Feature processing method and apparatus, electronic device, storage medium, and program product

Abstract

The application discloses a feature processing method and device, electronic equipment, a storage medium and a program product; the application can obtain an object relationship graph; feature interaction processing is performed on a plurality of object nodes in the object relationship graph to obtain target node feature information of the plurality of object nodes; node connection relationship information of the object nodes is determined according to an interaction relationship in the object relationship graph; the node connection relationship information of the object nodes is subjected to heterogenous edge denoising processing to obtain target node connection relationship information of the object nodes; and the object relationship graph is subjected to graph feature enhancement processing according to the target node feature information and the target node connection relationship information of the object nodes, to obtain a target object relationship graph after feature enhancement, so that the target object relationship graph is used for identifying an abnormal object. In the embodiment of the application, the target object relationship graph is helpful for coping with the highly disguised and concealed characteristics of abnormal behaviors. Therefore, the scheme can improve the identification accuracy of the abnormal object.

Description

Technical Field

[0001] This application relates to the field of computers, and specifically to a feature processing method, apparatus, electronic device, storage medium, and program product. Background Technology

[0002] With the rapid development of the internet, the amount of user interaction data has exploded in various fields such as social media, e-commerce, and financial transactions, and the complexity and diversity of interactions have increased significantly. Hidden within this massive amount of data is a large amount of interaction data related to abnormal behavior, such as interactions related to fraudulent transactions, malicious intrusions, and the leakage of sensitive information.

[0003] Current technologies typically employ anomaly detection models to analyze interaction data and identify anomalous data based on the analysis results, aiming to address potential security threats and enhance network protection capabilities. However, with the continuous advancement of adversarial technologies, anomalous behaviors are increasingly learning to mimic normal interaction patterns to evade detection. This highly disguised and stealthy nature makes these anomalous data difficult to detect, resulting in low accuracy for current anomaly detection models. Summary of the Invention

[0004] This application provides a feature processing method, apparatus, electronic device, storage medium, and program product. By performing graph feature enhancement processing on the object relationship graph, it can not only enhance the feature representation capability of object nodes, but also more accurately reflect the interaction relationship between object nodes. This helps to deal with the highly disguised and concealed characteristics of abnormal behavior, and provides a more reliable basis for the identification of abnormal objects. In this way, the accuracy of abnormal object identification can be improved.

[0005] This application provides a feature processing method, including:

[0006] Obtain the object relationship graph, which represents the interaction relationships between object nodes corresponding to multiple objects;

[0007] Feature interaction processing is performed on multiple object nodes in the object relationship graph to obtain the target node feature information of multiple object nodes;

[0008] Based on the interaction relationships in the object relationship graph, determine the node connection relationship information of the object nodes. The node connection relationship information includes the connection relationship information between the object node and other object nodes in the object relationship graph.

[0009] The node connection relationship information of the object node is denoised by heterogeneous edges to obtain the target node connection relationship information of the object node. Heterogeneous edges represent the interaction relationship between different types of object nodes.

[0010] Based on the target node feature information and target node connection relationship information of the object node, graph feature enhancement processing is performed on the object relationship graph to obtain the feature-enhanced target object relationship graph, so as to identify abnormal objects through the target object relationship graph.

[0011] This application embodiment also provides a feature processing apparatus, including:

[0012] The acquisition unit is used to acquire the object relationship graph, which represents the interaction relationship between object nodes corresponding to multiple objects.

[0013] The feature interaction unit is used to perform feature interaction processing on multiple object nodes in the object relationship graph to obtain the target node feature information of multiple object nodes.

[0014] The information determination unit is used to determine the node connection relationship information of object nodes based on the interaction relationship in the object relationship graph. The node connection relationship information includes the connection relationship information between the object node and other object nodes in the object relationship graph.

[0015] The denoising unit is used to perform heterogeneous edge denoising on the node connection relationship information of the object node to obtain the target node connection relationship information of the object node. The heterogeneous edges represent the interaction relationship between different types of object nodes.

[0016] The feature enhancement unit is used to perform graph feature enhancement processing on the object relationship graph based on the target node feature information and target node connection relationship information of the object nodes, so as to obtain the feature-enhanced target object relationship graph, and to identify abnormal objects through the target object relationship graph.

[0017] In some embodiments, the feature interaction unit includes a data enhancement subunit, a feature interaction subunit, and a feature projection subunit:

[0018] The data augmentation subunit is used to perform data augmentation processing on the node information of object nodes in the object relationship graph to obtain the processed node information of the object nodes.

[0019] The feature interaction subunit is used to perform feature interaction processing on the processed node information of each object node in the object relationship graph to obtain the node feature information of each object node in the object relationship graph.

[0020] The feature projection subunit is used to perform feature projection processing on the node feature information of the object node to obtain the target node feature information of the object node.

[0021] In some embodiments, the feature interaction subunit is used for:

[0022] For each object node in the object relationship graph, the processed node information of each neighbor node of the object node is fused to obtain the fused feature information.

[0023] Based on the fused feature information, the processed node information of the object node is iteratively updated to obtain the node feature information of the object node.

[0024] In some embodiments, based on the fused feature information, the processed node information of the object node is iteratively updated to obtain the node feature information of the object node, including:

[0025] Based on the fused feature information, the processed node information of the object node is updated to obtain the new processed node information of the object node.

[0026] Return to the step of fusing the processed node information of each neighbor node of each object node in the object relationship graph to obtain the node feature information of the object node.

[0027] In some embodiments, the denoising unit includes a noise prediction subunit, a similarity calculation subunit, a noise update subunit, and a denoising subunit:

[0028] The noise prediction subunit is used to perform noise prediction processing on the node connection relationship information of the object node to obtain the initial noise information of the node connection relationship information.

[0029] The similarity calculation subunit is used to calculate the similarity between the target node feature information of the object node and the target node feature information of the associated object node based on the node connection relationship information. The associated object node is the node connected to the object node in the object relationship graph.

[0030] The noise update subunit is used to update the initial noise information based on similarity to obtain the updated noise information.

[0031] The denoising subunit is used to denoise the node connection relationship information based on the updated noise information to obtain the target node connection relationship information of the object node.

[0032] In some embodiments, the noise update subunit is used for:

[0033] Based on node connection relationship information, calculate the number of node connections of the object node;

[0034] The initial noise information is updated based on similarity and the number of node connections to obtain the updated noise information.

[0035] In some embodiments, the noise reduction subunit is used for:

[0036] Based on the updated noise information, the node connection relationship information is denoised to obtain the denoised node connection relationship information.

[0037] The denoised node connection information is determined as the new node connection information of the object node. The process returns to perform noise prediction processing on the node connection information of the object node to obtain the initial noise information of the node connection information, thus obtaining the target node connection information of the object node.

[0038] In some embodiments, the acquisition unit includes a relational graph acquisition subunit and a graph decomposition subunit:

[0039] The relationship diagram acquisition sub-unit is used to obtain the original object relationship diagram, which represents the interaction relationships between multiple objects.

[0040] The graph decomposition subunit is used to decompose the original object relationship graph into multiple object relationship graphs.

[0041] In some embodiments, the graph decomposition subunit is used for:

[0042] The original object relationship graph is sampled multiple times to obtain the node group corresponding to each sample. The node group includes multiple object nodes.

[0043] For each node group, based on the interaction relationships of the object nodes in the node group in the original object relationship graph, the interaction relationships of the object nodes in the node group are constructed to obtain the object relationship graph corresponding to the node group.

[0044] In some embodiments, the feature enhancement unit is configured to:

[0045] Based on the target node feature information and target node connection relationship information of the object node, the node information and connection relationship of the object node in the object relationship graph are updated to obtain the updated object relationship graph.

[0046] The updated object relationship graphs are then fused to obtain the target object relationship graph.

[0047] In some embodiments, the feature enhancement unit is configured to:

[0048] Based on the target node feature information and target node connection relationship information of the object node, the node information and connection relationship of the object node in the object relationship graph are updated to obtain the updated object relationship graph.

[0049] Calculate the importance information of the associated nodes of the object nodes in the updated object relationship graph. The importance information of the associated nodes includes the importance information of other object nodes to the object node.

[0050] Based on the target node feature information, target node connection relationship information, and associated node importance information of the object node, graph feature enhancement processing is performed on the object relationship graph to obtain the feature-enhanced target object relationship graph.

[0051] In some embodiments, calculating the importance information of associated nodes of object nodes in the updated object relationship graph includes:

[0052] Identify path instances in the updated object relationship graph;

[0053] For each object node in the path instance, node traversal is performed by using the edges between object nodes in the updated object relationship graph to calculate the importance information of other object nodes in the path instance relative to the object node, thereby obtaining the importance information of associated nodes.

[0054] In some embodiments, calculating the importance information of associated nodes of object nodes in the updated object relationship graph includes:

[0055] Calculate the importance information of other object nodes to the object node;

[0056] Identify the object nodes whose importance information is greater than a preset value from other object nodes and request adjustment.

[0057] The importance information of the node to be adjusted is suppressed to obtain the processed importance information.

[0058] In some embodiments, after performing graph feature enhancement processing on the object relationship graph based on the target node feature information and target node connection relationship information of the object nodes to obtain the feature-enhanced target object relationship graph, the device further includes an anomaly recognition unit, used for:

[0059] Based on the object relationship graph, multi-dimensional anomaly feature extraction processing is performed on the target object relationship graph to obtain the feature information of each object node in the target object relationship graph under various dimensions;

[0060] Based on the feature information of each object node in the target object relationship graph under various dimensions, predict the probability information of each object node in the target object relationship graph belonging to an abnormal object node;

[0061] Based on probability information, abnormal objects are identified from the target object relationship graph.

[0062] In some embodiments, the feature projection subunit is used for:

[0063] The feature projection model is used to perform feature projection processing on the node feature information of the object node to obtain the target node feature information of the object node.

[0064] Before performing feature projection processing on the node feature information of the object node through the feature projection model to obtain the target node feature information of the object node, the device also includes a feature projection model training unit, used for:

[0065] Obtain the sample object relationship graph and the set of positive and negative samples for each sample object node in the sample object relationship graph;

[0066] Feature interaction processing is performed on each sample object node in the sample object relationship graph to obtain the initial node feature information of each sample object node;

[0067] The initial node feature information of the sample object node is processed by feature projection model to obtain the sample node feature information of the sample object node.

[0068] Based on the sample node feature information of the sample object node and the object feature information of the sample objects in the positive and negative sample sets of the sample object node, the parameters of the feature projection model are adjusted to obtain the trained feature projection model.

[0069] In some embodiments, the noise reduction unit is used for:

[0070] By using a relation diffusion generation model, the node connection relationship information of the object node is denoised by heterogeneous edges to obtain the target node connection relationship information of the object node.

[0071] Before obtaining the target node connection information of the object node through heterogeneous edge denoising processing of the node connection relationship information of the object node using the relation diffusion generation model, the device also includes a relation diffusion generation model training unit, used for:

[0072] Acquire training data, which includes node connection information of sample object nodes in the sample object relationship graph;

[0073] The node connection relationship information of the sample object nodes is noise-added to obtain the noise-added connection relationship information;

[0074] By using a relation diffusion generation model, the noisy connection relation information is denoised by heterogeneous edges to obtain the denoised connection relation information.

