delayed segments in the buffer line are inserted into the node hidden layer result after propagation according to the slot, and the late-injection node hidden layer features are generated.
[0011] A mirror node layer is constructed based on the hidden layer features of the back-insertion node. The hidden layer vector of the node is processed by segment rotation to obtain the hidden layer vector of the mirror node. Graph convolution propagation is performed on the two-layer graph structure. The original node results after propagation are interleaved with the corresponding mirror node results according to their positions to generate the hidden layer features of the mirror fused node.
[0012] The hidden layer features of the mirrored fused node are input into the final ChebNet sorting layer to perform graph convolution propagation. The tail segment of the hidden layer of the node is extracted according to the path chain and passed sequentially along the path chain. The received segment is inserted into the middle slot of the hidden layer of the current node to generate the hidden layer features of the path splicing node.
[0013] The hidden features of the path concatenation nodes are input into the output layer, and the event tag sequence is combined to perform iterative training until the convergence condition is met, thus obtaining the security detection model.
[0014] Optionally, acquiring the security equipment operation data specifically includes:
[0015] Collect operational data output by each security device during the monitoring period, and aggregate it according to device number and collection time to form device-level operational data;
[0016] Perform time alignment and anomaly removal on device-level operational data, and divide it into continuous time slices according to a uniform time granularity;
[0017] Numerical features representing the operating status of the equipment are extracted from the equipment-level operating data within each time slice, forming equipment features that correspond one-to-one with the security equipment;
[0018] Read the event information corresponding to the monitoring period, match the event information with each time slice, assign corresponding event tags to each time slice, and generate an event tag sequence in chronological order.
[0019] Optionally, the construction of the device diagram based on the association between security devices specifically includes:
[0020] The edge computing node receives the device features uploaded by each security device, reads the device number, installation location and device category corresponding to each security device, and uses each security device as a node in the device graph;
[0021] Calculate the distance between installation locations, and denote the node pairs that are less than the distance threshold and located in the same area as spatial connection edges;
[0022] Statistically analyze the event triggering order of different security devices within a continuous time slice, and record the node pairs whose triggering time interval is less than the time threshold as time-series connection edges;
[0023] Read the records of linkage events formed by two security devices in the same monitoring period, and record the node pairs that appear in the same linkage event record as linkage connection edges;
[0024] The spatial connection edges, temporal connection edges, and linkage connection edges are merged to generate an edge connection matrix, forming a device diagram.
[0025] Extract the device features and edge connection matrix within the corresponding time period from the device graph to generate a graph snapshot corresponding to a single time window;
[0026] Arrange the snapshots corresponding to each time window in chronological order to generate a snapshot sample set.
[0027] Optionally, the ChebNet backbone network specifically includes:
[0028] The ChebNet backbone network uses ChebNet graph convolutional units as the basic propagation structure. The ChebNet backbone network consists of the following layers from input to output: front graph convolutional layer, fragment late insertion block, mirror node propagation layer, final ChebNet finishing layer, and output layer.
[0029] The fragment late insertion block performs fragment splitting, cache delay, and slot back-insertion on the hidden layer features of the middle node, and outputs the hidden layer features of the back-inserted node.
[0030] A mirror node layer is constructed based on the hidden layer features of the inserted node. ChebNet graph convolution propagation and staggered splicing are performed on the two-layer graph structure to output the hidden layer features of the mirror fused node.
[0031] The final ChebNet processing layer performs graph convolution processing on the hidden features of the mirrored fused nodes, and performs tail segment propagation and middle slot insertion on the hidden features of the final node according to the path chain, outputting the hidden features of the path spliced node.
[0032] Optionally, the step of inputting the hidden layer features of the middle node into the late-path back-insertion block specifically includes:
[0033] Read the hidden layer vectors of each node in the hidden layer features of the middle node, and divide each node's hidden layer vector into the front segment, the middle transition segment, and the back segment along the channel direction.
[0034] The first segment is input into the next ChebNet graph convolution unit to perform graph convolution propagation, the intermediate transition segment is written to the buffer line and the storage location remains unchanged, and the last segment is input into the sorting unit to perform channel rearrangement to obtain the sorted last segment.
[0035] After the next ChebNet graph convolutional unit outputs the propagated node hidden layer result, the intermediate transition segment and the sorted subsequent segment in the cache line are read according to the node index order, and the intermediate transition segment and the sorted subsequent segment are inserted into the fixed interval slot in the propagated node hidden layer result in sequence.
