Anomaly analysis method and device, electronic equipment and storage medium

Abstract

This application discloses an anomaly analysis method, apparatus, electronic device, and storage medium. The method includes: acquiring target graphs and target hypergraphs corresponding to multiple objects to be analyzed; extracting features from the target graphs to obtain first graph features; extracting features from the target hypergraphs to obtain second graph features; fusing the features of each object to be analyzed in the first graph features and the second graph features to obtain target fusion features for each object to be analyzed; and determining anomaly objects exhibiting abnormal behavior from the multiple objects to be analyzed based on the target fusion features of the multiple objects to be analyzed. The method of this application improves the accuracy of anomaly analysis of objects.

Description

Technical Field

[0001] This application relates to the field of electronic information technology, and more specifically, to an anomaly analysis method, apparatus, electronic device, and storage medium. Background Technology

[0002] Anomaly detection is a technique for identifying anomalous samples or behaviors in data that do not conform to normal patterns or distributions. For example, it can identify users with abnormal behavior within a user group based on their user behavior, or identify devices with abnormal behavior from a cluster of devices based on their device behavior.

[0003] In related technologies, a graph structure can be constructed based on the object behaviors of multiple objects to be analyzed. This graph structure indicates the relationships between the object behaviors of different objects to be analyzed. Then, the graph structure is used to analyze the objects to be analyzed, in order to identify abnormal objects with anomalous behavior from among the multiple objects to be analyzed. However, this method suffers from the problem of low accuracy in anomaly analysis. Summary of the Invention

[0004] In view of this, embodiments of this application propose an anomaly analysis method, apparatus, electronic device, and storage medium.

[0005] In a first aspect, embodiments of this application provide an anomaly analysis method, the method comprising: edges and a graph node corresponding to each object to be analyzed, each graph node indicating the object behavior of the corresponding object to be analyzed, and graph nodes corresponding to two objects to be analyzed associated with object behavior being connected by a connecting edge; a target hypergraph comprising a hypergraph node corresponding to each object to be analyzed and multiple hyperedges, each hypergraph node indicating the object behavior of the corresponding object to be analyzed, and hypergraph nodes corresponding to multiple objects to be analyzed associated with object behavior being connected to the same hyperedge; performing feature extraction on the target graph to obtain first graph features; performing feature extraction on the target hypergraph to obtain second graph features; fusing the features of each object to be analyzed in the first graph features and the second graph features to obtain target fused features of each object to be analyzed; and determining an anomaly object with abnormal behavior from the multiple objects to be analyzed based on the target fused features of the multiple objects to be analyzed.

[0006] Secondly, embodiments of this application provide an anomaly analysis apparatus, comprising: an acquisition module, configured to acquire a target graph and a target hypergraph corresponding to multiple objects to be analyzed; the target graph includes multiple connecting edges and a graph node corresponding to each object to be analyzed, each graph node indicating the object behavior of the corresponding object to be analyzed, and graph nodes corresponding to two objects to be analyzed that are associated with the object behavior being connected by a connecting edge; the target hypergraph includes a hypergraph node corresponding to each object to be analyzed and multiple hyperedges, each hypergraph node indicating the object behavior of the corresponding object to be analyzed, and hypergraph nodes corresponding to multiple objects to be analyzed that are associated with the object behavior being connected to the same hyperedge; a first extraction module, configured to extract features from the target graph to obtain first graph features; a second extraction module, configured to extract features from the target hypergraph to obtain second graph features; a fusion module, configured to fuse the features of each object to be analyzed in the first graph features and the second graph features to obtain target fusion features of each object to be analyzed; and an anomaly object determination module, configured to determine an anomaly object with abnormal behavior from the multiple objects to be analyzed based on the target fusion features of the multiple objects to be analyzed.

[0007] Optionally, the device further includes a hypergraph construction module, used to determine the hypergraph nodes corresponding to each of the multiple objects to be analyzed and the object behavior similarity between the multiple objects to be analyzed based on the object behavior characteristics of the multiple objects to be analyzed; for any at least two objects to be analyzed, if the object behavior similarity between the at least two objects to be analyzed reaches a first similarity threshold, the hypergraph nodes corresponding to the at least two objects to be analyzed are connected to the same hyperedge to obtain the target hypergraph.

[0008] Optionally, the hypergraph construction module is also used to determine the hypergraph nodes corresponding to each of the multiple objects to be analyzed based on the object behavior characteristics of the multiple objects to be analyzed; and to connect the hypergraph nodes corresponding to the multiple objects to be analyzed that share the target behavior information to the same hyperedge to obtain the target hypergraph.

[0009] Optionally, the device further includes a graph construction module, used to determine the graph nodes corresponding to each of the multiple objects to be analyzed and the object behavior similarity between the multiple objects to be analyzed based on the object behavior characteristics of the multiple objects to be analyzed; for any two objects to be analyzed, if the object behavior similarity between the two objects to be analyzed reaches a second similarity threshold, a connection edge is established between the two graph nodes corresponding to the two objects to be analyzed to obtain the target graph.

[0010] Optionally, the second extraction module is further configured to aggregate the hypergraph nodes connected by each hyperedge in the target hypergraph to obtain the hyperedge representation of each hyperedge; update each hypergraph node based on the hyperedge representation of the hyperedge connected to each hypergraph node to obtain the intermediate hypergraph; and perform feature encoding on the intermediate hypergraph to obtain the second graph features.

[0011] Optionally, the fusion module is further configured to project the features of each object to be analyzed in the first image features to obtain the first projected features corresponding to each object to be analyzed; project the features of each object to be analyzed in the second image features to obtain the second projected features corresponding to each object to be analyzed; and perform feature fusion on the first projected features and the second projected features of each object to be analyzed to obtain the target fusion features of each object to be analyzed.

[0012] Optionally, the first image features are extracted using a graph neural network, and the second image features are extracted using a hypergraph neural network. The device further includes a training module for acquiring sample graphs and sample hypergraphs corresponding to multiple sample objects. The sample graph includes multiple sample connection edges and sample graph nodes corresponding to each sample object. Each sample graph node is used to indicate the object behavior of the corresponding sample object, and the sample graph nodes corresponding to two sample objects associated with the object behavior are connected by a sample connection edge. The sample hypergraph includes a sample hypergraph node corresponding to each sample object and multiple sample hyperedges. Each sample hypergraph node is used to indicate the object behavior of the corresponding sample object, and the sample hypergraph nodes corresponding to multiple sample objects associated with the object behavior are connected to the same sample hyperedge. The graph neural network extracts features from the sample graph to obtain the first sample graph features. The hypergraph neural network extracts features from the sample hypergraph to obtain the second sample graph features. Based on the first and second sample graph features, positive and negative sample pairs corresponding to each sample object are constructed. The graph neural network and the hypergraph neural network are trained based on the positive and negative sample pairs corresponding to multiple sample objects.

[0013] Optionally, the training module is further configured to determine positive sample pairs of the reference sample object based on the features of the reference sample object in the features of the first sample map and the features of the reference sample object in the features of the second sample map; the reference sample object is any one of the multiple sample objects; and to determine negative sample pairs of the reference sample object based on the features of the reference sample object in the features of the first sample map and the features of the other sample objects in the features of the second sample map; the other sample objects are the sample objects other than the reference sample object among the multiple sample objects.

[0014] Optionally, the training module is also used to determine the mutual information of each sample object based on the positive and negative sample pairs corresponding to each sample object; determine the optimization function value based on the mutual information of multiple sample objects; and train the graph neural network and the hypergraph neural network with the goal of maximizing the optimization function value.

[0015] Optionally, the abnormal object determination module is further configured to cluster the target fusion features of multiple objects to be analyzed to obtain at least one cluster center; determine the abnormal score of each object to be analyzed based on the target fusion features of each object to be analyzed and at least one cluster center; and determine the abnormal objects with abnormal behavior from the multiple objects to be analyzed based on the abnormal scores of multiple objects to be analyzed.

[0016] Optionally, the abnormal object determination module is further configured to, for each object to be analyzed, obtain the cluster center that is closest to the target fusion feature of the object to be analyzed from at least one cluster center, and use it as the target cluster center of the object to be analyzed; and determine the abnormal score of each object to be analyzed based on the target fusion feature and the target cluster center of each object to be analyzed.

[0017] Optionally, the abnormal object determination module is also used to determine the abnormal score of each object to be analyzed based on the target fusion features of each object to be analyzed and the relative distance between the target cluster centers.

