A real-time network anomaly information detection method and device

Abstract

The application discloses a kind of real-time network exception information detection method and device, it is related to network space safety exception detection technical field.For solving the problem that existing technology is difficult to realize the real-time, accurate detection of exception information in large-scale complex network.Input a group of time-varying propagation subgraph;Important nodes in subgraph are obtained by bidirectional breadth-first traversal strategy;Standardized dynamic node features are constructed for each traversed node;Topological features of each node are constructed;The features of all nodes under the timestamp are aggregated;Time series data under all timestamps are detected for anomalies using a gated recurrent unit, obtaining dynamic time features of abnormal information;Using a multi-head time series attention mechanism to extract the probability of any node being abnormal at different timestamps;Output the group of nodes with the highest probability, which are the predicted abnormal nodes corresponding to the nodes that published abnormal information in the social area.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security anomaly detection technology, and more specifically to a method and apparatus for real-time network anomaly information detection. Background Technology

[0002] Driven by the development of digitalization and informatization, the interactions between various entities in complex systems continuously generate massive amounts of time-series correlated data. This type of data can be efficiently modeled using Continuous-Time Dynamic Graphs (CTDGs), which abstract entities as nodes and the interactions between entities over time as dynamic edges. Dynamic graphs have been widely applied in scenarios such as social information dissemination, financial transactions, IoT communication, and biological protein interactions. They can effectively characterize system structure and evolutionary patterns and have significant application value for identifying abnormal information and ensuring network security. Currently, abnormal behaviors such as fake accounts spreading rumors and malicious defamation spread rapidly and have a wide impact, easily causing economic losses and social disorder. Therefore, real-time and accurate detection of abnormal information in dynamic networks has become an urgent need.

[0003] Current dynamic graph anomaly detection relies on Graph Neural Networks (GNNs) as its core, employing mostly unsupervised or semi-supervised learning methods. It primarily depends on node, edge, and graph structure features to identify anomalous samples. Existing methods attempt to improve the efficiency of capturing dynamic information through incremental computation to alleviate the problem of high model update overhead; simultaneously, they reduce dependence on labeled data through semi-supervised / unsupervised training, adapting to sparse anomaly sample scenarios. However, existing techniques have significant shortcomings: first, they struggle to efficiently capture dynamic changes in the network, and incremental update schemes have poor generality, resulting in poor detection performance in complex networks; second, they still have a strong dependence on labeled data, and semi-supervised / unsupervised methods lack stability; third, they cannot effectively focus on sparse anomaly information, and simple data processing methods easily lose key anomaly samples, making them difficult to adapt to dynamic propagation scenarios.

[0004] In summary, existing dynamic graph anomaly detection methods cannot simultaneously achieve efficient dynamic information capture, low labeling dependence, and the ability to mine anomalies from a small number of samples, making it difficult to achieve real-time and accurate detection of anomalies in large-scale complex networks. Summary of the Invention

[0005] This invention provides a real-time network anomaly detection method and apparatus to address the problem that existing dynamic graph anomaly detection methods cannot simultaneously achieve real-time and accurate detection of anomalies in large-scale complex networks due to their inability to balance dynamic information capture efficiency, low labeling dependence, and small sample anomaly mining capabilities.

[0006] This invention provides a real-time network anomaly detection method, comprising:

[0007] Based on the multi-timestamp propagation graph snapshot sequence, determine the initial propagation graph snapshot, initial node set, initial edge relationship, and initial node state;

[0008] Based on the initial node state, the nodes marked as abnormal are determined as the initial center node. Starting from the initial center node, the system traverses both the historical time direction and the future time direction simultaneously. From the large-scale dynamic propagation graph, the set of associated abnormal nodes, the set of associated abnormal edges, and the state of associated abnormal nodes are determined to form an abnormal association subgraph.

[0009] Determine the initial dynamic feature vector corresponding to each timestamp for each abnormal node in the set of associated abnormal nodes; concatenate the unified dynamic feature vector determined based on the initial dynamic feature vector with the time encoding vector to obtain the standardized dynamic node feature with temporal memory;

[0010] Obtain the historical neighbor set corresponding to the historical time from the abnormal association subgraph. Based on the historical neighbor set and the abnormal association subgraph, determine multiple static topological attributes corresponding to each abnormal node. Obtain the static topological feature matrix according to the number of points of the abnormal node and the dimension of the multiple static topological attributes.

[0011] Based on the standardized dynamic node features and the static topological feature matrix, a unique aggregate feature for the same abnormal node is obtained; the unique aggregate feature is then used to perform time-series modeling on the gated loop unit to obtain the dynamic temporal evolution feature of the abnormal node.

[0012] The dynamic time evolution feature, the standardized dynamic node feature, and the time encoding vector are concatenated to obtain the attention feature; the attention feature, the unique aggregation feature, and the initial dynamic feature vector are concatenated, and the final anomaly probability of each anomaly node is obtained through a multilayer perceptron; the anomaly node with the highest anomaly probability is determined as the optimal anomaly detection result.

[0013] This invention provides a real-time network anomaly detection device, comprising:

[0014] The initial unit is used to determine the initial propagation graph snapshot, initial node set, initial edge relationship, and initial node state based on the multi-timestamp propagation graph snapshot sequence.

[0015] The forming unit is used to determine the marked abnormal nodes as the initial center nodes according to the initial node state, and to traverse from the initial center nodes in both the historical time direction and the future time direction to determine the set of associated abnormal nodes, the set of associated abnormal edges, and the state of associated abnormal nodes from the large-scale dynamic propagation graph, thereby forming an abnormal association subgraph.

[0016] The first obtaining unit is used to determine the initial dynamic feature vector corresponding to each time stamp of each abnormal node in the set of associated abnormal nodes; and to concatenate the unified dynamic feature vector determined based on the initial dynamic feature vector with the time encoding vector to obtain the standardized dynamic node feature with time sequence memory.

[0017] The second obtaining unit is used to obtain a set of historical neighbors corresponding to historical time from the abnormal association subgraph, determine multiple static topological attributes corresponding to each abnormal node based on the set of historical neighbors and the abnormal association subgraph, and obtain a static topological feature matrix according to the number of points of the abnormal node and the dimension of the multiple static topological attributes.

[0018] The third obtaining unit is used to obtain the unique aggregated features of the same abnormal node based on the standardized dynamic node features and the static topological feature matrix; and to obtain the dynamic temporal evolution features of the abnormal node by performing time-series modeling on the unique aggregated features through the gated loop unit.

[0019] The determining unit is used to concatenate the dynamic time evolution features, standardized dynamic node features, and time encoding vector to obtain attention features; concatenate the attention features, the unique aggregation features, and the initial dynamic feature vector, and obtain the final anomaly probability of each anomaly node through a multilayer perceptron; and determine the anomaly node with the highest anomaly probability as the optimal anomaly detection result.

[0020] This invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform any of the above-described methods for detecting real-time network anomalies.

[0021] This invention provides a computer device, which includes a memory and a processor. The memory stores a computer program, and when the computer program is executed by the processor, the processor performs a real-time network anomaly detection method as described above.

