A long tail adaptive multi-view collaborative anomaly discovery method for time-series interaction graphs

Abstract

The application discloses a long-tail adaptive multi-view collaborative anomaly discovery method for time-series interaction graphs, and belongs to the fields of graph data mining and anomaly detection. The method solves the problems of the existing time-series interaction graph collaborative anomaly detection, such as the split of node and group detection processes, the insufficient dynamic collaborative mode capture, and the poor adaptability of extreme long-tail distribution of abnormal samples. The application proposes an end-to-end collaborative anomaly discovery framework. Firstly, three-dimensional complementary feature views of time series, structure and global are constructed for nodes of the time-series interaction graph. The time series view is constructed through sinusoidal position encoding, the structure view is constructed through basic interaction mode statistics and personalized webpage ranking, and the global view is constructed through a graph autoencoder. Then, the feature space is aligned through a multilayer perceptron, and high-discriminative node embedding is adaptively fused based on a scaled dot-product attention. Furthermore, a joint optimization target of a focal classification loss and an adaptive contrast loss is constructed. Through embedding-driven subgraph aggregation and connected component reasoning, end-to-end processing of collaborative anomaly discovery from the node level to the group level is realized.

Description

Technical Field

[0001] This invention belongs to the field of graph data mining and anomaly detection technology, and provides a method for discovering anomalies in long-tailed adaptive multi-view collaborative graphs in time-series interactive graphs. Background Technology

[0002] Temporal interaction graphs are widely used in various practical systems such as financial transactions and social media. The detection of anomalous entities and coordinated anomalous groups directly affects the prevention and control of high-risk illegal activities such as financial fraud and malicious platform manipulation. Although graph neural networks have become the mainstream technology for node anomaly detection, most existing methods only focus on the detection of independent nodes, making it difficult to explicitly model the relational dependencies of coordinated anomalies, nor can they establish the intrinsic connection between node-level anomalies and group-level detection. At the same time, coordinated anomalies usually exhibit dynamic evolutionary interaction patterns, making it difficult to capture their progressively formed characteristics from a single perspective. Furthermore, anomalous nodes exhibit an extreme long-tail distribution, which can easily cause the model to favor the majority of normal categories, resulting in a large number of missed detections of rare high-risk anomalies. In addition, existing methods generally treat node detection and group detection as independent tasks, resulting in limited robustness and generalization. On large-scale temporal interaction graphs, they suffer from low operating efficiency and poor scalability, making it difficult to meet application requirements.

[0003] In summary, the existing technology has the following technical problems:

[0004] Existing technologies for detecting anomalies in time-series interactive graph collaboration suffer from technical problems such as fragmented node and group detection, insufficient ability to capture dynamic collaboration patterns, poor adaptability to long-tail category imbalance, and weak scalability in large-scale scenarios. Summary of the Invention

[0005] The purpose of this invention is to solve the technical problems of existing time-series interactive graph collaborative anomaly detection methods, such as the fragmentation of node and group detection, insufficient capture of dynamic collaborative patterns, poor adaptability to long-tail category imbalance, high model computing power requirements, and weak scalability in large-scale scenarios.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] A method for detecting anomalies in long-tail adaptive multi-view collaboration of temporal interaction graphs includes the following steps:

[0008] Step S1: Preprocess the input dynamic time-series interaction data, construct a time-series interaction graph and complete the formal definition of the problem, divide the training set, validation set and test set, and construct long-tail anomaly detection benchmark data adapted to real scenarios.

[0009] Step S2: Construct complementary multi-view features for each node in the temporal interaction graph, and generate a temporal view that captures the temporal activity patterns of the node, a structural view that describes the interaction structure characteristics of the node, and a global view that models the global context bias of the node.

[0010] Step S3: Design a multi-view feature fusion module based on scaling dot product attention, adaptively learn the importance weights of different views for each node, and integrate the multi-view features into a unified node embedding representation;

[0011] Step S4: Construct a joint optimization objective that combines focus classification loss and adaptive contrastive loss. Expand the representation interval between abnormal and normal samples through an adaptive hard negative sample sampling strategy to alleviate the extreme long-tail class imbalance problem of the temporal interaction graph and complete the iterative training and optimization of the model.

[0012] Step S5: Based on the trained node embeddings, perform embedding-driven subgraph aggregation on the detected abnormal nodes, and infer cohesive collaborative abnormal groups to achieve end-to-end processing from node-level abnormal detection to group-level collaborative abnormal discovery.

