Anomaly detection method, apparatus and related device

Abstract

The application provides an anomaly detection method, device and related equipment, and belongs to the technical field of information. The anomaly detection method provided by the application comprises the following steps: acquiring a to-be-detected graph and a plurality of abnormal subgraph templates; extracting text description information of the plurality of abnormal subgraph templates respectively; generating common mode subgraph text description information according to a preset large model, a preset prompt instruction and the text description information, and constructing a common mode subgraph according to the common mode subgraph text description information, wherein the common mode subgraph text description information is used to represent a common mode of the plurality of abnormal subgraph templates; determining a candidate region in the to-be-detected graph by using the common mode subgraph, and detecting the candidate region by using the plurality of abnormal subgraph templates. The anomaly detection method can improve the anomaly detection efficiency.

Description

Technical Field

[0001] This application relates to the field of information technology, and in particular to an anomaly detection method, apparatus and related equipment. Background Technology

[0002] In anomaly detection processes based on graph data, subgraph matching is a mainstream technique. Existing methods often focus on subgraph isomorphism, using backtracking search within a complex graph network to find matching structures that are completely identical to a pre-defined subgraph template in terms of node attributes, edge types, and topological connections. Due to the strict matching constraints and backtracking search characteristics, these methods often incur high computational costs, resulting in low anomaly detection efficiency. Summary of the Invention

[0003] This application provides an anomaly detection method, apparatus, and related equipment, which can solve the technical problem of low anomaly detection efficiency.

[0004] In a first aspect, embodiments of this application provide an anomaly detection method, the method comprising:

[0005] Obtain the image to be detected and multiple abnormal sub-image templates;

[0006] Extract the text description information of each of the multiple abnormal subgraph templates;

[0007] Based on the preset large model, preset prompt instructions and the text description information, generate common pattern subgraph text description information, construct a common pattern subgraph based on the common pattern subgraph text description information, and use the common pattern subgraph text description information to characterize the common pattern of the multiple abnormal subgraph templates;

[0008] Candidate regions are determined in the image to be detected using the common pattern subgraph, and the candidate regions are detected using the multiple abnormal subgraph templates.

[0009] Optionally, the step of extracting the text description information of the plurality of abnormal subgraph templates includes:

[0010] Extract the graph node type information, graph edge relationship information, graph topology information, and business semantic information corresponding to each of the multiple abnormal subgraph templates;

[0011] The graph node type information, graph edge relationship information, graph topology information, and business semantic information corresponding to each of the multiple abnormal subgraph templates are integrated to obtain the text description information of the multiple abnormal subgraph templates.

[0012] Optionally, constructing the public pattern subgraph based on the text description information of the public pattern subgraph includes:

[0013] Extract entity information, entity relationship information, and attribute constraint information corresponding to the entity information and entity relationship information from the text description information of the public pattern subgraph;

[0014] Graph nodes of a common pattern subgraph are generated based on the entity information. The topology of the common pattern subgraph is generated based on the relationship information between the graph nodes of the common pattern subgraph and the entities. The common pattern subgraph is constructed based on the topology of the common pattern subgraph and the attribute constraint information.

[0015] Optionally, determining candidate regions in the image to be detected using the common pattern subgraph includes:

[0016] Based on a preset graph neural network model, the embedding features of multiple nodes in the common pattern subgraph and the graph to be detected are extracted respectively.

[0017] Based on the embedded features, attribute similarity scores are determined between multiple nodes in the public pattern subgraph and multiple nodes in the graph to be detected.

[0018] Based on the attribute similarity score and the preset similarity threshold, a set of candidate nodes corresponding to multiple nodes in the public pattern subgraph in the graph to be detected is determined;

[0019] Candidate regions are obtained by matching the candidate node set with the topology of the common pattern subgraph on the graph to be detected.

[0020] Optionally, the step of detecting the candidate region using the plurality of abnormal sub-image templates includes:

[0021] The semantic matching score and structural similarity score between the plurality of abnormal subgraph templates and the candidate regions are determined respectively;

[0022] The semantic matching score and the structural similarity score are weighted and summed to obtain the overall matching score;

[0023] If the overall matching score is less than a preset threshold, the candidate region is determined to be a normal region.

[0024] If the overall matching score is greater than or equal to a preset threshold, the candidate region is determined to be an abnormal region.

[0025] Optionally, determining the text description information of the common pattern subgraph based on the preset large model, preset prompt instructions, and the text description information includes:

[0026] Determine the positive and negative sample nodes that match the pre-selected node in the image to be detected. The pre-selected node is any node among multiple nodes in the common pattern sub-image. The positive sample node is a node whose attribute similarity score with the pre-selected node is greater than the preset similarity threshold. The negative sample node is a node whose attribute similarity score with the pre-selected node is less than or equal to the preset similarity threshold.

[0027] The first intermediate value is determined based on the Euclidean norm of the difference between the embedding features of the preselected node and the embedding features of the positive sample node.

[0028] The second intermediate value is determined based on the Euclidean norm of the difference between the embedding features of the preselected node and the embedding features of the negative sample node.

[0029] The optimized function value is determined based on the difference between the first intermediate value and the second intermediate value;

[0030] The preset prompt instruction is adjusted according to the optimized function value to obtain the adjusted prompt instruction;

[0031] The adjusted prompt instruction and the text description information are input into the preset large model, and the preset large model outputs the text description information of the common pattern subgraph.