[0022] This invention provides a method and apparatus for real-time network anomaly detection. The scheme employs a bidirectional breadth-first search strategy, traversing both historical and future time directions with marked anomaly nodes as the center. This accurately prunes the anomaly-related subgraphs, significantly eliminating irrelevant node noise in large-scale dynamic propagation graphs and focusing on the core links of anomaly propagation. This scheme is suitable for scenarios with few samples, enabling early and accurate location of optimal anomaly detection results and reducing the adverse effects of anomaly information in social networks. Furthermore, this scheme does not rely on global anomaly data; the detection process can be initiated with only a small number of marked anomaly nodes, eliminating the need for large-scale global data collection, reducing data acquisition costs, and solving the problem of excessive reliance on global data in traditional schemes. This scheme builds a dynamic memory mechanism through a temporal update function, extracting temporal features using time-encoded vectors to achieve real-time feature updates. By relying on spatiotemporal graph traversal to reduce data processing volume and combining incremental learning with a memory bank, it can adapt to dynamic network changes without requiring full retraining of the model, ensuring real-time anomaly detection based on the latest data. This invention integrates standardized dynamic node features and static topological features, taking into account both the dynamic behavior patterns of nodes and network structural attributes, thus overcoming the shortcomings of single features. Through mean aggregation, Gated Recurrent Unit (GRU) temporal modeling, and multi-head temporal attention mechanisms, it strengthens feature correlations and enhances the model's ability to withstand temporal noise, enabling stable detection performance even in large-scale complex networks. This invention solves the problem that existing dynamic graph anomaly detection methods cannot simultaneously achieve efficient dynamic information capture, low annotation dependency, and the ability to mine anomalies from small samples, thus hindering real-time and accurate anomaly detection in large-scale complex networks. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a schematic flowchart of a real-time network anomaly detection method provided by an embodiment of the present invention;

[0025] Figure 2 A schematic diagram illustrating the spatiotemporal graph traversal method provided in an embodiment of the present invention;

[0026] Figure 3 This is a complete diagram illustrating the memory calculation based on spatiotemporal graph traversal provided in an embodiment of the present invention.

[0027] Figure 4This is a schematic diagram illustrating the output of anomaly detection results provided in an embodiment of the present invention;

[0028] Figure 5 This is a schematic diagram comparing the number of events after spatiotemporal graph traversal processing with the original data in real networks such as Wikipedia and Reddit, as provided in an embodiment of the present invention.

[0029] Figure 6 This diagram illustrates the performance comparison between the detection methods of this invention and other methods in a few-shot scenario using real networks like Wikipedia and MOOC, as provided in this embodiment of the invention.

[0030] Figure 7 This is a schematic diagram of a real-time network anomaly detection device provided in an embodiment of the present invention. Detailed Implementation

[0031] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0032] Figure 1 This is a schematic flowchart of a real-time network anomaly detection method provided by an embodiment of the present invention; the following is a... Figure 1 Taking an example, this invention provides a detailed description of a real-time network anomaly detection method. Figure 1 As shown, the method includes the following steps:

[0033] Step 101: Determine the initial propagation graph snapshot, initial node set, initial edge relationship, and initial node state based on the multi-timestamp propagation graph snapshot sequence;

[0034] Step 102: Based on the initial node state, determine the marked abnormal nodes as the initial center nodes. Starting from the initial center nodes, traverse both the historical time direction and the future time direction simultaneously to determine the set of associated abnormal nodes, the set of associated abnormal edges, and the state of associated abnormal nodes from the large-scale dynamic propagation graph, forming an abnormal association subgraph.

[0035] Step 103: Determine the initial dynamic feature vector corresponding to each timestamp for each abnormal node in the set of associated abnormal nodes; concatenate the unified dynamic feature vector determined based on the initial dynamic feature vector with the time encoding vector to obtain the standardized dynamic node feature with time sequence memory.

[0036] Step 104: Obtain the set of historical neighbors corresponding to historical time from the abnormal association subgraph; based on the set of historical neighbors and the abnormal association subgraph, determine multiple static topological attributes corresponding to each abnormal node; and obtain the static topological feature matrix according to the number of points of the abnormal node and the dimension of the multiple static topological attributes.

[0037] Step 105: Based on the standardized dynamic node features and the static topological feature matrix, obtain the unique aggregated features of the same abnormal node; perform time-series modeling on the unique aggregated features through a gated loop unit to obtain the dynamic temporal evolution features of the abnormal node;

[0038] Step 106: Concatenate the dynamic time evolution features, standardized dynamic node features, and time encoding vector to obtain attention features; concatenate the attention features, the unique aggregation features, and the initial dynamic feature vector, and obtain the final anomaly probability of each anomaly node through a multilayer perceptron; determine the anomaly node with the highest anomaly probability as the optimal anomaly detection result.

[0039] The present invention provides a real-time network anomaly detection method, the execution subject of which is a server, which can also be called a network anomaly detection server in this scheme. The server has a built-in spatiotemporal graph processing module, feature extraction module, temporal modeling module and attention discrimination module, and automatically completes the entire process of operation from network snapshot input to anomaly information release and location.

[0040] In step 101, based on the input multi-timestamp propagation graph snapshot sequence from the target region, four types of parameters are determined: initial propagation graph snapshot, initial node set, initial edge relationship, and initial node state.

[0041] It should be noted that the multi-timestamp propagation graph snapshot sequence here is a static network data set collected at fixed time intervals from a continuous spatiotemporal propagation network, with each timestamp corresponding to an independent propagation graph snapshot.

[0042] In this embodiment of the invention, each timestamp corresponds to an initial propagation graph snapshot, which can be represented by the following formula:

[0043] (1)

[0044] in, Indicates the first A snapshot of the initial propagation graph with timestamps. Represents the initial set of nodes in the target region. Represents the initial set of edge relationships. Indicates the first A set of initial node states with timestamps.

[0045] Furthermore, the initial node state can be represented by the following formula:

[0046] (2)

[0047] in, Represents a node In the The initial node state is represented by a timestamp, where 1 indicates that the node is in an abnormal state, meaning that abnormal information has been received / propagated; and 0 indicates that the node is in a normal state, meaning that abnormal information has not been received / propagated. Indicates the first In this embodiment, the initial node corresponds to the first node in the target region. Each node.

[0048] In practical applications, multiple timestamp snapshots are stitched and merged in chronological order to form a continuous spatiotemporal propagation network. This network integrates all timestamps, initial nodes, initial edge relationships, and initial node states to completely reconstruct the entire process of anomaly information from its generation to its traversal in future time directions. At the same time, the initial node states can accurately locate initial anomaly clues, avoiding subsequent detection without a clear direction, reducing detection blindness, and improving the operability of detection.

[0049] In step 102, the multi-timestamp propagation graph snapshot sequence is spliced ​​and merged in chronological order to form a large-scale dynamic propagation graph. This network integrates all timestamps, initial propagation graph snapshots, initial node sets, initial edge relationships, and initial node states.

[0050] Then proceed in sequence: determine the initial center node, divide the historical time and future time, traverse the historical time direction and the future time direction simultaneously, and obtain the abnormal correlation subgraph.

[0051] Specifically, when determining the initial center node, the nodes marked as abnormal are prioritized as the initial center node based on the initial node status. If no nodes are marked as abnormal based on the initial node status, the nodes with a degree lower than the average degree in the current snapshot are selected as the initial center node. Then, the initial center node is added to the visited set to avoid repeated traversal, and is also added to the queue to be traversed as the starting point.

[0052] It should be noted that in a social network graph, the degree of a node represents the number of other nodes that node directly connects to, i.e., the number of edges; The degree can be expressed as: and The number of directly connected edges. Correspondingly, the average degree represents the average of all nodes included in the initial propagation graph snapshot.

[0053] Furthermore, based on the timestamp of the initial central node, the continuous spatiotemporal propagation network is divided into two parts: the time with timestamps earlier than the reference time is the historical time, and the time with timestamps later than the reference time is the future time; the historical time and the future time correspond to the historical time direction and the future time direction of the propagation of abnormal information, respectively.