[0013] Furthermore, the specific steps of step S1 are as follows:

[0014] Step S1.1: Model the time-series interaction data as a dynamic directed graph. ,in For a set of entity nodes, A set of timestamps Given a set of directed interaction edges with timestamps, each interaction edge... Representative moment From node To the node Directed interactive events;

[0015] Step S1.2, for each node Assign binary labels ,in Indicates an abnormal node. The set of normal nodes is denoted as and the set of abnormal nodes is denoted as . The set of normal nodes is denoted as Define the collaborative anomaly group as a subset of anomaly nodes. Nodes within the group exhibit collaborative behavior in both temporal activities and relational connections;

[0016] Step S1.3: Following the principle of temporal causality, and using a time-sequential division method, divide the temporal interaction flow... The dataset is divided into training, validation, and test sets to prevent future data leaks.

[0017] Furthermore, the specific steps of step S2 are as follows:

[0018] Step S2.1, Time-series view construction: For each node Collect the timestamps corresponding to all interaction events in which it participates as a source node or target node, and obtain a timestamp set:

[0019]

[0020] The timestamps are normalized to 0-1 to eliminate time scale differences:

[0021]

[0022] in, and These are the earliest and latest timestamps within the entire lifecycle of the time-series interaction graph, respectively.

[0023] compute nodes The average activity time, representing its core active phase:

[0024]

[0025] Using a sinusoidal coding function to average the scalar activity time Mapped to High-dimensional temporal feature vectors preserve temporal order and relative interval information:

[0026]

[0027] in, The preset feature embedding dimension;

[0028] The temporal feature vectors of all nodes are stacked vertically in node order to obtain the temporal view feature matrix:

[0029]

[0030] in, This represents the total number of nodes in the time-series interaction graph;

[0031] Step S2.2, Structural View Construction: Integrating local interaction pattern statistics and the importance of multi-hop neighborhood structure, structural view features are constructed. First, three core basic interaction patterns are defined (corresponding to the basic building blocks of collaborative anomalies):

[0032] Aggregation mode: Multiple source nodes within a preset time window Both internal nodes point to the same target node;

[0033] Fast migration mode: Node At any moment To the node After interaction, the node At any moment To the node Continue interacting, and satisfy ;

[0034] Divergence mode: The same source node within a preset time window It can simultaneously point to multiple target nodes;

[0035] For each node Count the number of times it participates in the above three modes, and generate a 3D mode statistical vector:

[0036]

[0037] in, They are nodes The number of times the data participates in convergence, rapid transfer, and divergence modes;

[0038] To capture the structural influence of multi-hop neighborhoods, an adjacency matrix is ​​obtained based on temporal interaction graph aggregation. The structural importance vector of nodes is calculated using Personalized PageRank (PPR), with the following iterative formula:

[0039]

[0040] in For the first The PPR vector of the next iteration. For nodes The corresponding one-hot vector, The restart probability is set to 0.15 by default; the final PPR vector is obtained after iteration until convergence. ;

[0041] Concatenate the pattern statistics vector with the PPR vector to obtain the node. Structural view feature vectors:

[0042]

[0043] in, This represents a vector concatenation operation;

[0044] The structural view features of all nodes are stacked vertically to obtain the structural view feature matrix:

[0045] ;

[0046] Step S2.3, Global View Construction: Model the deviation of nodes relative to the global structural context using the graph convolutional encoder of the graph autoencoder (GAE);

[0047] The timing interaction diagram constructed based on step S1.1 Aggregate all interaction edges into a static graph snapshot and construct its adjacency matrix. ;

[0048] To avoid losing self-loop information, an identity matrix is ​​added to obtain an adjacency matrix with self-loops:

[0049]

[0050] in It is the identity matrix; the corresponding degree matrix is Its diagonal elements The temporal view features obtained in steps S2.1 and S2.2 are concatenated with the structural view features to form the initial node features for the graph convolutional encoder.

[0051]

[0052] L-layer graph convolution is used for multi-hop information propagation and aggregation. The inter-layer propagation rule is as follows:

[0053]

[0054] in, For the first The node representation matrix of the layer, For the first The learnable weight matrix of the layer, It is a ReLU nonlinear activation function;

[0055] The output of the last layer of graph convolution is used as the global view feature matrix:

[0056]

[0057] Furthermore, the specific steps of step S3 are as follows:

[0058] Step S3.1: Project the temporal view, structural view, and global view onto the shared latent space using an independent MLP encoder to obtain the encoded representation. ;

[0059] Step S3.2: Stack the three views into a view sequence. , For the number of nodes, As a potential dimension;

[0060] Step S3.3: Generate query via linear projection ,key ,value Weights are calculated by scaling the dot product attention:

[0061]

[0062] The dimension of the key vector;

[0063] Step S3.4: Weighted fusion according to attention weights to obtain a unified node embedding matrix. Complete the integration of multi-view features.