[0032] Secondly, embodiments of this application provide an anomaly detection device, the device comprising:

[0033] The acquisition module is used to acquire the image to be detected and multiple abnormal sub-image templates;

[0034] The first processing module is used to extract the text description information of the multiple abnormal subgraph templates respectively;

[0035] The second processing module is used to generate common pattern subgraph text description information based on the preset large model, preset prompt instructions and the text description information, and to construct a common pattern subgraph based on the common pattern subgraph text description information. The common pattern subgraph text description information is used to characterize the common pattern of the multiple abnormal subgraph templates.

[0036] The third processing module is used to determine candidate regions in the image to be detected using the common pattern subgraph, and to detect the candidate regions using the multiple abnormal subgraph templates.

[0037] Thirdly, embodiments of this application provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the anomaly detection method as described in the first aspect.

[0038] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the anomaly detection method as described in the first aspect.

[0039] Fifthly, embodiments of this application provide a computer program product, including computer instructions that, when executed by a processor, implement the steps of the anomaly detection method as described in the first aspect.

[0040] In this embodiment, a preset large model is used to guide the construction of the common pattern subgraph, which can quickly locate candidate regions and improve anomaly detection efficiency. In addition, since the candidate regions are determined in the image to be detected using the common pattern subgraph, the candidate regions are detected using the multiple anomaly subgraph templates. This combination of coarse screening and detection not only ensures the accuracy of anomaly detection but also avoids performing full and complex calculations on the image to be detected, effectively reducing the overall computational overhead and further improving anomaly detection efficiency. Attached Figure Description

[0041] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a flowchart of an anomaly detection method provided in an embodiment of this application;

[0043] Figure 2 This is a schematic diagram of the structure of an anomaly detection device provided in an embodiment of this application;

[0044] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0045] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0046] The terms "first," "second," etc., used in this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, not limited in number; for example, the first object can be one or more. Furthermore, "and / or" in this application indicates at least one of the connected objects. For example, the scope of protection of "A and / or B" covers at least three scenarios: Scenario 1: including A but not B; Scenario 2: including B but not A; Scenario 3: including both A and B. Additionally, the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0047] See Figure 1 , Figure 1 This is a flowchart of an anomaly detection method provided in an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0048] Step 101: Obtain the image to be detected and multiple abnormal sub-image templates;

[0049] The image to be detected and the multiple abnormal sub-image templates can be pre-constructed images or existing images.

[0050] Taking the aforementioned anomaly detection method for detecting abnormal calls (such as fraudulent calls) in the field of communications as an example:

[0051] The graph to be detected can be a graph constructed based on call relationships; the graph to be detected can be generated by structuring all call and traffic data in the database to produce a full call relationship graph. (In this application, it may also be referred to as a large-scale target map).

[0052] The multiple anomaly subgraph templates can be obtained by analyzing and organizing historically abnormal call relationships and call detail record data into structured information, and then modeling entity relationships through graph structure mapping. Due to the diversity of abnormal behaviors, it is necessary to generate a corresponding anomaly subgraph for each abnormal behavior, and then summarize and integrate the anomaly subgraphs to form multiple anomaly subgraph templates (which can also be referred to as an anomaly subgraph template set in this application): { , , ..., },in It can represent the i-th abnormal subgraph template in the abnormal subgraph template set.

[0053] Specifically, each abnormal subgraph template can correspond to a specific anti-fraud behavior pattern.

[0054] In this step, the image to be detected and multiple abnormal sub-image templates are obtained, providing a data foundation for anomaly detection.

[0055] Step 102: Extract the text description information of the multiple abnormal subgraph templates respectively;

[0056] The text description information can be obtained by feature extraction and semantic encoding of the abnormal pattern subgraph from multiple dimensions, and may include feature labels, semantic descriptions or attribute parameters defined by the abnormal subgraph template; the text description information can be understood by the preset large model described later.

[0057] The extraction of text description information from the multiple anomaly subgraph templates can be based on the aforementioned multiple anomaly subgraph templates { , ,..., }, respectively extract the text description information corresponding to each of the multiple abnormal subgraph templates { , , ..., };in, It can represent Corresponding text description information;

[0058] In this step, the text description information of the multiple abnormal subgraph templates is extracted to provide a data foundation for generating a common pattern subgraph;

[0059] Step 103: Generate common pattern subgraph text description information based on the preset large model, preset prompt instructions and the text description information; construct a common pattern subgraph based on the common pattern subgraph text description information; the common pattern subgraph text description information is used to characterize the common pattern of the multiple abnormal subgraph templates.

[0060] Among them, the preset large model can be a large language model (LLM). An LLM is a deep learning language model that is pre-trained with massive amounts of text data and has a large number of parameters. Its main feature is that it can perform semantic understanding, context modeling and intent parsing of natural language text, and can complete tasks such as language generation, understanding and reasoning based on input prompts.

[0061] Specifically, the pre-defined large model framework can be based on a modular and scalable neural network system with the attention mechanism Transformer as the underlying foundation. The core objective is to efficiently capture the complex semantic relationships in the data, support feature modeling with high generalization ability, and adapt to call fraud prevention scenarios.

[0062] The preset prompt instruction can be a prompt word generated based on a preset prompt instruction template; in this application, a preset prompt instruction template can also be used to represent a type of preset prompt instruction based on a preset prompt instruction template; the preset prompt instruction template can be constructed based on a prompt learning algorithm, embedding professional knowledge of graph structure analysis into the preset prompt instruction template and preset prompt instructions, guiding the preset large model to analyze the common patterns of multiple abnormal subgraph templates, and generating reasonable common pattern subgraph text description information.

[0063] Specifically, the construction of the preset prompt instructions can include two parts: task definition and instruction framework; wherein, the task definition can standardize the task scenario and input / output structure of the preset large model;

[0064] For example: "Analyze the following multiple abnormal pattern graph descriptions and find the largest common pattern subgraph structure among them; output the node types, edge relationships, and topological features of this common pattern subgraph."