[0018] Thirdly, embodiments of this application provide an electronic device, including a processor and a memory; the memory stores computer-readable instructions, which, when executed by the processor, implement the above-described method.

[0019] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-readable instructions that, when executed by a processor, implement the above-described method.

[0020] Fifthly, embodiments of this application provide a computer program product, including computer instructions, which, when executed by a processor, implement the method described above.

[0021] This application provides an anomaly analysis method, apparatus, electronic device, and storage medium. First, a target graph and a target hypergraph corresponding to multiple objects to be analyzed are constructed. In the target hypergraph, hypergraph nodes corresponding to multiple objects to be analyzed whose behavior is associated are connected to the same hyperedge. Thus, the target hypergraph indicates the group characteristics of the object group associated with the object behavior. After extracting features from the target hypergraph to obtain second graph features, the second graph features more accurately indicate the clustering behavior of the object group associated with the object behavior. The second graph features include higher-order associations of the object group associated with the object behavior. This makes the target fusion feature obtained by fusing the first graph features corresponding to the target graph and the second graph features corresponding to the target hypergraph more accurately indicate the clustering behavior of the object group associated with the object behavior. The target fusion feature has high accuracy and rich information, thereby making the anomaly objects determined based on the target fusion feature more accurate and improving the accuracy of anomaly analysis of objects. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 A schematic diagram is shown illustrating the application scenarios applicable to the embodiments of this application;

[0024] Figure 2 A flowchart of an anomaly analysis method according to an embodiment of this application is shown;

[0025] Figure 3 A schematic diagram of a target hypergraph in an embodiment of this application is shown;

[0026] Figure 4 It shows Figure 2 A flowchart of the steps preceding step S120 in the corresponding embodiment is shown in one embodiment;

[0027] Figure 5 A schematic diagram of an anomaly analysis process in an embodiment of this application is shown;

[0028] Figure 6 A block diagram of an anomaly analysis apparatus according to one embodiment of this application is shown;

[0029] Figure 7 A structural block diagram of an electronic device for performing an anomaly analysis method according to an embodiment of this application is shown. Detailed Implementation

[0030] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0031] In the following description, the terms "first" and "second" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first" and "second" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0032] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit the application. It should be noted that "multiple" as used herein refers to two or more. "And / or" describes the association relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship.

[0033] Please refer to Figure 1 The diagram illustrates an application scenario applicable to the embodiments of this application. This application scenario includes a terminal 110, a server 120, and a database 130.

[0034] Terminal 110 is a device with resource transmission and reception capabilities, such as a smartphone, tablet, e-book reader, music player, wearable device, smart home device, in-vehicle terminal, etc. Terminal 110 has a client installed, which can send anomaly analysis requests. For example, the client can be an instant messaging client, content interaction client, email client, SMS client, etc.

[0035] The server 120 can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0036] Database 130 can be a standalone physical storage device, a database cluster or distributed system consisting of multiple physical storage devices, or a cloud storage database providing cloud storage functionality. The database is used to store the object behavior characteristics of multiple objects to be analyzed, as well as the object behavior characteristics of multiple sample objects.

[0037] In some embodiments, terminal 110 may generate and send an anomaly analysis request to server 120 in response to user operation. The anomaly analysis request is used to perform anomaly analysis on multiple objects to be processed. In response to the anomaly analysis request, server 120 obtains the object behavior features corresponding to the multiple objects to be analyzed from database 130, constructs a target graph and a target hypergraph based on the object behavior features corresponding to the multiple objects to be analyzed, and then extracts features from the target graph and the target hypergraph respectively to obtain first graph features and second graph features. After that, server 120 determines the target fusion features of each object to be analyzed based on the first graph features and the second graph features, and selects the abnormal objects with abnormal behavior based on the target fusion features of each object to be analyzed. Finally, the abnormal objects with abnormal behavior are returned to terminal 110 so that terminal 110 can display the abnormal objects with abnormal behavior.

[0038] Of course, in some embodiments, the server 120 may directly respond to the user's operation, obtain the object behavior characteristics corresponding to multiple objects to be analyzed from the database 130, and then the server 120 determines the abnormal objects with abnormal behavior based on the object behavior characteristics corresponding to multiple objects to be analyzed.

[0039] Alternatively, the server 110 can directly respond to the user's operation by obtaining the object behavior characteristics corresponding to multiple objects to be analyzed from the database 130 through the server 120. Then, based on the object behavior characteristics corresponding to multiple objects to be analyzed, the terminal 110 can determine the abnormal objects with abnormal behavior.

[0040] In addition, the server 120 can obtain the object behavior features of multiple sample objects from the database 130, and then construct a sample hypergraph and a sample graph based on the object behavior features of multiple sample objects. It can also train a graph neural network and a hypergraph neural network based on the sample hypergraph and the sample graph. After obtaining the trained graph neural network and hypergraph neural network, it can store the graph neural network and hypergraph neural network so as to extract the first graph features through the graph neural network and the second graph features through the hypergraph neural network.

[0041] Of course, when server 120 identifies an abnormal object with abnormal behavior from multiple objects to be analyzed, the graph neural network and hypergraph neural network are deployed on server 120. When terminal 110 identifies an abnormal object with abnormal behavior from multiple objects to be analyzed, server 120 sends the graph neural network and hypergraph neural network to terminal 110, which stores the graph neural network and hypergraph neural network so that terminal 110 can extract first graph features through graph neural network and second graph features through hypergraph neural network.

[0042] For ease of understanding, the following explanation will use electronic devices as the subject of the method for determining the differential features in this application.

[0043] Please see Figure 2 , Figure 2 This application illustrates a flowchart of an anomaly analysis method according to an embodiment of the present application. The method is applied to an electronic device, which may be... Figure 1 The terminal 110 or server 120 in the middle, the method may include:

[0044] S110. Obtain the target graph and target hypergraph corresponding to multiple objects to be analyzed.

[0045] The target graph includes multiple connecting edges and a graph node corresponding to each object to be analyzed. Each graph node is used to indicate the object behavior of the corresponding object to be analyzed. The graph nodes corresponding to two objects to be analyzed that are associated with the object behavior are connected by a connecting edge. The target hypergraph includes a hypergraph node corresponding to each object to be analyzed and multiple hyperedges. Each hypergraph node is used to indicate the object behavior of the corresponding object to be analyzed. The hypergraph nodes corresponding to multiple objects to be analyzed that are associated with the object behavior are connected to the same hyperedge.

[0046] In this application, the object to be analyzed can be a physical object or a virtual object. For example, the object to be analyzed can be a user (i.e., a person), an electronic device, or a virtual object in a virtual scene.

[0047] A graph, or graph structure, studies many-to-many relationships between data elements. A graph includes nodes and edges. Each edge connects two nodes. A node indicates an object, and the edges between nodes indicate the relationships between the objects indicated by the nodes. The existence of edges between nodes means that there is a relationship between the objects indicated by the nodes, and the absence of edges between nodes means that there is no relationship between the objects indicated by the nodes. Furthermore, different edges can be used to indicate different relationships.

[0048] A hypergraph, also known as a hypergraph structure, is an extension of graph theory. A hypergraph consists of nodes and hyperedges. In a graph (i.e., a graph structure), an edge connects only two nodes. In a hypergraph, a hyperedge can connect two or more nodes. Multiple nodes connected to the same hyperedge indicate relationships between multiple objects. Similarly, different hyperedges can indicate different relationships. Based on the foregoing, since a hyperedge can connect two or more nodes, a hypergraph can indicate relationships between multiple objects, allowing it to better represent complex relationships and diverse interactions.

[0049] Specifically, a node in the target graph is used as a graph node. A graph node is determined based on an object to be analyzed. If there is a relationship between two objects to be analyzed, a connecting edge is constructed between the graph nodes corresponding to the two objects to be analyzed, so as to indicate the relationship between the two objects to be analyzed through the connecting edge.

[0050] For example, the target graph G can be represented as in, Let A represent the set of nodes in the graph, and E represent the set of edges, reflecting the direct relationship between the objects to be analyzed indicated by the nodes. Let A ∈ {0,1}. n×n Let represent the adjacency matrix of the graph, where n represents the total number of graph nodes. Each element Aij in the matrix indicates whether there is a connecting edge between graph node i and graph node j. If there is a connecting edge, the value of Aij is 1; otherwise, the value of Aij is 0. Let d represent the feature matrix of the graph, where d represents the feature dimension. Each row xi of the matrix represents the d-dimensional feature vector of the graph node i, and xi indicates the object behavior of the object to be analyzed.