[0036] When an existing segment exists in a fixed-interval slot, the existing segment is moved backward along the channel direction while preserving the original channel order in the unreplaced slot.
[0037] Arrange the hidden layer results of each node that has completed slot insertion in the order of node index to generate the hidden layer features of the inserted node.
[0038] Optionally, the construction of the mirror node layer based on the hidden layer features of the insertion back node specifically includes:
[0039] Read the hidden layer vectors of each node in the hidden layer features of the back-insertion node, and generate a mirror node corresponding to each node, thus creating a mirror node layer.
[0040] The hidden layer vectors of each node are continuously segmented along the channel direction to obtain several sequentially arranged feature segments. The positions of each feature segment are adjusted according to a predetermined rotation order to generate the hidden layer vectors of the mirror nodes corresponding to each mirror node.
[0041] Preserve the edge connection relationship between the original nodes, copy the edge connection relationship between the mirror nodes according to the same node index correspondence, and establish a one-to-one connection edge between each original node and the corresponding mirror node to form a two-layer graph structure.
[0042] The original node hidden layer vector and the mirror node hidden layer vector are input into the ChebNet graph convolution unit. Graph convolution propagation is performed on the two-layer graph structure to obtain the propagated original node result and the propagated mirror node result.
[0043] Read the results of each original node and the corresponding mirror node, and splice them together in an alternating manner along the channel direction. Write the original node result fragments and mirror node result fragments into the spliced channel position in sequence.
[0044] Arrange the interlaced splicing results corresponding to each node in the order of node index to generate the hidden layer features of the mirrored fused nodes.
[0045] Optionally, the final-level ChebNet tidying layer specifically includes:
[0046] The hidden features of the mirrored fused nodes and the corresponding edge connection matrix are input into the final ChebNet sorting layer, and graph convolution propagation is performed to obtain the hidden features of the final nodes corresponding to each node.
[0047] Based on the order of nodes in the path chain, read the hidden layer vector of the last-level node corresponding to each node, and extract the hidden layer tail segment of the node from the tail of the hidden layer vector of each node.
[0048] According to the adjacent relationship in the path chain, the hidden tail segment of the current node is passed to the next node in the path chain, and the node at the end of the path chain passes the hidden tail segment of the node to the starting node of the path chain.
[0049] After each path chain completes one round of sequential transmission, the hidden layer tail segment received by each node is read and inserted into the middle slot of the current node's hidden layer vector.
[0050] When the middle slot contains existing channel content, move the existing channel content backward along the channel direction, keeping the position of the first channel unchanged;
[0051] The hidden layer results of each node that has completed the insertion of the middle slot are arranged in the order of the node index to generate the hidden layer features of the path splicing node.
[0052] Optionally, the step of inputting and outputting the hidden layer features of the path concatenation nodes specifically includes:
[0053] The hidden features of the path concatenation nodes are input into the output layer to obtain the corresponding security detection results;
[0054] The security detection results are matched with the event tag sequence to calculate the training error;
[0055] The parameters of the ChebNet backbone network are updated based on the training error; the security detection result output, training error calculation and parameter update are repeated until the convergence condition is met, and the security detection model is obtained.
[0056] The beneficial effects of this invention are:
[0057] (1) This invention introduces a segment delayed insertion structure in the ChebNet backbone network, and performs delayed caching, graph convolution propagation and slot insertion processing on the hidden features of the middle node after splitting them. This makes the hidden information of the node no longer transmitted synchronously along a single inter-layer link, which enhances the segmentation organization capability of the internal features of the security equipment node and is conducive to improving the representation integrity of multi-source security data in the graph propagation process.
[0058] (2) By constructing a mirror node layer, the present invention generates mirror nodes that correspond one-to-one with the original nodes on the basis of the original node layer, performs graph convolution propagation on the two-layer graph structure, and interleaves the original node results and mirror node results after propagation to form the hidden layer features of mirror fusion nodes, which enriches the intermediate representation of nodes and is conducive to improving the ability of security equipment association status to be expressed in the graph structure.
[0059] (3) This invention inputs the hidden layer features of the mirror fusion node into the final ChebNet sorting layer, extracts the tail segment of the hidden layer of the node according to the path chain and passes it sequentially along the path chain, inserts it into the middle slot of the hidden layer of the current node, so that the sequential association between security devices can continue to be retained and passed after graph convolution sorting, which is beneficial to characterize the path association relationship between devices in scenarios such as parks, buildings, and passages, and improves the security detection model's ability to identify multi-device linkage anomalies. Attached Figure Description
[0060] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:
[0061] Figure 1 This is a flowchart of a security detection model training method based on graph neural networks proposed in this invention;
[0062] Figure 2 This is a schematic diagram of the segment delayed insertion processing in a security detection model training method based on graph neural networks proposed in this invention.