[0075] Based on the denoised connection relationship information and the node connection relationship information of the sample object nodes, the parameters of the relationship diffusion generation model are adjusted to obtain the trained relationship diffusion generation model.

[0076] This application also provides an electronic device, including a processor and a memory, wherein the memory stores a plurality of instructions; the processor loads instructions from the memory to execute steps in any of the feature processing methods provided in this application.

[0077] This application also provides a computer-readable storage medium storing a plurality of instructions adapted for loading by a processor to execute steps in any of the feature processing methods provided in this application.

[0078] This application also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps in any of the feature processing methods provided in this application.

[0079] This application embodiment can obtain an object relationship graph, which represents the interaction relationships between object nodes corresponding to multiple objects; perform feature interaction processing on multiple object nodes in the object relationship graph to obtain target node feature information of multiple object nodes; determine the node connection relationship information of object nodes based on the interaction relationships in the object relationship graph, including the connection relationship information between object nodes and other object nodes in the object relationship graph; perform heterogeneous edge denoising processing on the node connection relationship information of object nodes to obtain target node connection relationship information of object nodes, where heterogeneous edges represent the interaction relationships between object nodes of different types; and perform graph feature enhancement processing on the object relationship graph based on the target node feature information and target node connection relationship information of object nodes to obtain a feature-enhanced target object relationship graph, so as to identify abnormal objects through the target object relationship graph.

[0080] In this application, after obtaining the object relationship graph, feature interaction processing can be performed on multiple object nodes in the graph to enhance their feature representation capabilities and obtain target node feature information. Furthermore, based on the interaction relationships in the object relationship graph, node connection relationship information can be obtained. By performing heterogeneous edge denoising processing on the node connection relationship information, heterogeneous edges representing the interaction relationships between different types of object nodes can be removed, resulting in more accurate target node connection relationship information. By combining the target node feature information with the target node connection relationship information, graph feature enhancement processing can be performed on the object relationship graph. The target object relationship graph after feature enhancement processing not only enhances the feature representation capabilities of object nodes but also more accurately reflects the interaction relationships between object nodes. This processing method can effectively address the highly disguised and concealed characteristics of abnormal behavior, providing a more reliable foundation for the identification of abnormal objects. Therefore, the accuracy of abnormal object identification is improved. Attached Figure Description

[0081] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0082] Figure 1a This is a schematic diagram of a scenario for the feature processing method provided in an embodiment of this application;

[0083] Figure 1b This is a schematic flowchart of the feature processing method provided in the embodiments of this application;

[0084] Figure 2a This is a flowchart illustrating the application of the feature processing method provided in this application embodiment in a graph decomposition scenario;

[0085] Figure 2b This is a schematic diagram of a scene after the original object relationship diagram provided in the embodiments of this application has been processed by the feature processing method;

[0086] Figure 3 This is a schematic diagram of the feature processing device provided in the embodiments of this application;

[0087] Figure 4 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0088] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0089] This application provides a feature processing method, apparatus, electronic device, storage medium, and program product.

[0090] Specifically, the feature processing device can be integrated into an electronic device, such as a terminal or server. The terminal can be a mobile phone, tablet, smart Bluetooth device, laptop, or personal computer (PC); the server can be a single server or a server cluster consisting of multiple servers.

[0091] In some embodiments, the feature processing device may also be integrated into multiple electronic devices, such as multiple servers, with multiple servers implementing the feature processing method of this application.

[0092] In some embodiments, the terminal can also be used as a server to implement some or all of the functions of a server.

[0093] In this application embodiment, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0094] It is understood that in the specific implementation of this application, data related to the interaction relationship between object nodes corresponding to objects is involved. When the embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0095] For example, refer to Figure 1a This electronic device can acquire an object relationship graph, which represents the interaction relationships between object nodes corresponding to multiple objects; perform feature interaction processing on multiple object nodes in the object relationship graph to obtain target node feature information of multiple object nodes; determine the node connection relationship information of object nodes based on the interaction relationships in the object relationship graph, including the connection relationship information between object nodes and other object nodes in the object relationship graph; perform heterogeneous edge denoising processing on the node connection relationship information of object nodes to obtain target node connection relationship information of object nodes, where heterogeneous edges represent the interaction relationships between object nodes of different types; and perform graph feature enhancement processing on the object relationship graph based on the target node feature information and target node connection relationship information of object nodes to obtain a feature-enhanced target object relationship graph, so as to identify abnormal objects through the target object relationship graph.

[0096] After obtaining the object relationship graph, this application performs feature interaction processing on multiple object nodes in the graph to enhance their feature representation capabilities and obtain target node feature information. Furthermore, based on the interaction relationships in the object relationship graph, node connection relationship information can be obtained. By performing heterogeneous edge denoising processing on the node connection relationship information, heterogeneous edges representing interactions between different types of object nodes can be removed, resulting in more accurate target node connection relationship information. By combining the target node feature information with the target node connection relationship information, graph feature enhancement processing can be performed on the object relationship graph. The target object relationship graph after feature enhancement not only enhances the feature representation capabilities of object nodes but also more accurately reflects the interaction relationships between object nodes. This processing method can effectively address the highly disguised and concealed characteristics of abnormal behavior, providing a more reliable foundation for the identification of abnormal objects. Therefore, the accuracy of abnormal object identification is improved.

[0097] The following sections provide detailed descriptions of each example. It should be noted that the sequence numbers of the following embodiments are not intended to limit the preferred order of the embodiments.

[0098] In this embodiment, a feature processing method is provided, such as Figure 1b As shown, the specific process of this feature processing method can be as follows:

[0099] 101. Obtain the object relationship graph, which represents the interaction relationships between object nodes corresponding to multiple objects.

[0100] In this context, an object refers to an entity capable of interaction. For example, in scenarios such as social media, e-commerce, and financial transactions, objects can be users, user accounts, etc. In cybersecurity scenarios, objects can be devices, internet addresses, etc. In logistics scenarios, objects can refer to goods, warehouses, etc. In healthcare scenarios, objects can be medicines, etc. In the Internet of Things (IoT) scenario, objects can be sensors, devices, smart furniture, etc.

[0101] An object node is a node that represents an object.

[0102] For example, when the object is a user or user account, the object node can represent the user's interaction information. When the object is a device or internet address, the object node can represent device information. When the object is goods or a warehouse, the object node can represent goods information or warehouse information. When the object is medicine, the object node can represent medicine information. When the object is smart furniture, the object node can represent smart furniture information, and so on.

[0103] Interaction relationships are used to describe the interaction between two entities. For example, interaction relationships can refer to transactions, information exchanges, goods delivery, drug distribution, and data transmission between two entities.

[0104] An object relationship graph is a graph that represents the interaction relationships between multiple object nodes, where multiple object nodes correspond one-to-one with multiple objects.

[0105] In some embodiments, in order to disrupt the interaction relationships of some nodes in the original object relationship graph, thereby cutting off potentially heterogeneous edges, and to reduce the computational cost of directly performing graph feature enhancement processing on the original object relationship graph, the method for obtaining the object relationship graph includes:

[0106] Obtain the original object relationship graph, which represents the interaction relationships between multiple objects;

[0107] The original object relationship graph is decomposed into multiple object relationship graphs.

[0108] The original object relationship graph is generated based on the obtained interaction relationships between multiple objects, and it contains all the interaction relationships between the multiple objects. The original object relationship graph includes multiple object nodes and the edges between the object nodes. There is a one-to-one correspondence between multiple object nodes and multiple objects, and the edges between the object nodes represent the interaction relationships between the objects corresponding to the object nodes.

[0109] An object relationship graph is a subgraph extracted and decomposed from the original object relationship graph. It only contains the interaction relationships between some objects in the original object relationship graph.

[0110] In some embodiments, in order to retain node information related to objects while severing some interaction relationships between nodes when performing graph structure decomposition on the original object relationship graph, the original object relationship graph is subjected to graph structure decomposition processing to obtain multiple object relationship graphs, including:

[0111] The original object relationship graph is sampled multiple times to obtain the node group corresponding to each sample. The node group includes multiple object nodes.

[0112] For each node group, based on the interaction relationships of the object nodes in the node group in the original object relationship graph, the interaction relationships of the object nodes in the node group are constructed to obtain the object relationship graph corresponding to the node group.

[0113] Among them, the node group is a set of object nodes extracted by sampling the original object relationship graph.

[0114] For example, if the original object relationship graph contains n object nodes, and the sampling quantity is set to x, where x is less than n, when sampling the original object relationship graph, a node group containing x object nodes is obtained. Based on the interaction relationship of the x object nodes in the node group in the original object relationship graph, the object relationship graph corresponding to the node group is constructed.

[0115] In some embodiments, each object node in the original object relationship graph may be sampled only once to ensure that the same node does not appear in multiple node groups.

[0116] In some embodiments, the same object node in the original object relationship graph may be sampled multiple times so that the object node can be in multiple node groups.

[0117] In some embodiments, there may be at least one interaction relationship between two object nodes in the node group in the original object relationship graph. When constructing the object relationship graph, the at least one interaction relationship can be merged so that the edges in the object relationship graph can represent at least one interaction relationship.

[0118] For example, when the original object relationship graph is a social network graph, nodes represent users, and edges represent different interaction relationships. A user may have two interaction relationships with another user: "like" and "comment". If these two interaction relationships are merged when constructing the object relationship graph, then there will only be one edge between the two users, representing their interaction, and this edge can contain information of both interaction types (such as like and comment).

[0119] 102. Perform feature interaction processing on multiple object nodes in the object relationship graph to obtain the target node feature information of multiple object nodes.

[0120] The target node feature information is a comprehensive feature representation of each object node obtained after feature interaction processing of multiple object nodes in the object relationship graph. It reflects the differences between normal and abnormal object nodes. In some embodiments, to improve the feature representation capability of object nodes in the object relationship graph and thus enhance the differences between different types of nodes, feature interaction processing is performed on multiple object nodes in the object relationship graph to obtain target node feature information for multiple object nodes, including:

[0121] Data augmentation is performed on the node information of object nodes in the object relationship graph to obtain the processed node information of the object nodes;

[0122] After processing the node information of each object node in the object relationship graph, feature interaction processing is performed to obtain the node feature information of each object node in the object relationship graph.

[0123] The node feature information of the object node is processed by feature projection to obtain the target node feature information of the object node.

[0124] Among them, node information is the relevant information of the object represented by the object node. This node information may include the object's basic attributes, historical behavior data, interaction relationships with other objects, the object's current state and location, etc.

[0125] Data augmentation refers to processing operations that transform the node information of object nodes, such as feature perturbation and feature combination, to increase data diversity and enrich the feature representation of data.

[0126] In some embodiments, in an object relationship graph, if the interaction relationship between object nodes is a transaction relationship, then the node information of an object node may include transaction information between that object node and other object nodes with which it has a transaction relationship, such as transaction amount, number of transactions, etc. By perturbing features, this specific transaction information (such as transaction amount, number of transactions) can be converted into a range or interval, or random noise can be added to the transaction information, thereby increasing the diversity of the data and improving the robustness of the model.