[0051] In some implementations, the method for determining the target graph may include: determining the graph nodes corresponding to each of the multiple objects to be analyzed and the object behavior similarity between the multiple objects to be analyzed based on the object behavior characteristics of the multiple objects to be analyzed; for any two objects to be analyzed, if the object behavior similarity between the two objects to be analyzed reaches a second similarity threshold, establishing a connection edge between the two graph nodes corresponding to the two objects to be analyzed to obtain the target graph. The second similarity threshold can be set based on requirements; for example, the second similarity threshold may be 0.7.

[0052] Object behavior features are used to indicate the object behavior of the object to be analyzed. They allow for the monitoring and collection of the object behavior of the object to be analyzed, obtaining object behavior information. This object behavior information is then encoded to obtain the object behavior features of the object to be analyzed. For example, convolutional neural networks, long short-term memory neural networks, variational autoencoders, and recurrent neural networks can be used to encode the object behavior information of the object to be analyzed. It is easy to understand that the networks used here to encode the object behavior information of the object to be analyzed are merely examples and do not constitute a limitation of this application. Users can also select other networks to encode the object behavior information of the object to be analyzed based on their needs.

[0053] The behavior of the object to be analyzed can vary depending on the object being analyzed and the scenario. For example, in a network security scenario, when the object to be analyzed is a user, the behavior of the object to be analyzed can be the user's network behavior. The network behavior information can include the user's IP address, the time when the user sent network requests, the type of network requests sent by the user, and the frequency of the network requests sent by the user.

[0054] For example, in the context of device detection, when the object to be analyzed is a device, the object behavior to be analyzed can be the device's running behavior. The running behavior information corresponding to the running behavior can include the device's memory usage, processor usage, active periods of the device, and the amount of data processed by the device.

[0055] After obtaining the object behavior characteristics of the objects to be analyzed, a graph node is assigned to each object to be analyzed, and the object behavior characteristics of the objects to be analyzed are used as the node representation of the assigned graph node, which realizes the determination of a graph node for each object to be analyzed.

[0056] In this embodiment, cosine similarity, Euclidean distance, and Manhattan distance can be calculated for the object behavior features of multiple objects to be analyzed, which can be used as the object behavior similarity between multiple objects to be analyzed. If the object behavior similarity between two objects to be analyzed reaches the second similarity threshold, it means that the object behavior of the two objects to be analyzed is highly similar. At this time, a connecting edge can be constructed between the graph nodes of the two objects to be analyzed to indicate that the two objects to be analyzed have an association relationship. By traversing all the objects to be analyzed in this way, the target graph is obtained.

[0057] In some other embodiments, the method for determining the target graph may include: determining the graph nodes corresponding to each of the multiple objects to be analyzed based on the object behavior characteristics of the multiple objects to be analyzed; and for any two objects to be analyzed, if the two objects to be analyzed share target behavior information, establishing a connection edge between the two graph nodes corresponding to the two objects to be analyzed to obtain the target graph.

[0058] The target behavior information can be object behaviors defined based on requirements. The target behavior information can vary depending on the scenario and the object to be analyzed. For example, in a network security scenario, if the object to be analyzed is a user, the target behavior information could be the IP address, the user's request type, and the user's request frequency. In a device detection scenario, if the object to be analyzed is a device, the target behavior information could be the local area network address or device identifier.

[0059] If two objects to be analyzed share target behavior information, it means that the object behaviors of the two objects to be analyzed are highly similar. In this case, a connecting edge can be built between the graph nodes of the two objects to be analyzed to indicate that the two objects to be analyzed have a relationship. By traversing all the objects to be analyzed in this way, the target graph can be obtained.

[0060] Specifically, a node in the target hypergraph is considered a hypergraph node. A hypergraph node is determined based on an object to be analyzed. If multiple objects to be analyzed have relationships, then the hypergraph nodes corresponding to these multiple objects are connected to the target hypergraph node. Figure 1 Hyperedges are used to indicate the relationships between multiple objects to be analyzed.

[0061] For example, the target hypergraph H can be represented as in, This represents the set of nodes that make up the hypergraph (generally, graph nodes can serve as hypergraph nodes, therefore, the set of hypergraph nodes is...). It can be a set with graph nodes (Same), ε is the set of hyperedges, and the hyperedges are... It can connect multiple hypergraph nodes, fully expressing the complex and diverse relationships between these hypergraph nodes.

[0062] In some implementations, the method for determining the target hypergraph may include: determining the hypergraph nodes corresponding to each of the multiple objects to be analyzed and the object behavior similarity between the multiple objects to be analyzed based on the object behavior characteristics of the multiple objects to be analyzed; for any at least two objects to be analyzed, if the object behavior similarity between any two objects to be analyzed reaches a first similarity threshold, connecting the hypergraph nodes corresponding to the at least two objects to be analyzed to the same hyperedge to obtain the target hypergraph. The first similarity threshold can be set based on requirements; for example, the first similarity threshold is 0.7.

[0063] After obtaining the object behavior characteristics of the objects to be analyzed, a hypergraph node is assigned to each object to be analyzed, and the object behavior characteristics of the objects to be analyzed are used as the node representation of the assigned hypergraph node. This is how a hypergraph node is determined for each object to be analyzed.

[0064] It is easy to understand that, as mentioned above, the node representations of hypergraph nodes and graph nodes are respectively the node representations of the object behavior characteristics of the object to be analyzed. Therefore, in the target hypergraph and the target graph, the node representations of graph nodes and hypergraph nodes corresponding to the same object to be analyzed can be the same.

[0065] In this embodiment, cosine similarity, Euclidean distance, and Manhattan distance can be calculated for the object behavior features of multiple objects to be analyzed, which can be used as the object behavior similarity between the multiple objects to be analyzed. For any at least two objects to be analyzed, if the similarity threshold between each pair of the at least two objects to be analyzed reaches a first similarity threshold, it means that the object behavior similarity between each pair of the at least two objects to be analyzed is highly similar. At this time, their corresponding hypergraph nodes are connected to the same hyperedge. Thus, at least two objects to be analyzed whose pairwise object behavior similarity reaches the first similarity threshold are connected to the same hyperedge to obtain the target hypergraph.

[0066] As mentioned above, if the similarity of the object behaviors between any two pairs of objects to be analyzed corresponding to the hypergraph nodes connected by the same hyperedge reaches the first similarity threshold, then there may be a situation where the similarity of the object behaviors between a certain object to be analyzed and some other objects to be analyzed reaches the first similarity threshold, and the similarity of the object behaviors between the object to be analyzed and some other objects to be analyzed also reaches the first similarity threshold. Therefore, the hypergraph node corresponding to each object to be analyzed may be connected to multiple hyperedges.

[0067] For example, if the similarity of the object behaviors between each pair of objects f1, f2, f3, and f4 reaches the first similarity threshold, then the hypergraph nodes a1 (corresponding to object f1), a2 (corresponding to object f2), a3 (corresponding to object f3), and a4 (corresponding to object f4) are connected to the same hyperedge e1. The similarity between objects f4 and f5 also reaches the first similarity threshold, and the hypergraph nodes a4 (corresponding to object f4) and a5 (corresponding to object f5) are connected to hyperedge e2. (The similarity of the object behaviors between objects f5 and f1 does not reach the first similarity threshold, therefore...) (The hypergraph node a5 corresponding to the analyzed object f5 is not connected to hyperedge e1); the object behavior similarity between each pair of analyzed objects f4, f6, and f7 all reaches the first similarity threshold. At this time, the hypergraph node a4 corresponding to analyzed object f4, the hypergraph node a6 corresponding to analyzed object f6, and the hypergraph node a7 corresponding to analyzed object f7 are connected to the same hyperedge e3 (the object behavior similarity between analyzed object f6 and analyzed object f1, and the object behavior similarity between analyzed object f7 and analyzed object f3, do not reach the first similarity threshold; therefore, the hypergraph node a6 corresponding to analyzed object f6 and the hypergraph node a7 corresponding to analyzed object f7 are not connected to hyperedge e1). At this time, the constructed hypergraph is as follows: Figure 3 As shown, the hypergraph node a4 corresponding to the object f4 to be analyzed is connected to hyperedges e1, e2 and e3 respectively.

