Privacy data abnormal access behavior detection method based on graph neural network

Abstract

The application relates to the field of electric digital data processing, in particular to a privacy data abnormal access behavior detection method based on a graph neural network. The method comprises the following steps: a dynamic access graph construction module, preprocessing of a multi-source system log, generation of a static subgraph based on a time window and concatenation to form a heterogeneous multi-relation dynamic access graph; a time sequence feature decoupling module, time-varying access features and time-invariant identity features are separated by using a time sequence decoupling network, and the features are expressed by combining orthogonal constraints and a gating mechanism; a graph feature aggregation and detection module, topological feature extraction is completed by feature alignment and relationship perception aggregation, an abnormality detection result is output after feature fusion, and the model performance is improved by combining topology prediction and multi-loss joint optimization, and a dynamic access control strategy is generated according to an abnormal path. The application solves the problems of semantic information loss, feature mutual interference and hidden abnormality difficult to identify in the prior art, and improves the accuracy and real-time performance of privacy data abnormal access detection.

Description

Technical Field

[0001] This invention relates to the field of electronic digital data processing, specifically to a method for detecting abnormal access behavior to privacy data based on graph neural networks. Background Technology

[0002] Current methods for detecting abnormal access to privacy data often employ graph-based data processing architectures. These architectures extract user and privacy data entities from system logs, treating entities as isomorphic nodes and access records between entities as indistinguishable edges, constructing a static access graph. For node features, conventional approaches typically extract statistical indicators such as access frequency and operation type distribution, concatenating these indicators into a fixed-dimensional feature vector. However, in the feature processing stage, these approaches fail to distinguish the semantic differences between entity types and interaction relationships, flattening the complex access network into a single-structure isomorphic graph. Subsequent graph neural networks then perform uniform message passing based on this isomorphic graph, leading to the loss of high-dimensional semantic information.

[0003] When faced with time information in access logs, existing graph neural network (Graph Neural Network) solutions typically convert timestamps into periodic codes or directly use them as scalar dimensions, concatenating them into the initial feature vectors of nodes. In the aggregation phase of the Graph Neural Network, a uniform and fixed aggregation function is used to average or sum the features of all neighboring nodes. This processing places temporal features and the entity's inherent attribute features in the same feature space for mixed computation, failing to distinguish between the dynamic characteristics of access behavior evolving over time and the inherent static attributes of the entity's identity. Under the unified aggregation function, the time-varying statistical features and time-invariant identity features of neighboring nodes are convolved simultaneously, causing the evolution patterns of the two types of features to interfere with each other.

[0004] Because existing solutions encode time-varying access habit features and time-invariant identity attribute features in a mixed manner, and use an indiscriminate aggregation mechanism in the graph convolution process, when detecting hidden long-term abnormal access behavior, the long-term low-frequency time-varying access patterns are buried by high-frequency inherent attribute features, and the temporal evolution features under different interaction relationships cannot be extracted in a targeted manner, making it difficult to accurately capture hidden long-term abnormal access behavior. Summary of the Invention

[0005] The purpose of this invention is to provide a method for detecting abnormal access behavior to privacy data based on graph neural networks, which can solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A method for detecting abnormal access behavior of privacy data based on graph neural networks includes: extracting user entities, privacy data entities, terminal entities and their interaction relationships from system logs, and constructing a heterogeneous multi-relationship dynamic access graph containing multiple types of nodes and multiple semantic edges; A time-series decoupling network is used to decompose the node feature vectors in the heterogeneous multi-relationship dynamic access graph into time-varying features representing access habits and time-invariant features representing identity attributes; In the message passing stage of the graph neural network, a relation-aware aggregation function is used to assign differentiated weights based on the semantic type of the multi-semantic edges, and the time-varying features and time-invariant features of the neighboring nodes are topologically aggregated respectively. The aggregated time-varying features are fused with the time-invariant features and input into the classifier to output the abnormal access behavior detection results.

[0007] Preferably, extracting user entities, privacy data entities, terminal entities and their interaction relationships from system logs, and constructing a heterogeneous multi-relationship dynamic access graph containing multiple types of nodes and multiple semantic edges includes: slicing the system logs according to a set time window, generating a multi-time static subgraph based on the interaction relationships within a single time window, constructing connection edges for the same entities across time periods, and merging the multi-time static subgraphs through the connection edges to form the heterogeneous multi-relationship dynamic access graph, wherein the multiple semantic edges include temporal predecessor and successor relationship edges representing the evolution of entities across time periods.

[0008] Preferably, the temporal decoupling network is used to decompose the node feature vectors in the heterogeneous multi-relationship dynamic access graph into time-varying features representing access habits and time-invariant features representing identity attributes. This includes: the temporal decoupling network constructs parallel temporal convolution channels and global pooling channels; the temporal convolution channels extract the dynamic change trend of the node feature vectors based on a sliding time window as the time-varying features; the global pooling channels perform max pooling on the node feature vectors within the node's lifecycle to extract static distribution attributes as the time-invariant features; and an orthogonal constraint loss function is introduced to suppress feature redundancy between the time-varying features and the time-invariant features.