[0064] Furthermore, the specific steps of step S4 are as follows: Step S4.1, construct a focus classification loss to alleviate long-tail imbalance, the formula is:

[0065]

[0066] For cross-entropy loss, Predict the probability for the true class. To focus parameters, As a category balance factor;

[0067] Step S4.2: Construct an adaptive contrastive loss, using hard negative sample sampling to construct triples, as shown in the formula:

[0068]

[0069] Embedding for anchor points, positive samples, and hard negative samples. Marginal value, Cosine similarity;

[0070] Step S4.3: Construct the total loss The model is optimized by iterative training using the Adam optimizer and combined with an early stopping strategy.

[0071] Furthermore, the specific steps of step S5 are as follows:

[0072] Step S5.1: Filter high-confidence anomalous nodes based on node anomaly scores, and generate a candidate anomaly subgraph set by combining the basic interaction patterns. ;

[0073] Step S5.2: Calculate subgraph embedding using average pooling. Embedded for nodes;

[0074] Step S5.3: Calculate subgraph similarity using cosine similarity. Construct a subgraph weighted interaction graph;

[0075] Step S5.4: Set the similarity threshold ,reserve By finding the edges, we obtain an unweighted connected graph;

[0076] Step S5.5: Extract the connected components in the connected graph as the final cooperative anomaly group output.

[0077] This invention constructs an end-to-end temporal interaction graph collaborative anomaly detection framework through joint optimization of multi-view complementary feature learning, adaptive attention fusion, and long-tail adaptation. This significantly improves the accuracy and robustness of anomaly detection in large-scale dynamic scenarios. Specific beneficial effects are as follows:

[0078] 1. This invention constructs a long-tail anomaly detection benchmark adapted to real business scenarios by formal modeling of time-series interaction graphs and partitioning of time-series causal datasets (step S1), which solves the problems of non-standard time-series data modeling and poor model generalization caused by future information leakage in the prior art.

[0079] Step S1 models the time-series interaction data as a dynamic directed graph with timestamps (Step S1.1), clearly defines the core concepts of node anomalies and collaborative anomaly groups (Step S1.2), and strictly follows temporal causality to divide the training set, validation set, and test set in chronological order (Step S1.3). This method avoids the problem of future information leakage caused by random partitioning and aligns with the causal characteristics of time-series interactions in scenarios such as financial transactions and network communications.

[0080] 2. This invention captures the dynamic behavior and structural characteristics of nodes from multiple dimensions by constructing features from three complementary views: temporal, structural, and global (step S2). This solves the problems of existing methods that cannot capture dynamic collaborative patterns from a single modeling perspective and have incomplete coverage of anomaly discrimination features. It achieves the effect of extracting collaborative anomaly discrimination signals and enhancing the model's feature expression capabilities.

[0081] Step S2 constructs a temporal view through sinusoidal encoding (Step S2.1), accurately depicting the temporal activity patterns of nodes and their behavioral characteristics at different evolutionary stages; it constructs a structural view through basic interaction pattern statistics and the PPR algorithm (Step S2.2), integrating the influence of local interaction patterns and multi-hop neighborhood structures to capture the core structural discrimination signals of collaborative anomalies; and it constructs a global view through a graph convolutional encoder (Step S2.3), modeling the structural deviations of nodes relative to the global context. These three views form a complementary feature representation system, covering various discriminative features of dynamically evolving collaborative anomalies, avoiding information omissions caused by a single perspective, and providing high-quality feature input for subsequent anomaly detection.

[0082] 3. This invention solves the problems of information weight imbalance and feature complementarity not being fully utilized caused by existing methods by using a multi-view feature fusion module based on scaling dot product attention (step S3) to adaptively learn the importance weights of different views for nodes. This achieves the effect of data-driven adaptive feature integration and enhanced node embedding discriminativeness.

[0083] Step S3 projects different views into a shared latent space using independent MLP encoders (Step S3.1), ensuring the consistency of feature distribution across multiple views. It then learns node-level view weights through a scaling dot product attention mechanism (Steps S3.2-S3.3), focusing on feature dimensions that contribute more to anomaly detection. Finally, a weighted fusion is performed to generate a unified node embedding representation (Step S3.4). This approach abandons fixed-weight fusion methods, maximizing the complementary advantages of multi-view features through a data-driven approach. It avoids interference from invalid information in the embedding representation, and the generated node embeddings possess temporal, structural, and global contextual characteristics, improving the feature separability between abnormal and normal samples.

[0084] 4. This invention solves the problem in the prior art that the model is biased towards the normal class and the false negative rate of rare high-risk anomalies caused by the long tail distribution of abnormal samples, by combining the focus classification loss and adaptive contrast loss into a joint optimization objective (step S4) and with an adaptive hard negative sample sampling strategy, thus effectively alleviating the class imbalance.