[0054] A breadth-first traversal is performed simultaneously from the initial center node in both the historical and future time directions. The traversal logic is the same in both directions, only the timestamp range differs. In the historical time direction, directly connected neighbor nodes with timestamps less than the base time are selected, while in the future time direction, directly connected neighbor nodes with timestamps greater than the base time are selected. During the traversal, only neighbor nodes directly connected to the initial center node are visited, and only unvisited nodes are added to the visited set and the traversal queue. A maximum traversal limit is set to prevent infinite expansion. The traversal terminates when the maximum traversal limit is reached or no new nodes are available for visit.

[0055] After traversal, collect all visited nodes to form a set of associated abnormal nodes; extract the corresponding connecting edges to obtain a set of associated abnormal edges; extract the node states to obtain the states of associated abnormal nodes; and then, based on the above set of associated abnormal nodes, set of associated abnormal edges, and states of associated abnormal nodes, form an abnormal association subgraph.

[0056] Among them, the set of associated abnormal nodes refers to all nodes that are directly or indirectly related to the propagation of abnormal information, obtained by bidirectional breadth-first traversal with the initial central node as the core; the set of associated abnormal edges refers to all edge relationships between associated abnormal nodes that carry the propagation of abnormal information, used to characterize the connection relationship and state between associated abnormal nodes; the state of associated abnormal nodes is used to characterize the state of each abnormal node in the set of associated abnormal nodes at the corresponding timestamp, that is, whether each associated abnormal node propagates abnormal information at the corresponding timestamp.

[0057] In this embodiment of the invention, the abnormal correlation subgraph is determined by the following formula:

[0058] (3)

[0059] in, This represents the abnormal association subgraph obtained through a bidirectional breadth-first search strategy. Represents a set of associated abnormal nodes. Represents the set of associated abnormal edges. Indicates the first Each timestamp is associated with the status of an abnormal node.

[0060] In this embodiment of the invention, the propagation graph snapshot sequence is a sequence obtained by dividing the entire dynamic propagation process into time segments and sampling at each moment. The dynamic propagation process is a continuous spatiotemporal propagation network, and each propagation graph snapshot is a subgraph of the spatiotemporal propagation network at a certain moment.

[0061] The proposed method, guided by the initial central node of the anomalous node, employs a traversal strategy along both historical and future time directions. Compared to traditional single-direction traversal, it can completely capture the entire "historical-future" propagation link of the anomalous node, identifying both the source and the future propagation path, thus avoiding omissions of associated anomalous nodes. The resulting anomalous association subgraph eliminates irrelevant node noise from large-scale dynamic propagation graphs, significantly reducing subsequent feature computation and improving detection efficiency. Furthermore, it clarifies the three key elements of the anomalous association subgraph, providing a precise range for subsequent feature extraction, avoiding global traversal of large-scale networks, and addressing the low detection efficiency of existing technologies in large-scale networks.

[0062] In step 103, taking the abnormal association subgraph obtained in the above steps as the object, a memory vector that is dynamically updated over time is constructed for each abnormal node included in the set of associated abnormal nodes.

[0063] First, for the set of anomalous nodes, the initial dynamic feature vectors of each anomalous node at different timestamps are iteratively updated based on the time-series update function. The initial dynamic feature vectors of each anomalous node at different timestamps are represented by the following formula:

[0064] (4)

[0065] in, Indicates the time stamp of the abnormal node The initial dynamic feature vector, Indicates the time stamp of the abnormal node The initial dynamic feature vector, This represents a time-series update function used to update the initial dynamic feature vectors of abnormal nodes at different timestamps. Represents a timestamp.

[0066] In this embodiment of the invention, the abnormal node set is a global concept, which is a set of all nodes marked as abnormal in the graph obtained by global filtering based on the initial node state for a single initial propagation graph snapshot; the associated abnormal node set is a local subset, which is a set obtained by taking the initial center node marked as abnormal as the starting point and simultaneously traversing in both historical and future time directions, retaining only the nodes that have direct / indirect abnormal propagation links with the initial center node, and summarizing them. The associated abnormal node set is a subset of the abnormal node set.

[0067] Furthermore, by performing linear transformations and activation function mappings on the initial dynamic feature vectors using a multilayer perceptron (MLP), the initial dynamic features of different dimensions are unified into the same dimensional space, resulting in a unified dynamic feature vector with uniform dimensions, as shown below:

[0068] (5)

[0069] in, This represents a unified dynamic feature vector, which can eliminate differences in feature dimensions and ensure compatibility for subsequent feature fusion. This represents a multilayer perceptron, used to perform linear transformations and activations on initial dynamic feature vectors to achieve dimensionality unification. This represents the initial dynamic feature vector.

[0070] Simultaneously, cosine coding is performed on the timestamps corresponding to each abnormal node to transform discrete timestamps into continuous time-series vectors, thereby enhancing the semantics of temporal location. The cosine coding formula is shown below:

[0071] (6)

[0072] in, Represents timestamp The corresponding time-coded vector, Represents a timestamp. (dimension) represents the dimension of the time-encoded output. A cosine function is used to capture the temporal sequence and interval relationships, resulting in higher similarity between encoded vectors of similar timestamps. Represents the cosine function. Represents the natural logarithm. This represents the outer product of matrices.

[0073] Furthermore, the unified dynamic feature vector and the time encoding vector are concatenated according to their dimensions, and the dynamic behavior memory of nodes and temporal position information are integrated to obtain standardized dynamic node features with temporal memory.

[0074] This step employs a temporal update function to update the initial dynamic features step-by-step from the zero vector, preserving the temporal memory of the abnormal node features and capturing the dynamic evolution of the abnormal node state. This addresses the limitation of traditional static features in failing to reflect the temporal changes of abnormal nodes. A multilayer perceptron is used to unify the dynamic feature dimensions, ensuring consistency across all abnormal node features and preventing differences in feature dimensions from affecting subsequent aggregation and modeling. Finally, time cosine coding is combined to integrate time information into the dynamic features, with unified coding for the same timestamp, ensuring the consistency and accuracy of temporal information and improving the comprehensiveness of feature representation.

[0075] In step 104, since the anomalous association subgraph includes a set of associated anomalous nodes, edges whose two ends both exist within the historical time frame are selected from the associated anomalous node set based on historical time, resulting in a set of historically valid edges. Then, for each anomalous node, only nodes directly connected to the anomalous node are selected from the historically valid edges, forming a set of historical neighbors for the anomalous node. Based on the above method, connections not formed in future time can be excluded, ensuring that topological features are based only on historically stable connections, while limiting the neighbor range to historically stable social relationships.

[0076] Furthermore, based on the historical neighbor set and the anomaly association subgraph, multiple static topological attributes are extracted for each anomaly node. These attributes cover both connectivity (number of historical neighbors, number of forward / backward edges) and network location (network centrality, distance to the anomaly core node), comprehensively characterizing the node's static structural features. Further, following the format of the number of anomaly nodes and the dimensions of the static topological attributes, the static topological attributes of all anomaly nodes are arranged sequentially to form a dimensionally regular static topological feature matrix.

[0077] In this step, by limiting the determination of the historical neighbor set based on historical time, interference from dynamic connections in the future time is avoided, ensuring the stability of static features; it can supplement the network structure information missing in dynamic features and improve feature integrity; stable historical topology features enhance the model's ability to resist temporal noise and improve the robustness of anomaly identification.

[0078] In order to eliminate the redundancy between standardized dynamic node features and static topology features under the same abnormal node and the same timestamp, in step 105, multiple features are first merged into a unique aggregate feature for the same abnormal node.