[0009] Preferably, the method of using a relation-aware aggregation function to assign differentiated weights based on the semantic type of the multi-semantic edge, and performing topological aggregation on the time-varying features and time-invariant features of the neighboring nodes respectively, includes: the relation-aware aggregation function constructing an independent mapping matrix for each type of semantic edge in the multi-semantic edge, projecting the feature vector of the center node and the feature vector of the neighboring nodes under the corresponding mapping matrix, and performing a weighted summation based on the attention coefficients corresponding to the semantic type of the multi-semantic edge, to obtain the aggregated representation of the time-varying features and the aggregated representation of the time-invariant features respectively.

[0010] Preferably, fusing the aggregated time-varying features with the time-invariant features and inputting them into the classifier to output abnormal access behavior detection results includes: performing a bilinear interactive fusion operation on the aggregated representation of the aggregated time-varying features and the aggregated representation of the time-invariant features, calculating the cross product of the two types of features and concatenating them with the original aggregated representation to generate a fused feature vector, inputting the fused feature vector into the multilayer perceptron in the classifier, having the multilayer perceptron output the probability value of a node belonging to the abnormal access behavior category, and determining nodes whose probability value exceeds a preset judgment threshold as abnormal access nodes.

[0011] Preferably, based on the time-varying features and time-invariant features obtained from the time-series decoupling network, a forgetting gating mechanism is introduced during the dynamic evolution process. The forgetting coefficient is calculated based on the node feature vector at the current moment and the time-varying features at the previous moment. The historically accumulated time-varying features are selectively erased and their states are updated according to the forgetting coefficient. The time-invariant features are then smoothly accumulated and updated throughout their entire lifecycle through an exponential moving average mechanism to suppress the interference of occasional access noise on the representation of identity attributes.

[0012] Preferably, before the relation-aware aggregation function performs weighted summation, a type-aware feature alignment layer is constructed to address the differences in feature spaces of heterogeneous nodes among the multiple types of nodes. The feature vectors of different types of nodes are mapped to a common feature space of the same dimension through the linear transformation matrix corresponding to their respective node types. The weighted aggregation operation based on the attention coefficient is then performed in the common feature space to eliminate feature distribution offsets between heterogeneous entities.

[0013] Preferably, for the static subgraphs of adjacent time steps in the heterogeneous multi-relation dynamic access graph, newly added and disappeared interaction edges across time steps are extracted to construct a differential subgraph. The edge features in the differential subgraph are input into the edge-length short-term memory network to predict the edge distribution state of the differential subgraph at the next time step. Based on the predicted edge distribution state, the topology of the heterogeneous multi-relation dynamic access graph is pre-corrected to compensate for the topology lag caused by the access log collection delay.

[0014] Preferably, during the model training phase, a joint optimization objective function is constructed, which includes temporal decoupling orthogonal constraint loss, graph structure reconstruction loss, and classification cross-entropy loss. When calculating the classification cross-entropy loss, difficult samples whose probability values ​​are in the confusion interval are dynamically selected based on the abnormal probability values ​​currently output by the model. Dynamically increased penalty weights are assigned to the difficult samples, so that the joint optimization objective function focuses on the feature offset correction of the difficult samples during gradient backpropagation, thereby improving the model's discriminability of boundary ambiguity access behavior.

[0015] Preferably, after the classifier outputs the abnormal access behavior detection result, the abnormal interaction path corresponding to the abnormal access behavior detection result is extracted, the security level label of the privacy data entity associated with the abnormal interaction path and the network location label of the access terminal entity are parsed, a dynamic access control policy containing the security level label and the network location label is generated, and the dynamic access control policy is sent to the corresponding access control execution node to intercept subsequent access requests of the same type of topology path.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. By constructing a heterogeneous, multi-relational dynamic access graph containing multiple types of nodes and multiple semantic edges, the semantic topological differences of entities and interactions are preserved. A temporal decoupling network is employed to decompose node feature vectors into time-varying features representing access habits and time-invariant features representing identity attributes, thus eliminating the coupling interference between the two types of features in the same space. In the message passing stage of the graph neural network, a relation-aware aggregation function is used to assign differentiated weights based on the semantic type of the multiple semantic edges, performing topological aggregation on the time-varying and time-invariant features of neighboring nodes respectively. These techniques propagate time-varying patterns independently under the corresponding semantic topology, overcoming the defect of time-varying features being obscured by inherent attributes. This enables the model to extract habit evolution patterns over long periods, solving the technical problem of accurately capturing hidden, long-term abnormal access behaviors.

[0017] 2. Dynamic trends are extracted as time-varying features through temporal convolution channels, while static distribution attributes are extracted as time-invariant features through global pooling channels. An orthogonal constraint loss function is introduced to suppress feature redundancy between time-varying and time-invariant features, enhancing the purity of feature representation. A forgetting gating mechanism is introduced to calculate the forgetting coefficient based on the current features and the time-varying features of the previous time step, selectively erasing and updating the state of historical time-varying features, eliminating the interference of occasional access noise on time-varying features. For the dynamic access graph, interaction edges added and disappeared across time steps are extracted to construct a difference graph. The edge features of the difference graph are input into the edge-length short-term memory network to predict the edge distribution state at the next time step. The topology is pre-corrected based on the prediction results, compensating for the topology lag caused by the access log collection delay and enhancing the system's responsiveness to dynamic evolution. Attached Figure Description

[0018] Figure 1 Flowchart for constructing a heterogeneous multi-relationship dynamic access graph; Figure 2 Flowchart for dual-channel feature splitting and feature updating in a temporally decoupled network; Figure 3 Flowchart for heterogeneous node feature alignment and relationship-aware differential topology aggregation; Figure 4Flowchart for constructing difference graphs and predicting and correcting the topology of short-term memory networks with side lengths; Figure 5 Flowchart for training multi-loss joint optimization and hard sample weighted model; Figure 6 This is a flowchart for the closed-loop handling of abnormal path resolution and dynamic access control policies. Detailed Implementation

[0019] The technical solutions described in this specific embodiment are further explanations of the above technical solutions and are not intended to limit the scope of protection.