[0127] For example, in an object relationship graph, the node information of object node A includes a transaction amount of 150 yuan and 8 transactions with object node B. Through feature perturbation, a transaction amount range of [140, 160] yuan and a transaction count range of [7, 9] transactions can be generated. These ranges can then be defined as interval features; for example, a transaction amount range of [140, 160] yuan is considered a "medium transaction amount," and a transaction count range of [7, 9] transactions is considered a "medium transaction count." Alternatively, random noise (e.g., ±10%) can be added to the transaction amount of 150 yuan and the number of transactions of 8 to cause slight fluctuations in the transaction information.

[0128] In some embodiments, the node information of an object node may include multiple transaction features between the object node and other object nodes with which it has a transaction relationship, such as object activity and number of transactions. By combining features, these multiple transaction features (such as object activity and number of transactions) can be combined to generate new and more informative transaction features (such as "active transaction rate" and "transaction frequency"). This method can improve the expressive power of node information.

[0129] Post-processing node information refers to the new node information obtained after data augmentation of the object node's node information. For example, post-processing node information may include the node information before data augmentation, the newly added node information after data augmentation, or it may only include the newly added node information after data augmentation, and so on.

[0130] Node feature information is the interactive feature representation of each object node obtained after feature interaction processing of multiple object nodes in the object relationship graph.

[0131] Feature projection processing refers to mapping high-dimensional node feature information to a low-dimensional space to generate concise and discriminative feature representations. For example, feature projection processing can be linear projection, task-driven projection, clustering-based projection, and so on.

[0132] Linear projection maps high-dimensional features to a low-dimensional space through linear transformation. Linear projection methods include principal component analysis (PCA), linear discriminant analysis (LDA), and fully connected layers. PCA maps high-dimensional features to a low-dimensional space by calculating the principal components of the features. LDA maximizes the discriminant power between classes while reducing dimensionality. Fully connected layers use fully connected layers in a neural network to perform linear transformations on the features.

[0133] Task-driven projection designs feature projection methods based on specific downstream tasks (such as classification and clustering). Task-driven projection methods can be supervised learning models, projection layers in graph neural networks, etc. Supervised learning models use classifiers (such as logistic regression and support vector machines) to project features, while projection layers in graph neural networks add a fully connected layer at the end of the graph neural network to map node feature information to a low-dimensional space.

[0134] Cluster-based projection maps high-dimensional features to a low-dimensional space using clustering methods. Cluster-based projection methods include K-means clustering, spectral clustering, etc. K-means clustering divides high-dimensional features into K clusters and maps each sample to the center of its cluster. Spectral clustering maps high-dimensional features to a low-dimensional space using a graph Laplacian matrix.

[0135] The target node feature information is the feature information corresponding to the node feature information of the object node after feature projection.

[0136] In some embodiments, in order to process and fuse the feature information of each object node and its neighboring nodes in the object relationship graph, and progressively update the node feature information of the object nodes to improve the feature representation capability of the object nodes, feature interaction processing is performed on the processed node information of each object node in the object relationship graph to obtain the node feature information of each object node in the object relationship graph, including:

[0137] For each object node in the object relationship graph, the processed node information of each neighbor node of the object node is fused to obtain the fused feature information.

[0138] Based on the fused feature information, the processed node information of the object node is iteratively updated to obtain the node feature information of the object node.

[0139] In this context, a neighbor node is an object node that has an interactive relationship with an object node in the object relationship graph.

[0140] The fused feature information is the feature information obtained by fusing the processed node information of each neighbor node of the object node.

[0141] in, and These are nodes v i The representation matrices of the (l+1)th and (l)th layers of the network, N i Represents node v i The set of one-hop neighbor nodes, This represents the average value obtained by fusing the processed node information of each neighbor node in the neighbor node set, i.e., the fused feature information. σ is a non-linear activation function, such as the Corrected Linear Unit (ReLU), W (l) It is a weight matrix used to iteratively update the node information after processing the object node.

[0142] In some embodiments, to enable an object node to progressively integrate the feature information of its directly and indirectly connected neighboring nodes, thereby enhancing the feature representation capability of the object node, the processed feature information of the object node is iteratively updated based on the integrated feature information to obtain the node feature information of the object node, including:

[0143] Based on the fused feature information, the processed node information of the object node is updated to obtain the new processed node information of the object node.

[0144] Return to the step of fusing the processed node information of each neighbor node of each object node in the object relationship graph to obtain the node feature information of the object node.

[0145] Among them, the new processed feature information refers to the feature information obtained by fusing the processed feature information of each of the current neighboring nodes of the object node.

[0146] For example, consider an object relationship diagram including object node a, object node b, object node c, object node d, and object node e, where object node a has interactive relationships with object node b and object node d, object node b has interactive relationships with object node a and object node c, and object node c has interactive relationships with object node b and object node e.

[0147] In the process of iteratively updating the node information after processing the object node to obtain the node feature information:

[0148] In the first iteration, for object node a, its corresponding fused feature information is: For object node b, its corresponding fused feature information is: For object node c, its corresponding fused feature information is: For object node d, its corresponding fused feature information is: For object node e, its corresponding fused feature information

[0149] The fused feature information obtained in the first iteration is used to update the processed feature information of each object node, resulting in new processed node information for the object node.

[0150] In the second iteration,

[0151] The fused feature information obtained in the second iteration is used to update the processed feature information of each object node obtained in the first iteration, resulting in new processed feature information. For the second iteration update, since the processed feature information of object nodes a, b, c, d, and e already covers the processed feature information of directly connected and indirectly connected object nodes, the new processed node information obtained by each object node in the second round is used as the node feature information.

[0152] In some embodiments, in order to distinguish different types of object nodes after feature projection processing, the node feature information of the object nodes is subjected to feature projection processing to obtain the target node feature information of the object nodes, including:

[0153] The feature projection model is used to perform feature projection processing on the node feature information of the object node to obtain the target node feature information of the object node.

[0154] Before performing feature projection processing on the node feature information of the object node using a feature projection model to obtain the target node feature information of the object node, the following steps are also included:

[0155] Obtain the sample object relationship graph and the set of positive and negative samples for each sample object node in the sample object relationship graph;

[0156] Feature interaction processing is performed on each sample object node in the sample object relationship graph to obtain the initial node feature information of each sample object node;

[0157] The initial node feature information of the sample object node is processed by feature projection model to obtain the sample node feature information of the sample object node.

[0158] Based on the sample node feature information of the sample object node and the object feature information of the sample objects in the positive and negative sample sets of the sample object node, the parameters of the feature projection model are adjusted to obtain the trained feature projection model.

[0159] Feature projection models generate concise and discriminative feature representations by mapping high-dimensional node features to a low-dimensional space. For example, feature projection models can be based on linear projection, task-driven projection, clustering-based projection, and so on. The sample object relationship graph is the object relationship graph used to train the feature projection model.

[0160] A sample object node is an object node in the sample object relationship graph.

[0161] The positive and negative sample set is the set of positive and negative samples of sample object nodes in the sample object relationship graph. It can be understood that the objects represented by sample object nodes marked as normal in the sample object relationship graph belong to the positive samples of the sample object node, while the objects represented by sample object nodes marked as abnormal belong to the negative samples of the sample object node.

[0162] The initial node feature information is the interactive feature representation obtained by each sample object node after feature interaction processing of multiple sample object nodes in the sample object relationship graph.

[0163] Sample node feature information is the feature information corresponding to the initial node feature information of the sample object after feature projection.

[0164] The trained feature projection model is a process of comparing the feature information of sample object nodes with the object feature information of sample objects in the positive and negative sample sets, calculating the loss, and adjusting the model parameters. The final result is a model that can effectively map the sample node feature information of sample objects to the feature space. By optimizing the parameters during training, this model makes the distribution of positive and negative samples in the feature space more reasonable, achieving better classification or feature discrimination results.

[0165] When adjusting the parameters of the feature projection model, the object node v i The loss function for feature projection is:

[0166]

[0167] Among them, L GCL It is the contrastive loss function, z i It is the embedding vector of object node i, z i =Proj(Encoder(x) i ))∈Rh "·" denotes the inner product, τ∈R + A(i) is a scalar temperature parameter, and h represents the dimension of the object node projection. train \{v i} is the exception to the object node v i The set of all training object nodes outside of the set of positive and negative samples. P(i) = {v P ∈A(i); y P =y i Let} be the set of all positive samples in the training batch that are different from object node i, and |P(i)| be its cardinality. This loss function encourages object nodes with the same label to move closer to each other in the embedding space during training, while object nodes with different labels are kept as far apart as possible.

[0168] 103. Based on the interaction relationships in the object relationship graph, determine the node connection relationship information of the object nodes. The node connection relationship information includes the connection relationship information between the object node and other object nodes in the object relationship graph.

[0169] Among them, node connection information refers to structured data that can represent the interaction relationships between nodes in an object relationship graph. For example, node connection information can be an adjacency matrix, an adjacency list, etc.

[0170] An adjacency matrix is ​​a two-dimensional matrix where each element represents whether there is a connection between two objects in the graph. If there is a connection between node i and node j, the matrix element has a value of 1 (or a numerical value representing the connection strength); otherwise, it has a value of 0.

[0171] For example, the adjacency matrix is:

[0172]

[0173] In this diagram, the first row and first column represent node A, the second row and second column represent node B, and so on. A value of 1 in the first row and second column (A and B) indicates an interaction between A and B. Similarly, a value of 1 in the third row and fourth column (C and D) indicates an interaction between C and D.

[0174] An adjacency list represents connections by listing all neighboring nodes for each object node. For example, for object node i, a list of all nodes directly connected to it can be provided.

[0175] Other object nodes refer to any object node in the object relationship graph that is not the object node itself.

[0176] Connection information indicates the interaction between two object nodes. For example, when the node connection information is an adjacency matrix, a connection value of 1 indicates an interaction between the two objects, while a connection value of 0 indicates no interaction. When the node connection information of an object node is an adjacency list, the connection information indicates that the object node interacts with other object nodes in the adjacency list; object nodes not in the adjacency list do not interact with the object node.

[0177] 104. Perform heterogeneous edge denoising on the node connection relationship information of the object node to obtain the target node connection relationship information of the object node. Heterogeneous edges represent the interaction relationship between different types of object nodes.

[0178] In this context, heterogeneous edges are edges that connect object nodes of different types in an object relationship graph, representing the interaction relationships between these different types of object nodes. For example, if different types of object nodes include normal object nodes and abnormal object nodes, then heterogeneous edges are the edges corresponding to the interaction relationships between normal object nodes and abnormal object nodes.

[0179] Target node connection information refers to the connection relationship information between object nodes remaining after removing the connection relationship information represented by heterogeneous edges. In some embodiments, in order to identify and remove heterogeneous edges in the object relationship graph, thereby more accurately reflecting the interaction relationship between object nodes, the node connection relationship information of object nodes is subjected to heterogeneous edge denoising processing to obtain the target node connection relationship information of object nodes, including:

[0180] Noise prediction processing is performed on the node connection relationship information of the object nodes to obtain the initial noise information of the node connection relationship information;

[0181] Based on node connection relationship information, the similarity between the target node feature information of the object node and the target node feature information of the associated object node is calculated. The associated object node is the node connected to the object node in the object relationship graph.