[0065] Subsequently, in the instruction framework section, this application may propose a hierarchical description structure: clearly defining the pre-defined large model as an expert in subgraph set analysis, emphasizing its professional capabilities in discovering structural commonalities; the task instruction section needs to detail the analysis requirements, including identifying node types and edge relationships present in all patterns, extracting core topological structures, and considering key objectives such as business semantic similarity. Furthermore, in the structural commonality analysis, the pre-defined large model is required to identify absolutely common elements (nodes and edges contained in all patterns) and relatively common elements (features shared by most patterns). At the semantic abstraction level, the large model is guided to discover functionally similar structural variants.

[0066] To standardize the output of the core structure of the common subgraph in a predetermined format for large models, this application can further introduce a confidence assessment mechanism into the preset prompt instructions. This mechanism includes a list of necessary node types, a set of core edge relationships, a textual description of structural features, statistics on the number of coverage patterns, and a confidence assessment based on the degree of pattern consistency. By comprehensively considering factors such as node type consistency, edge relationship stability, structural integrity, and the rationality of business logic, the reliability of the generated results is ensured.

[0067] More specifically, the step of generating common pattern subgraph text description information based on the preset large model, preset prompt instructions, and the text description information can refer to the following first formula:

[0068] y = LLM({{ , , ..., }, }),

[0069] In the first formula, y can represent the textual description information of the common pattern subgraph; LLM can represent the pre-defined large oracle model; { , , ..., } can represent the text description information corresponding to each of the above multiple anomaly subgraph templates; It can represent a preset prompt instruction template (i.e., a preset prompt instruction based on a preset prompt instruction template).

[0070] The construction of the common pattern subgraph based on the text description information of the common pattern subgraph can be based on a predetermined transformation rule, which transforms the text description information of the common pattern subgraph into a common pattern subgraph. The common pattern subgraph can represent the common pattern of the multiple anomaly subgraph templates, which can improve the versatility, efficiency and generalization ability of anomaly detection.

[0071] In this step, the text description information of the multiple anomaly subgraph templates is understood using a preset large model to obtain the text description information of the common pattern subgraph used to represent the common pattern of the multiple anomaly subgraph templates. This can greatly reduce the computational overhead and thus improve the efficiency of anomaly detection. Since the common pattern subgraph can represent the common pattern of the multiple anomaly subgraph templates, it can improve the generalization ability of anomaly detection, and improve the accuracy and effect of anomaly detection.

[0072] Step 104: Use the common pattern subgraph to determine candidate regions in the image to be detected, and use the multiple abnormal subgraph templates to detect the candidate regions.

[0073] Similarly, taking the anomaly detection method for abnormal call detection in the field of communications as an example, the common pattern subgraph is used to determine candidate regions in the graph to be detected, and the multiple anomaly subgraph templates are used to detect the candidate regions. Finally, it can be used to identify the graph structure formed by abnormal calls (such as fraudulent calls), thereby completing the anomaly detection.

[0074] In this step, candidate regions are determined in the image to be detected using the common pattern subgraph. Since the common pattern subgraph can represent the common pattern of multiple anomaly subgraph templates, it can quickly locate candidate regions that match the common pattern, reducing invalid matching ranges and improving anomaly detection efficiency. Furthermore, the candidate regions are detected using the multiple anomaly subgraph templates to ensure the accuracy of anomaly detection. This two-stage detection method, combining coarse screening and verification, avoids performing full and complex calculations on the image to be detected, thereby effectively reducing overall computational overhead and improving anomaly detection efficiency while ensuring detection accuracy.

[0075] In this embodiment, a preset large model is used to guide the construction of the common pattern subgraph, which can quickly locate candidate regions and improve anomaly detection efficiency. In addition, since the candidate regions are determined in the image to be detected using the common pattern subgraph, the candidate regions are detected using the multiple anomaly subgraph templates. This combination of coarse screening and detection not only ensures the accuracy of anomaly detection but also avoids performing full and complex calculations on the image to be detected, effectively reducing the overall computational overhead and further improving anomaly detection efficiency.

[0076] In some implementations, the step of extracting the text description information of the plurality of abnormal subgraph templates includes:

[0077] Extract the graph node type information, graph edge relationship information, graph topology information, and business semantic information corresponding to each of the multiple abnormal subgraph templates;

[0078] The graph node type information, graph edge relationship information, graph topology information, and business semantic information corresponding to each of the multiple abnormal subgraph templates are integrated to obtain the text description information of the multiple abnormal subgraph templates.

[0079] Taking the aforementioned anomaly detection method for abnormal call detection in the field of communications as an example:

[0080] The graph node type information may include the node categories appearing in the abnormal subgraph template, such as "user name information", "mobile phone number", "device name information", "Internet Protocol (IP) address" during a call;

[0081] The graph node type information may also include the attributes of each node type, such as the "online time" and "credit rating" of the graph node (e.g., user node).

[0082] The relationship information of the graph edges may include connection relationship information between nodes, such as "call frequency" and "calls between accounts";

[0083] The aforementioned topological information can be used to describe the topological features of the abnormal subgraph template. For example, at the topological feature extraction level, it can include basic graph metrics, such as the number of graph nodes, the number of graph edges, and graph density. It can also identify key nodes through centrality analysis, which can include degree centrality and betweenness centrality.

[0084] The business semantic information can be semantic enhancement information at the business level, specifically, it can be anomaly type annotations (such as pyramid scheme recruitment or anomalous device aggregation) and behavioral feature descriptions (intensive calls in a short period of time, abnormal time activities) added to each anomaly subgraph template.