[0063] Figure 3 This is a mirror node layer construction diagram of the security detection model training method based on graph neural networks proposed in this invention. Detailed Implementation
[0064] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.
[0065] refer to Figures 1-3 A method for training a security detection model based on graph neural networks includes the following steps:
[0066] Acquire operational data from security equipment, extract corresponding equipment features, and generate event tag sequences;
[0067] Based on the relationships between security devices, a device diagram is constructed. The device diagram is then segmented according to time windows to generate a sample set of diagram snapshots.
[0068] Construct the ChebNet backbone network, input the graph snapshot sample set into the ChebNet backbone network to perform front-end graph convolutional propagation, and generate hidden layer features of the middle node;
[0069] The hidden layer features of the middle node are input into the late-injection block of the segment. The hidden layer vector of the node is split into segments. The split delayed segments are written into the buffer line. The remaining segments are input into the next segment graph for convolution propagation. The delayed segments in the buffer line are inserted into the node hidden layer result after propagation according to the slot, and the late-injection node hidden layer features are generated.
[0070] A mirror node layer is constructed based on the hidden layer features of the back-insertion node. The hidden layer vector of the node is processed by segment rotation to obtain the hidden layer vector of the mirror node. Graph convolution propagation is performed on the two-layer graph structure. The original node results after propagation are interleaved with the corresponding mirror node results according to their positions to generate the hidden layer features of the mirror fused node.
[0071] The hidden layer features of the mirrored fused node are input into the final ChebNet sorting layer to perform graph convolution propagation. The tail segment of the hidden layer of the node is extracted according to the path chain and passed sequentially along the path chain. The received segment is inserted into the middle slot of the hidden layer of the current node to generate the hidden layer features of the path splicing node.
[0072] The hidden features of the path concatenation nodes are input into the output layer, and the event tag sequence is combined to perform iterative training until the convergence condition is met, thus obtaining the security detection model.
[0073] In this embodiment, obtaining security equipment operation data specifically includes:
[0074] The system collects operational data output by each security device during the monitoring period, and aggregates it according to device number and collection time to form device-level operational data. Security devices include cameras, access control devices, infrared detectors, and environmental sensors. During aggregation, the data is stored using a binary index method of device number-collection time to form a time-series data table corresponding to each security device.
[0075] Time alignment and anomaly removal are performed on device-level operational data, which is divided into continuous time slices according to a unified time granularity. Time alignment uses a unified timestamp benchmark for resampling. Data with multiple sampling records within the same time granularity is handled accordingly. Anomaly removal includes deleting data with missing timestamps, deleting data with empty fields, and removing data that exceeds ±3 times the historical mean of the corresponding device. Adjacent time slices are divided using a non-overlapping sliding method.
[0076] Numerical features representing the operating status of devices are extracted from the device-level operational data within each time slice, forming device features that correspond one-to-one with security devices; the numerical features are obtained using statistical methods.
[0077] The system reads event information corresponding to the monitoring period, matches the event information with each time slice, assigns a corresponding event tag to each time slice, and generates an event tag sequence in chronological order. The event information comes from alarm logs and review records. During matching, the system aligns events according to their occurrence time falling into the corresponding time slice. When event information exists in the same time slice, the time slice is marked as an abnormal event time slice. When no event information exists in the same time slice, the time slice is marked as a normal time slice.
[0078] In this embodiment, constructing a device diagram based on the relationships between security devices specifically includes:
[0079] The edge computing node receives device features uploaded by each security device, reads the device number, installation location and device category of each security device, and uses each security device as a node in the device graph; each security device sends its device features to the edge computing node according to the reporting cycle.
[0080] Calculate the distance between installation locations, and record the node pairs that are less than the distance threshold and located in the same area as spatial connection edges; the same area is divided according to monitoring zones;
[0081] Statistically analyze the event triggering order of different security devices within a continuous time slice, and record the node pairs whose triggering time interval is less than the time threshold as time-series connection edges;
[0082] Read the linkage event records formed by two security devices in the same monitoring period, and record the node pairs that appear in the same linkage event record as linkage connection edges; the linkage event records are formed by merging edge computing nodes based on the same abnormal event.