[0182] The initial noise information is updated based on the similarity to obtain the updated noise information;

[0183] Based on the updated noise information, the node connection relationship information is denoised to obtain the target node connection relationship information of the object node.

[0184] The initial noise information refers to the connection information corresponding to heterogeneous edges in the predicted node connection information.

[0185] An associated object node refers to any object node in an object relationship graph that has a connection relationship with it.

[0186] Similarity refers to the degree of similarity between an object node and its associated object nodes with which it has a connection relationship.

[0187] In some embodiments, when the similarity between an object node and its associated object node meets a preset similarity, the object node and its associated object node belong to the same class.

[0188] In some embodiments, when the similarity between an object node and its associated object node does not meet a preset similarity, the object node and the associated object node are not of the same type. That is, it can be understood that one of the object node and the associated object node is a normal object node and the other is an abnormal object node. In this way, it is possible to determine the connection relationship of the node connection relationship information that belongs to the heterogeneous edge, and thus determine the noise based on the heterogeneous edge.

[0189] The preset similarity is a pre-set threshold used to measure similarity.

[0190] Updated noise information refers to the noise information obtained by updating the initial noise information through similarity.

[0191] For example, the updated noise information could be the connection information corresponding to new heterogeneous edges discovered through similarity, based on the initial noise information. Alternatively, it could be the similarity verification of two object nodes connected by the connection information in the initial noise information, with connection information that does not meet the preset similarity requirement retained as the updated noise information.

[0192] In some embodiments, to further identify noise information and filter out low-quality connections between nodes in the object relationship graph, the initial noise information is updated based on similarity to obtain updated noise information, including:

[0193] Based on node connection relationship information, calculate the number of node connections of the object node;

[0194] The initial noise information is updated based on similarity and the number of node connections to obtain the updated noise information.

[0195] Among them, the node connection quantity information refers to the number of associated object nodes connected to this object node in the node connection relationship information.

[0196] Updated noise information refers to the noise information obtained by updating the initial noise information through similarity and node connection information.

[0197] In some embodiments, the updated noise information may include, in addition to the connection relationship information corresponding to new heterogeneous edges discovered through similarity based on the initial noise information, also identify and determine some edges as noise information from edges whose number of node connections deviates significantly from the normal node degree distribution (e.g., sudden high-density connections of low-frequency nodes, node connections with abnormal degree distribution, etc.).

[0198] Sudden high-density connections in low-frequency nodes refer to nodes that were previously less connected and less active in the network (i.e., low-frequency nodes) suddenly establishing dense connections with a large number of other nodes. Abnormal degree distribution node connections refer to nodes whose number of connections (degrees) is significantly higher or lower than the normal degree distribution of nodes.

[0199] In some embodiments, in order to improve the accuracy of the connection relationship information of object nodes by progressively denoising and reduce the impact of noise on subsequent analysis tasks, the node connection relationship information is denoised based on the updated noise information to obtain the target node connection relationship information of the object nodes, including:

[0200] Based on the updated noise information, the node connection relationship information is denoised to obtain the denoised node connection relationship information.

[0201] The denoised node connection information is determined as the new node connection information of the object node. The process returns to perform noise prediction processing on the node connection information of the object node to obtain the initial noise information of the node connection information, thus obtaining the target node connection information of the object node.

[0202] Among them, the denoised node connection information refers to the node connection information obtained by removing the updated noise information from the node connection information.

[0203] The new node connection information refers to using the node connection information obtained from the previous denoising as the input for the next round of noise prediction.

[0204] In some embodiments, the method further includes:

[0205] Obtain the historical number of denoising attempts for the node connection relationship information of the target node;

[0206] After denoising the node connection information based on the updated noise information to obtain the denoised node connection information, the method further includes:

[0207] Based on the node connection information after denoising, the historical denoising count is updated to obtain the current denoising count;

[0208] The denoised node connection information is determined as the new node connection information of the object node. The process then returns to perform noise prediction processing on the node connection information of the object node to obtain the initial noise information of the node connection information. This process yields the target node connection information of the object node, including:

[0209] When the current number of denoising attempts does not meet the preset number of denoising attempts, the denoised node connection relationship information is determined as the new node connection relationship information of the object node. The process returns to the step of performing noise prediction processing on the node connection relationship information of the object node to obtain the initial noise information of the node connection relationship information. This process continues until the current number of denoising attempts meets the preset number of denoising attempts. Then, the denoised node connection relationship information corresponding to the current number of denoising attempts is used as the target node connection relationship information of the object node.

[0210] Among them, the historical denoising count refers to the cumulative number of times that the node connection relationship information of the object node has undergone denoising processing.

[0211] The current denoising count refers to the cumulative count after the latest denoising process of the node connection relationship information of the object node, which is the historical denoising count plus 1.

[0212] The preset number of noise reduction attempts is a pre-set number of attempts used to measure the number of noise reduction attempts.

[0213] For example, when the preset denoising count is 2, the historical denoising count for the node connection relationship information S1 of the target node is obtained; when it is the first denoising, the historical denoising count is 0; noise prediction processing is performed on the node connection relationship information S1 of the target node to obtain the initial noise information Z1 of the node connection relationship information S1; based on the node connection relationship information S1, the similarity X1 between the target node feature information of the target node and the target node feature information of the associated target node is calculated; according to the similarity X1, the initial noise information Z1 is updated to obtain the updated noise information Z2; based on the updated noise information Z2, the node connection relationship information S1 is denoised to obtain the denoised node connection relationship information S2. Based on the denoised node connection relationship information S2, the historical denoising count of 0 is updated to obtain the current denoising count of 1. Since the current denoising count of 1 is less than the preset denoising count of 2, the denoised node connection relationship information S2 is determined as the new node connection relationship information S1 of the target node. * It then determines the current denoising count of 1 as the historical denoising count and returns the node connection relationship information S1 for the object node. * Noise prediction processing is performed to obtain node connection relationship information S1. * The initial noise information is processed until the current denoising count 2 equals the preset denoising count 2, and the denoised node connection relationship information S2 corresponding to the current denoising count 2 is then processed. *This information serves as the connection relationship information between the target nodes of the object node.

[0214] In some embodiments, in order to identify and remove heterogeneous edges in the node connection relationship information of object nodes, thereby ensuring that the target node connection relationship information of object nodes can more accurately represent the interaction relationship between object nodes, heterogeneous edge denoising processing is performed on the node connection relationship information of object nodes to obtain the target node connection relationship information of object nodes, including:

[0215] By using a relation diffusion generation model, the node connection relationship information of the object node is denoised by heterogeneous edges to obtain the target node connection relationship information of the object node.

[0216] Before obtaining the target node connection information of the object node through the relation diffusion generation model and performing heterogeneous edge denoising on the node connection relationship information of the object node, the following steps are also included:

[0217] Acquire training data, which includes node connection information of sample object nodes in the sample object relationship graph;

[0218] The node connection relationship information of the sample object nodes is noise-added to obtain the noise-added connection relationship information;

[0219] By using a relation diffusion generation model, the noisy connection relation information is denoised by heterogeneous edges to obtain the denoised connection relation information.

[0220] Based on the denoised connection relationship information and the node connection relationship information of the sample object nodes, the parameters of the relationship diffusion generation model are adjusted to obtain the trained relationship diffusion generation model.

[0221] Among them, the relation diffusion generation model is used to identify heterogeneous edges from the node connection relationship information of object nodes. For example, the relation diffusion generation model can specifically be a denoising diffusion probability model, a generative adversarial network model, or a sound reinforcement model.

[0222] Training data consists of samples generated from training relation diffusion models.

[0223] The node connection relationship information of sample object nodes refers to structured data that can represent the interaction relationship between each object node in the sample object relationship graph.

[0224] Noise-added connectivity information refers to the information obtained by adding additional node connections to the node connectivity information of the sample object nodes.

[0225] Denoising connection information refers to the connection information between object nodes after removing the connection information represented by heterogeneous edges from the noise-added connection information.

[0226] The trained relation diffusion generation model is a process of comparing the denoised connection relation information with the node connection relation information of the sample object nodes, calculating the loss and adjusting the model parameters to improve the accuracy of the relation diffusion generation model in identifying heterogeneous edges.

[0227] In some embodiments, the relation diffusion generation model includes two inverse Markov chains, wherein one inverse Markov chain is used for the forward diffusion process and the other inverse Markov chain is used for the inverse denoising process.

[0228] The node connection information (adjacency matrix A′) of the sample object nodes is treated as image data. During the forward diffusion process, at each time step t, Gaussian noise ε ~ N(0,1) is injected into the adjacency matrix A′. Based on the preset hyperparameter set {β... 1 , ..., β T Add noise to the adjacency matrix A′:

[0229]

[0230] in, Let represent the adjacency matrix of the sample object relationship graph i at time step t, and let the hyperparameter T represent the total number of time steps for the two diffusion processes.

[0231] Based on this calculation, the iterative formula for the equation can be calculated as follows:

[0232]

[0233] Where, α t =1-β t and In the reverse denoising process, the relation diffusion generation model is trained. To predict initial noise information.

[0234] Furthermore, this application employs graph contrast learning guidance equations and degree penalty guidance:

[0235]

[0236] Among them, Gui deg This refers to the degree penalty guidance, where degree specifically refers to the number of node connections, which is used to guide relationship generation.

[0237] At each time step t, the guidance function equation provides guidance by calculating the similarity between currently connected pairs of nodes, where a pair of nodes refers to sample object nodes with connections in the sample object relationship graph. The degree penalty function equation adjusts the degree distribution of generated relationships to make it more reasonable and consistent with the degree distribution of real-world networks such as social networks, communication networks, the Internet of Things, and financial networks. Real-world networks are typically represented in the form of object relationship graphs, and degree distribution refers to the distribution of the number of connections (i.e., degree) of each node in the entire network. The entire guidance can be expressed as follows:

[0238] The all =γ1·Gui sim +γ2·Gui deg Among them, Gui sim This refers to similarity guidance, where γ1 and γ2 are hyperparameters.

[0239] Update the initial noise information The following instructions are provided:

[0240] Here, s is a hyperparameter used to determine the scale of the guidance.

[0241] For example, taking a hyperparameter T of 3 time steps as an example, the relation diffusion generation model is trained as follows:

[0242] right The noise reduction process is performed at the first time step to obtain... right The noise reduction process is performed at the second time step to obtain... right The noise reduction process is performed at the third time step to obtain...