[0085] The extraction of text description information from the multiple abnormal subgraph templates can be specifically referred to in the following second formula:

[0086]

[0087] In the second formula, This can represent the template of the i-th abnormal subgraph mentioned above. The corresponding text description information; the text description information corresponding to each of the multiple abnormal subgraph templates can be { , , ..., }; δ can represent a mapping function from graph structure to textual description information; δ can represent a transformation rule. The transformation rule can be set as needed by those skilled in the art, for example, the transformation rule can be determined according to the four dimensions of graph node type information, graph edge relationship information, graph topology information, and business semantic information.

[0088] In this embodiment, by integrating the graph node type information, graph edge relationship information, graph topology information, and business semantic information corresponding to each of the multiple abnormal subgraph templates, textual description information of the multiple abnormal subgraph templates is obtained. This allows the textual description information to comprehensively and accurately express the feature information of the abnormal subgraph templates from multiple dimensions such as node type, edge relationship, topology, and business semantics. Consequently, the common pattern subgraph accurately represents the common pattern of the multiple abnormal subgraph templates from multiple dimensions, improving the accuracy of anomaly detection.

[0089] In some implementations, constructing the public pattern subgraph based on the text description information of the public pattern subgraph includes:

[0090] Extract entity information, entity relationship information, and attribute constraint information corresponding to the entity information and entity relationship information from the text description information of the public pattern subgraph;

[0091] Graph nodes of a common pattern subgraph are generated based on the entity information. The topology of the common pattern subgraph is generated based on the relationship information between the graph nodes of the common pattern subgraph and the entities. The common pattern subgraph is constructed based on the topology of the common pattern subgraph and the attribute constraint information.

[0092] Specifically, extracting entity information from the text description information of the common pattern subgraph and generating graph nodes of the common pattern subgraph based on the entity information can be achieved by determining the type of the entity information according to preset node rules and assigning a globally unique identifier to the entity information; the globally unique identifier corresponds one-to-one with the entity in the entity information, and the corresponding graph node can be determined through the identifier; finally, all generated graph nodes are summarized to form a graph node set of the common pattern subgraph.

[0093] The step of generating the topology of the common pattern subgraph based on the relationship information between the graph nodes and the entities in the common pattern subgraph can be as follows: extracting triples (<subject, relation, object>) of the entity relationship information, and then verifying whether the subject-object node belongs to the graph node set; after verifying the validity of the subject-object node (for example, when both the subject and the object are graph nodes in the graph node set), establishing edge connections between graph nodes according to preset edge rules and the relationship between the subject-object nodes, and integrating all edge connections to form the topology of the common pattern subgraph;

[0094] The construction of the common pattern subgraph based on the topology of the common pattern subgraph and the attribute constraint information can be achieved by matching the node and edge affiliations in the topology based on the extracted attribute constraint information and converting them into standardized key-value pairs. Alternatively, the implicit attributes of the nodes and edges in the topology can be enhanced and supplemented by combining the aforementioned business semantic information. The standardized key-value pairs and the implicit attributes can be bound to the topology, so that the graph nodes and the graph topology have corresponding attribute features, thereby constructing the common pattern subgraph.

[0095] Specifically, the public schema subgraph can also be topologically verified to check edge and node matching and attribute consistency, generating a public schema subgraph containing "node type - relationship type - attribute constraints". ;

[0096] More specifically, construct the public pattern subgraph. You can refer to the third formula below:

[0097]

[0098] In the third formula, It can represent a common pattern subgraph; This can represent a mapping function from the textual description information of the public subgraph to the public pattern subgraph; r can represent the text description information of the common subgraph in the first formula; r can represent the transformation rule, which can be set as needed by those skilled in the art (such as according to the transformation rule defined above).

[0099] In some implementations, determining candidate regions in the image to be detected using the common pattern subgraph includes:

[0100] Based on a preset graph neural network model, the embedding features of multiple nodes in the common pattern subgraph and the graph to be detected are extracted respectively.

[0101] Based on the embedded features, attribute similarity scores are determined between multiple nodes in the public pattern subgraph and multiple nodes in the graph to be detected.

[0102] Based on the attribute similarity score and the preset similarity threshold, a set of candidate nodes corresponding to multiple nodes in the public pattern subgraph in the graph to be detected is determined;

[0103] Candidate regions are obtained by matching the candidate node set with the topology of the common pattern subgraph on the graph to be detected.

[0104] The Graph Neural Network (GNN) model can be a deep learning model specifically designed for processing graph-structured data. It learns feature representations of nodes, edges, or the entire graph by transmitting and aggregating information between nodes and edges, thereby performing tasks such as node classification, link prediction, graph classification, and anomaly detection.

[0105] Specifically, the framework of the GNN model can be a modular neural network system for non-Euclidean data (graph structure data). The core objective is to learn low-dimensional vector representations by capturing the correlation information of nodes, edges, and global structures in the graph, thereby supporting various graph-related tasks.

[0106] Based on the GNN model, common pattern subgraphs can be extracted from both attribute and structure dimensions. and the image to be detected Embedding features of multiple nodes.

[0107] Specifically, the GNN model may include multiple graph convolutional layers, where the common pattern subgraph is applied to any node in the graph to be detected. In the process of extracting embedded features, The embedding features of the layer can be referenced in the following fourth formula:

[0108]

[0109] In the fourth formula, It can represent a node exist Layer embedding features; It can represent an activation function; It can represent aggregate functions, specifically nodes. neighboring nodes Feature aggregation method; Represents a node A neighboring node; It can represent a node exist Embedded features; It can represent a node The set of neighboring nodes; It can be expressed as in Layer Learnable weight matrix for linear transformation; It can be expressed as in Layer Learnable weight matrix for linear transformation.