[0085] Step S4, through focus classification loss (step S4.1), combined with a class balancing factor and focus modulation term, reduces the dominant role of easily distinguishable normal samples in model optimization and increases the loss contribution weight of rare abnormal samples. Through adaptive contrastive loss and a difficult negative sample sampling strategy (step S4.2), the gap between abnormal and normal samples in the representation space is further widened. Finally, the model is iteratively optimized end-to-end through a joint loss function (step S4.3). This mechanism allows the model to accurately learn the discriminative features of abnormal samples even in extremely long-tailed imbalanced scenarios, significantly reducing the false negative rate of high-risk anomalies and significantly improving the detection accuracy of the model in real-world business scenarios.

[0086] 5. This invention solves the problems of fragmented node-level detection and group-level discovery, and insufficient robustness and generalization caused by reliance on external heuristic rules in the prior art by embedding-driven subgraph aggregation and collaborative group reasoning (step S5), combined with an end-to-end multi-view learning framework. It achieves the effect of end-to-end processing from node anomaly detection to collaborative group discovery and lightweight deployment adapted to large-scale temporal interaction graphs.

[0087] Step S5, based on the trained high-discriminative node embeddings, filters high-confidence anomalous nodes and generates candidate subgraphs (Step S5.1). It then calculates the overall embedding of the subgraphs using average pooling and constructs the subgraph interaction graph using cosine similarity (Steps S5.2-S5.3). Finally, it obtains cohesive collaborative anomalous groups based on connected component inference (Steps S5.4-S5.5). This method establishes a fundamental connection between node-level anomalies and group-level discovery, avoiding the poor generalization problem caused by external heuristic rules. Simultaneously, the entire framework features a lightweight design, high computational efficiency in multi-view feature extraction and attention fusion, significantly reducing the computational requirements for model deployment. It can be widely adapted to various practical business scenarios, such as malicious behavior control in financial anti-fraud platforms.

[0088] 6. This invention solves the problems of fragmentation between node-level detection and group-level discovery, insufficient capture of dynamic collaborative patterns, and poor model robustness in long-tail imbalance scenarios in existing technologies by using an end-to-end collaborative framework (steps S2, S3, S4, and S5) based on multi-view complementary feature learning, adaptive attention fusion, and embedding-driven subgraph aggregation. It achieves high-precision and lightweight end-to-end collaborative anomaly detection in large-scale temporal interaction graphs.

[0089] The complementary features generated by multi-view feature construction (step S2) are differentiated and integrated by the adaptive attention fusion module (step S3). The resulting node embeddings retain both single-node anomaly features and the association with the collaborative interaction structure. The joint optimization objective of long-tail adaptation (step S4) further enhances the anomaly discrimination capability of the embeddings, providing a reliable foundation for group inference. Embedding-driven subgraph aggregation (step S5) deeply binds node anomaly detection with group collaborative inference, connecting the complete link from single-node identification to collaborative group discovery. This collaborative mechanism can still accurately capture dynamic collaborative anomaly patterns even in extreme long-tail scenarios. At the same time, the lightweight module design reduces computing power, enabling efficient operation in large-scale temporal interaction graphs with millions of nodes. Attached Figure Description

[0090] Figure 1 This is a flowchart of the method steps of the present invention. Detailed Implementation

[0091] The present invention will now be further described in conjunction with the accompanying drawings and specific embodiments.

[0092] Please see Figure 1 The present invention provides a technical solution:

[0093] To address the problems mentioned above, this invention takes temporal interaction scenarios such as financial anti-money laundering and cybersecurity fraud detection as its background. Facing the challenges of capturing collaborative anomaly patterns, the extreme long-tail distribution of anomaly samples, and the disconnect between node detection and group discovery processes in dynamic interaction scenarios, it proposes a long-tail adaptive multi-view collaborative anomaly detection method for temporal interaction graphs. Through joint optimization of multi-view complementary feature learning, adaptive attention fusion, and long-tail adaptation, it achieves end-to-end processing from node-level anomaly detection to group-level collaborative anomaly discovery, improving the accuracy and robustness of anomaly detection in dynamic temporal interaction scenarios.

[0094] Specifically, this invention provides a method for detecting anomalies in long-tail adaptive multi-view collaboration of temporal interaction graphs, comprising the following steps:

[0095] Step S1: Preprocess the input dynamic temporal interaction data, construct a temporal interaction graph, and formally define the problem. Following temporal causality, divide the data into training, validation, and test sets to build a long-tail anomaly detection benchmark data adapted to real-world business scenarios. Specifically, this includes the following steps:

[0096] Step S1.1: Model the time-series interaction data as a dynamic directed graph. ,in For a set of entity nodes, A set of timestamps Given a set of directed interaction edges with timestamps, each interaction edge... Representative moment From node To the node Directed interactive events;

[0097] Step S1.2, for each node Assign binary labels ,in Indicates an abnormal node. The set of normal nodes is denoted as and the set of abnormal nodes is denoted as . The set of normal nodes is denoted as Define the collaborative anomaly group as a subset of anomaly nodes. Nodes within the group exhibit collaborative behavior in both temporal activities and relational connections;

[0098] Step S1.3: Following the principle of temporal causality, the temporal interaction stream is divided into training set, validation set, and test set by dividing it into 60%, 20%, and 20% according to time order, respectively, to avoid future data leakage.