[0079] Specifically, based on the standardized dynamic node features and topological feature matrix with temporal memory, the nodes are grouped according to the same anomalous node and the same timestamp to obtain all dynamic features and all static topological features of the same anomalous node at the same timestamp. Then, the dynamic features and static topological features of the same node and the same timestamp are aggregated by mean, and multiple feature information is merged to obtain the unique aggregated feature of the same anomalous node. The mean aggregation is determined by the following formula:

[0080] (7)

[0081] in, This indicates a unique aggregate feature for the same abnormal node. This represents the total number of features at the same node and with the same timestamp. Indicates the first Dynamic features or topological features.

[0082] Furthermore, the unique aggregated features of the same anomalous node are obtained through the above steps. These features are arranged along the time dimension without temporal correlation or temporal dependency modeling. To capture the long-term dependency relationship and temporal evolution law of the unique aggregated features of the same anomalous node over time, the unique aggregated feature sequence of each anomalous node is input into a gated recurrent unit. Through the gated recurrent unit, the aggregated features of all timestamps of the same anomalous node are strung together into a time series for temporal modeling, learning temporal dependencies, capturing dynamic evolution laws, and outputting a temporal enhanced feature that integrates all historical information, i.e., the dynamic temporal evolution feature of the anomalous node.

[0083] The dynamic time evolution characteristics are determined by the following formula:

[0084] (8)

[0085] in, It represents the dynamic time evolution characteristics, the time-series enhancement characteristics of the gated loop unit output, and captures the evolution law of nodes over time; This represents a gated recurrent unit, used for temporal modeling of unique aggregated features and learning the temporal dependencies between nodes. This indicates a unique aggregated feature for the same abnormal node.

[0086] This step aggregates dynamic and static features according to the principle of the same abnormal node and the same timestamp. Through dimensional adaptation and mean aggregation, a unique aggregated feature is generated, which solves the problem that dynamic and static features exist independently and cannot work together, thus achieving efficient feature fusion. A gated recurrent unit is used to perform temporal modeling on the aggregated feature sequence to capture the temporal evolution law of node features, further strengthening the temporal correlation and improving the accuracy of anomaly detection. The memory and forgetting mechanism of the gated recurrent unit can automatically filter effective features, eliminate redundant information, reduce noise interference, and adapt to the anomaly detection requirements of complex dynamic networks.

[0087] In step 106, the dynamic temporal evolution features, standardized dynamic node features, and temporal encoding vectors of the abnormal nodes are concatenated to construct the query matrix, key matrix, and value matrix in sequence, thereby obtaining the attention features.

[0088] Specifically, the query matrix, key matrix, value matrix, and attention features are determined using the following formula:

[0089] (9)

[0090] (10)

[0091] (11)

[0092] in, Represents the attention query matrix. This represents a multilayer perceptron, used for dimensionality transformation and feature extraction of concatenated features. Indicates dynamic time evolution characteristics. This represents a matrix concatenation symbol used to concatenate dynamic temporal evolution features with a temporal encoding vector. Represents the time-coded vector. (Result, output features) represents the attention features. (Softmax Function, Normalized Exponential Function) represents the normalized exponential function used to normalize attention weights, resulting in a probability distribution ranging from 0% to 100%. This represents the transpose of the key matrix. Represents the dimension of the key matrix. This represents the attention value matrix.

[0093] Furthermore, the attention features, the unique aggregated features of the same anomalous node, and the initial dynamic feature vector are concatenated to obtain a comprehensive feature set. The comprehensive feature set is then used to obtain the final anomalous probability of each anomalous node through a multilayer perceptron, which is the final anomalous probability vector corresponding to each of all anomalous nodes, as shown below:

[0094] (12)

[0095] in, Indicates the final anomaly probability. Represents the normalized exponential function, This represents a multilayer perceptron. Indicating attentional characteristics, This symbol represents a matrix concatenation symbol used to concatenate attention features, unique aggregation features, and the initial dynamic feature vector. Indicates a unique aggregation feature. This represents the initial dynamic feature vector.

[0096] Furthermore, by maximizing the function of the final anomaly probability, the anomaly node with the highest anomaly probability is determined as the optimal anomaly detection result, i.e., the network anomaly information publishing node in this example, as shown below:

[0097] (13)

[0098] in, This represents the optimal anomaly detection result obtained after filtering by maximum value. Indicates an abnormal node. This represents a function that takes the maximum value and is used to filter out the nodes with the highest probability of being anomalies. Represents a set of abnormal nodes. Indicates abnormal nodes The corresponding final anomaly probability.

[0099] This step constructs the query matrix (Q), the key matrix (K), and the value matrix (Q). This method integrates temporal features, initial dynamic features, and time-encoded vectors from a gated recurrent unit. A multi-head temporal attention mechanism captures the temporal correlation weights between nodes, addressing the problem that traditional attention mechanisms focus only on a single feature and fail to reflect temporal evolutionary relationships, thus improving feature correlation. Multi-dimensional feature concatenation, combined with a multilayer perceptron and attention features, calculates the final anomaly probability, ensuring the comprehensiveness and accuracy of probability calculation. By setting thresholds to filter nodes, the source of anomaly information is clearly identified, achieving precision in the historical time direction of anomalies. This allows for rapid identification of the publisher of anomaly information, minimizing the impact of its spread and addressing the pain point of existing technologies' difficulty in accurately locating the source of anomalies.

[0100] To explain the present invention more clearly, the method will be further explained and illustrated below with specific data.

[0101] Step 201, input the multi-timestamp propagation graph snapshot sequence, which includes 4 timestamps, in chronological order as follows: The four timestamps correspond to four initial propagation graph snapshots, as follows:

[0102] Initial node initial edge Initial node state .

[0103] Initial node initial edge Initial node state: .

[0104] Initial node initial edge Initial node state: .

[0105] Initial node initial edge Initial node state: .

[0106] Step 202: The four timestamp propagation graph snapshots are stitched and merged in chronological order to obtain a continuous spatiotemporal propagation network, which includes 7 nodes: ; 6 sides: ; bind the timestamp of each node's occurrence ( correspond ; correspond ; correspond ; correspond ; correspond ; correspond ; correspond (and retain the state of each node at the corresponding timestamp).

[0107] Based on the initial node status output in step 201, filter out nodes marked as abnormal (status = 1) and determine the initial center node. .

[0108] Starting with the initial center node timestamp Based on this, the continuous spatiotemporal propagation network is divided into two time regions:

[0109] The historical timeline is as follows: (Right now This region contains only a snapshot of the initial propagation graph. The initial nodes and initial edges.

[0110] The future time is: (Right now This region contains only a snapshot of the initial propagation graph. , The initial nodes and initial edges.

[0111] From the initial central node Starting from the beginning, we traverse both the historical and future time directions. The traversal rules are as follows: first find directly connected nodes, then filter by timestamp, and do not traverse repeatedly. The specific process is as follows:

[0112] Initialization: Visited collection (Initial center node), traverse the queue traversal counter (The maximum number of traversals is 150, which is far from being reached in this embodiment).

[0113] Round 1 traversal ( ): Retrieve from the traversal queue .

[0114] Historical direction ( ):try to find Directly connected nodes, only , Not visited, add to visited collection And traversing the queue.

[0115] Future direction ( ):try to find The directly connected nodes are , None of them have been visited, so they have been added to the visited set. And traversing the queue.

[0116] renew: traverse the queue , .