[0110] Specifically, based on the embedded features, the attribute similarity scores between multiple nodes in the public pattern subgraph and multiple nodes in the graph to be detected can be determined by referring to the following fifth formula:

[0111]

[0112] In the fifth formula, It can represent a common pattern subgraph any node; It can represent the image to be detected. any node; It can represent a node and nodes Attribute similarity score; It can represent a node Corresponding embedded features; It can represent a node The corresponding embedding features.

[0113] Preset similarity threshold It can be configured as needed by those skilled in the art;

[0114] The attribute similarity score is greater than In this case, the node can be determined. For nodes Similar nodes; where the attribute similarity score is less than or equal to In this case, the node can be determined. Not a node Similar nodes; based on the above judgment method, the common pattern subgraph can be determined. Multiple nodes in the image to be detected Similar nodes in the list are then used to obtain the candidate node set Candidates(v).

[0115] Specifically, it can be based on Candidates(v) and the image to be detected. The original edge relationships are used to determine candidate subgraphs in the graph to be detected. This subgraph will fully preserve all possible matching starting points (i.e., nodes that satisfy the basic attribute association) and potential connected paths, providing a search range for subsequent matching;

[0116] Subsequently, The backtracking search algorithm is run on top of the search, with the core objective of finding regions that match the common pattern subgraph. Search efficiency can be improved through two key optimizations: First, optimize the search order by prioritizing the exploration of candidate nodes with higher similarity in the attribute filtering layer during the backtracking process to reduce invalid explorations. Second, prioritize matching nodes with high degree in the target template. These nodes have stronger matching constraints, which can quickly trigger the pruning mechanism, terminate search paths that do not meet the conditions in time, and avoid repeated calculations by recording failed paths.

[0117] Through the complete process of "identifying candidate subgraphs → optimizing backtracking search → pruning and deduplication" described above, candidate regions that match the common subgraph template are selected from the graph to be detected. .

[0118] It should be noted that, due to the common pattern subgraph It is a subset of the multiple anomaly subgraph templates (since the common pattern subgraph is a common extraction of multiple anomaly subgraph patterns, it is simpler than any single anomaly subgraph template), therefore the matched candidate regions It is an extension based on precise matching (while retaining the core matching structure, it does not excessively restrict the association of surrounding nodes), so as to avoid missing effective matches when matching with multiple abnormal subgraph templates in the next stage due to overly strict pruning in the early stage.

[0119] In this embodiment, attribute similarity scores are obtained based on a preset graph neural network model, which quickly yields the candidate node set of each node in the common pattern subgraph on the graph to be detected, thus improving processing efficiency. Then, candidate regions are obtained by matching the candidate node set according to the topological structure of the common pattern subgraph, which can reduce invalid calculations, reduce computational overhead, and improve the accuracy of candidate regions.

[0120] In some implementations, detecting the candidate regions using the plurality of abnormal sub-image templates includes:

[0121] Semantic matching scores and structural similarity scores between the plurality of abnormal subgraph templates and the candidate regions are determined respectively; the semantic matching scores and the structural similarity scores are weighted and summed to obtain the overall matching score;

[0122] If the overall matching score is less than a preset threshold, the candidate region is determined to be a normal region.

[0123] If the overall matching score is greater than or equal to a preset threshold, the candidate region is determined to be an abnormal region.

[0124] The step of determining the semantic matching scores of the plurality of abnormal subgraph templates and the candidate regions can be achieved by determining the text description information of the candidate regions in the same way, and matching the text description information of the plurality of abnormal subgraph templates with the text description information of the candidate regions based on a preset semantic matching function or semantic matching rule to obtain a semantic matching score.

[0125] The structural similarity scores between the multiple abnormal subgraph templates and the candidate regions can be determined by using preset rules or preset graph neural network models. The structural similarity between the multiple abnormal subgraph templates and the candidate regions can be calculated and quantified to obtain the corresponding structural similarity scores.

[0126] The weighted summation of the semantic matching score and the structural similarity score to obtain the overall matching score can be referred to in the following sixth formula:

[0127]

[0128] In the sixth formula, and They can represent the i-th anomaly subgraph template and the j-th candidate region, respectively; It can represent and Overall matching score; It can represent a semantic matching scoring function; It can represent a structural similarity scoring function; and They can be represented separately and The preset weights can balance the contributions of the two parts.

[0129] The preset threshold can be a threshold set as needed by those skilled in the art; since different fraud categories or anomaly categories have different degrees of evolution, the size of the preset threshold can be dynamically adjusted for different anomaly sub-graph templates or anomaly types or fraud types to avoid errors and omissions.

[0130] In this embodiment, semantic matching scores are used to ensure that the candidate region corresponds to the core structure of the multiple abnormal subgraph templates, and structural similarity scores are used to ensure the similarity of the candidate region to the edge structure of the multiple abnormal subgraph templates. The candidate region is determined to be a normal region or an abnormal region based on the overall matching score, which can improve the accuracy of matching between the candidate region and the abnormal subgraph template in both semantic and structural dimensions, thereby improving the accuracy of anomaly detection.

[0131] In some implementations, determining the common pattern subgraph text description information based on the preset large model, preset prompt instructions, and the text description information includes:

[0132] Determine the positive and negative sample nodes that match the pre-selected node in the image to be detected. The pre-selected node is any node among multiple nodes in the common pattern sub-graph. The positive sample node is a node whose attribute similarity score with the pre-selected node is greater than the preset similarity threshold. The sample node is a node whose attribute similarity score with the pre-selected node is less than or equal to the preset similarity threshold.

[0133] The first intermediate value is determined based on the Euclidean norm of the difference between the embedding features of the preselected node and the embedding features of the positive sample node.