[0243] Generate model ε through relation diffusion θ ,predict The initial noise information 1 in the data is used to continue based on... The initial noise information 1 is updated based on the similarity between currently connected node pairs and the number of node connections, resulting in updated noise information 1. The updated noise information 1 is then used to update the initial noise information 1. Denoising was performed to obtain

[0244] Generate model ε through relation diffusion θ predict The initial noise information 2 in the middle, continue according to The initial noise information 2 is updated based on the similarity between currently connected node pairs and the number of node connections, resulting in updated noise information 2. The updated noise information 2 is then used to update the noise information. Denoising was performed to obtain

[0245] Predicting using the relation diffusion generative model εθ The initial noise information 3 in the middle, continue according to The initial noise information 3 is updated based on the similarity between currently connected node pairs and the number of node connections, resulting in updated noise information 3. The updated noise information 3 is then used to update the noise information. Denoising was performed to obtain

[0246] according to and Differences between them and Differences between them and The differences between them are used to adjust the parameters of the relation diffusion generation model, resulting in the trained relation diffusion generation model.

[0247] 105. Based on the target node feature information and target node connection relationship information of the object nodes, perform graph feature enhancement processing on the object relationship graph to obtain the feature-enhanced target object relationship graph, so as to identify abnormal objects through the target object relationship graph.

[0248] Among them, graph feature enhancement processing refers to the operation of enhancing the node features of object nodes in the object relationship graph to enhance the difference between normal object nodes and abnormal object nodes.

[0249] A target object relationship graph is a new object relationship graph formed by enhancing the features of object nodes in an object relationship graph by incorporating the target node feature information and target node connection relationship information of the object nodes.

[0250] An anomalous object is an object in a target object relationship graph that is identified as an abnormal node because its interactions differ from the normal pattern. These abnormal interactions can reveal potential risks or problems, such as fraudulent transactions, malicious intrusions, or information leaks. In other words, anomalous objects expose potential threats or anomalies in the system through their unusual interactive behaviors.

[0251] In some embodiments, to enhance the feature representation capability of object nodes and more accurately reflect the interaction relationships between object nodes, thereby identifying the interaction relationships corresponding to abnormal behaviors with highly disguised and concealed characteristics, and helping to discover abnormal objects, graph feature enhancement processing is performed on the object relationship graph based on the target node feature information and target node connection relationship information of the object nodes, to obtain the feature-enhanced target object relationship graph, including:

[0252] Based on the target node feature information and target node connection relationship information of the object node, the node information and connection relationship of the object node in the object relationship graph are updated to obtain the updated object relationship graph.

[0253] The updated object relationship graphs are then fused to obtain the target object relationship graph.

[0254] The updated object relationship graph is obtained by decomposing the original object relationship graph into a graph structure. The updated object relationship graph is obtained by updating the node information and connection relationships of the object nodes in the object relationship graph using the target node feature information and target node connection relationship information.

[0255] In some embodiments, the original object relationship graph is decomposed into multiple object relationship graphs, and then an updated object relationship graph is determined for each object relationship graph. Finally, by merging these updated object relationship graphs, the target object relationship graph is obtained.

[0256] In some embodiments, the original object relationship graph includes multiple object nodes. After graph decomposition of the original object relationship graph, the same object node may appear in multiple object relationship graphs. To more accurately identify abnormal objects, the updated object relationship graphs can be merged to comprehensively consider the node information and connection relationships of object nodes in each updated object relationship graph, thereby analyzing the performance of object nodes more comprehensively. This method can effectively avoid misjudgments that may be caused by relying on a single object relationship graph, improving the overall accuracy and reliability of anomaly detection. In some embodiments, to enable object nodes in the object relationship graph to obtain the importance information of other object nodes relative to themselves, thereby further enhancing the node representation capability of object nodes in the object relationship graph and helping to identify the interaction relationships corresponding to abnormal behaviors with highly disguised and concealed characteristics, so as to discover abnormal objects, graph feature enhancement processing is performed on the object relationship graph based on the target node feature information and target node connection relationship information of the object nodes to obtain the feature-enhanced target object relationship graph, including:

[0257] Based on the target node feature information and target node connection relationship information of the object node, the node information and connection relationship of the object node in the object relationship graph are updated to obtain the updated object relationship graph.

[0258] Calculate the importance information of the associated nodes of the object nodes in the updated object relationship graph. The importance information of the associated nodes includes the importance information of other object nodes to the object node.

[0259] Based on the target node feature information, target node connection relationship information, and associated node importance information of the object node, graph feature enhancement processing is performed on the object relationship graph to obtain the feature-enhanced target object relationship graph.

[0260] Other object nodes are those that originate from the object node and are reached through the connections in the updated object relationship graph. For example, other object nodes can be object nodes directly connected to the object node, or they can be object nodes indirectly connected to the object node.

[0261] The importance information of associated nodes includes the importance information of the corresponding object nodes of other object nodes.

[0262] In some embodiments, the PageRank algorithm is used to analyze each object node in the updated object relationship graph. First, based on the connection relationships in the updated object relationship graph, other object nodes directly or indirectly connected to the object node are identified. Next, with the object node as the center, the importance information of each other object node relative to the object node is calculated to obtain the importance information of the associated nodes of the object node. Based on the target node feature information, target node connection relationship information, and associated node importance information of each object node in the updated object relationship graph, graph feature enhancement processing is performed on the object relationship graph to obtain the feature-enhanced target object relationship graph. In some embodiments, in order to calculate the importance information of the associated nodes of the object node, the importance information of the associated nodes of the object node in the updated object relationship graph is calculated, including:

[0263] Identify path instances in the updated object relationship graph;

[0264] For each object node in the path instance, node traversal is performed by using the edges between object nodes in the updated object relationship graph to calculate the importance information of other object nodes in the path instance relative to the object node, thereby obtaining the importance information of associated nodes.

[0265] In this context, a path instance refers to a link connecting object nodes in the updated object relationship graph. For example, a path instance can be a closed link in the updated object relationship graph that starts from an initial object node, passes through a series of connections and intermediate object nodes, and ultimately returns to the initial object node, such as object node A → object node B → to object node C → object node A. A path instance can also be a non-closed path, such as object node A → object node B → to object node C.

[0266] An edge between object nodes is a line connecting two object nodes, which can represent the interactive relationship between the two object nodes.

[0267] Node traversal refers to starting from an object node in a path instance, and visiting other object nodes that are directly or indirectly connected to that object node through the edges in the path, gradually traversing all relevant object nodes that can be reached.

[0268] In some embodiments, in order to calculate the importance information of other object nodes in a path instance relative to an object node, node traversal is performed using the edges between object nodes in the updated object relationship graph to calculate the importance information of other object nodes in a path instance relative to an object node, including:

[0269] Set the initial importance and weight information for each object node in the path instance;

[0270] By traversing the edges between object nodes in the updated object relationship graph, the initial importance information of each object node is iteratively updated based on the weight information, so as to obtain the importance information of other object nodes in the path instance to the object node.

[0271] Among them, the initial importance information refers to the importance information determined based on the target node feature information of the object node.

[0272] For example, the initial importance information can be the importance information calculated based on the target node feature information of the object node, or it can be the probability of the object node being abnormal based on the target node feature information, and so on.

[0273] Weight information is used to indicate the probability that each object node in a path instance is a starting point.

[0274] In some embodiments, a preset probability is set for starting from an object node and returning to an object node, and the probability of jumping to other object nodes is determined.

[0275] Taking a path instance containing 5 object nodes, numbered v1, v2, v3, v4, and v5, as an example, in the process of calculating the importance information of other object nodes in the path instance relative to the object node by walking through the edges between object nodes in the updated object relationship graph:

[0276] 1. Given that v1 and v3 were chosen as starting points, with weights of 0.7 and 0.3 respectively, the preference vector P0 can be represented as: P0 = [0.7, 0, 0.3, 0, 0]. This means that the random walk has a 70% probability of starting from v1 and a 30% probability of starting from v3.

[0277] 2. Set the restart probability α, which controls the two behaviors of the random walk: 1) Follow the edge to move to an adjacent node: randomly select a neighbor of the current node with probability 1-α. 2) Return to the starting node: return to the set of starting nodes defined by the preference vector P0 with probability α.

[0278] When the random walk "restarts," it selects a new starting node based on the weight of P0. Therefore, the higher the weight, the greater the probability that the corresponding node will be selected as the starting point.

[0279] 3. The calculation of importance information is an iterative process, and its formula is:

[0280] p i+1 =(1-α)M T P i +αP0;

[0281] Where M represents the edges between object nodes in the updated object relationship graph, p i P0 represents the importance information of each object node after the i-th iteration, and P0 is the preference vector, which directly participates in the calculation of each iteration.

[0282] In each iteration, the αP0 term re-injects the weights of the preference vector into the calculation, ensuring that the random walk is always influenced by the starting node. In other words, the larger the weight of an object node, the stronger its influence will be throughout the iteration.

[0283] The distribution of importance information of other object nodes in the final path instance represents the importance score of each node relative to the starting object node. Since the weight of P0 directly affects the selection of the starting point of the random walk and the restart behavior, the starting object node with a larger weight will have a greater impact on the exploration of the entire graph structure.

[0284] For example, if v1 has a higher weight, then nodes directly or indirectly connected to v1 will have higher importance scores. If v3 has a lower weight, then even if v3 has some important neighboring nodes, their scores will be limited.

[0285] In some embodiments, to avoid the updated object relationship graph having an excessive impact on the subsequent identification of abnormal objects due to the importance information of some nodes, the importance information of the associated nodes of the object nodes in the updated object relationship graph is calculated, including:

[0286] Calculate the importance information of other object nodes to the object node;

[0287] Identify the object nodes whose importance information is greater than a preset value from other object nodes and request adjustment.

[0288] The importance information of the node to be adjusted is suppressed to obtain the processed importance information.

[0289] The preset value is a pre-set information used to measure the importance of other object nodes to the object node.

[0290] The object nodes to be adjusted refer to other object nodes whose importance information is greater than the preset value.

[0291] The processed importance information refers to the importance information obtained after suppressing the importance information of the object node to be adjusted, from the importance information of other object nodes to the object node.

[0292] For example, for object node A, other object nodes directly or indirectly connected to it include object node B, object node C, and object node D. Object node B's importance to object node A is a PageRank value of 1, object node C's importance to object node A is a PageRank value of 2, and object node D's importance to object node A is a PageRank value of 3. If object node C connects to more other nodes, causing its PageRank value of 2 to exceed a preset value, then object node C will be considered an object node requiring adjustment. In this case, the PageRank value of 2 is suppressed, for example, by reducing its weight to decrease the influence of object node C on object node A, thus obtaining the adjusted importance information.

[0293] In some embodiments, in order to identify abnormal objects through the feature-enhanced target object relationship graph, after performing graph feature enhancement processing on the object relationship graph based on the target node feature information and target node connection relationship information of the object nodes, and obtaining the feature-enhanced target object relationship graph, the method further includes:

[0294] Based on the object relationship graph, multi-dimensional anomaly feature extraction processing is performed on the target object relationship graph to obtain the feature information of each object node in the target object relationship graph under various dimensions;

[0295] Based on the feature information of each object node in the target object relationship graph under various dimensions, predict the probability information of each object node in the target object relationship graph belonging to an abnormal object node;

[0296] Based on probability information, abnormal objects are identified from the target object relationship graph.

[0297] Among them, multi-dimensional anomaly feature extraction processing refers to identifying and extracting key features that can reflect the anomaly of a node by analyzing from multiple different dimensions.