[0099] Step S2: Construct complementary multi-view features for each node in the temporal interaction graph to generate a temporal view that captures the temporal activity patterns of the nodes, a structural view that describes the interaction structure characteristics of the nodes, and a global view that models the global context bias of the nodes.

[0100] The specific steps are as follows:

[0101] Step 2.1: Constructing the temporal view by modeling the temporal activity patterns of nodes using sinusoidal encoding. For each node, collect the timestamps corresponding to all its interactive events. After normalizing the timestamps to 0-1, calculate the average activity time of the node throughout its entire lifecycle in the temporal interaction graph. Using a sinusoidal encoding function, map the scalar value of the average activity time to a fixed-dimensional high-dimensional vector representation. The sinusoidal encoding formula is:

[0102]

[0103] in, For embedded dimensions, The normalized average activity time of the node is used; the generated high-dimensional vector is used as the temporal view feature matrix of the node. Complete the construction of the time sequence view.

[0104] Step 2.2: Constructing the structural view, integrating local interaction patterns and multi-hop neighborhood structural features. First, define three basic interaction patterns: convergence, fast transfer, and divergence. Count the frequency of each node's occurrence in these three basic patterns to generate a pattern statistical vector for each node. Subsequently, the importance of the multi-hop neighborhood structure of the PPR calculation nodes in the personalized webpage ranking is used to generate the PPR vector. The iterative formula for PPR is:

[0105]

[0106] in, For the first The PPR vector of the next iteration. The adjacency matrix of the temporal interaction graph. For indicating nodes The one-hot vector, For the restart probability, the final After iterative convergence, the pattern statistical vector is obtained; finally, the pattern statistical vector is... With PPR vector The nodes are spliced ​​together to generate structural view features, and the structural view features of all nodes constitute a structural view feature matrix. The splicing formula is:

[0107]

[0108] in, This indicates a vector concatenation operation.

[0109] Step 2.3: Global View Construction. Global context bias of nodes is modeled using a graph convolutional network. All interaction edges are aggregated into a static graph snapshot. The graph convolutional encoder of the Graph Autoencoder (GAE) is used as the feature extraction skeleton for the global view. Through multi-hop information propagation and aggregation in the graph convolutional layers, the feature bias of each node with its global structural context is compared, and the node representation is updated. The inter-layer propagation rule of the graph convolution is as follows:

[0110]

[0111] in, For the first The node representation matrix of the layer, Features of the initial nodes; To add a self-loop adjacency matrix, This is the corresponding degree matrix. For the first The learnable weight matrix of the layer, It is a non-linear activation function;

[0112] The node representations output by the graph convolutional encoder are used as the global view feature matrix. Complete the construction of the global view.

[0113] Step S3: Design a multi-view feature fusion module based on scaling dot product attention, which adaptively learns the importance weights of different views for each node, and integrates the multi-view features into a unified node embedding representation:

[0114] Step 3.1: View Encoding Projection – Mapping multi-view features to a shared latent space. Using three independent multilayer perceptron (MLP) encoders, the temporal view, structural view, and global view are projected onto a shared latent space of consistent dimensions, yielding the encoded view representations, as shown in the following formula:

[0115]

[0116] in, , , These are the MLP encoders corresponding to the timing view, structure view, and global view, respectively. This is the encoded view representation.

[0117] Step 3.2: Stacking View Sequences to Construct Node-Level View Feature Sequences. The three encoded view representations are stacked along the view dimension to form the view sequence for each node. ;

[0118] in, For the number of nodes, For the dimensions of the shared potential space.

[0119] Step 3.3: Calculate scaling dot product attention and adaptively learn view weights. Perform linear projection on the view sequence to generate a query matrix. Key matrix Value matrix Attention weights between views are calculated using scaling dot product attention, with the following formula:

[0120]

[0121] in, is the dimension of the key vector.

[0122] Step 3.4: Weighted fusion to generate unified node embeddings. This is achieved by calculating the attention weight pair matrix. Weighted averages are then applied across the view dimension to obtain the final unified node embedding matrix. This enables adaptive fusion of multi-view features.