[0134] The second intermediate value is determined based on the Euclidean norm of the difference between the embedding features of the preselected node and the embedding features of the negative sample node.

[0135] The optimized function value is determined based on the difference between the first intermediate value and the second intermediate value;

[0136] The preset prompt instruction is adjusted according to the optimized function value to obtain the adjusted prompt instruction;

[0137] The adjusted prompt instruction and the text description information are input into the preset large model, and the preset large model outputs the text description information of the common pattern subgraph.

[0138] The number of positive sample nodes and negative sample nodes can be one or more; therefore, positive sample nodes can also be called the positive sample set, and negative sample nodes can also be called the negative sample set.

[0139] The positive sample nodes and negative sample nodes can be in one-to-one correspondence, thus forming a set of positive and negative sample pairs.

[0140] For example, the positive and negative sample nodes can be constructed using a small number of positive and negative samples embedded in the prompt instructions through few-shot learning, guiding the large model to learn from the samples through powerful reasoning capabilities.

[0141] Furthermore, for complex pattern sets, a multi-round interactive optimization strategy can be adopted. The first round performs preliminary identification, the second round supplements knowledge on the problem points of the large model, and when the correct feedback result is output, the interaction process along with the result is used as a sample to embed the prompt template to obtain the adjusted prompt instruction; then the text description information of the common pattern subgraph, the common pattern subgraph, and the embedding features are optimized, so that when candidate regions are determined in the image to be detected using the common pattern subgraph, the embedding distance of matching nodes is aggregated, while the embedding distance of non-matching nodes is increased.

[0142] The determination of the optimization function value based on the sum of the first and second intermediate values ​​can be referenced in the following seventh formula:

[0143]

[0144] In the seventh formula, It can represent the value of an optimization function. It can represent pre-selected nodes; It can represent a node Embedded features; It can represent the nodes in the graph to be detected. Matching positive sample nodes (e.g., nodes with node) (Nodes whose attribute similarity score is greater than the preset similarity threshold). It can represent a node Embedded features; It can represent the nodes in the graph to be detected. Mismatched negative sample nodes (e.g., nodes with nodes) (Nodes whose attribute similarity score is less than or equal to the preset similarity threshold). It can represent a node Embedded features; It can represent the set of all positive and negative sample pairs; It can represent the L2 norm (Euclidean norm).

[0145] More specifically, in the seventh formula, It can represent the first intermediate value. It can represent the second intermediate value.

[0146] In this embodiment, the preset prompt instruction is adjusted using positive and negative sample nodes to obtain the adjusted prompt instruction. The adjusted prompt instruction and the text description information are input into the preset large model, and the preset large model outputs the text description information of the common pattern subgraph. When there is an essential difference between the common pattern subgraph and the candidate region, the discriminative power can be improved. When there is no essential difference between the common pattern subgraph and the candidate region, the discriminative power can be reduced, providing reliable support for determining the candidate region in the image to be detected and further improving the anomaly detection results.

[0147] It should be noted that the above-described anomaly detection method can be executed by an electronic device, that is, all steps included in the above method are executed by the electronic device, which can be an electronic device such as a server, computer or mobile phone.

[0148] See Figure 2 , Figure 2 This is a schematic diagram of the structure of an anomaly detection device provided in an embodiment of this application, as shown below. Figure 2 As shown, the anomaly detection device 200 includes:

[0149] Module 201 is used to acquire the image to be detected and multiple abnormal sub-image templates;

[0150] The first processing module 202 is used to extract the text description information of the multiple abnormal sub-graph templates respectively;

[0151] The second processing module 203 is used to generate common pattern subgraph text description information based on the preset large model, preset prompt instructions and the text description information, and to construct a common pattern subgraph based on the common pattern subgraph text description information. The common pattern subgraph text description information is used to characterize the common pattern of the multiple abnormal subgraph templates.

[0152] The third processing module 204 is used to determine candidate regions in the image to be detected using the common pattern subgraph, and to detect the candidate regions using the multiple abnormal subgraph templates.

[0153] Optionally, the step of extracting the text description information of the plurality of abnormal subgraph templates includes:

[0154] Extract the graph node type information, graph edge relationship information, graph topology information, and business semantic information corresponding to each of the multiple abnormal subgraph templates;

[0155] The graph node type information, graph edge relationship information, graph topology information, and business semantic information corresponding to each of the multiple abnormal subgraph templates are integrated to obtain the text description information of the multiple abnormal subgraph templates.

[0156] Optionally, constructing the public pattern subgraph based on the text description information of the public pattern subgraph includes:

[0157] Extract entity information, entity relationship information, and attribute constraint information corresponding to the entity information and entity relationship information from the text description information of the public pattern subgraph;

[0158] Graph nodes of a common pattern subgraph are generated based on the entity information. The topology of the common pattern subgraph is generated based on the relationship information between the graph nodes of the common pattern subgraph and the entities. The common pattern subgraph is constructed based on the topology of the common pattern subgraph and the attribute constraint information.

[0159] Optionally, determining candidate regions in the image to be detected using the common pattern subgraph includes:

[0160] Based on a preset graph neural network model, the embedding features of multiple nodes in the common pattern subgraph and the graph to be detected are extracted respectively.

[0161] Based on the embedded features, attribute similarity scores are determined between multiple nodes in the public pattern subgraph and multiple nodes in the graph to be detected.

[0162] Based on the attribute similarity score and the preset similarity threshold, a set of candidate nodes corresponding to multiple nodes in the public pattern subgraph in the graph to be detected is determined;

[0163] Candidate regions are obtained by matching the candidate node set with the topology of the common pattern subgraph on the graph to be detected.