[0083] The spatial connection edges, temporal connection edges, and linkage connection edges are merged to generate an edge connection matrix, forming a device diagram.
[0084] Extract the device features and edge connection matrix within the corresponding time period from the device graph to generate a graph snapshot corresponding to a single time window;
[0085] Arrange the snapshots corresponding to each time window in chronological order to generate a snapshot sample set.
[0086] In this embodiment, the ChebNet backbone network specifically includes:
[0087] The ChebNet backbone network uses ChebNet graph convolutional units as the basic propagation structure. The ChebNet backbone network consists of the following layers from input to output: front graph convolutional layer, fragment late insertion block, mirror node propagation layer, final ChebNet finishing layer, and output layer.
[0088] The fragment late insertion block performs fragment splitting, cache delay, and slot back-insertion on the hidden layer features of the middle node, and outputs the hidden layer features of the back-inserted node.
[0089] A mirror node layer is constructed based on the hidden layer features of the inserted node. ChebNet graph convolution propagation and staggered splicing are performed on the two-layer graph structure to output the hidden layer features of the mirror fused node.
[0090] The final ChebNet processing layer performs graph convolution processing on the hidden features of the mirrored fused nodes, and performs tail segment propagation and middle slot insertion on the hidden features of the final node according to the path chain, outputting the hidden features of the path spliced node.
[0091] In this embodiment, the late-path back-insertion block of the hidden layer feature input fragment of the middle node specifically includes:
[0092] Read the hidden layer vectors of each node in the hidden layer features of the middle node, and divide each node's hidden layer vector into a front segment, a middle transition segment, and a rear segment along the channel direction; the channel ratio of the front segment, the middle transition segment, and the rear segment is preset, and in this embodiment, it is 2:1:1;
[0093] The preceding segment is input into the next ChebNet graph convolution unit to perform graph convolution propagation. The intermediate transition segment is written to the buffer line and its storage position remains unchanged. The following segment is input into the sorting unit to perform channel rearrangement, resulting in the sorted following segment. The intermediate transition segment of each node is written to a unique fixed buffer position and its buffer position is not changed before the current round of propagation is completed. The sorting unit performs cyclic shift rearrangement on the following segment to obtain the sorted following segment.
[0094] After the next ChebNet graph convolutional unit outputs the propagated node hidden layer results, the intermediate transition segment and the sorted later segment in the cache line are read in the order of node index. The intermediate transition segment and the sorted later segment are inserted into the fixed-interval slots in the propagated node hidden layer results in sequence. The fixed-interval slots are set with one insertion position every 2 channels. When inserting, the intermediate transition segment is written first, and then the sorted later segment is written.
[0095] When there is an existing segment in a fixed-interval slot, the existing segment is moved backward along the channel direction while retaining the original channel order in the slots that have not been replaced. The original segment is moved backward in a way that moves from the end channel forward slot by slot. After moving backward, the channel content that exceeds the dimension length is directly truncated, and the original channel that has not entered the insertion slot retains its original order.
[0096] Arrange the hidden layer results of each node that has completed slot insertion in the order of node index to generate the hidden layer features of the inserted node.
[0097] In this embodiment, constructing a mirror node layer based on the hidden layer features of the back-insertion node specifically includes:
[0098] Read the hidden layer vectors of each node in the hidden layer features of the back-insertion node, and generate a mirror node corresponding to each node, thus creating a mirror node layer.
[0099] The hidden layer vectors of each node are continuously segmented along the channel direction to obtain several sequentially arranged feature segments. The positions of each feature segment are adjusted according to a predetermined rotation order to generate the hidden layer vectors of the mirror nodes corresponding to each mirror node.
[0100] Preserve the edge connections between the original nodes, and copy the edge connections between mirror nodes according to the same node index correspondence. Establish a one-to-one connection edge between each original node and its corresponding mirror node to form a two-layer graph structure. The edge connections between the original nodes directly adopt the edge connection matrix corresponding to the hidden layer features of the back-inserted nodes. The edge connection matrix between mirror nodes is copied according to the same row and column positions. Each original node establishes a connection edge only with one mirror node of the corresponding index.
[0101] The original node hidden layer vector and the mirror node hidden layer vector are input into the ChebNet graph convolution unit. Graph convolution propagation is performed on the two-layer graph structure to obtain the propagated original node result and the propagated mirror node result.
[0102] Read the results of each original node and the corresponding mirror node, and splice them together in an alternating manner along the channel direction. Write the original node result fragments and mirror node result fragments into the spliced channel position in sequence.