[0117] Second round of traversal ( ): Retrieve from the queue Historical direction No nodes, no processing; future direction :try to find The directly connected nodes are (Visited) , Unvisited, add to visited collection And traversing the queue.

[0118] renew: traverse the queue , .

[0119] Multiple rounds of traversal are performed according to the traversal queue order. All directly connected nodes have been visited, no new nodes are added, and the queue gradually becomes empty. When the queue is empty, count=7 (the maximum number of times 150 has not been reached), and the traversal terminates.

[0120] After the traversal terminates, collect all visited nodes to form a set of associated abnormal nodes; extract the corresponding connecting edges to obtain a set of associated abnormal edges; extract the node states to obtain the states of associated abnormal nodes, thus obtaining the abnormal association subgraph. The details are as follows:

[0121] Related abnormal node set : (7 nodes in total, no irrelevant nodes). Set of edges related to anomalies. Both ends of the filter are in The edges in, i.e. (6 edges in total). Status of associated abnormal nodes. (Node-Timestamp-Status Correspondence): ; ; ; ; ; ; .

[0122] Step 203, using a time-series update function, from Starting with the zero vector, update the initial dynamic feature vector of each anomalous node in each set of anomalous nodes at the corresponding timestamp each time step:

[0123] by For example, The corresponding timestamps are respectively and ( ): ; ; .

[0124] Furthermore, The initial dynamic feature vectors corresponding to the timestamps are as follows:

[0125] Initial dynamic feature vectors for each timestamp: ; .

[0126] Initial dynamic feature vectors for each timestamp: ; ; .

[0127] Initial dynamic feature vectors for each timestamp: ; .

[0128] Initial dynamic feature vectors for each timestamp: ; ; .

[0129] Initial dynamic feature vectors for each timestamp: ; .

[0130] Initial dynamic feature vectors for each timestamp: ; .

[0131] Furthermore, the initial dynamic feature vector of each node is input into the multilayer perceptron and mapped to the same dimension through linear transformation and ReLU activation function. The result after unifying the dimensions of each node is as follows:

[0132] : ; .

[0133] : ; .

[0134] : ; .

[0135] : .

[0136] : ; .

[0137] : .

[0138] : .

[0139] Furthermore, using a simplified time cosine encoding formula (adapted for Word display) from the uploaded file, the timestamp corresponding to each abnormal node is encoded to generate a 2D time encoding vector. The core calculation process and results are as follows (retaining two decimal places for simplified calculation):

[0140] : .

[0141] : .

[0142] : .

[0143] : .

[0144] Note: The time-encoding vectors corresponding to the same timestamp are completely identical (e.g., all nodes are at the same timestamp). The encodings are all This ensures the consistency of time information.

[0145] Furthermore, the dynamic feature vector after unifying the dimensions of each node ( ) and the corresponding timestamp's time-coded vector ( By concatenating the columns, we obtain standardized dynamic node features with temporal memory (the concatenated dimension is 2×3). The specific concatenation process and results for each node are as follows:

[0146] hour, ; hour, The splicing results of the remaining nodes are omitted.

[0147] In this embodiment of the invention, dynamic features are used to record node behavior characteristics (such as abnormal contact and information propagation intensity), and time-encoding vectors are used to mark the temporal position of node behavior (such as the time when abnormal contact occurs). The two complement each other. If behavioral features are missing, the content of node behavior cannot be determined; if temporal information is missing, the order of behavior cannot be distinguished, and the propagation temporal pattern cannot be captured. After the two types of features are concatenated, a complete node feature expression can be formed.

[0148] By combining the behavioral characteristics and temporal information of the aforementioned fusion nodes, complete and standardized dynamic node features can be generated, ensuring that the features of each node at each timestamp include both dynamic behavioral memory and temporal location information.

[0149] Step 204, using the initial center node timestamp Based on this, only valid edges within the historical time t≤2 are retained (i.e., social connections before and during the occurrence of anomalous propagation, excluding edges formed by future propagation). The filtering result is: Ehistory = (There are 2 edges in total).

[0150] Based on the filtered historical valid edges E Find the directly connected nodes of each abnormal node within a historical time period to form a historical neighbor set. The details are as follows:

[0151] Historical neighbors are ,Right now ; Historical neighbors are ,Right now ; There are no directly connected edges within the historical time period t≤2, i.e. ; Historical neighbors are ,Right now .

[0152] Furthermore, based on the historical neighbor set of each node and historical effective border Historically, five static topological attributes were extracted (covering node social breadth, connection role, coreity, and distance from the source of the anomaly). The specific attributes and definitions are as follows:

[0153] Historical Neighbor Count (Social Breadth): The total number of direct neighbors of a node within a historical period (e.g., ...). The number of historical neighbors is 2).

[0154] Historical positive edge count (active connection): The number of historical valid edges where a node is the initiator (e.g., Initiate (The number of positive edges is 2).

[0155] Historical reverse edge count (passive connection): The number of historical valid edges where a node acts as the receiver (e.g., take over (The number of reverse edges is 1).

[0156] Network centrality (whether a node is a core node): The degree to which a node is core within the subgraph formed by historical valid edges. Values ​​range from 0 to 1; higher values ​​indicate that the node is closer to the network core (e.g., ...). It is the source of the anomaly, with a centrality of 0.9.

[0157] distance Distance (distance from the source of the anomaly): Node relative to the initial center node The score corresponding to the shortest path distance ranges from 0 to 1, with smaller scores for closer distances (e.g., ...). distance Recently, the score was 0.3.

[0158] Based on 7 abnormal nodes ( A 7×5 static topological feature matrix is ​​constructed using 5 static topological attributes and 5 static topological attributes. (Adapted for Word display, with semicolons for line breaks and spaces for column breaks), the specific matrix is ​​as follows (correcting missing items in the original matrix to ensure each node corresponds to 5 attributes): All values ​​in the matrix are calculated based on historical edges and neighbor sets, and the calculation process is reproducible.

[0159] Step 205: Based on the principle of the same anomalous node and the same timestamp, collect all dynamic features and all static topological features of the same anomalous node at the same timestamp, and then perform mean aggregation on the two types of features. For example, the complete process is as follows:

[0160] Aggregation characteristics: Standardized dynamic characteristics (2×3 matrix), static topological features are , The corresponding row vector is [ (1×5 vector), first perform mean dimensionality reduction on the dynamic features (reduce the dimensionality of the 2×3 matrix to a 1×3 vector). Then, pad the static feature vector to a 1×3 vector. (Adapting to dynamic feature dimensions) yields two feature sets of the same dimension.

[0161] Aggregation parameters: Characteristic number of parts (One copy of dynamic features, one copy of topological features).

[0162] Mean aggregation calculation: Substituting the numerical values, we get .

[0163] Other node aggregation: Following the same rules, the dynamic and topological features of each anomalous node at the corresponding timestamp are aggregated by mean to obtain the unique aggregated features of each anomalous node at each timestamp (e.g., of ).

[0164] Dynamic features and static topological features have different dimensions and types. If they are not aggregated, it will cause feature confusion in subsequent time series modeling. The above method can ensure that the same abnormal node and a timestamp correspond to a unique feature representation. At the same time, dynamic behavioral features and static topological features are integrated to form more comprehensive node features.

[0165] Step 206: Arrange the unique aggregated features of all timestamps of each abnormal node in chronological order to form the aggregated feature sequence of that node. Then, input the sequence into a gated recurrent unit. Through the memory and forgetting mechanism of the gated recurrent unit, capture the temporal evolution pattern of the node features and output dynamic temporal evolution features. Specifically For example: Aggregated feature sequence: in chronological order , (based on (The dynamic features and topological features are aggregated to obtain the result).