[0068] In some other embodiments, the method for determining the target hypergraph may include: determining the hypergraph nodes corresponding to each of the multiple objects to be analyzed based on the object behavior characteristics of the multiple objects to be analyzed; connecting the hypergraph nodes corresponding to the multiple objects to be analyzed that share target behavior information to the same hyperedge to obtain the target hypergraph.

[0069] If multiple objects to be analyzed share target behavior information, it means that the object behaviors of the multiple objects to be analyzed are highly similar. In this case, the hypergraph nodes of the multiple objects to be analyzed can be connected to the same hyperedge to indicate that the multiple objects to be analyzed have a relationship. By traversing all the objects to be analyzed in this way, the target hypergraph can be obtained.

[0070] S120. Extract features from the target image to obtain the features of the first image.

[0071] In this application, a Graph Neural Network (GNN) can be used to extract features from the target graph to extract features of the relationships between the objects to be analyzed indicated by different graph nodes in the target graph, thus obtaining the first graph features. At this time, the first graph features indicate the object behavior of the objects to be analyzed and the pairwise relationships between the objects to be analyzed.

[0072] S130. Extract features from the target hypergraph to obtain the features of the second graph.

[0073] In this application, a Hypergraph Graph Neural Network (HGNN) can be used to extract features from the target hypergraph to extract features of the relationships between the objects to be analyzed indicated by different hypergraph nodes in the target hypergraph, thus obtaining second graph features. At this point, the second graph features indicate the object behaviors of the objects to be analyzed and the group relationships between the object groups associated with those object behaviors.

[0074] In some implementations, the hypergraph nodes connected to each hyperedge in the target hypergraph can be aggregated first to obtain the hyperedge representation of each hyperedge; each hypergraph node can be updated based on the hyperedge representation of the hyperedges connected to each hypergraph node to obtain an intermediate hypergraph; and the intermediate hypergraph can be feature-encoded to obtain the second graph features.

[0075] This can be achieved by performing weighted summation and averaging operations on the hypergraph nodes connected by each hyperedge (since hypergraph nodes indicate the object to be analyzed through the node representations they contain, this operation is performed on the node representations of the hypergraph nodes). This aggregates the hypergraph nodes connected by the hyperedges, and the result is used as the hyperedge representation of the hyperedge. Then, for each hypergraph node connected by the hyperedge, weighted summation, averaging, and cross-attention operations are performed on each hypergraph node connected to it using the hyperedge representation (this is also performed on the node representations of the hypergraph nodes). This updates each hypergraph node connected to the hyperedge (i.e., updates the node representations of the hypergraph nodes), resulting in an updated hypergraph as an intermediate hypergraph. Finally, feature encoding of the intermediate hypergraph can be performed using a graph neural network or a hypergraph neural network to obtain the features of the second graph.

[0076] S140. The features of each object to be analyzed in the first graph and the second graph are fused to obtain the target fused features of each object to be analyzed.

[0077] In other words, for each object to be analyzed, its corresponding feature is obtained from the first feature map as the first feature, and its corresponding feature is obtained from the second feature map as the second feature. Then, the first feature and the second feature of the object to be analyzed are fused to obtain the target fused feature of the object to be analyzed. The fusion process here includes, but is not limited to, weighted fusion, concatenation, and fusion through attention mechanisms.

[0078] In some other implementations, the features (i.e., the first features) of each object to be analyzed in the first image feature are projected to obtain the first projected features corresponding to each object to be analyzed; the features (i.e., the second features) of each object to be analyzed in the second image feature are projected to obtain the second projected features corresponding to each object to be analyzed; the first projected features and the second projected features of each object to be analyzed are fused to obtain the target fused features of each object to be analyzed.

[0079] In this application, a multilayer perceptron (MLP) can be used to project the features of each object to be analyzed in the first image feature and the features in the second image feature respectively, so as to project them into the same representation space, thereby obtaining the first projection feature and the second projection feature corresponding to the object to be analyzed. Then, the first projection feature and the second projection feature corresponding to the object to be analyzed are weighted and fused, stitched together, and fused through an attention mechanism to obtain the target fused feature corresponding to the object to be analyzed.

[0080] S150. Based on the target fusion features of multiple objects to be analyzed, identify abnormal objects with abnormal behavior from the multiple objects to be analyzed.

[0081] After obtaining the target fusion features of multiple objects to be analyzed, the objects exhibiting abnormal behavior can be identified as abnormal objects based on the differences between the target fusion features of the multiple objects to be analyzed.

[0082] In some implementations, the target fusion features of multiple objects to be analyzed can be clustered to obtain at least one cluster center. For each object to be analyzed, if the relative distance (e.g., Manhattan distance or Euclidean distance) between the target fusion features of the object to be analyzed and each cluster center is greater than a specified distance, the object to be analyzed is determined to be an abnormal object with abnormal behavior. If the relative distance between the target fusion features of the object to be analyzed and at least one cluster center is not greater than a specified distance, the object to be analyzed is determined to be a normal object with normal behavior.

[0083] In this application, the target fusion features of multiple objects to be analyzed can be measured by distance using K-means clustering algorithm, hierarchical clustering algorithm, or clustering method based on Gaussian mixture model, so as to cluster the target fusion features of multiple objects to be analyzed into at least one cluster center.

[0084] In some other implementations, the target fusion features of multiple objects to be analyzed are clustered to obtain at least one cluster center; based on the target fusion features of each object to be analyzed and the at least one cluster center, an anomaly score is determined for each object to be analyzed; based on the anomaly scores of multiple objects to be analyzed, anomaly objects exhibiting abnormal behavior are identified from the multiple objects to be analyzed. The anomaly score indicates the degree of anomalousness of the object to be analyzed; the higher the anomaly score, the higher the degree of anomalousness and the higher the probability that the object is an anomaly; conversely, the lower the anomaly score, the lower the degree of anomalousness and the lower the probability that the object is an anomaly.

[0085] For example, the average, maximum, median, and minimum values ​​of the relative distances (such as Manhattan distance or Euclidean distance) between the target fusion features of the object to be analyzed and each cluster center can be calculated as the outlier score of the object to be analyzed.

[0086] For example, for each object to be analyzed, the cluster center closest to the target fusion feature of the object to be analyzed is obtained from at least one cluster center and used as the target cluster center of the object to be analyzed; based on the target fusion feature and the target cluster center of each object to be analyzed, the anomaly score of each object to be analyzed is determined.

[0087] In other words, the cluster center closest to the target fusion feature of the object to be analyzed is first determined as the target cluster center of the object to be analyzed. Then, based on the target fusion feature of the object to be analyzed and the differences or relationships between the target cluster centers, the abnormal score of the object to be analyzed is determined.

[0088] In some implementations, weighted summation, product, and concatenation operations can be performed on the target fusion features and target clusters of each object to be analyzed, and the results of the operations can be fully connected to obtain the anomaly score of the object to be analyzed.

[0089] In other implementations, the anomaly score for each object to be analyzed can be determined based on the relative distance between the target fusion features and the target cluster centers. For example, the anomaly score can be calculated as the absolute value of the relative distance between the target fusion features and the target cluster centers; the anomaly score can be calculated as the L2 norm of the relative distance between the target fusion features and the target cluster centers; or the anomaly score can be obtained by performing an exponential function operation (such as the natural exponential function) on the relative distance between the target fusion features and the target cluster centers.

[0090] After obtaining the abnormal scores of each object to be analyzed, objects with abnormal scores higher than the score threshold can be identified as abnormal objects. The score threshold can be a value set based on requirements, or the average of the abnormal scores of multiple objects to be analyzed.

[0091] In this application, anomaly detection can be used for identifying fraudulent donations in public welfare (that is, identifying the behavior of malicious misappropriation of donations in public welfare donations), telecommunications fraud identification (determining whether telecommunications fraud has been committed based on user behavior), and financial fraud identification in financial scenarios (identifying whether a user's financial transaction is a fraudulent transaction based on the user's financial transaction behavior), etc. It can provide strong technical support for risk control and security management and has broad application prospects.

[0092] In this embodiment, firstly, target graphs and target hypergraphs corresponding to multiple objects to be analyzed are constructed. In the target hypergraph, the hypergraph nodes corresponding to multiple objects to be analyzed that are associated with the object behavior are connected to the same hyperedge. Thus, the target hypergraph indicates the group characteristics of the object group associated with the object behavior. After extracting features from the target hypergraph to obtain the second graph features, the second graph features more accurately indicate the clustering behavior of the object group associated with the object behavior. This makes the second graph features include the high-order association relationships of the object group associated with the object behavior. As a result, the target fusion features obtained by fusing the first graph features corresponding to the target graph and the second graph features corresponding to the target hypergraph also more accurately indicate the clustering behavior of the object group associated with the object behavior. The target fusion features have high accuracy and rich information, which makes the abnormal objects identified based on the target fusion features more accurate and improves the accuracy of anomaly analysis of objects.