[0298] Feature information in each dimension refers to the feature information extracted from an object node in different dimensions that can reflect the node's abnormal situation.

[0299] For example, in financial transaction scenarios, the feature information of various dimensions may cover multiple abnormal features such as abnormal transaction amount, abnormal transaction location, and abnormal transaction frequency.

[0300] Probability information refers to the probability that an object node belongs to an abnormal object node.

[0301] In some embodiments, when the probability information meets the preset probability information, the object node is determined to be an abnormal object node.

[0302] Among them, the exception object is the object corresponding to the exception object node.

[0303] As can be seen from the above, the embodiments of this application can obtain an object relationship graph, which represents the interaction relationships between object nodes corresponding to multiple objects; perform feature interaction processing on multiple object nodes in the object relationship graph to obtain target node feature information of multiple object nodes; determine the node connection relationship information of object nodes based on the interaction relationships in the object relationship graph, including the connection relationship information between object nodes and other object nodes in the object relationship graph; perform heterogeneous edge denoising processing on the node connection relationship information of object nodes to obtain target node connection relationship information of object nodes, where heterogeneous edges represent the interaction relationships between object nodes of different types; and perform graph feature enhancement processing on the object relationship graph based on the target node feature information and target node connection relationship information of object nodes to obtain a feature-enhanced target object relationship graph, so as to identify abnormal objects through the target object relationship graph.

[0304] This application allows for feature interaction processing of multiple object nodes in an object relationship graph after acquisition, enhancing their feature representation capabilities and obtaining target node feature information. Furthermore, based on the interaction relationships in the object relationship graph, node connection information can be obtained. By performing heterogeneous edge denoising on the node connection information, heterogeneous edges representing interactions between different types of object nodes can be removed, resulting in more accurate target node connection information. By combining the target node feature information with the target node connection information, graph feature enhancement processing can be performed on the object relationship graph. The target object relationship graph after feature enhancement not only enhances the feature representation capabilities of object nodes but also more accurately reflects the interaction relationships between object nodes. This processing method effectively addresses the highly disguised and concealed characteristics of abnormal behavior, providing a more reliable foundation for the identification of abnormal objects. Therefore, the accuracy of abnormal object identification is improved.

[0305] The method described in the above embodiments will be further described in detail below.

[0306] In this embodiment, the method of this application embodiment will be described in detail, taking as an example that the accuracy of identifying abnormal objects is not affected while reducing the amount of computation.

[0307] like Figure 2a As shown, the specific process of a feature processing method is as follows:

[0308] 201. Obtain the original object relationship graph, which represents the interaction relationships between multiple objects; and perform graph structure decomposition on the original object relationship graph to obtain multiple object relationship graphs.

[0309] 202. For each object relationship graph, perform feature interaction processing on multiple object nodes in the object relationship graph to obtain the target node feature information of multiple object nodes.

[0310] In some embodiments, feature interaction processing is performed on multiple object nodes in an object relationship graph to obtain target node feature information of the multiple object nodes, including:

[0311] The feature projection model is used to perform feature projection processing on the node feature information of the object node to obtain the target node feature information of the object node.

[0312] Before performing feature projection processing on the node feature information of the object node through the feature projection model to obtain the target node feature information of the object node, the device also includes a feature projection model training unit, used for:

[0313] Obtain the sample object relationship graph and the set of positive and negative samples for each sample object node in the sample object relationship graph;

[0314] Feature interaction processing is performed on each sample object node in the sample object relationship graph to obtain the initial node feature information of each sample object node;

[0315] The initial node feature information of the sample object node is processed by feature projection model to obtain the sample node feature information of the sample object node.

[0316] Based on the sample node feature information of the sample object node and the object feature information of the sample objects in the positive and negative sample sets of the sample object node, the parameters of the feature projection model are adjusted to obtain the trained feature projection model.

[0317] 203. Based on the interaction relationships in the object relationship graph, determine the node connection relationship information of the object nodes. The node connection relationship information includes the connection relationship information between the object node and other object nodes in the object relationship graph.

[0318] 204. Perform heterogeneous edge denoising on the node connection relationship information of the object node to obtain the target node connection relationship information of the object node. Heterogeneous edges represent the interaction relationship between different types of object nodes.

[0319] In some embodiments, such as Figure 2b As shown, heterogeneous edge denoising processing is performed on the node connection relationship information of the object node to obtain the target node connection relationship information of the object node, including:

[0320] Noise prediction processing is performed on the node connection relationship information of the object nodes to obtain the initial noise information of the node connection relationship information;

[0321] Based on node connection relationship information, the similarity between the target node feature information of the object node and the target node feature information of the associated object node is calculated. The associated object node is the node connected to the object node in the object relationship graph.

[0322] Based on node connection relationship information, calculate the number of node connections of the object node;

[0323] The initial noise information is updated based on similarity and the number of node connections to obtain the updated noise information.

[0324] Based on the updated noise information, the node connection relationship information is denoised to obtain the denoised node connection relationship information.

[0325] The denoised node connection information is determined as the new node connection information of the object node. The process returns to perform noise prediction processing on the node connection information of the object node to obtain the initial noise information of the node connection information, thus obtaining the target node connection information of the object node.

[0326] In some embodiments, heterogeneous edge denoising processing is performed on the node connection relationship information of the object node to obtain the target node connection relationship information of the object node, including:

[0327] By using a relation diffusion generation model, the node connection relationship information of the object node is denoised by heterogeneous edges to obtain the target node connection relationship information of the object node.

[0328] Before obtaining the target node connection information of the object node through heterogeneous edge denoising processing of the node connection relationship information of the object node using the relation diffusion generation model, the device also includes a relation diffusion generation model training unit, used for:

[0329] Acquire training data, which includes node connection information of sample object nodes in the sample object relationship graph;

[0330] The node connection relationship information of the sample object nodes is noise-added to obtain the noise-added connection relationship information;

[0331] By using a relation diffusion generation model, the noisy connection relation information is denoised by heterogeneous edges to obtain the denoised connection relation information.

[0332] Based on the denoised connection relationship information and the node connection relationship information of the sample object nodes, the parameters of the relationship diffusion generation model are adjusted to obtain the trained relationship diffusion generation model.

[0333] By training a relation diffusion generation model through noise addition, noise prediction, and distribution inference, this model directly learns the latent distribution of relations within an object relation graph. Therefore, this application can reduce the generation of heterogeneous edges and conform to the distribution of the original financial transaction scenario. Based on these homogeneously generated relation graphs, weak anomalous signals are amplified during the aggregation process and become sufficiently obvious for detection by the relation diffusion generation model.

[0334] 205. Based on the target node feature information and target node connection relationship information of the object node, update the node information and connection relationship of the object node in the object relationship graph to obtain the updated object relationship graph.

[0335] 206. Perform graph fusion processing on each updated object relationship graph to obtain the target object relationship graph, so as to identify abnormal objects through the target object relationship graph.

[0336] In some embodiments, after performing graph feature enhancement processing on the object relationship graph based on the target node feature information and target node connection relationship information of the object nodes to obtain the feature-enhanced target object relationship graph, the method further includes:

[0337] Based on the object relationship graph, multi-dimensional anomaly feature extraction processing is performed on the target object relationship graph to obtain the feature information of each object node in the target object relationship graph under various dimensions;

[0338] Based on the feature information of each object node in the target object relationship graph under various dimensions, predict the probability information of each object node in the target object relationship graph belonging to an abnormal object node;

[0339] Based on probability information, abnormal objects are identified from the target object relationship graph.

[0340] In some embodiments, such as Figure 2b As shown, the multi-relationship detector can use multiple filters to capture the feature information of each object node in various dimensions, and the probability information of each object node in the target object relationship graph belonging to an abnormal object node.

[0341] In financial transaction scenarios, anomalous objects exhibit strong adversarial behavior, with their superficial information and neighbor similarity highly consistent with normal objects. Extracting the remaining anomalous signals from adaptive camouflage is crucial for anomaly detection in financial transaction scenarios.

[0342] To address the adaptive spoofing problem, this application proposes a graph augmentation method based on diffusion relation generation. First, a supervised graph contrastive learning method is used to mine valuable expert knowledge from a limited set of labels, thereby enhancing the decision boundary between anomalous and normal object nodes. Then, guided by the supervised graph contrastive learning method and a degree penalty function, a guided relation diffusion generator is used to generate a target object relation graph without inter-class edges. Finally, a weighted multi-relation filter is used to continuously amplify weak spoofing signals during the aggregation process, and multiple flexible, spatially localized bandpass filters are used to capture weak spoofing information.

[0343] As shown above, efficient mining of abnormal objects in the object relationship graph has been achieved.

[0344] To better implement the above methods, this application also provides a feature processing device, which can be integrated into an electronic device, such as a terminal or server. The terminal can be a mobile phone, tablet computer, smart Bluetooth device, laptop computer, or personal computer; the server can be a single server or a server cluster composed of multiple servers.

[0345] For example, in this embodiment, the method of this application embodiment will be described in detail by taking the feature processing device specifically integrated into an electronic device as an example.

[0346] For example, such as Figure 3 As shown, the feature processing device may include an acquisition unit 301, a feature interaction unit 302, an information determination unit 303, a noise reduction unit 304, and a feature enhancement unit 305, as follows:

[0347] (I) Acquisition Unit 301.

[0348] The acquisition unit 301 is used to acquire an object relationship graph, which represents the interaction relationship between object nodes corresponding to multiple objects.

[0349] In some embodiments, the acquisition unit includes a relational graph acquisition subunit and a graph decomposition subunit:

[0350] The relationship diagram acquisition sub-unit is used to obtain the original object relationship diagram, which represents the interaction relationships between multiple objects.

[0351] The graph decomposition subunit is used to decompose the original object relationship graph into multiple object relationship graphs.

[0352] In some embodiments, the graph decomposition subunit is used for:

[0353] The original object relationship graph is sampled multiple times to obtain the node group corresponding to each sample. The node group includes multiple object nodes.

[0354] For each node group, based on the interaction relationships of the object nodes in the node group in the original object relationship graph, the interaction relationships of the object nodes in the node group are constructed to obtain the object relationship graph corresponding to the node group.

[0355] (II) Feature interaction unit 302.

[0356] The feature interaction unit 302 is used to perform feature interaction processing on multiple object nodes in the object relationship graph to obtain the target node feature information of multiple object nodes.

[0357] In some embodiments, the feature interaction unit includes a data enhancement subunit, a feature interaction subunit, and a feature projection subunit:

[0358] The data augmentation subunit is used to perform data augmentation processing on the node information of object nodes in the object relationship graph to obtain the processed node information of the object nodes.

[0359] The feature interaction subunit is used to perform feature interaction processing on the processed node information of each object node in the object relationship graph to obtain the node feature information of each object node in the object relationship graph.

[0360] The feature projection subunit is used to perform feature projection processing on the node feature information of the object node to obtain the target node feature information of the object node.

[0361] In some embodiments, the feature interaction subunit is used for:

[0362] For each object node in the object relationship graph, the processed node information of each neighbor node of the object node is fused to obtain the fused feature information.