[0166] Gated Loop Unit Modeling and Calculation: The above sequence is input into the gated loop unit, processed by the gating mechanism, and then output. Dynamic temporal evolution characteristics .

[0167] Modeling other nodes: Following the same rules, the aggregated feature sequence of each node is input into the gated recurrent unit to obtain their respective dynamic time evolution features.

[0168] The aggregated features generated by the above steps are single-moment snapshot features, which can only reflect the overall state of a node at a certain moment. However, anomaly propagation is a long-term dependent process across time (from the source of the anomaly). Start, gradually move towards As nodes proliferate, a propagation chain of "source → secondary node → terminal node" is formed. Ordinary models cannot capture this long-term temporal dependency, while gated recurrent units (GRUs) possess long-term memory capabilities, remembering the characteristics of nodes at early timestamps and passing them to subsequent timestamps; through forget gates and update gates, they automatically capture the temporal evolution patterns of node features (such as...). abnormal features from arrive (Changes), filtering out irrelevant instantaneous features; focusing on the core path of abnormal propagation, strengthening the features of source nodes and key propagation nodes, and suppressing noise from irrelevant terminal nodes.

[0169] The modeling of node features reveals long-term temporal propagation patterns, upgrading single-moment aggregated features into temporally enhanced features with historical memory. This captures the behavioral evolution of nodes throughout the anomaly propagation process, providing temporally enhanced feature support for subsequent attention mechanisms and anomaly probability calculations.

[0170] Step 207, based on the timing characteristics of the gated loop unit obtained in the above steps ( ), initial dynamic feature vector ( ) and time-coded vector ( The query matrix, key matrix, and value matrix required for the attention mechanism are constructed using a multilayer perceptron. The specific construction rules are as follows (fully adapted to preceding data):

[0171] Query matrix: The time-series features of the gated recurrent unit of each abnormal node are concatenated with the time-encoded vector of the corresponding timestamp, and then input into a multilayer perceptron for linear transformation to obtain the query matrix;

[0172] Key matrix and value matrix: The gated recurrent unit temporal features, initial dynamic feature vector and corresponding timestamp time encoding vector of each abnormal node are concatenated and input into the multilayer perceptron for linear transformation to obtain the key matrix and value matrix.

[0173] During anomaly propagation, the impact of different anomaly nodes on the anomaly spread is not equal: the initial central node The impact of the (source of the anomaly) is the greatest, and direct contact with it is the most direct. of The impact is secondary, on the end nodes. Minimal impact. Attention mechanisms, by constructing query, key, and value matrices, can: automatically learn the association weights between nodes, accurately quantify the contribution of each node to anomaly propagation; highlight the source of the anomaly (…). ) and key propagation nodes ( The feature weights are used to suppress noise from irrelevant end nodes; by combining temporal information and dynamic features, the attention weights not only consider the topological associations of nodes, but also the temporal associations, thus improving the accuracy of weight calculation.

[0174] Furthermore, a scaled dot product attention mechanism is employed to apply formulas to the constructed query matrix, key matrix, and value matrix. The attention features of each anomalous node are calculated.

[0175] The attention features of each anomalous node include both the node's own temporal and dynamic information and the strength of the association between the node and other nodes, providing core feature support for the subsequent final anomalous probability calculation, while also making the anomalous associations interpretable.

[0176] Step 208: The attention features, unique aggregate features, and initial dynamic feature vectors of the abnormal nodes obtained in the above steps are concatenated to form multi-dimensional fusion features. These features are then input into a multilayer perceptron for linear transformation and finally normalized using the softmax function to obtain the final abnormal probability of each abnormal node. After obtaining the final abnormal probability of each abnormal node through the multilayer perceptron, the abnormal node with the highest abnormal probability is determined as the optimal abnormal detection result.

[0177] Set an anomaly probability threshold (in this embodiment, the threshold is set to 0.5), and then set the final anomaly probability... Nodes with an anomalous value ≥0.5 are identified as nodes that publish network anomaly information; based on the calculation results, the final output node is... Then the node The node corresponding to the maximum final anomaly probability is output as the optimal anomaly detection result, i.e., the node that publishes network anomaly information in this example; the remaining nodes ( If the probability of abnormality is lower than the threshold, it is determined to be a normal node.

[0178] To clearly demonstrate the experimental base used in this experiment, the statistical parameters of nodes, events, and abnormal nodes for the three real network datasets are shown in Table 1.

[0179] Table 1. Size of the test dataset

[0180]

[0181] As shown in Table 1, Wikipedia, Reddit, and MOOC are all large-scale dynamic network datasets with a massive number of nodes and events; among them, the MOOC dataset has a higher proportion of anomalous nodes, making it more suitable for the application scenario of few-sample detection in this invention. (The following text...) Figure 5 An experiment comparing event volume was conducted using Wikipedia and Reddit datasets. Figure 6 A comparative experiment on detection performance was conducted based on Wikipedia and Mooc datasets.

[0182] Figure 2 This is a schematic diagram illustrating the spatiotemporal graph traversal method provided in an embodiment of the present invention. Specifically, for timestamps... It contains multiple event time points. Diamonds represent marked anomalous nodes, circles represent normal nodes, and triangles represent nodes obtained through bidirectional breadth-first search. As seen from the left to the right anomalous association subgraph, the final data used for anomaly detection only includes anomalous nodes and the nodes obtained through the traversal. This scheme uses the timestamps corresponding to the marked anomalous nodes as the base timestamps and performs traversals in both historical and partial future time directions, with a maximum of 150 traversals. Since there is a time lag between the processing time of the spatiotemporal graph traversal and the actual collection time of the edge information, historical time nodes and some future time nodes later than the current timestamp are included during the traversal.

[0183] Figure 3 This is a complete graphical illustration of the memory calculation for the dynamic graph anomaly detection method based on spatiotemporal graph traversal provided in this embodiment of the invention. Specifically, it first calculates the timestamp... Encode the nodes to generate time-encoded vectors; then read the initial dynamic feature vectors corresponding to the nodes from the memory. The original node data is encoded to obtain standardized dynamic node features. These three types of features are combined to construct a query matrix, a key matrix, and a value matrix. The query matrix is ​​obtained by concatenating the standardized dynamic node features with a time-encoded vector; the key and value matrices are obtained by concatenating the standardized dynamic node features, the time-encoded vector, and the initial dynamic feature vector. Attention features are calculated using the query matrix, key matrix, and value matrix. Since a single node can correspond to multiple states and timestamps within the same time period, multiple sets of attention features are generated. Therefore, it is necessary to perform mean aggregation on multiple attention sets for the same node to obtain a unique aggregated feature. Finally, the attention features are updated through a gated recurrent unit, the processing result is output, and the corresponding node features in the memory are updated synchronously.

[0184] Figure 4 This is a schematic diagram illustrating the anomaly detection result output provided in an embodiment of the present invention. The data in the diagram represents the attention features obtained after node aggregation; the filled diagonal lines represent labeled anomalous nodes, and the unfilled areas represent nodes obtained through bidirectional breadth-first search. The features are input into a multilayer perceptron used as a classifier, and the output is the final anomaly probability for each node. The final anomaly probability ranges from 0 to 1, with higher values ​​indicating a higher probability that a node is an anomalous. The final anomaly probabilities are sorted in descending order, and the optimal anomaly detection result for a specified number of nodes is output based on this sorting. .