[0123] Step S4: Construct a joint optimization objective combining focus classification loss and adaptive contrastive loss. This involves expanding the representation gap between outliers and normal samples using an adaptive hard negative sample sampling strategy to alleviate the extreme long-tail class imbalance problem in the temporal interaction graph, thus completing iterative training and optimization of the model. Specifically, this includes the following steps:

[0124] Step 4.1: Construct a focus-based classification loss for long-tail imbalance to strengthen the supervision signal for outlier samples. The focus-based classification loss combines class-specific weights and a focus modulation term to reduce the dominant role of easily classified normal samples in model optimization and increase the loss contribution weight of rare outlier samples. The formula is as follows:

[0125]

[0126] in, The standard cross-entropy loss for each sample, The predicted probability of the true class. To focus parameters, This is a category balance factor.

[0127] Step 4.2: Construct an adaptive contrastive loss to expand the feature margin through difficult negative sample sampling. Adaptive difficult negative sample sampling is performed in normal nodes to construct triplet samples. The contrastive loss adopts the form of triplet marginal loss, focusing on difficult normal samples with features similar to those of anomalous samples, further widening the margin between anomalous and normal samples in the representation space. The formula is:

[0128]

[0129] in, These are the node embeddings for anchor points, positive samples, and difficult negative samples, respectively. Marginal value, Cosine similarity; By minimizing the score Selected from the normal node candidate set.

[0130] Step 4.3: Construct the joint optimization total loss function to complete end-to-end model training. The joint optimization total loss function is constructed as follows:

[0131]

[0132] in, and These are the weight coefficients for classification loss and contrastive loss, respectively. Based on the joint optimization of the total loss function, the Adam optimizer is used to perform end-to-end iterative training on the model. An early stopping strategy is implemented based on the performance of the validation set. Training is terminated when the F1 score on the validation set does not improve for a preset number of consecutive rounds, thus completing the global optimization of the model parameters.

[0133] Step S5: Based on the trained node embeddings, perform embedding-driven subgraph aggregation on the detected anomalous nodes to infer cohesive collaborative anomalous groups, achieving end-to-end processing from node-level anomaly detection to group-level collaborative anomaly discovery. Specifically, this includes the following steps:

[0134] Step 5.1: Anomaly Node Screening and Candidate Anomaly Subgraph Generation. Based on the trained node embeddings, the anomaly score of each node is output through a fully connected layer classifier. High-confidence anomaly nodes with anomaly scores exceeding a preset threshold are screened out. Combining three basic interaction modes—convergence, fast transition, and divergence—a set of candidate anomaly subgraphs containing at least three nodes is generated. .

[0135] Step 5.2: Subgraph embedding calculation to construct the overall feature representation of the subgraph. For each candidate anomaly subgraph, the overall embedding vector of the subgraph is calculated using average pooling. The formula is:

[0136]

[0137] in, For subgraph The number of nodes within, For nodes Embedded representation.

[0138] Step 5.3: Subgraph similarity calculation and construction of a weighted interaction graph. The similarity between any two candidate anomaly subgraphs is calculated using cosine similarity to construct a weighted interaction graph between the subgraphs. The similarity calculation formula is:

[0139]

[0140] wherein, is the similarity weight between subgraph and subgraph.

[0141] Step 5.4: collaborative abnormal group reasoning, and output a final detection result. Set a similarity threshold , when the similarity between subgraphs , a connecting edge is created between the two subgraphs, and the weighted interaction graph is converted into an unweighted connected graph; all connected components in the unweighted connected graph are extracted and output as the final collaborative abnormal group, completing the whole process from node-level anomaly detection to group-level collaborative anomaly discovery.

[0142] The present invention has the following advantages:

[0143] The present invention adopts an end-to-end collaborative anomaly discovery framework integrating multi-view feature learning, adaptive attention fusion, long-tail adaptation optimization and embedding-driven subgraph aggregation, which effectively solves the core pain points of collaborative anomaly detection in temporal interaction graphs, improves detection accuracy, robustness and scene adaptability, which is specifically embodied as follows:

[0144] 1. The present invention adopts a multi-view feature construction technology with time-series, structural and global three-dimensional complementarity, extracts corresponding dimensional features by sinusoidal coding, interaction mode statistics + PPR algorithm, and GAE graph convolution respectively, covers the discriminative signals of dynamic collaborative anomalies, and solves the problem that a single modeling perspective cannot capture the gradually evolving collaborative mode.

[0145] 2. The present invention adopts a multi-view adaptive fusion technology based on scaled dot-product attention, learns node-level view weights in a data-driven manner, replaces the simple concatenation fusion with fixed weights, maximizes the complementary advantages of multi-view features, and significantly improves the feature separability between abnormal and normal samples.

[0146] 3. The present invention adopts a joint optimization technology combining focal classification loss and adaptive contrast loss, weakens the dominant role of easily classified normal samples in optimization through focal modulation, enlarges the feature interval between abnormal and normal samples through hard negative sample sampling, effectively alleviates the model bias problem caused by the extremely long-tailed distribution of abnormal samples, and greatly reduces the missed detection rate of high-risk anomalies.