[0093] Secondly, the features of each object to be analyzed in the first feature map and the features in the second feature map are projected onto the same representation space, instead of directly fusing the features of each object to be analyzed in the first feature map and the features in the second feature map. This avoids the situation where the feature representation spaces are different when fusing features from different representation spaces, which leads to poor feature fusion effect and inaccurate target fused features after fusion. This improves the accuracy of the target fused features of each object to be analyzed, thereby improving the anomaly analysis effect.

[0094] Furthermore, the objects to be analyzed are clustered to group those with similar behaviors together. Cluster centers indicate the characteristics of different object groups. Since most objects are normal, multiple cluster centers accurately indicate the characteristics of different groups of normal objects. Then, based on the difference between the cluster centers and the target fusion features of the objects to be analyzed, anomaly scores are determined. This makes the anomaly scores more accurately indicate the differences between anomalous objects and normal object groups, thus making the identification of anomalous objects based on anomaly scores more accurate.

[0095] In one embodiment, such as Figure 4 As shown, before S120, the method further includes:

[0096] S210. Obtain the corresponding sample graph and sample hypergraph for multiple sample objects.

[0097] The sample graph includes multiple sample connection edges and a sample graph node corresponding to each sample object (a node in the sample graph is considered as a sample graph node, and a connection edge is considered as a sample connection edge). Each sample graph node is used to indicate the object behavior of the corresponding sample object. The sample graph nodes corresponding to two sample objects associated with the object behavior are connected by a sample connection edge. The sample hypergraph includes a sample hypergraph node corresponding to each sample object and multiple sample hyperedges (a node in the sample hypergraph is considered as a sample hypergraph node, and a hyperedge is considered as a sample hyperedge). Each sample hypergraph node is used to indicate the object behavior of the corresponding sample object. The sample hypergraph nodes corresponding to multiple sample objects associated with the object behavior are connected to the same sample hyperedge.

[0098] The sample object can be the same as the object to be analyzed mentioned above, or it can be a different object. For example, the sample object can be a user, device, or virtual object. Furthermore, the construction process of the sample graph and sample hypergraph here refers to the construction process of the target and target hypergraph mentioned above.

[0099] S220. Extract features from the sample graph using a graph neural network to obtain the first sample graph features; extract features from the sample hypergraph using a hypergraph neural network to obtain the second sample graph features.

[0100] In other words, feature extraction is performed directly on the sample graph using a graph neural network to extract features of the relationships between sample objects indicated by different sample graph nodes, resulting in the first sample graph feature. At this point, the first sample graph feature indicates the object behavior of the sample objects and the pairwise relationships between them.

[0101] Similarly, a hypergraph neural network can be used to extract features from the sample hypergraph to extract features of the relationships between sample objects indicated by different sample hypergraph nodes, thus obtaining the second sample graph features. In this second sample graph feature, the object behavior of the sample object and the group relationships between the groups of objects associated with that behavior are indicated.

[0102] S230. Based on the features of the first sample map and the features of the second sample map, construct positive sample pairs and negative sample pairs corresponding to each sample object.

[0103] After the first and second sample map features, positive and negative sample pairs are constructed for each sample object based on the features of each sample object in the first sample map (first sample feature) and the features of each sample object in the second sample map (second sample feature). Each sample feature in the positive sample pair of a sample object indicates the sample object, thus the positive sample pair of the sample object constitutes a "good sample" that indicates accurate information. If each sample feature in the positive sample pair of a sample object contains features that indicate other sample objects, then the positive sample pair of the sample object constitutes a "bad sample" that indicates incorrect information.

[0104] In some implementations, the features of a sample object in the first sample graph (first sample feature) and the features in the second sample graph (second sample feature) can be combined into a sample pair as a positive sample pair of the sample object; the features of a sample object in the first sample graph (first sample feature) and any other sample object in the second sample graph (second sample feature) can be combined into a sample pair as a negative sample pair of the sample object; or, the features of a sample object in the second sample graph (second sample feature) and any other sample object in the first sample graph (first sample feature) can be combined into a sample pair as a negative sample pair of the sample object.

[0105] In some other implementations, positive sample pairs of a reference sample object may be determined based on the features of the reference sample object in the first sample map features and the features of the reference sample object in the second sample map features; the reference sample object is any one of a plurality of sample objects; negative sample pairs of a reference sample object may be determined based on the features of the reference sample object in the first sample map features and the features of the other sample objects in the second sample map features; the other sample objects are sample objects other than the reference sample object among the plurality of sample objects.

[0106] In other words, the features of a sample object in the first sample graph (first sample feature) and the features in the second sample graph (second sample feature) are combined into a sample pair, which is a positive sample pair of the sample object. The positive sample pair includes two sample features. At the same time, the features of the sample object in the first sample graph (first sample feature) are combined into a sample pair with the features of each other sample object in the second sample graph (second sample feature), resulting in multiple sample pairs (the number of multiple sample pairs is the number of other sample objects). These multiple sample pairs are all negative sample pairs of the sample object.

[0107] For example, if the sample objects include c1, c2, ..., c10, then feature c11 of c1 in the first sample graph feature and feature c12 of c1 in the second sample graph feature are combined into a sample pair, which is the positive sample pair of sample object c. Feature c22 of c2 in the second sample graph feature and feature c11 of c1 in the first sample graph feature are combined into a sample pair, which is the negative sample pair of sample object c1. Feature c32 of c3 in the second sample graph feature and feature c11 of c1 in the first sample graph feature are combined into a sample pair, which is the negative sample pair of sample object c1. Thus, 9 negative sample pairs are determined for sample object c1. Similarly, by traversing other sample objects, 9 negative sample pairs and 1 positive sample pair are obtained respectively.

[0108] In some implementations, the features (first sample features) of each sample object in the first sample map feature can be projected to obtain the first sample projection feature corresponding to each sample object; the features (second sample features) of each sample object in the second sample map feature can be projected to obtain the second sample projection feature corresponding to each sample object; based on the first sample projection feature and the second sample projection feature corresponding to the reference sample object, the positive sample pair of the reference sample object can be determined; based on the first sample projection feature corresponding to the reference sample object and the second sample projection feature corresponding to other sample objects, the negative sample pair of the reference sample object can be determined.

[0109] It can be achieved by projecting the features of each sample object in the first sample map feature (i.e., the first sample feature) and the features in the second sample map feature (i.e., the second sample feature) of each sample object onto the same representation space using a multilayer perceptron, thereby obtaining the first sample projection feature and the second sample projection feature corresponding to the sample object.

[0110] After this, the first and second sample projection features corresponding to the sample object can be combined into a sample pair as a positive sample pair of the sample object, which includes two sample features. Simultaneously, the first sample projection feature corresponding to the sample object can be combined with the second sample projection feature corresponding to any other sample object to form a sample pair as a negative sample pair of the sample object; alternatively, the second sample projection feature corresponding to the sample object can be combined with the first sample projection feature corresponding to any other sample object to form a sample pair as a negative sample pair of the sample object; or, the first sample projection feature corresponding to the sample object can be combined with the second sample projection feature corresponding to each of the other sample objects to form a sample pair, resulting in multiple sample pairs (the number of sample pairs equals the number of other sample objects), all of which are negative sample pairs of the sample object.

[0111] S240. Train the graph neural network and the hypergraph neural network based on the positive and negative sample pairs corresponding to each of the multiple sample objects.

[0112] After obtaining the positive and negative sample pairs corresponding to each of the multiple sample objects, an optimization function value can be constructed based on the differences between the positive and negative sample pairs corresponding to each of the multiple sample objects. The parameters of the graph neural network and the hypergraph neural network are adjusted by the optimization function value to train the graph neural network and the hypergraph neural network. After training the graph neural network and the hypergraph neural network, the trained graph neural network is used to achieve the purpose of extracting the first graph feature in step S120, and the trained hypergraph neural network is used to achieve the purpose of extracting the second graph feature in step S130.