[0185] Figure 5This diagram illustrates the comparison between the number of events after spatiotemporal graph traversal processing and the original number of events in real-world networks like Wikipedia and Reddit, as provided in this embodiment of the invention. This experiment was conducted based on the datasets in Table 1, selecting 70% of the original data from both datasets as test samples. The vertical axis in the diagram represents the number of events in thousands (K). The area filled with diagonal lines represents the original event data, and the area filled with intersecting lines represents the event data filtered through spatiotemporal graph traversal. Experimental results show that the effective number of events is significantly reduced after spatiotemporal graph traversal processing; this solution can complete the network anomaly detection task using only approximately 30% of the Wikipedia data and 14% of the Reddit data.

[0186] Figure 6 This diagram illustrates the performance comparison between this solution and other algorithms in a few-shot scenario using real-world networks like Wikipedia and MOOCs, as provided in this embodiment of the invention. The experiment was designed based on the dataset in Table 1, selecting 70%, 60%, 50%, 40%, and 30% of the original data sequentially as the training set, and the last 15% as the unified test set. The vertical axis in the diagram represents the ROC-AUC (area under the receiver operating characteristic curve, unit: %), ranging from 0% to 100%, with higher values ​​indicating better anomaly detection performance; the horizontal axis represents the proportion of training data to the original data. Experimental results show that on both datasets, the detection performance of this invention is superior to other open-source algorithms; and as the proportion of training data decreases, the performance degradation of this invention is minimal, demonstrating excellent few-shot anomaly detection capabilities.

[0187] In summary, this invention provides a real-time network anomaly detection method and apparatus. This scheme employs a bidirectional breadth-first search strategy, traversing both historical and future time directions with marked anomaly nodes as the center. This accurately prunes the anomaly-related subgraphs, significantly eliminating irrelevant node noise in large-scale dynamic propagation graphs and focusing on the core links of anomaly propagation. This scheme is suitable for low-sample detection scenarios, enabling early and accurate location of optimal anomaly detection results and reducing the adverse effects of anomaly information in social networks. Furthermore, this scheme does not rely on global anomaly data; the detection process can be initiated with only a small number of marked anomaly nodes, eliminating the need for large-scale global data collection, reducing data acquisition costs, and solving the problem of excessive reliance on global data in traditional schemes. This scheme builds a dynamic memory mechanism through a temporal update function, extracts temporal features using time-encoded vectors, and achieves real-time feature updates. It reduces data processing volume through spatiotemporal graph traversal and combines incremental learning with a memory bank, allowing adaptation to dynamic network changes without requiring full retraining of the model, ensuring real-time anomaly detection based on the latest data. This invention integrates standardized dynamic node features and static topological features, taking into account both the dynamic behavior patterns of nodes and network structural attributes, thus overcoming the shortcomings of single features. Through mean aggregation, gated recurrent unit temporal modeling, and multi-head temporal attention mechanisms, it strengthens feature correlations and enhances the model's ability to withstand temporal noise, enabling the scheme to maintain stable detection performance in large-scale complex networks. This invention solves the problem that existing dynamic graph anomaly detection methods cannot simultaneously achieve efficient dynamic information capture, low annotation dependency, and the ability to mine anomalies from few samples, thus hindering real-time and accurate anomaly detection in large-scale complex networks.

[0188] Based on the same inventive concept, this invention provides a real-time network anomaly detection device. Since the principle by which this device solves the technical problem is similar to that of a real-time network anomaly detection method, the implementation of this device can refer to the implementation of the method, and the repeated parts will not be described again.

[0189] like Figure 7 As shown, the device includes an initial unit 701, a forming unit 702, a first obtaining unit 703, a second obtaining unit 704, a third obtaining unit 705, and a determining unit 706.

[0190] The initial unit 701 is used to determine the initial propagation graph snapshot, the initial node set, the initial edge relationship, and the initial node state based on the multi-timestamp propagation graph snapshot sequence.

[0191] The forming unit 702 is used to determine the marked abnormal nodes as the initial center nodes according to the initial node state, and to traverse from the initial center nodes in both the historical time direction and the future time direction to determine the set of associated abnormal nodes, the set of associated abnormal edges, and the state of associated abnormal nodes from the large-scale dynamic propagation graph, thereby forming an abnormal association subgraph.

[0192] The first obtaining unit 703 is used to determine the initial dynamic feature vector corresponding to each abnormal node in the abnormal node set at each timestamp through a time-series update function; and to concatenate the unified dynamic feature vector determined based on the initial dynamic feature vector with the time-encoded vector to obtain the standardized dynamic node feature with time-series memory.

[0193] The second obtaining unit 704 is used to obtain a set of historical neighbors corresponding to historical time from the abnormal association subgraph, determine multiple static topological attributes corresponding to each abnormal node based on the set of historical neighbors and the abnormal association subgraph, and obtain a static topological feature matrix according to the number of points of the abnormal node and the dimension of the multiple static topological attributes.

[0194] The third obtaining unit 705 is used to obtain the unique aggregated feature of the same abnormal node based on the standardized dynamic node features and the static topological feature matrix; and to perform time-series modeling on the unique aggregated feature through the gated loop unit to obtain the dynamic time evolution feature of the abnormal node.

[0195] The determining unit 706 is used to concatenate the dynamic time evolution features, standardized dynamic node features, and time encoding vector to obtain attention features; concatenate the attention features, the unique aggregation features, and the initial dynamic feature vector, and obtain the final anomaly probability of each anomaly node through a multilayer perceptron; and determine the anomaly node with the highest anomaly probability as the optimal anomaly detection result.

[0196] It should be understood that the units included in the above-described real-time network anomaly detection device are only logically divided according to the functions implemented by the device. In practical applications, the above-described units can be superimposed or separated. Furthermore, the functions implemented by the real-time network anomaly detection device provided in this embodiment correspond one-to-one with the real-time network anomaly detection method provided in the above-described embodiment. The more detailed processing flow implemented by this device has been described in detail in the first embodiment of the method described above, and will not be described in detail here.

[0197] Another embodiment of the present invention provides a computer device, the computer device including: a processor and a scene database; the scene database is used to store computer program code, the computer program code including computer instructions; when the processor executes the computer instructions, the electronic device performs each step of the real-time network anomaly information detection method shown in the above method embodiment.

[0198] Another embodiment of the present invention provides a computer-readable storage medium storing computer instructions that, when executed on a computer device, cause the computer device to perform the various steps of the real-time network anomaly detection method shown in the above-described method embodiment.

[0199] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for real-time network anomaly detection, characterized in that, include: Based on the multi-timestamp propagation graph snapshot sequence, determine the initial propagation graph snapshot, initial node set, initial edge relationship, and initial node state; Based on the initial node state, the nodes marked as abnormal are determined as the initial center node. Starting from the initial center node, the system traverses both the historical time direction and the future time direction simultaneously. From the large-scale dynamic propagation graph, the set of associated abnormal nodes, the set of associated abnormal edges, and the state of associated abnormal nodes are determined to form an abnormal association subgraph. Determine the initial dynamic feature vector corresponding to each timestamp for each abnormal node in the set of associated abnormal nodes; concatenate the unified dynamic feature vector determined based on the initial dynamic feature vector with the time encoding vector to obtain the standardized dynamic node feature with temporal memory; Obtain the historical neighbor set corresponding to the historical time from the abnormal association subgraph. Based on the historical neighbor set and the abnormal association subgraph, determine multiple static topological attributes corresponding to each abnormal node. Obtain the static topological feature matrix according to the number of points of the abnormal node and the dimension of the multiple static topological attributes. Based on the standardized dynamic node features and the static topological feature matrix, a unique aggregate feature for the same abnormal node is obtained; the unique aggregate feature is then used to perform time-series modeling on the gated loop unit to obtain the dynamic temporal evolution feature of the abnormal node. The dynamic time evolution feature, the standardized dynamic node feature, and the time encoding vector are concatenated to obtain the attention feature; the attention feature, the unique aggregation feature, and the initial dynamic feature vector are concatenated, and the final anomaly probability of each anomaly node is obtained through a multilayer perceptron; the anomaly node with the highest anomaly probability is determined as the optimal anomaly detection result.