[0363] Based on the fused feature information, the processed node information of the object node is iteratively updated to obtain the node feature information of the object node.

[0364] In some embodiments, based on the fused feature information, the processed node information of the object node is iteratively updated to obtain the node feature information of the object node, including:

[0365] Based on the fused feature information, the processed node information of the object node is updated to obtain the new processed node information of the object node.

[0366] Return to the step of fusing the processed node information of each neighbor node of each object node in the object relationship graph to obtain the node feature information of the object node.

[0367] In some embodiments, the feature projection subunit is used for:

[0368] The feature projection model is used to perform feature projection processing on the node feature information of the object node to obtain the target node feature information of the object node.

[0369] Before performing feature projection processing on the node feature information of the object node through the feature projection model to obtain the target node feature information of the object node, the device also includes a feature projection model training unit, used for:

[0370] Obtain the sample object relationship graph and the set of positive and negative samples for each sample object node in the sample object relationship graph;

[0371] Feature interaction processing is performed on each sample object node in the sample object relationship graph to obtain the initial node feature information of each sample object node;

[0372] The initial node feature information of the sample object node is processed by feature projection model to obtain the sample node feature information of the sample object node.

[0373] Based on the sample node feature information of the sample object node and the object feature information of the sample objects in the positive and negative sample sets of the sample object node, the parameters of the feature projection model are adjusted to obtain the trained feature projection model.

[0374] (III) Information Determination Unit 303.

[0375] The information determination unit 303 is used to determine the node connection relationship information of the object node based on the interaction relationship in the object relationship graph. The node connection relationship information includes the connection relationship information between the object node and other object nodes in the object relationship graph.

[0376] (iv) Noise reduction unit 304.

[0377] The denoising unit 304 is used to perform heterogeneous edge denoising processing on the node connection relationship information of the object node to obtain the target node connection relationship information of the object node. The heterogeneous edges represent the interaction relationship between different types of object nodes.

[0378] In some embodiments, the denoising unit includes a noise prediction subunit, a similarity calculation subunit, a noise update subunit, and a denoising subunit:

[0379] The noise prediction subunit is used to perform noise prediction processing on the node connection relationship information of the object node to obtain the initial noise information of the node connection relationship information.

[0380] The similarity calculation subunit is used to calculate the similarity between the target node feature information of the object node and the target node feature information of the associated object node based on the node connection relationship information. The associated object node is the node connected to the object node in the object relationship graph.

[0381] The noise update subunit is used to update the initial noise information based on similarity to obtain the updated noise information.

[0382] The denoising subunit is used to denoise the node connection relationship information based on the updated noise information to obtain the target node connection relationship information of the object node.

[0383] In some embodiments, the noise update subunit is used for:

[0384] Based on node connection relationship information, calculate the number of node connections of the object node;

[0385] The initial noise information is updated based on similarity and the number of node connections to obtain the updated noise information.

[0386] In some embodiments, the noise reduction subunit is used for:

[0387] Based on the updated noise information, the node connection relationship information is denoised to obtain the denoised node connection relationship information.

[0388] The denoised node connection information is determined as the new node connection information of the object node. The process returns to perform noise prediction processing on the node connection information of the object node to obtain the initial noise information of the node connection information, thus obtaining the target node connection information of the object node.

[0389] In some embodiments, the noise reduction unit is used for:

[0390] By using a relation diffusion generation model, the node connection relationship information of the object node is denoised by heterogeneous edges to obtain the target node connection relationship information of the object node.

[0391] Before obtaining the target node connection information of the object node through heterogeneous edge denoising processing of the node connection relationship information of the object node using the relation diffusion generation model, the device also includes a relation diffusion generation model training unit, used for:

[0392] Acquire training data, which includes node connection information of sample object nodes in the sample object relationship graph;

[0393] The node connection relationship information of the sample object nodes is noise-added to obtain the noise-added connection relationship information;

[0394] By using a relation diffusion generation model, the noisy connection relation information is denoised by heterogeneous edges to obtain the denoised connection relation information.

[0395] Based on the denoised connection relationship information and the node connection relationship information of the sample object nodes, the parameters of the relationship diffusion generation model are adjusted to obtain the trained relationship diffusion generation model.

[0396] (V) Feature enhancement unit 305.

[0397] The feature enhancement unit 305 is used to perform graph feature enhancement processing on the object relationship graph based on the target node feature information and the target node connection relationship information of the object node, so as to obtain the feature-enhanced target object relationship graph, and to identify abnormal objects through the target object relationship graph.

[0398] In some embodiments, the feature enhancement unit is configured to:

[0399] Based on the target node feature information and target node connection relationship information of the object node, the node information and connection relationship of the object node in the object relationship graph are updated to obtain the updated object relationship graph.

[0400] The updated object relationship graphs are then fused to obtain the target object relationship graph.

[0401] In some embodiments, the feature enhancement unit is configured to:

[0402] Based on the target node feature information and target node connection relationship information of the object node, the node information and connection relationship of the object node in the object relationship graph are updated to obtain the updated object relationship graph.

[0403] Calculate the importance information of the associated nodes of the object nodes in the updated object relationship graph. The importance information of the associated nodes includes the importance information of other object nodes to the object node.

[0404] Based on the target node feature information, target node connection relationship information, and associated node importance information of the object node, graph feature enhancement processing is performed on the object relationship graph to obtain the feature-enhanced target object relationship graph.

[0405] In some embodiments, calculating the importance information of associated nodes of object nodes in the updated object relationship graph includes:

[0406] Identify path instances in the updated object relationship graph;

[0407] For each object node in the path instance, node traversal is performed by using the edges between object nodes in the updated object relationship graph to calculate the importance information of other object nodes in the path instance relative to the object node, thereby obtaining the importance information of associated nodes.

[0408] In some embodiments, calculating the importance information of associated nodes of object nodes in the updated object relationship graph includes:

[0409] Calculate the importance information of other object nodes to the object node;

[0410] Identify the object nodes whose importance information is greater than a preset value from other object nodes and request adjustment.

[0411] The importance information of the node to be adjusted is suppressed to obtain the processed importance information.

[0412] In some embodiments, after performing graph feature enhancement processing on the object relationship graph based on the target node feature information and target node connection relationship information of the object nodes to obtain the feature-enhanced target object relationship graph, the device further includes an anomaly recognition unit, used for:

[0413] Based on the object relationship graph, multi-dimensional anomaly feature extraction processing is performed on the target object relationship graph to obtain the feature information of each object node in the target object relationship graph under various dimensions;

[0414] Based on the feature information of each object node in the target object relationship graph under various dimensions, predict the probability information of each object node in the target object relationship graph belonging to an abnormal object node;

[0415] Based on probability information, abnormal objects are identified from the target object relationship graph.

[0416] In practice, each of the above units can be implemented as an independent entity or can be arbitrarily combined to be implemented as the same or several entities. For the specific implementation of each of the above units, please refer to the previous method embodiments, which will not be repeated here.

[0417] As can be seen from the above, the feature processing device in this embodiment obtains an object relationship graph by an acquisition unit, which represents the interaction relationships between object nodes corresponding to multiple objects; a feature interaction unit performs feature interaction processing on multiple object nodes in the object relationship graph to obtain target node feature information of multiple object nodes; an information determination unit determines the node connection relationship information of object nodes based on the interaction relationships in the object relationship graph, which includes the connection relationship information between object nodes and other object nodes in the object relationship graph; a denoising unit performs heterogeneous edge denoising processing on the node connection relationship information of object nodes to obtain target node connection relationship information of object nodes, where heterogeneous edges represent the interaction relationships between object nodes of different types; and a feature enhancement unit performs graph feature enhancement processing on the object relationship graph based on the target node feature information and target node connection relationship information of object nodes to obtain a feature-enhanced target object relationship graph, which is used to identify abnormal objects.

[0418] Therefore, the embodiments of this application can improve the accuracy of identifying abnormal objects.

[0419] This application also provides an electronic device, which can be a terminal, a server, or other similar device. The terminal can be a mobile phone, tablet computer, smart Bluetooth device, laptop computer, personal computer, etc.; the server can be a single server or a server cluster composed of multiple servers, etc.

[0420] In some embodiments, the feature processing device may also be integrated into multiple electronic devices, such as multiple servers, with multiple servers implementing the feature processing method of this application.

[0421] In this embodiment, a server will be used as an example for detailed description. For example, ... Figure 4 As shown, it illustrates a schematic diagram of the server structure involved in an embodiment of this application. Specifically:

[0422] The server may include components such as a processor 401 with one or more processing cores, a memory 402 with one or more computer-readable storage media, a power supply 403, an input module 404, and a communication module 405. Those skilled in the art will understand that... Figure 4 The server architecture shown does not constitute a limitation on the server and may include more or fewer components than illustrated, or combine certain components, or have different component arrangements. Wherein:

[0423] The processor 401 is the control center of the server, connecting various parts of the server via various interfaces and lines. It performs various server functions and processes data by running or executing software programs and / or modules stored in the memory 402, and by calling data stored in the memory 402. In some embodiments, the processor 401 may include one or more processing cores; in some embodiments, the processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into the processor 401.

[0424] The memory 402 can be used to store software programs and modules. The processor 401 executes various functional applications and data processing by running the software programs and modules stored in the memory 402. The memory 402 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the server, etc. In addition, the memory 402 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 402 may also include a memory controller to provide the processor 401 with access to the memory 402.

[0425] The server also includes a power supply 403 that supplies power to the various components. In some embodiments, the power supply 403 can be logically connected to the processor 401 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 403 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0426] The server may also include an input module 404, which can be used to receive input numeric or character information, and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control.

[0427] The server may also include a communication module 405. In some embodiments, the communication module 405 may include a wireless module, through which the server can perform short-range wireless transmission, thereby providing users with wireless broadband internet access. For example, the communication module 405 can be used to help users send and receive emails, browse web pages, and access streaming media.

[0428] Although not shown, the server may also include a display unit, etc., which will not be described in detail here. Specifically, in this embodiment, the processor 401 in the server loads the executable files corresponding to the processes of one or more applications into the memory 402 according to the following instructions, and the processor 401 runs the applications stored in the memory 402, thereby implementing the steps in the methods of the various embodiments of this application.

[0429] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0430] As can be seen from the above, by performing graph feature enhancement processing on the object relationship graph, not only can the feature representation capability of the object nodes be enhanced, but the interaction relationship between the object nodes can also be reflected more accurately. This helps to deal with the highly disguised and concealed characteristics of abnormal behavior, and provides a more reliable basis for the identification of abnormal objects. In this way, the accuracy of identifying abnormal objects can be improved.

[0431] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0432] Therefore, embodiments of this application provide a computer-readable storage medium storing a plurality of instructions that can be loaded by a processor to execute steps in any of the feature processing methods provided in embodiments of this application. For example, the instructions can execute the following steps:

[0433] Obtain the object relationship graph, which represents the interaction relationships between object nodes corresponding to multiple objects;

[0434] By performing feature interaction processing on multiple object nodes in the object relationship graph, the target node feature information of multiple object nodes can be obtained.