[0113] In some implementations, cross-entropy loss, mean squared error loss, and absolute value loss can be calculated based on the differences between positive and negative sample pairs corresponding to each sample object. These losses can then be used as the object losses for each sample object, and the object losses of multiple sample objects can be summed to obtain the optimization function value. After obtaining the optimization function value, the graph neural network and hypergraph neural network can be trained with the goal of maximizing the optimization function value.

[0114] The optimization function value here indicates the difference between positive and negative sample pairs. Therefore, the greater the difference between positive and negative sample pairs, the better the training results will be. Thus, the goal here is to maximize the optimization function value.

[0115] In some other implementations, the mutual information of each sample object is determined based on the positive and negative sample pairs corresponding to each sample object; the optimization function value is determined based on the mutual information of multiple sample objects; and the graph neural network and the hypergraph neural network are trained with the goal of maximizing the optimization function value.

[0116] In some implementations, if the features in a sample pair are not projected, for each sample object, the inner product of the transpose of the first sample feature and the second sample feature in the positive sample pair of each sample object can be calculated to obtain the inner product of the positive sample pair. Then, the inner product of the positive sample pair is calculated using the natural exponential function to obtain the positive sample pair operation result. Simultaneously, the inner product of the transpose of the first sample feature and the second sample feature in the negative sample pair of each sample object can be calculated to obtain the inner product of the negative sample pair. Then, the inner product of the negative sample pair is calculated using the natural exponential function to obtain the negative sample pair operation result. The negative sample pair operation results for all negative sample pairs corresponding to each sample object are summed to obtain the total negative sample pair operation result for the sample object. Then, the ratio of the positive sample pair operation result of the sample object to the total negative sample pair operation result is calculated using a logarithmic function, and this result is used as the mutual information of the sample objects. This process is repeated for each sample object to obtain the mutual information of each sample object, and the average of the mutual information of each sample object is used as the optimization function value. At this point, the optimization function value... The calculation process can be summarized by the following formula:

[0117]

[0118] Where N is the number of sample objects, ε i Let ε be the set of negative sample pairs formed by the negative sample pairs of the i-th sample object. j h is the j-th negative sample pair in the set of negative sample pairs of the i-th sample object. gi h represents the first sample feature corresponding to the i-th sample object. pi h represents the second sample feature corresponding to the i-th sample object. pj It is the second sample feature in the j-th negative sample pair in the set of negative sample pairs of the i-th sample object.

[0119] In some other implementations, if the features in a sample pair are projected, for each sample object, the inner product of the transpose of the first projected feature and the second projected feature in the positive sample pair of each sample object can be calculated to obtain the inner product of the positive sample pair. This inner product is then calculated using the natural exponential function to obtain the positive sample pair operation result. Simultaneously, the inner product of the transpose of the first projected feature and the second projected feature in the negative sample pair of each sample object can be calculated to obtain the inner product of the negative sample pair. This inner product is then calculated using the natural exponential function to obtain the negative sample pair operation result. The negative sample pair operation results for all negative sample pairs corresponding to each sample object are summed to obtain the total negative sample pair operation result for that sample object. Then, the ratio of the positive sample pair operation result to the total negative sample pair operation result is calculated using a logarithmic function, and this result is used as the mutual information of the sample objects. This process is repeated for each sample object to obtain the mutual information of each sample object, and the average of the mutual information of each sample object is used as the optimization function value. At this point, the optimization function value... The calculation process can be summarized by the following formula:

[0120]

[0121] in, The first sample projection feature corresponding to the i-th sample object. The second sample projection feature corresponding to the i-th sample object. The second sample projection feature is the negative sample pair in the set of negative sample pairs of the i-th sample object.

[0122] Then, the graph neural network and hypergraph neural network can be trained with the goal of maximizing the optimization function value. Thus, the mutual information of sample objects indicates the difference between positive and negative sample pairs of each sample object. Correspondingly, the optimization function value indicates the difference between positive and negative sample pairs of multiple sample objects. The larger the optimization function value, the greater the difference between positive and negative sample pairs, and the more accurately the trained network can distinguish between positive and negative sample pairs, resulting in better training performance. Therefore, maximizing the optimization function value is the objective here.

[0123] After training the graph neural network and hypergraph neural network according to the aforementioned process, the graph neural network and hypergraph neural network have good feature extraction capabilities and can provide first graph features and second graph features with high accuracy.

[0124] It is worth mentioning that, in the aforementioned embodiments, the process of projecting the features (first sample features) of each sample object in the first sample map features using a multilayer perceptron is also described, to obtain the first sample projection features corresponding to each sample object; the process of projecting the features (second sample features) of each sample object in the second sample map features is also described, to obtain the second sample projection features corresponding to each sample object; then, positive and negative sample pairs are constructed based on the first and second sample projection features corresponding to each sample object; and training is then performed based on the positive and negative sample pairs. The mapping process is implemented through a multilayer perceptron. Therefore, after obtaining the optimization function value, it is necessary to adjust the parameters of the multilayer perceptron based on the optimization function value to train the multilayer perceptron, graph neural network, and hypergraph neural network, so that the multilayer perceptron has a high mapping effect.

[0125] In this embodiment, positive and negative sample pairs are constructed based on the first and second sample map features corresponding to multiple sample objects. Then, the mutual information of the positive and negative sample pairs is used to indicate the differences between them. An optimization function value is constructed, and the network is trained with the goal of maximizing the optimization function value. This maximizes the similarity of positive sample pairs and minimizes the similarity of negative sample pairs. In the absence of labeled information, the model's representation quality and generalization ability are improved by constructing a suitable contrast task, achieving efficient contrastive learning and improving the feature extraction capabilities of the trained graph neural network and hypergraph neural network.

[0126] Secondly, by using a contrastive learning method, the sensitivity of the trained network to abnormal behavior is enhanced, enabling it to better cope with diverse data in different scenarios and improve the robustness of the model in practical applications.

[0127] To better understand the solution in this application, a specific example will be used for explanation below.

[0128] First, network behavior data of 100,000 users is monitored and collected to obtain network behavior data of 100,000 users. Then, a hypergraph and a graph are constructed based on the network behavior data of 100,000 users. Both the hypergraph and the graph include 100,000 nodes, and each node indicates the network behavior of a user.

[0129] When constructing graphs and hypergraphs, cosine similarity can be used to measure the similarity of object behaviors between users. The process of determining object behavior similarity is as follows:

[0130]

[0131] Where, sim(x) i ,x j Let x be the similarity of object behavior between user i and user j. iLet x be the user behavior characteristics of the i-th user. j Let J represent the user behavior characteristics of the j-th user. These user behavior characteristics can be obtained by feature encoding based on the user's network behavior data.

[0132] like Figure 5 As shown, firstly, features are extracted from the graph using the trained graph neural network to obtain the first graph features, which include graph features from 100,000 individual users. Simultaneously, feature extraction is performed on the hypergraph using the trained graph neural network to obtain second graph features, which include the hypergraph features of 100,000 individual users.

[0133] The first projection map features are obtained by projecting the first map features onto the trained multilayer perceptron. The first projection map features include the first projection features corresponding to each of the 100,000 users. Similarly, the second projection map features are obtained by projecting the second map features onto the trained multilayer perceptron. The second projection map features include the second projection features corresponding to each of the 100,000 users.

[0134] For each user, the user's first projected feature With the second projection feature By splicing the data, the target fusion features of the user can be obtained. and In this way, by iterating through each user, 100,000 target fusion features are obtained.

[0135] Features of 100,000 targets were fused using the K-means algorithm. Clustering was performed, resulting in 30 cluster centers d. k k = 1, 2, 3, ..., 30.

[0136] For each user, determine the distance to their target fusion feature. The nearest cluster center is used as the target cluster center, and then the target fusion features are used based on the user. The user's anomaly score is calculated using the target cluster centers, and the calculation process is as follows:

[0137]

[0138] Among them, s v For outlier scores, K is 30.

[0139] Iterate through 100,000 users to obtain their respective abnormal scores, and identify 100 users whose abnormal scores are higher than the score threshold. These 100 users are considered to have abnormal behavior.

[0140] In this example, by introducing a hypergraph structure and fully utilizing the higher-order relationships between users, more accurate detection of abnormal users and user groups is achieved. Compared to traditional graph-based methods, this application demonstrates superior performance in capturing hidden user group structures and multi-node interactions using hypergraphs, significantly improving anomaly detection capabilities in complex networks.