[0164] Optionally, the step of detecting the candidate region using the plurality of abnormal sub-image templates includes:

[0165] Semantic matching scores and structural similarity scores between the plurality of abnormal subgraph templates and the candidate regions are determined respectively; the semantic matching scores and the structural similarity scores are weighted and summed to obtain the overall matching score;

[0166] If the overall matching score is less than a preset threshold, the candidate region is determined to be a normal region.

[0167] If the overall matching score is greater than or equal to a preset threshold, the candidate region is determined to be an abnormal region.

[0168] Optionally, determining the text description information of the common pattern subgraph based on the preset large model, preset prompt instructions, and the text description information includes:

[0169] Determine the positive and negative sample nodes that match the pre-selected node in the image to be detected. The pre-selected node is any node among multiple nodes in the common pattern sub-image. The positive sample node is a node whose attribute similarity score with the pre-selected node is greater than the preset similarity threshold. The negative sample node is a node whose attribute similarity score with the pre-selected node is less than or equal to the preset similarity threshold.

[0170] The first intermediate value is determined based on the Euclidean norm of the difference between the embedding features of the preselected node and the embedding features of the positive sample node.

[0171] The second intermediate value is determined based on the Euclidean norm of the difference between the embedding features of the preselected node and the embedding features of the negative sample node.

[0172] The optimized function value is determined based on the difference between the first intermediate value and the second intermediate value;

[0173] The preset prompt instruction is adjusted according to the optimized function value to obtain the adjusted prompt instruction;

[0174] The adjusted prompt instruction and the text description information are input into the preset large model, and the preset large model outputs the text description information of the common pattern subgraph.

[0175] The anomaly detection device 200 is designed to implement the various processes described above in the embodiments of the anomaly detection method. The technical features are one-to-one and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0176] This application also provides an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed by the processor, it implements the various processes of the above-described anomaly detection method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0177] For details, see Figure 3 This application also provides an electronic device, including a bus 301, a transceiver 302, an antenna 303, a bus interface 304, a processor 305, and a memory 306.

[0178] The transceiver 302 is used to acquire the image to be detected and multiple abnormal sub-image templates;

[0179] The processor 305 is used to extract text description information from the plurality of abnormal subgraph templates respectively;

[0180] Based on the preset large model, preset prompt instructions and the text description information, generate common pattern subgraph text description information, construct a common pattern subgraph based on the common pattern subgraph text description information, and use the common pattern subgraph text description information to characterize the common pattern of the multiple abnormal subgraph templates;

[0181] Candidate regions are determined in the image to be detected using the common pattern subgraph, and the candidate regions are detected using the multiple abnormal subgraph templates.

[0182] Optionally, the step of extracting the text description information of the plurality of abnormal subgraph templates includes:

[0183] Extract the graph node type information, graph edge relationship information, graph topology information, and business semantic information corresponding to each of the multiple abnormal subgraph templates;

[0184] The graph node type information, graph edge relationship information, graph topology information, and business semantic information corresponding to each of the multiple abnormal subgraph templates are integrated to obtain the text description information of the multiple abnormal subgraph templates.

[0185] Optionally, constructing the public pattern subgraph based on the text description information of the public pattern subgraph includes:

[0186] Extract entity information, entity relationship information, and attribute constraint information corresponding to the entity information and entity relationship information from the text description information of the public pattern subgraph;

[0187] Graph nodes of a common pattern subgraph are generated based on the entity information. The topology of the common pattern subgraph is generated based on the relationship information between the graph nodes of the common pattern subgraph and the entities. The common pattern subgraph is constructed based on the topology of the common pattern subgraph and the attribute constraint information.

[0188] Optionally, determining candidate regions in the image to be detected using the common pattern subgraph includes:

[0189] Based on a preset graph neural network model, the embedding features of multiple nodes in the common pattern subgraph and the graph to be detected are extracted respectively.

[0190] Based on the embedded features, attribute similarity scores are determined between multiple nodes in the public pattern subgraph and multiple nodes in the graph to be detected.

[0191] Based on the attribute similarity score and the preset similarity threshold, a set of candidate nodes corresponding to multiple nodes in the public pattern subgraph in the graph to be detected is determined;

[0192] Candidate regions are obtained by matching the candidate node set with the topology of the common pattern subgraph on the graph to be detected.

[0193] Optionally, the step of detecting the candidate region using the plurality of abnormal sub-image templates includes:

[0194] Semantic matching scores and structural similarity scores between the plurality of abnormal subgraph templates and the candidate regions are determined respectively; the semantic matching scores and the structural similarity scores are weighted and summed to obtain the overall matching score;

[0195] If the overall matching score is less than a preset threshold, the candidate region is determined to be a normal region.

[0196] If the overall matching score is greater than or equal to a preset threshold, the candidate region is determined to be an abnormal region.

[0197] Optionally, determining the text description information of the common pattern subgraph based on the preset large model, preset prompt instructions, and the text description information includes:

[0198] Determine the positive and negative sample nodes that match the pre-selected node in the image to be detected. The pre-selected node is any node among multiple nodes in the common pattern sub-image. The positive sample node is a node whose attribute similarity score with the pre-selected node is greater than the preset similarity threshold. The negative sample node is a node whose attribute similarity score with the pre-selected node is less than or equal to the preset similarity threshold.

[0199] The first intermediate value is determined based on the Euclidean norm of the difference between the embedding features of the preselected node and the embedding features of the positive sample node.

[0200] The second intermediate value is determined based on the Euclidean norm of the difference between the embedding features of the preselected node and the embedding features of the negative sample node.