[0435] Based on the interaction relationships in the object relationship graph, determine the node connection relationship information of the object nodes. The node connection relationship information includes the connection relationship information between the object node and other object nodes in the object relationship graph.

[0436] The node connection relationship information of the object node is denoised by heterogeneous edges to obtain the target node connection relationship information of the object node. Heterogeneous edges represent the interaction relationship between different types of object nodes.

[0437] Based on the target node feature information and target node connection relationship information of the object node, graph feature enhancement processing is performed on the object relationship graph to obtain the feature-enhanced target object relationship graph, so as to identify abnormal objects through the target object relationship graph.

[0438] The storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0439] According to one aspect of this application, a computer program product or computer program is provided, comprising a computer program / instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer program / instructions from the computer-readable storage medium and executes the computer program / instructions, causing the electronic device to perform the methods provided in various optional implementations of the feature processing aspects provided in the above embodiments.

[0440] Since the instructions stored in the storage medium can execute the steps of any of the feature processing methods provided in the embodiments of this application, the beneficial effects that any of the feature processing methods provided in the embodiments of this application can achieve can be realized. For details, please refer to the previous embodiments, which will not be repeated here.

[0441] The foregoing has provided a detailed description of a feature processing method, apparatus, electronic device, storage medium, and program product provided in the embodiments of this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A feature processing method, characterized in that, include: Obtain an object relationship graph, which represents the interaction relationships between object nodes corresponding to multiple objects; Feature interaction processing is performed on multiple object nodes in the object relationship graph to obtain target node feature information of the multiple object nodes; Based on the interaction relationships in the object relationship graph, determine the node connection relationship information of the object node, which includes the connection relationship information between the object node and other object nodes in the object relationship graph; The node connection relationship information of the object node is subjected to heterogeneous edge denoising processing to obtain the target node connection relationship information of the object node. The heterogeneous edges represent the interaction relationship between different types of object nodes. Based on the target node feature information and target node connection relationship information of the object nodes, graph feature enhancement processing is performed on the object relationship graph to obtain the feature-enhanced target object relationship graph, so as to identify abnormal objects through the target object relationship graph.

2. The feature processing method as described in claim 1, characterized in that, The step of performing feature interaction processing on multiple object nodes in the object relationship graph to obtain target node feature information of the multiple object nodes includes: Data augmentation processing is performed on the node information of the object nodes in the object relationship graph to obtain the processed node information of the object nodes; The processed node information of each object node in the object relationship graph is subjected to feature interaction processing to obtain the node feature information of each object node in the object relationship graph; The node feature information of the object node is subjected to feature projection processing to obtain the target node feature information of the object node.

3. The feature processing method as described in claim 2, characterized in that, The process of performing feature interaction processing on the processed node information of each object node in the object relationship graph to obtain the node feature information of each object node in the object relationship graph includes: For each object node in the object relationship graph, the processed node information of each neighbor node of the object node is fused to obtain fused feature information; Based on the fused feature information, the processed node information of the object node is iteratively updated to obtain the node feature information of the object node.

4. The feature processing method as described in claim 3, characterized in that, The step of iteratively updating the processed node information of the object node based on the fused feature information to obtain the node feature information of the object node includes: Based on the fused feature information, the processed node information of the object node is updated to obtain the new processed node information of the object node. Return to the step of fusing the processed node information of each neighbor node of the object node in the object relationship graph to obtain the node feature information of the object node.

5. The feature processing method as described in claim 1, characterized in that, The step of performing heterogeneous edge denoising processing on the node connection relationship information of the object node to obtain the target node connection relationship information of the object node includes: Noise prediction processing is performed on the node connection relationship information of the object node to obtain the initial noise information of the node connection relationship information; Based on the node connection relationship information, the similarity between the target node feature information of the object node and the target node feature information of the associated object node is calculated, wherein the associated object node is the node connected to the object node in the object relationship graph. Based on the similarity, the initial noise information is updated to obtain the updated noise information; Based on the updated noise information, the node connection relationship information is denoised to obtain the target node connection relationship information of the object node.

6. The feature processing method as described in claim 5, characterized in that, The step of updating the initial noise information based on the similarity to obtain updated noise information includes: Based on the node connection relationship information, calculate the number of node connections for the object node; Based on the similarity and the number of node connections, the initial noise information is updated to obtain the updated noise information.

7. The feature processing method as described in claim 5, characterized in that, The step of denoising the node connection relationship information based on the updated noise information to obtain the target node connection relationship information of the object node includes: Based on the updated noise information, the node connection relationship information is denoised to obtain denoised node connection relationship information. The denoised node connection information is determined as the new node connection information of the object node. The process of performing noise prediction processing on the node connection information of the object node to obtain the initial noise information of the node connection information is then returned to, thus obtaining the target node connection information of the object node.

8. The feature processing method as described in claim 1, characterized in that, The process of obtaining the object relationship graph includes: Obtain the original object relationship graph, which represents the interaction relationships between multiple objects; The original object relationship graph is decomposed into multiple object relationship graphs.

9. The feature processing method as described in claim 8, characterized in that, The process of performing graph structure decomposition on the original object relationship graph to obtain multiple object relationship graphs includes: The original object relationship graph is sampled multiple times to obtain a node group corresponding to each sample, and the node group includes multiple object nodes; For each node group, based on the interaction relationships of the object nodes in the node group in the original object relationship graph, the interaction relationships of the object nodes in the node group are constructed to obtain the object relationship graph corresponding to the node group.

10. The feature processing method as described in claim 8, characterized in that, The step of performing graph feature enhancement processing on the object relationship graph based on the target node feature information and target node connection relationship information of the object nodes to obtain a feature-enhanced target object relationship graph includes: Based on the target node feature information and target node connection relationship information of the object node, the node information and connection relationship of the object node in the object relationship graph are updated to obtain the updated object relationship graph. The updated object relationship graphs are then fused to obtain the target object relationship graph.

11. The feature processing method as described in claim 1, characterized in that, The step of performing graph feature enhancement processing on the object relationship graph based on the target node feature information and target node connection relationship information of the object nodes to obtain a feature-enhanced target object relationship graph includes: Based on the target node feature information and target node connection relationship information of the object node, the node information and connection relationship of the object node in the object relationship graph are updated to obtain the updated object relationship graph. Calculate the importance information of the associated nodes of the object nodes in the updated object relationship graph, wherein the importance information of the associated nodes includes the importance information of other object nodes to the object node; Based on the target node feature information, target node connection relationship information, and associated node importance information of the object nodes, graph feature enhancement processing is performed on the object relationship graph to obtain the feature-enhanced target object relationship graph.

12. The feature processing method as described in claim 11, characterized in that, The calculation of the importance information of associated nodes of object nodes in the updated object relationship graph includes: Identify the path instances in the updated object relationship graph; For each object node in the path instance, node traversal is performed through the edges between object nodes in the updated object relationship graph to calculate the importance information of other object nodes in the path instance relative to the object node, thereby obtaining the importance information of associated nodes.

13. The feature processing method as described in claim 11, characterized in that, The calculation of the importance information of associated nodes of object nodes in the updated object relationship graph includes: Calculate the importance information of other object nodes to the object node; Identify the object nodes whose importance information is greater than a preset value from the other object nodes; The importance information of the node to be adjusted is suppressed to obtain the processed importance information.

14. The feature processing method as described in claim 1, characterized in that, After performing graph feature enhancement processing on the object relationship graph based on the target node feature information and target node connection relationship information of the object nodes to obtain the feature-enhanced target object relationship graph, the process further includes: Based on the object relationship graph, multi-dimensional anomaly feature extraction processing is performed on the target object relationship graph to obtain the feature information of each object node in the target object relationship graph under each dimension; Based on the feature information of each object node in the target object relationship graph in each dimension, predict the probability information of each object node in the target object relationship graph belonging to an abnormal object node; Based on the probability information, abnormal objects are identified from the target object relationship graph.

15. The feature processing method as described in claim 2, characterized in that, The step of performing feature projection processing on the node feature information of the object node to obtain the target node feature information of the object node includes: The node feature information of the object node is processed by feature projection model to obtain the target node feature information of the object node. Before performing feature projection processing on the node feature information of the object node using a feature projection model to obtain the target node feature information of the object node, the method further includes: Obtain the sample object relationship graph and the positive and negative sample sets of each sample object node in the sample object relationship graph; Feature interaction processing is performed on each sample object node in the sample object relationship graph to obtain the initial node feature information of each sample object node; The initial node feature information of the sample object node is processed by feature projection using the feature projection model to obtain the sample node feature information of the sample object node. Based on the sample node feature information of the sample object node and the object feature information of the sample objects in the positive and negative sample sets of the sample object node, the parameters of the feature projection model are adjusted to obtain the trained feature projection model.

16. The feature processing method as described in claim 1, characterized in that, The step of performing heterogeneous edge denoising processing on the node connection relationship information of the object node to obtain the target node connection relationship information of the object node includes: By using a relation diffusion generation model, the node connection relationship information of the object node is subjected to heterogeneous edge denoising processing to obtain the target node connection relationship information of the object node. Before obtaining the target node connection information of the object node by performing heterogeneous edge denoising processing on the node connection relationship information of the object node through the relationship diffusion generation model, the method further includes: Acquire training data, which includes node connection relationship information of sample object nodes in the sample object relationship graph; The node connection relationship information of the sample object nodes is subjected to noise processing to obtain the noise-added connection relationship information; By using a relation diffusion generation model, the noisy connection relation information is subjected to heterogeneous edge denoising processing to obtain the denoised connection relation information. Based on the denoised connection relationship information and the node connection relationship information of the sample object nodes, the parameters of the relationship diffusion generation model are adjusted to obtain the trained relationship diffusion generation model.

17. A feature processing apparatus, characterized in that, include: An acquisition unit is used to acquire an object relationship graph, wherein the object relationship graph represents the interaction relationship between object nodes corresponding to multiple objects; The feature interaction unit is used to perform feature interaction processing on multiple object nodes in the object relationship graph to obtain target node feature information of the multiple object nodes. The information determination unit is used to determine the node connection relationship information of the object node based on the interaction relationship in the object relationship graph. The node connection relationship information includes the connection relationship information between the object node and other object nodes in the object relationship graph. The denoising unit is used to perform heterogeneous edge denoising processing on the node connection relationship information of the object node to obtain the target node connection relationship information of the object node, wherein the heterogeneous edge represents the interaction relationship between different types of object nodes; The feature enhancement unit is used to perform graph feature enhancement processing on the object relationship graph based on the target node feature information and target node connection relationship information of the object node, so as to obtain the feature-enhanced target object relationship graph, so as to identify abnormal objects through the target object relationship graph.

18. An electronic device, characterized in that, The method includes a processor and a memory, the memory storing multiple instructions; the processor loads instructions from the memory to perform the steps of the feature processing method as described in any one of claims 1 to 16.

19. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a plurality of instructions adapted for loading by a processor to perform the steps of the feature processing method according to any one of claims 1 to 16.

20. A computer program product comprising multiple instructions, characterized in that, When the instruction is executed by the processor, it implements the steps of the feature processing method according to any one of claims 1 to 16.

Images