[0141] Please see Figure 6 , Figure 6 This illustration shows a block diagram of an anomaly analysis apparatus according to one embodiment of the present application. The apparatus 600 includes:

[0142] The acquisition module 610 is used to acquire the target graph and target hypergraph corresponding to multiple objects to be analyzed. The target graph includes multiple connecting edges and a graph node corresponding to each object to be analyzed. Each graph node is used to indicate the object behavior of the corresponding object to be analyzed. The graph nodes corresponding to two objects to be analyzed that are associated with the object behavior are connected by a connecting edge. The target hypergraph includes a hypergraph node corresponding to each object to be analyzed and multiple hyperedges. Each hypergraph node is used to indicate the object behavior of the corresponding object to be analyzed. The hypergraph nodes corresponding to multiple objects to be analyzed that are associated with the object behavior are connected to the same hyperedge.

[0143] The first extraction module 620 is used to extract features from the target image to obtain the features of the first image;

[0144] The second extraction module 630 is used to extract features from the target hypergraph to obtain the features of the second hypergraph;

[0145] The fusion module 640 is used to fuse the features of each object to be analyzed in the first image features and the second image features to obtain the target fused features of each object to be analyzed.

[0146] The abnormal object determination module 650 is used to determine abnormal objects with abnormal behavior from multiple objects to be analyzed based on the target fusion features of multiple objects to be analyzed.

[0147] Optionally, the device further includes a hypergraph construction module, used to determine the hypergraph nodes corresponding to each of the multiple objects to be analyzed and the object behavior similarity between the multiple objects to be analyzed based on the object behavior characteristics of the multiple objects to be analyzed; for any at least two objects to be analyzed, if the object behavior similarity between the at least two objects to be analyzed reaches a first similarity threshold, the hypergraph nodes corresponding to the at least two objects to be analyzed are connected to the same hyperedge to obtain the target hypergraph.

[0148] Optionally, the hypergraph construction module is also used to determine the hypergraph nodes corresponding to each of the multiple objects to be analyzed based on the object behavior characteristics of the multiple objects to be analyzed; and to connect the hypergraph nodes corresponding to the multiple objects to be analyzed that share the target behavior information to the same hyperedge to obtain the target hypergraph.

[0149] Optionally, the device further includes a graph construction module, used to determine the graph nodes corresponding to each of the multiple objects to be analyzed and the object behavior similarity between the multiple objects to be analyzed based on the object behavior characteristics of the multiple objects to be analyzed; for any two objects to be analyzed, if the object behavior similarity between the two objects to be analyzed reaches a second similarity threshold, a connection edge is established between the two graph nodes corresponding to the two objects to be analyzed to obtain the target graph.

[0150] Optionally, the second extraction module 630 is further configured to aggregate the hypergraph nodes connected by each hyperedge in the target hypergraph to obtain the hyperedge representation of each hyperedge; update each hypergraph node based on the hyperedge representation of the hyperedge connected to each hypergraph node to obtain an intermediate hypergraph; and perform feature encoding on the intermediate hypergraph to obtain the second graph features.

[0151] Optionally, the fusion module 640 is further configured to project the features of each object to be analyzed in the first image features to obtain the first projected features corresponding to each object to be analyzed; project the features of each object to be analyzed in the second image features to obtain the second projected features corresponding to each object to be analyzed; and perform feature fusion on the first projected features and the second projected features of each object to be analyzed to obtain the target fusion features of each object to be analyzed.

[0152] Optionally, the first image features are extracted using a graph neural network, and the second image features are extracted using a hypergraph neural network. The device further includes a training module for acquiring sample graphs and sample hypergraphs corresponding to multiple sample objects. The sample graph includes multiple sample connection edges and sample graph nodes corresponding to each sample object. Each sample graph node is used to indicate the object behavior of the corresponding sample object, and the sample graph nodes corresponding to two sample objects associated with the object behavior are connected by a sample connection edge. The sample hypergraph includes a sample hypergraph node corresponding to each sample object and multiple sample hyperedges. Each sample hypergraph node is used to indicate the object behavior of the corresponding sample object, and the sample hypergraph nodes corresponding to multiple sample objects associated with the object behavior are connected to the same sample hyperedge. The graph neural network extracts features from the sample graph to obtain the first sample graph features. The hypergraph neural network extracts features from the sample hypergraph to obtain the second sample graph features. Based on the first and second sample graph features, positive and negative sample pairs corresponding to each sample object are constructed. The graph neural network and the hypergraph neural network are trained based on the positive and negative sample pairs corresponding to multiple sample objects.

[0153] Optionally, the training module is further configured to determine positive sample pairs of the reference sample object based on the features of the reference sample object in the features of the first sample map and the features of the reference sample object in the features of the second sample map; the reference sample object is any one of the multiple sample objects; and to determine negative sample pairs of the reference sample object based on the features of the reference sample object in the features of the first sample map and the features of the other sample objects in the features of the second sample map; the other sample objects are the sample objects other than the reference sample object among the multiple sample objects.

[0154] Optionally, the training module is also used to determine the mutual information of each sample object based on the positive and negative sample pairs corresponding to each sample object; determine the optimization function value based on the mutual information of multiple sample objects; and train the graph neural network and the hypergraph neural network with the goal of maximizing the optimization function value.

[0155] Optionally, the abnormal object determination module 650 is further configured to cluster the target fusion features of multiple objects to be analyzed to obtain at least one cluster center; determine the abnormal score of each object to be analyzed based on the target fusion features of each object to be analyzed and at least one cluster center; and determine the abnormal objects with abnormal behavior from the multiple objects to be analyzed based on the abnormal scores of multiple objects to be analyzed.

[0156] Optionally, the abnormal object determination module 650 is further configured to, for each object to be analyzed, obtain the cluster center that is closest to the target fusion feature of the object to be analyzed from at least one cluster center, and use it as the target cluster center of the object to be analyzed; and determine the abnormal score of each object to be analyzed based on the target fusion feature and the target cluster center of each object to be analyzed.

[0157] Optionally, the anomaly object determination module 650 is also used to determine the anomaly score of each object to be analyzed based on the target fusion features of each object to be analyzed and the relative distance between the target cluster centers.

[0158] It should be noted that the device embodiments in this application correspond to the aforementioned method embodiments. The specific principles in the device embodiments can be found in the content of the aforementioned method embodiments, and will not be repeated here.

[0159] Figure 7 A structural block diagram of an electronic device for performing an anomaly analysis method according to an embodiment of this application is shown. The electronic device may be... Figure 1 The terminal (110) or server (120), etc., should be noted. Figure 7 The computer system 1200 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0160] like Figure 7As shown, the computer system 1200 includes a Central Processing Unit (CPU) 1201, which can perform various appropriate actions and processes, such as executing the methods described in the above embodiments, based on programs stored in Read-Only Memory (ROM) 1202 or programs loaded from storage portion 1208 into Random Access Memory (RAM) 1203. The RAM 1203 also stores various programs and data required for system operation. The CPU 1201, ROM 1202, and RAM 1203 are interconnected via a bus 1204. An Input / Output (I / O) interface 1205 is also connected to the bus 1204.

[0161] The following components are connected to I / O interface 1205: an input section 1206 including a keyboard, mouse, etc.; an output section 1207 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1208 including a hard disk, etc.; and a communication section 1209 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 1209 performs communication processing via a network such as the Internet. A drive 1210 is also connected to I / O interface 1205 as needed. Removable media 1211, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 1210 as needed so that computer programs read from them can be installed into storage section 1208 as needed.

[0162] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 1209, and / or installed from removable medium 1211. When the computer program is executed by central processing unit (CPU) 1201, it performs various functions defined in the system of this application.

[0163] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such transmitted data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0164] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0165] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0166] In another aspect, this application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable storage medium carries computer-readable instructions that, when executed by a processor, implement the methods in any of the above embodiments.

[0167] According to one aspect of the embodiments of this application, a computer program product is provided, the computer program product including computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the electronic device to perform the methods of any of the above embodiments.

[0168] In the embodiments of this application, the terms "module" or "unit" refer to a part of a computer program with a predetermined function, which works together with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (e.g., processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that functions as a whole.

[0169] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0170] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause an electronic device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the methods according to the embodiments of this application.