[0103] Arrange the interlaced splicing results corresponding to each node in the order of node index to generate the hidden layer features of the mirrored fused nodes.
[0104] In this embodiment, the final-level ChebNet tidying layer specifically includes:
[0105] The hidden features of the mirror-fused nodes and the corresponding edge connection matrices are input into the final ChebNet consolidation layer, and graph convolution propagation is performed to obtain the hidden features of the final nodes corresponding to each node. The number of nodes in the hidden feature matrix of the mirror-fused nodes is consistent with the number of nodes in the corresponding edge connection matrix, and the number of channels corresponding to a single node in the hidden features of the mirror-fused nodes is twice the number of channels of the original node result after propagation.
[0106] Based on the arrangement order of each node in the path chain, the hidden layer vector of the last-level node corresponding to each node is read, and the hidden layer tail segment of the node is extracted from the tail of the hidden layer vector of each node. The path chain is obtained by organizing the node connection relationship in the device diagram. For nodes with multiple adjacent nodes, the front and rear positions in the path chain are determined according to the actual passage direction of the security equipment in the monitoring area, the installation position order, or the event triggering order. The same node corresponds to only one predecessor node and one successor node in a single path chain. The hidden layer tail segment of the node is continuously extracted from the tail of the hidden layer vector of the last-level node, and the channel length of the hidden layer tail segment of the node is less than the total channel length of the hidden layer vector of the last-level node.
[0107] According to the adjacent relationship in the path chain, the hidden tail segment of the current node is passed to the next node in the path chain, and the node at the end of the path chain passes the hidden tail segment of the node to the starting node of the path chain.
[0108] After each path chain completes one round of sequential transmission, the hidden layer tail segment received by each node is read and inserted into the middle slot of the current node's hidden layer vector.
[0109] When the middle slot contains existing channel content, the existing channel content is moved backward along the channel direction, keeping the position of the first channel unchanged; channel content that exceeds the end of the hidden layer vector of the last-level node is directly truncated.
[0110] The hidden layer results of each node that has completed the insertion of the middle slot are arranged in the order of the node index to generate the hidden layer features of the path splicing node.
[0111] In this embodiment, the input and output layers of the hidden features of the path splicing nodes specifically include:
[0112] The hidden features of the path splicing nodes are input into the output layer to obtain the corresponding security detection results. The output layer consists of a fully connected layer and a normalized output unit. The hidden features of the path splicing nodes are input into the output layer in the order corresponding to the snapshot samples. The output layer generates the corresponding anomaly discrimination result for each snapshot sample. The security detection results are represented in a binary classification output form, with the output value between 0 and 1.
[0113] The security detection results are matched with the event tag sequence to calculate the training error; each event tag in the event tag sequence is matched one-to-one with the corresponding snapshot sample; the training error is calculated using the cross-entropy loss function.
[0114] The parameters of the ChebNet backbone network are updated based on the training error. The security detection result output, training error calculation and parameter update are repeated until the convergence condition is met to obtain the security detection model. The parameter update is performed using the Adam optimization algorithm. The convergence condition is set to the change in training error of several consecutive training rounds being less than a threshold.
[0115] Example 1: To verify the feasibility of this invention in practice, it was applied to a security detection scenario in a closed campus. This scenario is equipped with video acquisition devices, access control devices, infrared detection devices, and environmental sensing devices, located at entrances / exits, passageways, floor transition areas, and key monitoring areas. Existing security processing methods primarily rely on single-device alarm results for judgment. When encountering continuous personnel movement, cross-area triggering, short-term obstruction, tailgating, or continuous responses from multiple devices, information fragmentation easily occurs. Some abnormal events are broken down into multiple independent alarm segments, leading to high false alarm and false negative rates. Furthermore, edge-side inference results cannot reliably reflect the sequential correlation between devices.
[0116] In this embodiment, edge computing nodes receive operational data reported by each security device, extract device features from continuous data, and form an event tag sequence corresponding to the monitoring period. A device graph is constructed based on the spatial proximity, continuous triggering, and linkage relationships between devices, and is divided into a graph snapshot sample set according to a unified time window. After the graph snapshot sample set enters the ChebNet backbone network, the initial graph convolution completes basic propagation, sending the hidden layer features of the middle nodes into the segment late-propagation back-insertion block. The hidden layer vector of the same node is split into an initial segment, an intermediate transition segment, and a final segment. The initial segment enters the next graph convolution, the intermediate transition segment is stored in the buffer line, and the final segment, after being processed, is inserted back into the propagation result along with the intermediate transition segment at a fixed slot, thus forming the back-inserted node hidden layer features.