[0201] The optimized function value is determined based on the difference between the first intermediate value and the second intermediate value;

[0202] The preset prompt instruction is adjusted according to the optimized function value to obtain the adjusted prompt instruction;

[0203] The adjusted prompt instruction and the text description information are input into the preset large model, and the preset large model outputs the text description information of the common pattern subgraph.

[0204] exist Figure 3In this context, a bus architecture (represented by bus 301) is used. Bus 301 can include any number of interconnected buses and bridges, linking various circuits including one or more processors represented by processor 305 and memory represented by memory 306. Bus 301 can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 304 provides an interface between bus 301 and transceiver 302. Transceiver 302 can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 305 is transmitted over a wireless medium via antenna 303, which further receives data and transmits it to processor 305.

[0205] Processor 305 manages bus 301 and general processing, and also provides various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Memory 306 can be used to store data used by processor 305 during operation.

[0206] Optionally, the processor 305 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a complex programmable logic device (CPLD).

[0207] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the above-described anomaly detection method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0208] This application also provides a computer program product, including computer instructions. When executed by a processor, these computer instructions implement the various processes of the above-described anomaly detection method embodiments and achieve the same technical effects. To avoid repetition, they will not be described again here.

[0209] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0210] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0211] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. An anomaly detection method, characterized in that, The method includes: Obtain the image to be detected and multiple abnormal sub-image templates; Extract the text description information of each of the multiple abnormal subgraph templates; Based on the preset large model, preset prompt instructions and the text description information, generate common pattern subgraph text description information, construct a common pattern subgraph based on the common pattern subgraph text description information, and use the common pattern subgraph text description information to characterize the common pattern of the multiple abnormal subgraph templates; Candidate regions are determined in the image to be detected using the common pattern subgraph, and the candidate regions are detected using the multiple abnormal subgraph templates.

2. The method according to claim 1, characterized in that, The step of extracting the text description information of the multiple abnormal subgraph templates includes: Extract the graph node type information, graph edge relationship information, graph topology information, and business semantic information corresponding to each of the multiple abnormal subgraph templates; The graph node type information, graph edge relationship information, graph topology information, and business semantic information corresponding to each of the multiple abnormal subgraph templates are integrated to obtain the text description information of the multiple abnormal subgraph templates.

3. The method according to claim 1, characterized in that, The step of constructing a public pattern subgraph based on the text description information of the public pattern subgraph includes: Extract entity information, entity relationship information, and attribute constraint information corresponding to the entity information and entity relationship information from the text description information of the public pattern subgraph; Graph nodes of a common pattern subgraph are generated based on the entity information. The topology of the common pattern subgraph is generated based on the relationship information between the graph nodes of the common pattern subgraph and the entities. The common pattern subgraph is constructed based on the topology of the common pattern subgraph and the attribute constraint information.

4. The method according to any one of claims 1 to 3, characterized in that, The step of determining candidate regions in the image to be detected using the common pattern subgraph includes: Based on a preset graph neural network model, the embedding features of multiple nodes in the common pattern subgraph and the graph to be detected are extracted respectively. Based on the embedded features, attribute similarity scores are determined between multiple nodes in the public pattern subgraph and multiple nodes in the graph to be detected. Based on the attribute similarity score and the preset similarity threshold, a set of candidate nodes corresponding to multiple nodes in the public pattern subgraph in the graph to be detected is determined; Candidate regions are obtained by matching the candidate node set with the topology of the common pattern subgraph on the graph to be detected.

5. The method according to any one of claims 1 to 3, characterized in that, The step of detecting the candidate region using the multiple abnormal sub-image templates includes: The semantic matching score and structural similarity score between the plurality of abnormal subgraph templates and the candidate regions are determined respectively; The semantic matching score and the structural similarity score are weighted and summed to obtain the overall matching score; If the overall matching score is less than a preset threshold, the candidate region is determined to be a normal region. If the overall matching score is greater than or equal to a preset threshold, the candidate region is determined to be an abnormal region.

6. The method according to claim 4, characterized in that, The step of determining the text description information of the common pattern subgraph based on the preset large model, preset prompt instructions, and the text description information includes: Determine the positive and negative sample nodes that match the pre-selected node in the image to be detected. The pre-selected node is any node among multiple nodes in the common pattern sub-image. The positive sample node is a node whose attribute similarity score with the pre-selected node is greater than the preset similarity threshold. The negative sample node is a node whose attribute similarity score with the pre-selected node is less than or equal to the preset similarity threshold. The first intermediate value is determined based on the Euclidean norm of the difference between the embedding features of the preselected node and the embedding features of the positive sample node. The second intermediate value is determined based on the Euclidean norm of the difference between the embedding features of the preselected node and the embedding features of the negative sample node. The optimized function value is determined based on the difference between the first intermediate value and the second intermediate value; The preset prompt instruction is adjusted according to the optimized function value to obtain the adjusted prompt instruction; The adjusted prompt instruction and the text description information are input into the preset large model, and the preset large model outputs the text description information of the common pattern subgraph.

7. An anomaly detection device, characterized in that, The device includes: The acquisition module is used to acquire the image to be detected and multiple abnormal sub-image templates; The first processing module is used to extract the text description information of the multiple abnormal subgraph templates respectively; The second processing module is used to generate common pattern subgraph text description information based on the preset large model, preset prompt instructions and the text description information, and to construct a common pattern subgraph based on the common pattern subgraph text description information. The common pattern subgraph text description information is used to characterize the common pattern of the multiple abnormal subgraph templates. The third processing module is used to determine candidate regions in the image to be detected using the common pattern subgraph, and to detect the candidate regions using the multiple abnormal subgraph templates.

8. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, Includes computer instructions that, when executed by a processor, implement the steps of the method as described in any one of claims 1 to 6.

Images