2. The method as described in claim 1, characterized in that, Starting from the initial center node, the process traverses both historical and future time directions to determine the set of associated abnormal nodes, the set of associated abnormal edges, and the states of associated abnormal nodes from the large-scale dynamic propagation graph, forming an abnormal association subgraph. This specifically includes: Identify all candidate nodes that have edge relationships with the initial center node, and determine the timestamp corresponding to each candidate node; When traversing the historical time direction, the timestamp corresponding to the initial center node is determined as the base timestamp. Select the candidate node connected to the initial center node. If the timestamp corresponding to the candidate node is earlier than the base timestamp, the candidate node is determined as an abnormal node and added to the traversal queue. After the traversal is completed, all the traversed nodes are summarized into a set of associated abnormal nodes. The set of associated abnormal edges and the status of associated abnormal nodes are extracted from the set of associated abnormal nodes. When traversing the future time direction, the timestamp corresponding to the initial center node is determined as the base timestamp. Select the candidate node connected to the initial center node. If the timestamp corresponding to the candidate node is later than the base timestamp, the candidate node is determined as an abnormal node and added to the traversal queue. After the traversal is completed, all the traversed nodes are summarized into an associated abnormal node set. The associated abnormal edge set and the associated abnormal node status are extracted from the associated abnormal node set. The associated abnormal node status is used to characterize the status of each abnormal node in the associated abnormal node set at the corresponding timestamp; the associated abnormal edge set is used to characterize the connection relationship and status between associated abnormal nodes.

3. The method as described in claim 1, characterized in that, The initial propagation map snapshot is represented by the following formula: The abnormal correlation subgraph is represented by the following formula: in, Indicates the first A snapshot of the initial propagation graph with timestamps. Represents the initial set of nodes in the target region. Represents the initial set of edge relationships. Indicates the first A set of initial node states with timestamps. Represents a node In the The initial node state is represented by a timestamp, where 1 indicates an abnormal state and 0 indicates a normal state. Indicates the first One initial node; Represents an abnormal correlation subgraph. Represents a set of associated abnormal nodes. Represents the set of associated abnormal edges. Indicates the first Each timestamp is associated with the status of an abnormal node.

4. The method as described in claim 1, characterized in that, The initial dynamic feature vector is determined by the following formula: The step of concatenating the unified dynamic feature vector determined based on the initial dynamic feature vector with the time-encoded vector to obtain standardized dynamic node features with temporal memory specifically includes: Based on the initial dynamic feature vector and the multilayer perceptron, a unified dynamic feature vector with uniform dimensions is obtained; time cosine encoding is performed on the timestamp corresponding to each abnormal node to obtain a time encoding vector; the unified dynamic feature vector and the time encoding vector are concatenated to obtain a standardized dynamic node feature with temporal memory. The unified dynamic feature vector is determined by the following formula: in, Indicates the time stamp of the abnormal node The initial dynamic feature vector, Indicates the time stamp of the abnormal node The initial dynamic feature vector, This represents the timing update function. Represents a timestamp. Represents a unified dynamic feature vector. This represents a multilayer perceptron. This represents the initial dynamic feature vector.

5. The method as described in claim 1, characterized in that, The step of obtaining the unique aggregation feature of the same abnormal node based on the standardized dynamic node features and the static topological feature matrix specifically includes: Based on the standardized dynamic node features and the static topology feature matrix, the nodes are grouped according to the same abnormal node and the same timestamp to obtain all dynamic features and all static topology features of the same abnormal node at the same timestamp; the mean of all dynamic features and all static topology features of the same abnormal node at the same timestamp is aggregated to obtain the unique aggregated feature of the same abnormal node. The unique aggregation feature is represented by the following formula: in, This indicates a unique aggregate feature for the same abnormal node. This represents the total number of features at the same node and with the same timestamp. Indicates the first Dynamic features or topological features.

6. The method as described in claim 1, characterized in that, The process of concatenating the dynamic temporal evolution features, standardized dynamic node features, and temporal encoding vectors to obtain attention features specifically includes: The dynamic temporal evolution features, standardized dynamic node features, and temporal encoding vectors are concatenated to construct a query matrix, a key matrix, and a value matrix, thereby obtaining the attention features. The query matrix, key matrix, value matrix, and attention feature are represented by the following formulas: in, Represents the attention query matrix. This represents a multilayer perceptron. Indicates dynamic time evolution characteristics. Represents matrix concatenation symbols. Represents the attention key matrix. Represents the attention value matrix. Represents the initial dynamic feature vector. Indicating attentional characteristics, Represents the normalized exponential function, Represents the attention key matrix The transpose of the matrix, Represents the dimension of the key matrix. Represents a timestamp.

7. The method as described in claim 1, characterized in that, The final anomaly probability is determined by the following formula: in, Indicates the final anomaly probability. Represents the normalized exponential function, This represents a multilayer perceptron. Indicating attentional characteristics, Represents matrix concatenation symbols. Indicates a unique aggregation feature. This represents the initial dynamic feature vector.

8. A real-time network anomaly detection device, characterized in that, include: The initial unit is used to determine the initial propagation graph snapshot, initial node set, initial edge relationship, and initial node state based on the multi-timestamp propagation graph snapshot sequence. The forming unit is used to determine the marked abnormal nodes as the initial center nodes according to the initial node state, and to traverse from the initial center nodes in both the historical time direction and the future time direction to determine the set of associated abnormal nodes, the set of associated abnormal edges, and the state of associated abnormal nodes from the large-scale dynamic propagation graph, thereby forming an abnormal association subgraph. The first obtaining unit is used to determine the initial dynamic feature vector corresponding to each time stamp of each abnormal node in the set of associated abnormal nodes; and to concatenate the unified dynamic feature vector determined based on the initial dynamic feature vector with the time encoding vector to obtain the standardized dynamic node feature with time sequence memory. The second obtaining unit is used to obtain a set of historical neighbors corresponding to historical time from the abnormal association subgraph, determine multiple static topological attributes corresponding to each abnormal node based on the set of historical neighbors and the abnormal association subgraph, and obtain a static topological feature matrix according to the number of points of the abnormal node and the dimension of the multiple static topological attributes. The third obtaining unit is used to obtain the unique aggregated features of the same abnormal node based on the standardized dynamic node features and the static topological feature matrix; and to obtain the dynamic temporal evolution features of the abnormal node by performing time-series modeling on the unique aggregated features through the gated loop unit. The determining unit is used to concatenate the dynamic time evolution features, standardized dynamic node features, and time encoding vector to obtain attention features; concatenate the attention features, the unique aggregation features, and the initial dynamic feature vector, and obtain the final anomaly probability of each anomaly node through a multilayer perceptron; and determine the anomaly node with the highest anomaly probability as the optimal anomaly detection result.

9. A computer-readable storage medium, characterized in that, The device contains a computer program that, when executed by a processor, causes the processor to perform a real-time network anomaly detection method as described in any one of claims 1-7.

10. A computer device, characterized in that, The computer device includes a memory and a processor. The memory stores a computer program, which, when executed by the processor, causes the processor to perform a real-time network anomaly detection method as described in any one of claims 1-7.

Images