[0117] After obtaining the hidden layer features of the insertion nodes, a one-to-one mirror node is generated for each original node. Segment rotation is performed on the hidden layer vectors of the original nodes to obtain the hidden layer vectors of the mirror nodes. The original node layer, the mirror node layer, and the corresponding connecting edges between layers together constitute a two-layer graph structure. After entering the ChebNet graph convolution, the two-layer graph structure produces the propagated original node results and the propagated mirror node results. These are then staggered along the channel direction to form the mirror-fused node hidden layer features. The mirror-fused node hidden layer features are input into the final ChebNet processing layer, and then a path chain is formed based on the actual security deployment path. Tail segments are extracted from the tail of each node's hidden layer vector and passed sequentially along the path chain to the next node. After completing one round of closed-loop propagation, the received segment is inserted into the middle slot of the current node's hidden layer to obtain the path-stitched node hidden layer features. Finally, the path-stitched node hidden layer features are input into the output layer, and combined with the event tag sequence, cyclic training is performed until convergence, resulting in the security detection model.
[0118] Under the same batch of samples, the method proposed in this invention was compared with the rule-based thresholding method, convolutional network method, basic GCN method, basic ChebNet method, and the method of this invention. Test results show that the method of this invention outperforms the comparison methods in terms of event-level accuracy, precision, recall, and F1 score, while maintaining a good balance in terms of false positive rate, false negative rate, and single-inference latency at edge nodes. Compared to the basic ChebNet method, the event-level accuracy of the method of this invention increased from 92.1% to 96.4%, precision from 90.8% to 95.7%, recall from 89.9% to 94.8%, and F1 score from 90.3% to 95.2%, while the false positive rate decreased from 7.4% to 3.1% and the false negative rate decreased from 8.2% to 3.8%. When executed at edge nodes, the single-inference latency of the method of this invention is 36 milliseconds, which is slightly higher than the rule-based thresholding method and the convolutional network method, but lower than the deep comparison schemes that require greater computational overhead, thus meeting the real-time detection requirements in edge scenarios.
[0119] The implementation results show that this invention does not simply rely on conventional graph convolution for node propagation. Instead, it reorganizes the internal fragments and sequential relationships between nodes through delayed fragment interpolation, mirrored node propagation, and path chain sequential transmission. The former prevents the hidden layer features of the same node from being simultaneously advanced, allowing intermediate propagation content to be interpolated later. The latter introduces mirrored accompanying expressions into the original node during propagation. The latter preserves the sequential relationships of devices in channels, entrances / exits, and transition areas after final-level reorganization. Therefore, in scenarios such as cross-regional continuous triggering, short-term occlusion recovery, tail-entry, and multi-node linkage anomalies, the alarm results obtained by this invention are more concentrated, and the boundaries of anomaly event identification are clearer. This demonstrates that this invention can effectively solve the problems of weak multi-device association, insufficient path sequence expression, and insufficient stability of edge-side detection in existing technologies.
[0120] Table 1: Comparison of Security Detection Model Performance
[0121] Method Name Rule-based threshold method Convolutional Network Method Basic GCN method Basic ChebNet method Method of the present invention Event-level accuracy 84.6% 88.3% 90.5% 92.1% 96.4% Accuracy 79.8% 84.9% 88.1% 90.8% 95.7% Recall rate 76.5% 82.4% 86.7% 89.9% 94.8% F1 value 78.1% 83.6% 87.4% 90.3% 95.2% False alarm rate 12.7% 9.8% 8.5% 7.4% 3.1% underreporting rate 15.9% 11.7% 9.6% 8.2% 3.8% Single inference delay 18 milliseconds 24 milliseconds 31 milliseconds 34 milliseconds 36 milliseconds Edge-side memory usage 412MB 568MB 624MB 653MB 689MB
[0122] As shown in Table 1, the rule-based thresholding method has the lowest inference latency, but its event-level accuracy, recall, and F1 score are all at a low level, indicating that single-device threshold judgment is difficult to cover scenarios with continuous multi-device interaction. Convolutional network methods can improve the feature recognition capability of single frames, but due to the lack of device graph structure representation, they are still insufficient in characterizing cross-node anomaly propagation.