[0020] Appendix Figure 1 In one embodiment, the system log data to be detected is first acquired. This system log data includes various types such as operating system logs, database access logs, application logs, and network device logs. Each system log entry contains standardized fields such as timestamp, user identifier, terminal identifier, operation object identifier, operation type, operation result, and operation duration. The acquired system logs undergo preprocessing operations, including removing duplicate logs, filtering invalid logs, completing missing fields, and standardizing the data format. The preprocessed system logs are then sorted according to their timestamps to form an ordered log sequence.

[0021] User entities, privacy data entities, terminal entities, and their interaction relationships are extracted from the preprocessed system logs. User entities are extracted from fields such as user ID, username, and employee number in the logs, with each user entity having a unique identifier. Privacy data entities are extracted from fields such as file path, database table name, field name, and API interface address in the logs, and their type and security level are determined according to predefined data classification rules. Terminal entities are extracted from fields such as IP address, MAC address, device ID, and hostname in the logs, with each terminal entity having a unique identifier. The extracted interaction relationships include login, logout, locking, and unlocking relationships between users and terminals; read, write, modify, delete, copy, move, and share relationships between users and privacy data; direct access relationships between terminals and privacy data; and permission granting, permission revoke, and delegation relationships between users. Each interaction relationship corresponds to a specific semantic type.

[0022] Based on the extracted entities and interaction relationships, a heterogeneous multi-relationship dynamic access graph is constructed, containing multiple types of nodes and semantic edges. Nodes in the heterogeneous multi-relationship dynamic access graph are divided into three types: user nodes, privacy data nodes, and terminal nodes. Different types of nodes have different initial feature sets. Edges are directed edges, and each edge contains attributes such as edge type, timestamp, operation result, and operation duration. The heterogeneous multi-relationship dynamic access graph evolves continuously over time. New system logs are processed, adding new nodes and edges to the graph; expired nodes and edges are archived or deleted according to a preset retention policy.

[0023] A temporal decoupling network is employed to decompose the node feature vectors in a heterogeneous multi-relational dynamic access graph into time-varying features representing access habits and time-invariant features representing identity attributes. The initial feature vector of a node is composed of inherent attribute features and interaction statistical features. Inherent attribute features include entity type, identifier hash, creation time, etc., while interaction statistical features include the number of interactions per unit time, the proportion of different operation types, the number of different entities interacting, and the average duration of interactions. The temporal decoupling network receives the feature sequences of nodes at consecutive time steps as input and extracts the time-varying and time-invariant features through two parallel processing channels.

[0024] In the message passing phase of the graph neural network, a relation-aware aggregation function is used to assign differentiated weights based on the semantic type of multiple semantic edges, and to perform topological aggregation on the time-varying features and time-invariant features of neighboring nodes respectively. The relation-aware aggregation function can distinguish the importance of different semantic edges and employ different aggregation strategies for different types of interaction relationships. The aggregation process is performed independently for time-varying and time-invariant features to avoid mutual interference between the two types of features during aggregation. The aggregated representations of time-varying and time-invariant features retain the local topological structure information of the central node and the feature information of neighboring nodes.

[0025] The aggregated time-varying features are fused with time-invariant features and input into the classifier, outputting the abnormal access behavior detection results. The fusion operation fully exploits the interaction information between the time-varying and time-invariant features, generating a fused feature vector with stronger discriminative power. The classifier processes the fused feature vector and outputs the probability value of each node belonging to the abnormal access behavior category. Based on a preset judgment threshold, nodes with probability values ​​exceeding the threshold are judged as abnormal access nodes, and the corresponding access behaviors are judged as abnormal access behaviors.

[0026] This embodiment fully describes the basic process of a privacy data anomaly access behavior detection method based on graph neural networks. By constructing a heterogeneous multi-relationship dynamic access graph, the semantic information of entities and interactions is preserved. By using a temporal decoupling network, time-varying access habit features and time-invariant identity attribute features are separated. By using a relation-aware aggregation function, differentiated feature aggregation under different semantic relationships is achieved. By using bilinear fusion and a classifier to output detection results, the problem of difficulty in detecting covert anomaly access caused by semantic information loss, feature coupling interference, and indiscriminate aggregation in existing technologies is solved.

[0027] In one embodiment, the process of extracting user entities, privacy data entities, terminal entities and their interaction relationships from system logs and constructing a heterogeneous multi-relationship dynamic access graph containing multiple types of nodes and multiple semantic edges includes: slicing the system logs according to a set time window, generating a multi-time static subgraph based on the interaction relationships within a single time window, constructing connection edges for the same entities across time periods, and merging the multi-time static subgraphs through the connection edges to form a heterogeneous multi-relationship dynamic access graph, wherein the multiple semantic edges include temporal predecessor and successor relationship edges representing the evolution of entities across time periods.