[0171] Other embodiments of this application will readily conceive of by those skilled in the art upon consideration of the specification and practice of the embodiments disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. It should be understood that this application is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

[0172] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. An anomaly analysis method, characterized in that, The method includes: Obtain a target graph and a target hypergraph corresponding to multiple objects to be analyzed; the target graph includes multiple connecting edges and a graph node corresponding to each object to be analyzed, each graph node is used to indicate the object behavior of the corresponding object to be analyzed, and the graph nodes corresponding to two objects to be analyzed that are associated with the object behavior are connected by a connecting edge; the target hypergraph includes a hypergraph node corresponding to each object to be analyzed and multiple hyperedges, each hypergraph node is used to indicate the object behavior of the corresponding object to be analyzed, and the hypergraph nodes corresponding to multiple objects to be analyzed that are associated with the object behavior are connected to the same hyperedge; Feature extraction is performed on the target image to obtain the features of the first image; Feature extraction is performed on the target hypergraph to obtain the features of the second graph; The features of each object to be analyzed in the first graph feature and the second graph feature are fused to obtain the target fused feature of each object to be analyzed. Based on the target fusion features of the multiple objects to be analyzed, abnormal objects with abnormal behavior are identified from the multiple objects to be analyzed.

2. The method according to claim 1, characterized in that, Before obtaining the target graph and target hypergraph corresponding to multiple objects to be analyzed, the method further includes: Based on the object behavior characteristics of the multiple objects to be analyzed, determine the hypergraph nodes corresponding to each of the multiple objects to be analyzed and the object behavior similarity among the multiple objects to be analyzed. For any two objects to be analyzed, if the similarity of the object behaviors between any two objects reaches a first similarity threshold, the hypergraph nodes corresponding to the two objects to be analyzed are connected to the same hyperedge to obtain the target hypergraph.

3. The method according to claim 1, characterized in that, Before obtaining the target graph and target hypergraph corresponding to multiple objects to be analyzed, the method further includes: Based on the object behavior characteristics of the multiple objects to be analyzed, the hypergraph nodes corresponding to each of the multiple objects to be analyzed are determined; Connect the nodes of the hypergraph corresponding to multiple objects to be analyzed that share target behavior information to the same hyperedge to obtain the target hypergraph.

4. The method according to claim 1, characterized in that, Before obtaining the target graph and target hypergraph corresponding to multiple objects to be analyzed, the method further includes: Based on the object behavior characteristics of the multiple objects to be analyzed, the graph nodes corresponding to each of the multiple objects to be analyzed and the object behavior similarity between the multiple objects to be analyzed are determined. For any two objects to be analyzed, if the similarity of the object behaviors between the two objects to be analyzed reaches the second similarity threshold, a connection edge is established between the two graph nodes corresponding to the two objects to be analyzed to obtain the target graph.

5. The method according to claim 1, characterized in that, The step of extracting features from the target hypergraph to obtain the features of the second graph includes: Aggregate the hypergraph nodes connected by each hyperedge in the target hypergraph to obtain the hyperedge representation of each hyperedge; Each hypergraph node is updated based on the hyperedge representation of the hyperedge connected to each hypergraph node to obtain an intermediate hypergraph. The intermediate hypergraph is feature-encoded to obtain the features of the second graph.

6. The method according to claim 1, characterized in that, The process of fusing the features of each object to be analyzed in the first graph feature and the second graph feature to obtain the target fused feature of each object to be analyzed includes: Project the features of each object to be analyzed in the first graph feature to obtain the first projected feature corresponding to each object to be analyzed; Project the features of each object to be analyzed in the second graph feature to obtain the second projected feature corresponding to each object to be analyzed; The first projection feature and the second projection feature of each object to be analyzed are fused to obtain the target fused feature of each object to be analyzed.

7. The method according to claim 1, characterized in that, The first image feature is extracted using a graph neural network, and the second image feature is extracted using a hypergraph neural network. Before performing feature extraction on the sample image to obtain the features of the first image, the method further includes: Obtain the corresponding sample graph and sample hypergraph for multiple sample objects; the sample graph includes multiple sample connection edges and a sample graph node corresponding to each sample object, each sample graph node is used to indicate the object behavior of the corresponding sample object, and the sample graph nodes corresponding to two sample objects with associated object behavior are connected by a sample connection edge; the sample hypergraph includes a sample hypergraph node corresponding to each sample object and multiple sample hyperedges, each sample hypergraph node is used to indicate the object behavior of the corresponding sample object, and the sample hypergraph nodes corresponding to multiple sample objects with associated object behavior are connected to the same sample hyperedge; The first sample image features are obtained by extracting features from the sample image using the graph neural network. The sample hypergraph features are extracted by the hypergraph neural network to obtain the second sample graph features; Based on the first sample map features and the second sample map features, construct positive sample pairs and negative sample pairs corresponding to each sample object; The graph neural network and the hypergraph neural network are trained based on the positive and negative sample pairs corresponding to each of the multiple sample objects.

8. The method according to claim 7, characterized in that, The step of constructing positive and negative sample pairs for each sample object based on the features of the first and second sample maps includes: Based on the features of the reference sample object in the first sample map features and the features in the second sample map features, a positive sample pair of the reference sample object is determined; the reference sample object is any one of the plurality of sample objects. Based on the features of the reference sample object in the first sample map features and the features of other sample objects in the second sample map features, negative sample pairs of the reference sample object are determined; the other sample objects are sample objects other than the reference sample object among the plurality of sample objects.

9. The method according to claim 7, characterized in that, The step of training the graph neural network and the hypergraph neural network based on the positive and negative sample pairs corresponding to each of the multiple sample objects includes: Based on the positive and negative sample pairs corresponding to each sample object, the mutual information of each sample object is determined; The optimal function value is determined based on the mutual information of the multiple sample objects; The graph neural network and the hypergraph neural network are trained with the goal of maximizing the value of the optimization function.

10. The method according to claim 1, characterized in that, The step of determining abnormal objects exhibiting anomalous behavior from the multiple objects to be analyzed based on the target fusion features of the multiple objects to be analyzed includes: Cluster the target fusion features of the multiple objects to be analyzed to obtain at least one cluster center; Based on the target fusion features of each object to be analyzed and the at least one cluster center, an anomaly score is determined for each object to be analyzed. Based on the anomaly scores of the multiple objects to be analyzed, anomaly objects with abnormal behavior are identified from the multiple objects to be analyzed.

11. The method according to claim 10, characterized in that, The step of determining the anomaly score of each object to be analyzed based on the target fusion features of each object and the at least one cluster center includes: For each object to be analyzed, the cluster center that is closest to the target fusion feature of the object to be analyzed is obtained from the at least one cluster center and used as the target cluster center of the object to be analyzed; Based on the target fusion features and target cluster centers of each object to be analyzed, an anomaly score is determined for each object to be analyzed.

12. The method according to claim 11, characterized in that, The step of determining the anomaly score of each object to be analyzed based on the target fusion features and target cluster centers of each object to be analyzed includes: Anomaly score for each object to be analyzed is determined based on the target fusion features of each object and the relative distance between target cluster centers.

13. An anomaly analysis device, characterized in that, The device includes: The acquisition module is used to acquire target graphs and target hypergraphs corresponding to multiple objects to be analyzed. The target graph includes multiple connecting edges and a graph node corresponding to each object to be analyzed. Each graph node is used to indicate the object behavior of the corresponding object to be analyzed. Graph nodes corresponding to two objects to be analyzed that are associated with each object behavior are connected by a connecting edge. The target hypergraph includes a hypergraph node corresponding to each object to be analyzed and multiple hyperedges. Each hypergraph node is used to indicate the object behavior of the corresponding object to be analyzed. Hypergraph nodes corresponding to multiple objects to be analyzed that are associated with each object behavior are connected to the same hyperedge. The first extraction module is used to extract features from the target image to obtain the features of the first image; The second extraction module is used to extract features from the target hypergraph to obtain the features of the second graph; The fusion module is used to fuse the features of each object to be analyzed in the first graph feature and the second graph feature to obtain the target fusion feature of each object to be analyzed. An abnormal object determination module is used to determine abnormal objects with abnormal behavior from the multiple objects to be analyzed based on the target fusion features of the multiple objects to be analyzed.

14. An electronic device, characterized in that, include: processor; A memory storing computer-readable instructions that, when executed by the processor, implement the method as described in any one of claims 1-12.

15. A computer-readable storage medium, characterized in that, It stores computer-readable instructions that, when executed by a processor, implement the method as described in any one of claims 1-13.

16. A computer program product, characterized in that, Includes computer instructions that, when executed by a processor, implement the method of any one of claims 1-12.

Images