[0147] 4. The present invention constructs a full-link end-to-end architecture from node feature learning to group collaborative reasoning, and solves the problem of separation between node detection and group discovery processes; meanwhile, the lightweight module design reduces computing power, and can adapt to large-scale temporal interaction graph scenes and actual scenes.

[0148] The above are merely representative embodiments among the many specific applications of this invention, and do not constitute any limitation on the scope of protection of this invention. All technical solutions formed by transformation or equivalent substitution fall within the scope of protection of this invention.

Claims

1. A method for detecting anomalies in long-tail adaptive multi-view collaboration of temporal interaction graphs, characterized in that, Includes the following steps: Step S1: Preprocess the input dynamic time-series interaction data, construct a dynamic directed time-series interaction graph with timestamps, and formally define node labels, abnormal node sets, normal node sets, and collaborative abnormal groups. Then, divide the training set, validation set, and test set according to time order to construct long-tail anomaly detection benchmark data that adapts to real business scenarios. Step S2: Construct complementary multi-view features for each node in the temporal interaction graph, and generate a temporal view that captures the temporal activity patterns of the node, a structural view that describes the interaction structure characteristics of the node, and a global view that models the global context bias of the node. Step S3: Design a multi-view feature fusion module based on scaling dot product attention, adaptively learn the importance weights of different views for each node, and integrate the multi-view features into a unified node embedding representation; Step S4: Construct a joint optimization objective that combines focus classification loss and adaptive contrast loss. Execute an adaptive hard negative sample sampling strategy in normal nodes to construct triplet samples. Select hard negative samples by minimizing the similarity difference between normal nodes and anchor points and positive samples, thereby expanding the representation interval between abnormal and normal samples, alleviating the extreme long-tail class imbalance problem of the temporal interaction graph, completing the iterative training and optimization of the model, and obtaining the trained node embeddings. Step S5: Based on the trained node embeddings, perform embedding-driven subgraph aggregation on the detected abnormal nodes, and infer cohesive collaborative abnormal groups to achieve end-to-end processing from node-level abnormal detection to group-level collaborative abnormal discovery.

2. The method for detecting anomalies in a long-tailed adaptive multi-view collaboration of a temporal interaction graph according to claim 1, characterized in that, The specific steps of step S1 are as follows: Step S1.1: Model the dynamic temporal interaction data as a timestamped dynamic directed temporal interaction graph. ,in For a set of entity nodes, A set of timestamps Given a set of directed interaction edges with timestamps, each interaction edge... Representative moment From node To the node Directed interactive events; Step S1.2, for each node Assign binary labels ,in Indicates an abnormal node. Denotes normal nodes as and abnormal nodes as . The set of normal nodes is denoted as ; Define the collaborative anomaly group as a subset of anomaly nodes. Nodes within the group exhibit collaborative behavior in both temporal activities and relational connections: multiple abnormal nodes within the group interact in similar or consecutive time periods and repeatedly form one or more basic interaction patterns such as convergence, rapid transfer, and divergence in the local topology, thus simultaneously presenting temporal activity correlation and relational connection correlation. Step S1.3: Following the principle of temporal causality, the temporal interaction stream is divided into training set, validation set, and test set in a 6:2:2 ratio according to the chronological order to avoid data leakage.