[0028] Specifically, a sliding time window mechanism is used. The window size is set according to the time granularity requirements of the business scenario, and the sliding step is smaller than the window size to ensure the continuity of the time series. Preprocessed system logs are allocated to corresponding time windows according to timestamps, with each time window corresponding to a static subgraph at a given moment. The static subgraph only contains entities appearing within that time window and their interactions, excluding information from other time windows. For the same entity appearing in multiple consecutive time windows, a temporal predecessor-successor relationship edge is constructed between corresponding nodes in the static subgraphs of adjacent moments, with the edge pointing from the node at the previous moment to the node at the next moment. The attributes of the temporal predecessor-successor relationship edge include the time interval between the two moments, changes in entity attributes, and changes in entity interaction behavior. Through these temporal predecessor-successor relationship edges, multiple discrete static subgraphs are connected into a unified, continuous, heterogeneous multi-relationship dynamic access graph. Each node in the dynamic access graph not only contains the feature information of the current moment but is also connected to the same entity nodes in historical and future moments through temporal edges, completely preserving the temporal evolution trajectory of entity access behavior.

[0029] To more clearly illustrate the types and semantic meanings of multi-semantic edges in heterogeneous multi-relational dynamic access graphs, Table 1 is provided below: Table 1. Types and semantic descriptions of multi-semantic edges in heterogeneous multi-relation dynamic access graphs.

[0030] This embodiment describes in detail the construction method of heterogeneous multi-relationship dynamic access graph. Static subgraphs are generated by slicing time windows, and multiple static subgraphs are merged into a dynamic graph by using temporal predecessor and successor relationship edges. This preserves the temporal evolution trajectory of entity access behavior and provides a basic data structure for subsequent extraction and analysis of temporal features.

[0031] Appendix Figure 2 In one embodiment, the process of using a temporal decoupling network to decompose the node feature vectors in a heterogeneous multi-relationship dynamic access graph into time-varying features representing access habits and time-invariant features representing identity attributes includes: the temporal decoupling network constructs parallel temporal convolution channels and global pooling channels; the temporal convolution channels extract the dynamic change trend of node feature vectors as time-varying features based on a sliding time window; the global pooling channels perform max pooling operations on the node feature vectors within the node's lifecycle to extract static distribution attributes as time-invariant features; and an orthogonal constraint loss function is introduced to suppress feature redundancy between time-varying and time-invariant features.

[0032] Specifically, the temporal convolutional channel comprises multiple one-dimensional convolutional layers. The kernel size, stride, and padding of each convolutional layer are set according to the length of the input feature sequence and the time-scale features to be extracted. Each convolutional layer is followed by a batch normalization layer and an activation function layer. The batch normalization layer is used to accelerate network training and prevent overfitting, and the activation function is ReLU. The input to the temporal convolutional channel is the feature sequence of the node across multiple consecutive time steps, with the length of the feature sequence equal to the number of time steps contained in the sliding time window. After processing through multiple layers of one-dimensional convolutions, the output feature vector represents the time-varying features of the node, which characterize the dynamic changes in node access habits over time.

[0033] The global pooling channel performs max pooling on the feature vectors of a node across all time steps throughout its lifetime. Max pooling is performed independently for each feature dimension; that is, for each dimension of the feature vector, the maximum value of that dimension across all time steps is taken as the output. Global max pooling extracts the global static distribution attributes of node features, unaffected by time variations. The output feature vector represents the node's time-invariant features, which characterize the node's inherent identity attributes.

[0034] To suppress feature redundancy between time-varying and time-invariant features and ensure that each type of feature can represent different information, an orthogonal constraint loss function is introduced. The orthogonal constraint loss function makes the time-varying feature vector and the time-invariant feature vector as orthogonal as possible in the feature space, reducing information overlap between the two types of features. The expression for the orthogonal constraint loss function is:

[0035] in, This represents the total number of nodes in a heterogeneous, multi-relationship dynamic access graph. For the first Time-varying feature vectors of each node, For the first The time-invariant eigenvectors of each node. Let represent the Frobenius norm. When When the value approaches 0, the time-varying feature vector and the time-invariant feature vector are approximately orthogonal, and feature redundancy between the two types of features is effectively suppressed.

[0036] Furthermore, based on the time-varying and time-invariant features obtained from the time-series decoupled network, a forgetting gating mechanism is introduced during the dynamic evolution process. The forgetting coefficient is calculated based on the node feature vector at the current moment and the time-varying features at the previous moment. The historically accumulated time-varying features are selectively erased and their states are updated according to the forgetting coefficient. The time-invariant features are then smoothly accumulated and updated throughout the entire lifecycle through an exponential moving average mechanism to suppress the interference of occasional access noise on the representation of identity attributes.

[0037] The specific implementation of the forgetting gating mechanism is as follows: for each node, at the current time... First, obtain the initial feature vector of the node at the current time. Time-varying characteristics of the previous moment .Will and A concatenation operation is performed to obtain a concatenated feature vector. This concatenated feature vector is then input into a linear layer. The output of the linear layer is processed by a sigmoid activation function to obtain the forgetting coefficient. The forgetting coefficient ranges from [0,1]. A larger forgetting coefficient indicates that more historical time-varying features are retained; a smaller forgetting coefficient indicates that more historical time-varying features are erased. The formula for calculating the forgetting coefficient is:

[0038] in, The weight matrix of the linear layer. The bias vector of the linear layer. This is the Sigmoid activation function.