[0123] After introducing graph structures, the basic GCN and basic ChebNet methods outperform the previous two methods in overall performance. The basic ChebNet method further improves accuracy, precision, and recall, indicating that spectral domain graph convolution is more suitable for handling the correlation of security devices. However, the basic ChebNet method still mainly relies on conventional inter-layer propagation, and its coverage of delayed processing of segments within the same node and path order propagation is insufficient.
[0124] The method of this invention achieves the best results in key indicators such as event-level accuracy, precision, recall, F1 score, false positive rate and false negative rate, while maintaining low edge-side inference latency and relatively stable computational overhead. This shows that the invention improves the ability to model multi-device association and the stability of anomaly detection without significantly increasing the deployment burden.
[0125] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.
Claims
1. A method for training a security detection model based on a graph neural network, characterized in that, Includes the following steps: Acquire operational data from security equipment, extract corresponding equipment features, and generate event tag sequences; Based on the relationships between security devices, a device diagram is constructed. The device diagram is then segmented according to time windows to generate a sample set of diagram snapshots. Construct the ChebNet backbone network, input the graph snapshot sample set into the ChebNet backbone network to perform front-end graph convolutional propagation, and generate hidden layer features of the middle node; The hidden layer features of the middle node are input into the late-injection block of the segment. The hidden layer vector of the node is split into segments. The split delayed segments are written into the buffer line. The remaining segments are input into the next segment graph for convolution propagation. The delayed segments in the buffer line are inserted into the node hidden layer result after propagation according to the slot, and the late-injection node hidden layer features are generated. A mirror node layer is constructed based on the hidden layer features of the back-insertion node. The hidden layer vector of the node is processed by segment rotation to obtain the hidden layer vector of the mirror node. Graph convolution propagation is performed on the two-layer graph structure. The original node results after propagation are interleaved with the corresponding mirror node results according to their positions to generate the hidden layer features of the mirror fused node. The hidden layer features of the mirrored fused node are input into the final ChebNet sorting layer to perform graph convolution propagation. The tail segment of the hidden layer of the node is extracted according to the path chain and passed sequentially along the path chain. The received segment is inserted into the middle slot of the hidden layer of the current node to generate the hidden layer features of the path splicing node. The hidden features of the path concatenation nodes are input into the output layer, and the event tag sequence is combined to perform iterative training until the convergence condition is met, thus obtaining the security detection model.
2. The method for training a security detection model based on a graph neural network according to claim 1, characterized in that, The acquisition of security equipment operation data specifically includes: Collect operational data output by each security device during the monitoring period, and aggregate it according to device number and collection time to form device-level operational data; Perform time alignment and anomaly removal on device-level operational data, and divide it into continuous time slices according to a uniform time granularity; Numerical features representing the operating status of the equipment are extracted from the equipment-level operating data within each time slice, forming equipment features that correspond one-to-one with the security equipment; Read the event information corresponding to the monitoring period, match the event information with each time slice, assign corresponding event tags to each time slice, and generate an event tag sequence in chronological order.
3. The method for training a security detection model based on a graph neural network according to claim 2, characterized in that, The construction of the device diagram based on the association between security devices specifically includes: The edge computing node receives the device features uploaded by each security device, reads the device number, installation location and device category corresponding to each security device, and uses each security device as a node in the device graph; Calculate the distance between installation locations, and denote the node pairs that are less than the distance threshold and located in the same area as spatial connection edges; Statistically analyze the event triggering order of different security devices within a continuous time slice, and record the node pairs whose triggering time interval is less than the time threshold as time-series connection edges; Read the records of linkage events formed by two security devices in the same monitoring period, and record the node pairs that appear in the same linkage event record as linkage connection edges; The spatial connection edges, temporal connection edges, and linkage connection edges are merged to generate an edge connection matrix, forming a device diagram. Extract the device features and edge connection matrix within the corresponding time period from the device graph to generate a graph snapshot corresponding to a single time window; Arrange the snapshots corresponding to each time window in chronological order to generate a snapshot sample set.
4. The method for training a security detection model based on a graph neural network according to claim 3, characterized in that, The ChebNet backbone network specifically includes: The ChebNet backbone network uses ChebNet graph convolutional units as the basic propagation structure. The ChebNet backbone network consists of the following layers from input to output: front graph convolutional layer, fragment late insertion block, mirror node propagation layer, final ChebNet finishing layer, and output layer. The fragment late insertion block performs fragment splitting, cache delay, and slot back-insertion on the hidden layer features of the middle node, and outputs the hidden layer features of the back-inserted node. A mirror node layer is constructed based on the hidden layer features of the inserted node. ChebNet graph convolution propagation and staggered splicing are performed on the two-layer graph structure to output the hidden layer features of the mirror fused node. The final ChebNet processing layer performs graph convolution processing on the hidden features of the mirrored fused nodes, and performs tail segment propagation and middle slot insertion on the hidden features of the final node according to the path chain, outputting the hidden features of the path spliced node.