3. The method for detecting anomalies in a long-tailed adaptive multi-view collaboration of a temporal interaction graph according to claim 2, characterized in that, Step S2 specifically includes the construction of the sequence view, the structure view, and the global view: Step S2.1, Time-series view construction: For each node Collect the timestamps corresponding to all interaction events in which it participates as a source node or target node, and obtain a timestamp set: The timestamps are normalized to 0-1 to eliminate time scale differences: in, and These are the earliest and latest timestamps within the entire lifecycle of the time-series interaction graph, respectively. compute nodes The average activity time, representing its core active phase: Using a sinusoidal coding function to average the scalar activity time Mapped to High-dimensional temporal feature vectors preserve temporal order and relative interval information: in, The preset feature embedding dimension; The temporal feature vectors of all nodes are stacked vertically in node order to obtain the temporal view feature matrix: in, This represents the total number of nodes in the time-series interaction graph; Step S2.2, Structural View Construction: Integrating local interaction pattern statistics and the importance of multi-hop neighborhood structure, structural view features are constructed. First, three core basic interaction patterns are defined: Aggregation mode: Multiple source nodes within a preset time window Both internal nodes point to the same target node; Fast migration mode: Node At any moment To the node After interaction, the node At any moment To the node Continue interacting, and satisfy ; Divergence mode: The same source node within a preset time window It can simultaneously point to multiple target nodes; For each node Count the number of times it participates in the above three modes, and generate a 3D mode statistical vector: in, They are nodes The number of times the data participates in convergence, rapid transfer, and divergence modes; To capture the structural influence of multi-hop neighborhoods, an adjacency matrix is ​​obtained based on temporal interaction graph aggregation. The structural importance vector of nodes in the personalized webpage ranking PPR calculation is adopted, and the iterative formula is as follows: in For the first The PPR vector of the next iteration. For nodes The corresponding one-hot vector, The restart probability is set to 0.15 by default; the final PPR vector is obtained after iteration until convergence. ; Concatenate the pattern statistics vector with the PPR vector to obtain the node. Structural view feature vectors: in, This represents a vector concatenation operation; The structural view features of all nodes are stacked vertically to obtain the structural view feature matrix: ； Step S2.3, Global View Construction: Model the deviation of nodes relative to the global structural context using the graph convolutional encoder of the graph autoencoder (GAE); The timing interaction diagram constructed based on step S1.1 Aggregate all interaction edges into a static graph snapshot and construct its adjacency matrix. ; To avoid losing self-loop information, an identity matrix is ​​added to obtain an adjacency matrix with self-loops: in It is the identity matrix; the corresponding degree matrix is Its diagonal elements The temporal view features obtained in steps S2.1 and S2.2 are concatenated with the structural view features to form the initial node features for the graph convolutional encoder. L-layer graph convolution is used for multi-hop information propagation and aggregation. The inter-layer propagation rule is as follows: in, For the first The node representation matrix of the layer, For the first The learnable weight matrix of the layer, It is a ReLU nonlinear activation function; The output of the last layer of graph convolution is used as the global view feature matrix: 。 4. The method for detecting anomalies in a long-tailed adaptive multi-view collaboration of a temporal interaction graph according to claim 3, characterized in that, Step S3 specifically includes: Step S3.1: Project the temporal view, structural view, and global view onto a shared latent space with consistent dimensions using three independent multilayer perceptron (MLP) encoders. Encoder Encoder Encoder These are the MLP encoders corresponding to the timing, structure, and global views, respectively. Step S3.2: Stack the three encoded view representations along the view dimension to form a view sequence for each node: in, For the number of nodes, Dimensions for sharing potential space; Step S3.3: View sequence Perform linear projection to generate the query matrix. Key matrix Sum matrix : in, For learnable parameter matrix, The dimension of the key vector; Calculate attention weights between views: Step S3.4: Weight the value matrix using attention weights and perform average pooling in the view dimension to obtain a unified node embedding matrix: 。 5. The method for detecting anomalies in a long-tailed adaptive multi-view collaboration of a temporal interaction graph according to claim 1, characterized in that, Step S4 specifically includes: Step S4.1: Construct a focus classification loss for long-tail imbalance. The loss consists of three parts: Basic cross-entropy loss term : Measures the difference between the classification prediction and the true label; Category balance factor Increase the loss weight for anomalous nodes in the minority class; Focus modulation term Reduce the dominant role of easily distinguishable normal samples in model optimization and focus on difficult-to-distinguish abnormal samples; For a batch of samples, the focus classification loss is defined as: in, These are focusing parameters used to adjust the modulation intensity; Step S4.2: Construct adaptive contrastive loss Adaptive hard negative sample sampling is performed in normal nodes to construct triplet samples, expanding the feature margin between abnormal and normal samples. The calculation formula is as follows: in, These are the node embeddings for anchor points, positive samples, and difficult negative samples, respectively. Marginal value, Cosine similarity; Step S4.3: Construct the joint optimization total loss function ,in To optimize the loss weights, the Adam optimizer is used to perform end-to-end iterative training on the model. The early stopping strategy is executed through the validation set performance to complete the parameter optimization, and the node embedding matrix Z after training is output.

6. The method for detecting anomalies in a long-tailed adaptive multi-view collaboration of a temporal interaction graph according to claim 1, characterized in that, Step S5 specifically includes: Step S5.1: Based on the trained node embeddings, the anomaly score of each node is output by the classifier. High-confidence anomaly nodes with anomaly scores exceeding a preset threshold are selected. Combining the three basic interaction modes of convergence, fast transition, and divergence, a candidate anomaly subgraph set is generated. ; Step S5.2: For each candidate anomaly subgraph, calculate the overall embedding vector of the subgraph using average pooling. The calculation formula is: in, For subgraph The number of nodes within, For nodes Embedded representation; Step S5.3: Calculate the similarity between any two candidate anomaly subgraphs using cosine similarity. Construct a subgraph weighted interaction graph, and the calculation formula is: Step S5.4: Set the similarity threshold When the similarity between subgraphs When creating connecting edges between two subgraphs, the weighted interactive graph is transformed into an unweighted connected graph; Step S5.5: Extract all connected components in the unweighted connected graph as the final cooperative anomaly group output.

Images