[0039] Based on the calculated forgetting coefficient Regarding the characteristics of historical changes Selective erasure is performed to obtain the erased historical features. ,in This represents an element-wise multiplication operation. It extracts temporary time-varying features from the current time step through the temporal convolution channel. The final time-varying feature at the current moment is obtained by weighted summation of the erased historical features. :

[0040] The time-invariant feature is updated using an exponential moving average mechanism, which smoothly accumulates historical information while responding appropriately to new information. The formula for calculating the exponential moving average update is:

[0041] in, The time-invariant feature at the current moment, This represents the time-invariant feature of the previous moment. These are the temporary time-invariant features extracted from the global pooling channel at the current time. This is the smoothing coefficient, with a value range of [0,1]. The larger the value of , the slower the time-invariant feature updates and the more historical information is retained; the smaller the value, the faster the time-invariant feature updates and the faster the response to current information.

[0042] This embodiment details the specific structure and implementation of the temporal decoupling network. It extracts time-varying and time-invariant features through parallel temporal convolutional channels and global pooling channels, respectively, and introduces orthogonal constraint loss to suppress feature redundancy. Simultaneously, a forgetting gating mechanism is introduced to dynamically update the time-varying features, eliminating interference from occasional access noise. An exponential moving average mechanism is used to smoothly update the time-invariant features, enhancing the stability of identity attribute representation.

[0043] Appendix Figure 3 In one embodiment, the process of using a relation-aware aggregation function to assign differentiated weights based on the semantic type of multiple semantic edges and to perform topological aggregation of the time-varying features and time-invariant features of neighboring nodes includes: the relation-aware aggregation function constructs an independent mapping matrix for each type of semantic edge in the multiple semantic edges, projects the feature vectors of the central node and the feature vectors of the neighboring nodes under the corresponding mapping matrix, and performs a weighted summation based on the attention coefficients corresponding to the semantic type of the multiple semantic edges to obtain the aggregated representations of the time-varying features and the aggregated representations of the time-invariant features, respectively.

[0044] Specifically, for each type of semantic edge in the heterogeneous multi-relational dynamic access graph, an independent linear mapping matrix is ​​constructed. The dimension of the linear mapping matrix is ​​determined by the dimension of the input features and the dimension of the output features, and the parameters of the mapping matrix corresponding to different semantic edges are learned independently during model training. For the center node... and its neighboring nodes If connected and The semantic type of the edge is Then the neighboring nodes Feature vectors through semantic type The corresponding mapping matrix Perform linear projection to obtain the projected feature vector. .

[0045] Computing central node With neighboring nodes Attention coefficient between Attention coefficient reflects the neighborhood nodes Through semantic edges For the central node The importance of the attention coefficient is determined by the dot product attention mechanism. First, the feature vector of the central node is mapped to the lookup vector mapping matrix. Project the vector to obtain the query vector. The feature vectors projected from the neighboring nodes are mapped to the key vector matrix. Projecting yields the key vector. The attention coefficient is obtained by normalizing the dot product of the query vector and the key vector using the Softmax function. The formula for calculating the attention coefficient is:

[0046] in, As the central node The set of all neighboring nodes It is the set of all semantic edge types.

[0047] The center node is obtained by weighting and summing the projected feature vectors of all neighboring nodes according to their corresponding attention coefficients. The aggregated feature vectors are obtained. The above aggregation process is performed independently on time-varying features and time-invariant features, respectively, resulting in two independent aggregated representations: the aggregated representation of time-varying features and the aggregated representation of time-invariant features.

[0048] Furthermore, before the weighted summation is performed by the relation-aware aggregation function, a type-aware feature alignment layer is constructed to address the differences in the feature spaces of heterogeneous nodes among multiple types of nodes. The feature vectors of different types of nodes are mapped to a common feature space of the same dimension through the linear transformation matrix corresponding to their respective node types. Then, a weighted aggregation operation based on attention coefficients is performed in the common feature space to eliminate the feature distribution offset between heterogeneous entities.

[0049] The specific implementation of the type-aware feature alignment layer is as follows: For user nodes, privacy data nodes, and terminal nodes, three independent linear transformation matrices are constructed respectively. Since the initial feature vectors of different node types have different dimensions, the corresponding linear transformation matrices map the feature vectors of all node types to a common feature space of the same dimension. The parameters of the linear transformation matrices are learned independently during model training, adaptively aligning the feature distributions of different node types to a unified space. After processing by the type-aware feature alignment layer, the feature vectors of different node types are distributed in the same feature space, eliminating feature dimension differences and distribution offsets. This allows subsequent relation-aware aggregation to be performed in a unified feature space, improving the quality of aggregated features.

[0050] To more clearly illustrate the initial feature composition and dimensions of different types of nodes, Table 2 is provided below: Table 2 Initial feature composition and dimensions of different types of nodes

[0051] This embodiment details the implementation of the relation-aware aggregation function. By constructing independent mapping matrices for different semantic edges and calculating differentiated attention coefficients, feature aggregation under different semantic relations is achieved. Simultaneously, a type-aware feature alignment layer is introduced to map the features of different types of nodes to a unified common feature space, eliminating feature distribution offsets between heterogeneous nodes and improving the discriminative power of the aggregated features.