5. The method for training a security detection model based on a graph neural network according to claim 4, characterized in that, The specific steps of inputting the hidden layer features of the middle node into the late-arrival back-insertion block of the fragment include: Read the hidden layer vectors of each node in the hidden layer features of the middle node, and divide each node's hidden layer vector into the front segment, the middle transition segment, and the back segment along the channel direction. The first segment is input into the next ChebNet graph convolution unit to perform graph convolution propagation, the intermediate transition segment is written to the buffer line and the storage location remains unchanged, and the last segment is input into the sorting unit to perform channel rearrangement to obtain the sorted last segment. After the next ChebNet graph convolutional unit outputs the propagated node hidden layer result, the intermediate transition segment and the sorted subsequent segment in the cache line are read according to the node index order, and the intermediate transition segment and the sorted subsequent segment are inserted into the fixed interval slot in the propagated node hidden layer result in sequence. When an existing segment exists in a fixed-interval slot, the existing segment is moved backward along the channel direction while preserving the original channel order in the unreplaced slot. Arrange the hidden layer results of each node that has completed slot insertion in the order of node index to generate the hidden layer features of the inserted node.
6. The method for training a security detection model based on a graph neural network according to claim 5, characterized in that, The construction of the mirror node layer based on the hidden layer features of the back-insertion node specifically includes: Read the hidden layer vectors of each node in the hidden layer features of the back-insertion node, and generate a mirror node corresponding to each node, thus creating a mirror node layer. The hidden layer vectors of each node are continuously segmented along the channel direction to obtain several sequentially arranged feature segments. The positions of each feature segment are adjusted according to a predetermined rotation order to generate the hidden layer vectors of the mirror nodes corresponding to each mirror node. Preserve the edge connection relationship between the original nodes, copy the edge connection relationship between the mirror nodes according to the same node index correspondence, and establish a one-to-one connection edge between each original node and the corresponding mirror node to form a two-layer graph structure. The original node hidden layer vector and the mirror node hidden layer vector are input into the ChebNet graph convolution unit. Graph convolution propagation is performed on the two-layer graph structure to obtain the propagated original node result and the propagated mirror node result. Read the results of each original node and the corresponding mirror node, and splice them together in an alternating manner along the channel direction. Write the original node result fragments and mirror node result fragments into the spliced channel position in sequence. Arrange the interlaced splicing results corresponding to each node in the order of node index to generate the hidden layer features of the mirrored fused nodes.
7. The method for training a security detection model based on a graph neural network according to claim 6, characterized in that, The final-level ChebNet sorting layer specifically includes: The hidden features of the mirrored fused nodes and the corresponding edge connection matrix are input into the final ChebNet sorting layer, and graph convolution propagation is performed to obtain the hidden features of the final nodes corresponding to each node. Based on the order of nodes in the path chain, read the hidden layer vector of the last-level node corresponding to each node, and extract the hidden layer tail segment of the node from the tail of the hidden layer vector of each node. According to the adjacent relationship in the path chain, the hidden tail segment of the current node is passed to the next node in the path chain, and the node at the end of the path chain passes the hidden tail segment of the node to the starting node of the path chain. After each path chain completes one round of sequential transmission, the hidden layer tail segment received by each node is read and inserted into the middle slot of the current node's hidden layer vector. When the middle slot contains existing channel content, move the existing channel content backward along the channel direction, keeping the position of the first channel unchanged; The hidden layer results of each node that has completed the insertion of the middle slot are arranged in the order of the node index to generate the hidden layer features of the path splicing node.
8. The method for training a security detection model based on a graph neural network according to claim 7, characterized in that, The specific steps of inputting and outputting the hidden layer features of the path concatenation nodes include: The hidden features of the path concatenation nodes are input into the output layer to obtain the corresponding security detection results; The security detection results are matched with the event tag sequence to calculate the training error; The parameters of the ChebNet backbone network are updated based on the training error; the security detection result output, training error calculation and parameter update are repeated until the convergence condition is met, and the security detection model is obtained.