[0052] Appendix Figure 4 In one embodiment, for the static subgraphs of adjacent time steps in the heterogeneous multi-relation dynamic access graph, newly added and disappeared interaction edges across time steps are extracted to construct a differential subgraph. The edge features in the differential subgraph are input into the edge-length short-term memory network to predict the edge distribution state of the differential subgraph at the next time step. Based on the predicted edge distribution state, the topology of the heterogeneous multi-relation dynamic access graph is pre-corrected to compensate for the topology lag caused by the access log collection delay.

[0053] Specifically, for adjacent times and Two static subgraphs and First, obtain the set of all edges in the two static subgraphs. and Calculate the difference between the edge sets to obtain the new edge set. and the set of vanishing edges The newly added edge set is included in time. Appears but at the moment All non-existent interactive edges, the set of vanishing edges is contained in time. Appears but at the moment All interaction edges that did not appear. Combine the set of newly added edges and the set of disappeared edges to construct the time step. arrive Difference molecule diagram Each edge in the difference graph contains features such as edge type, source node, target node, timestamp, operation result, and operation duration.

[0054] Continuous Difference numerator diagram at each time point The edge feature sequence is input into the edge-length short-term memory (LSTM) network. The LSTM network employs a variant of the long short-term memory (LSTM) network, specifically designed for processing edge sequence data in graph structures. The network input is the edge feature vector from each difference graph, which is constructed by concatenating various attribute codes of the edges. The LSTM network contains multiple stacked LSTM layers, with the number of hidden units in each LSTM layer determined by the complexity of the input data. The network output is the next time step. Difference molecule diagram Edge distribution state prediction, i.e., predicting which edges will be at time 1000. Which edges will be added at any time? The probability of each edge appearing or disappearing.

[0055] Based on the predicted edge distribution, the topology of the heterogeneous multi-relationship dynamic access graph at the current time is pre-corrected. For newly added edges with a predicted probability exceeding a preset threshold, these edges are added to the dynamic access graph in advance and marked as predicted edges; for disappearing edges with a predicted probability exceeding a preset threshold, these edges are marked as pending deletion in the dynamic access graph in advance. When the actual time... After the system logs are collected, the actual differential graph is generated. The actual difference graph is compared with the predicted difference graph to correct incorrectly predicted edges and update the topology of the dynamic access graph. Simultaneously, the error between the predicted and actual results is used to update the parameters of the edge-length short-term memory network, improving the accuracy of subsequent predictions.

[0056] This embodiment describes a dynamic access graph topology prediction and correction method based on differential graphs and edge-length short-term memory networks. By predicting the edge distribution state at the next time step, the topology structure of the dynamic access graph is corrected in advance, which makes up for the topology lag caused by the access log collection delay and improves the real-time performance and accuracy of abnormal access behavior detection.

[0057] Appendix Figure 5In one embodiment, during the model training phase, a joint optimization objective function is constructed, which includes temporal decoupling orthogonal constraint loss, graph structure reconstruction loss, and classification cross-entropy loss. When calculating the classification cross-entropy loss, difficult samples whose probability values ​​are in the confusion interval are dynamically selected based on the abnormal probability values ​​currently output by the model. Dynamically increased penalty weights are assigned to difficult samples, so that the joint optimization objective function focuses on the feature offset correction of difficult samples during gradient backpropagation, thereby improving the model's discriminability of boundary ambiguity access behavior.

[0058] Specifically, the joint optimization objective function consists of three parts, namely, the temporal decoupling orthogonal constraint loss. Graph structure reconstruction loss and classification cross-entropy loss The expression for the joint optimization objective function is:

[0059] in, , , These are the weighting coefficients for each loss function, used to balance the contributions of different loss functions. The values ​​of these weighting coefficients are adjusted based on the needs of the business scenario and the training performance of the model.

[0060] The graph structure reconstruction loss is used to constrain the node features learned by the graph neural network to accurately reconstruct the original graph structure. Specifically, for any two nodes... and The graph structure reconstruction loss is calculated by multiplying the dot product of the feature vectors of the nodes. The larger the dot product value, the higher the probability that there is an edge between the two nodes. The graph structure reconstruction loss is a binary cross-entropy loss between the dot product of the nodes with actual edges and the dot product of the nodes without actual edges. The graph structure reconstruction loss enables the graph neural network to learn node feature representations that reflect the graph topology.

[0061] The classification cross-entropy loss is used to measure the classification performance of a model. For each node... Its real label is , This indicates that the access behavior corresponding to this node is abnormal. This indicates that the access behavior corresponding to this node is normal. The probability that this node belongs to the abnormal category is output by the model. To improve the model's ability to discriminate against ambiguous boundary access behaviors, a dynamic weighting mechanism for difficult samples is introduced. First, a confusion interval is defined, with its upper and lower limits set based on the model's initial performance. Samples whose outlier probability values ​​fall within the confusion interval are classified as difficult samples; these are boundary samples that the model struggles to classify accurately.

[0062] For difficult samples, penalty weights are dynamically assigned based on their probability value and the distance to the midpoint of the confusion interval; the closer the sample, the greater the penalty weight. The formula for calculating the penalty weight is:

[0063] in, This is the weight adjustment coefficient, used to control the increase in the penalty weight. For non-difficult samples, the penalty weight... Applying the penalty weights to the classification cross-entropy loss for each sample yields the weighted classification cross-entropy loss:

[0064] During model training, an adaptive moment estimator optimizer is used to optimize the joint objective function. A decay mechanism is employed, with the learning rate decreasing according to a preset decay rate after a certain number of training epochs. The batch size is set based on hardware resources and dataset size. Training is stopped early when the loss function on the validation set stops decreasing for several consecutive training epochs to prevent overfitting.

[0065] To more clearly illustrate the components and weight settings of the joint optimization objective function, Table 3 is provided below: Table 3 Composition and weight settings of the joint optimization objective function

[0066] This embodiment describes the joint optimization objective function during the model training phase. By combining temporal decoupling orthogonal constraint loss, graph structure reconstruction loss, and weighted classification cross-entropy loss, multi-objective optimization of the model is achieved. A dynamic weighting mechanism for difficult samples is introduced, enabling the model to pay more attention to difficult samples with ambiguous boundaries during training, thereby improving the model's ability to detect hidden abnormal access behaviors.

[0067] Appendix Figure 6 In one embodiment, after the classifier outputs the abnormal access behavior detection result, the abnormal interaction path corresponding to the abnormal access behavior detection result is extracted, the security level label of the privacy data entity associated with the abnormal interaction path and the network location label of the access terminal entity are parsed, a dynamic access control policy containing the security level label and the network location label is generated, and the dynamic access control policy is sent to the corresponding access control execution node to intercept subsequent access requests of the same topology path.

[0068] Specifically, the process of extracting abnormal interaction paths is as follows: starting from the node identified as abnormal, trace back along the edges of the heterogeneous multi-relationship dynamic access graph. The tracing time is set according to business requirements. During the tracing process, all traversed nodes and edges are recorded, forming one or more abnormal interaction paths. The abnormal interaction path includes abnormal user nodes, abnormal terminal nodes, accessed privacy data nodes, and information such as the interaction relationships, interaction times, and interaction results between these nodes.

[0069] The system analyzes the security level tags of all privacy data entities associated with the abnormal interaction path. These security level tags are categorized based on the sensitivity of the privacy data, with different security levels corresponding to different protection requirements. The system also analyzes the network location tags of all terminal entities associated with the abnormal interaction path. These network location tags are categorized based on the network region where the terminal is located, with terminals in different network locations having different access permissions.

[0070] Based on the topological characteristics of the abnormal interaction path, the security level of the associated privacy data, and the network location of the associated terminal, a dynamic access control policy is generated. The dynamic access control policy includes fields such as a unique policy identifier, effective time, expiration time, source terminal network location range, target privacy data security level range, allowed operation types, blocked operation types, and associated abnormal event identifiers. For abnormal behaviors involving high-security-level privacy data, a strict access control policy is generated, blocking all access requests from the corresponding network location; for abnormal behaviors involving medium- to low-security-level privacy data, a relatively lenient access control policy is generated, blocking only high-risk operation types.

[0071] The generated dynamic access control policies are distributed to the corresponding access control enforcement nodes, which include network firewalls, database access control gateways, application system access control modules, and endpoint security management systems. Upon receiving the policy, the access control enforcement node immediately loads and applies it, blocking subsequent access requests that meet the policy conditions. Simultaneously, the results of abnormal access behavior detection, abnormal interaction path information, and the dynamic access control policies are recorded in the security incident management system for subsequent security auditing, incident analysis, and response handling.

[0072] To more clearly illustrate the fields and meanings of dynamic access control policies, Table 4 is provided below: Table 4. Fields and Meanings of Dynamic Access Control Policies

[0073] This embodiment describes the response and handling mechanism after abnormal access behavior is detected. By extracting abnormal interaction paths, parsing the tag information of related entities, generating targeted dynamic access control policies, and sending them to the access control execution node for real-time interception, it realizes timely response and closed-loop handling of abnormal access behavior and protects the security of privacy data.

Claims

1. A privacy data abnormal access behavior detection method based on a graph neural network, characterized in that, include: Extract user entities, privacy data entities, terminal entities and their interaction relationships from system logs, and construct a heterogeneous multi-relationship dynamic access graph containing multiple types of nodes and multiple semantic edges; A time-series decoupling network is used to decompose the node feature vectors in the heterogeneous multi-relationship dynamic access graph into time-varying features representing access habits and time-invariant features representing identity attributes; In the message passing stage of the graph neural network, a relation-aware aggregation function is used to assign differentiated weights based on the semantic type of the multi-semantic edges, and the time-varying features and time-invariant features of the neighboring nodes are topologically aggregated respectively. The aggregated time-varying features are fused with the time-invariant features and input into the classifier to output the abnormal access behavior detection results.

2. The privacy data abnormal access behavior detection method based on a graph neural network according to claim 1, characterized in that, Extracting user entities, privacy data entities, terminal entities, and their interaction relationships from system logs, and constructing a heterogeneous multi-relationship dynamic access graph containing multiple types of nodes and multiple semantic edges includes: slicing the system logs according to a set time window; generating a multi-time static subgraph based on the interaction relationships within a single time window; constructing connection edges for the same entities across time periods; and merging the multi-time static subgraphs through the connection edges to form the heterogeneous multi-relationship dynamic access graph. The multiple semantic edges include temporal predecessor and successor relationship edges representing the evolution of entities across time periods.

3. The privacy data abnormal access behavior detection method based on a graph neural network according to claim 1, characterized in that, The temporal decoupling network decomposes the node feature vectors in the heterogeneous multi-relation dynamic access graph into time-varying features representing access habits and time-invariant features representing identity attributes. The temporal decoupling network constructs parallel temporal convolution channels and global pooling channels. The temporal convolution channel extracts the dynamic change trend of the node feature vectors based on a sliding time window as the time-varying features. The global pooling channel performs max pooling on the node feature vectors within the node's lifecycle to extract static distribution attributes as the time-invariant features. An orthogonal constraint loss function is introduced to suppress feature redundancy between the time-varying features and the time-invariant features.

4. The privacy data abnormal access behavior detection method based on a graph neural network according to claim 1, characterized in that, The method of using a relation-aware aggregation function to assign differentiated weights based on the semantic type of the multi-semantic edges, and performing topological aggregation on the time-varying features and time-invariant features of the neighboring nodes respectively, includes: the relation-aware aggregation function constructing an independent mapping matrix for each type of semantic edge in the multi-semantic edges, projecting the feature vectors of the center node and the feature vectors of the neighboring nodes under the corresponding mapping matrix, and performing a weighted summation based on the attention coefficients corresponding to the semantic type of the multi-semantic edges, to obtain the aggregated representation of the time-varying features and the aggregated representation of the time-invariant features respectively.

5. The method for detecting abnormal access to privacy data based on graph neural networks according to claim 1, characterized in that, The process of fusing the aggregated time-varying features with the time-invariant features and inputting them into a classifier to output abnormal access behavior detection results includes: performing a bilinear interactive fusion operation on the aggregated representation of the aggregated time-varying features and the aggregated representation of the time-invariant features, calculating the cross product of the two types of features and concatenating them with the original aggregated representation to generate a fused feature vector, inputting the fused feature vector into the multilayer perceptron in the classifier, having the multilayer perceptron output the probability value of a node belonging to the abnormal access behavior category, and determining nodes whose probability value exceeds a preset judgment threshold as abnormal access nodes.

6. The method for detecting abnormal access to privacy data based on graph neural networks according to claim 3, characterized in that, Based on the time-varying features and time-invariant features obtained from the time-series decoupling network, a forgetting gating mechanism is introduced during the dynamic evolution process. The forgetting coefficient is calculated based on the node feature vector at the current moment and the time-varying features at the previous moment. The historically accumulated time-varying features are selectively erased and their states are updated according to the forgetting coefficient. The time-invariant features are then smoothly accumulated and updated throughout their entire lifecycle through an exponential moving average mechanism to suppress the interference of occasional access noise on the representation of identity attributes.

7. The method for detecting abnormal access to privacy data based on graph neural networks according to claim 4, characterized in that, Before the relation-aware aggregation function performs weighted summation, a type-aware feature alignment layer is constructed to address the differences in feature spaces of heterogeneous nodes among the multiple types of nodes. The feature vectors of different types of nodes are mapped to a common feature space of the same dimension through the linear transformation matrix corresponding to their respective node types. The weighted aggregation operation based on the attention coefficient is then performed in the common feature space to eliminate the feature distribution offset between heterogeneous entities.

8. The method for detecting abnormal access to privacy data based on graph neural networks according to claim 2, characterized in that, For the static subgraphs of adjacent time steps in the heterogeneous multi-relation dynamic access graph, newly added and disappeared interaction edges across time steps are extracted to construct a differential subgraph. The edge features of the differential subgraph are input into the edge-length short-term memory network to predict the edge distribution state of the differential subgraph at the next time step. Based on the predicted edge distribution state, the topology of the heterogeneous multi-relation dynamic access graph is pre-corrected to compensate for the topology lag caused by the access log collection delay.

9. The method for detecting abnormal access to privacy data based on graph neural networks according to claim 1, characterized in that, During the model training phase, a joint optimization objective function is constructed, which includes temporal decoupling orthogonal constraint loss, graph structure reconstruction loss, and classification cross-entropy loss. When calculating the classification cross-entropy loss, difficult samples with probability values ​​in the confusion interval are dynamically selected based on the abnormal probability values ​​of the current output of the model. Dynamically increased penalty weights are assigned to the difficult samples, so that the joint optimization objective function focuses on the feature offset correction of the difficult samples during gradient backpropagation, thereby improving the model's discriminative ability to detect boundary ambiguity access behavior.

10. The method for detecting abnormal access to privacy data based on graph neural networks according to claim 1, characterized in that, After the classifier outputs the abnormal access behavior detection result, the abnormal interaction path corresponding to the abnormal access behavior detection result is extracted, the security level label of the privacy data entity associated with the abnormal interaction path and the network location label of the access terminal entity are parsed, a dynamic access control policy containing the security level label and the network location label is generated, and the dynamic access control policy is sent to the corresponding access control execution node to intercept subsequent access requests of the same topology path.

Images