90 results about "Graph sequence" patented technology

A system and method for implementing a convergent intelligence fabric (CIF) for distributed artificial intelligence operations. The CIF architecture integrates tensor-theoretic foundations, probabilistic cache management, precision-aware memory operations, quantum-resistant security, and neural-based optimization within a unified framework. The system orchestrates asynchronous, multi-hop data flow among computational resources while maintaining data security through per-block encryption and identity-based access control. Key components include a universal multi-model KV cache subsystem, agent-parallel disaggregation pipelines, reinforcement learning-based orchestration, and neuromorphic memory integration. Advanced implementations incorporate graphon-enhanced memory for sparse graph sequences, multi-modal cognitive persistent memory, and quantum-resistant asynchronous multi-domain trust protocols. The system enables efficient cross-agent collaboration, sophisticated knowledge sharing, and secure cross-domain operations while optimizing computational resources and maintaining strict privacy guarantees across distributed AI deployments.

The invention provides a malicious encrypted traffic detection method based on cross-modal alignment and graph sequence fusion, and belongs to the technical field of information security. The invention relates to a multi-modal encrypted traffic detection model GGT-Net, which is a multi-modal encrypted traffic detection model, and is characterized in that the multi-modal encrypted traffic detection model is a multi-modal encrypted traffic detection model GGT-Net which is integrated with a graph convolutional network (GCN) and a gated loop unit (GRU). According to the model, protocol structure features and statistical sequence features of network traffic are independently modeled, multi-modal features are fused through a Transform module, and the specific steps are feature extraction and TLS interaction field analysis, statistical feature standardization and protocol diagram structuring, sequence information processing and diagram convolution feature learning and multi-modal feature fusion. And finally classifying and discriminating. According to the invention, the accuracy and generalization performance of encrypted traffic detection are obviously improved.

The invention belongs to the technical field of knowledge graph construction, and discloses a supply chain knowledge graph construction method based on time sequence dynamic perception and a large language model. Constructing a time sequence dynamic sensing model, and respectively generating a time-sensitive embedding matrix for the entity and relationship of each sub-graph in a historical time window; inputting the time-sensitive embedded matrix into an aggregator to further mine structure and semantic information of entities and relationships; establishing a dependency relationship of an autoregression model learning sub-graph in a time sequence, and generating a time sequence evolution representation; and inputting the time sequence evolution representation into a pre-trained large language model, generating candidate entities or candidate relationships to complement the fact tetrad, and updating the sub-graph sequence of the current timestamp. According to the method disclosed by the invention, the supply chain domain knowledge is adapted while the general semantic understanding capability is reserved, and the balance of dynamic evolution modeling, long-period dependency capture and efficient utilization of the domain knowledge is realized, so that the reliability and interpretability of a construction result are ensured.

The invention relates to the technical field of graph neural network and causal representation learning, in particular to a graph neural network method for separating time-varying and time-invariant causal features, which comprises the following steps: acquiring graph structure data at a plurality of moments, and establishing a dynamic graph sequence; coding the dynamic graph sequence by adopting a time sequence graph neural network to obtain a node representation matrix; respectively adopting a time-varying attention head, a time-invariant attention head and a shortcut attention head to carry out attention score calculation, mask construction and sub-graph decomposition processing on the node representation matrix to obtain a time-varying cause sub-graph, a time-invariant cause sub-graph and a shortcut feature sub-graph; performing independent graph neural network coding and dynamic gating fusion to obtain fusion features; determining a current predicted value according to the fusion feature; according to the method, the causal discovery accuracy, robustness and interpretability can be improved.

The invention relates to the technical field of graph data processing, can be applied to the medical field and the financial science and technology field, and discloses a dynamic feature enhancement method and device based on a graph convolutional network, equipment and a medium, which are applied to a dynamic investment relation network analysis scene or a multi-modal medical knowledge graph scene. Carrying out pretreatment on the raw materials; generating a target dynamic adjacency matrix through the self-supervised graph convolutional network; performing spatial-temporal feature aggregation processing based on the target dynamic adjacency matrix and the target historical graph sequence to obtain a global graph; local neighbor comparison loss calculation and global structure loss calculation are carried out respectively, parameter adjustment and model training are carried out on the self-supervised graph convolutional network according to a local comparison loss value and a global comparison loss value, and a target dynamic feature enhancement model is generated; and outputting a target enhanced feature based on the to-be-processed dynamic graph data through the target dynamic feature enhancement model. According to the method, the comprehensiveness and accuracy of feature extraction are improved.

The invention relates to a power grid topology short-term load prediction method and device based on a graph neural network, and relates to the technical field of power grid prediction, and the method comprises the steps: S1, constructing an initial power grid topological graph, and carrying out the power grid time sequence slicing to generate a power grid topological graph sequence under each timestamp; s2, a power grid space-time topological feature vector set is obtained, topological evolution coupling analysis is carried out based on the power grid space-time topological feature vector set, and corresponding power grid topological evolution feature representation containing node state embedding and edge relation embedding is generated; s3, constructing a power grid topological evolution prediction model based on the power grid topological evolution characteristic representation, and generating a future power grid topological structure evolution prediction result; and S4, calculating a power grid load influence factor based on the real-time operation data corresponding to each node in the power grid, and generating a power grid topology short-term load prediction result in combination with a future power grid topology structure evolution prediction result. Compared with the prior art, the method can achieve the precise load prediction under the topological change of the power grid.

The invention relates to a semi-template drug molecule inverse synthesis prediction method based on graph-sequence pre-training. The method comprises the following steps: selecting a public chemical molecule data set N; selecting a molecular sample from the N, and then extracting a molecular graph and a word segmentation sequence from the molecular sample; obtaining a sequence embedding matrix and a graph embedding matrix of the i by utilizing the word segmentation sequence of the i and the molecular graph; constructing an overall model M and a loss function Ltotal used for training the M; and training M in two stages by using AdamW to obtain a trained model M. By adopting the method disclosed by the invention, reactant atoms for generating a product can be accurately reduced, a starting material of the product is defined, and the research and development success rate of medicines or other products is improved.

The invention discloses a park intelligent operation optimization method based on a graph neural network, and the method comprises the following steps: S1, constructing a park dynamic graph structure, collecting building, equipment, personnel and traffic data, building nodes and edges, and forming a dynamic graph sequence; s2, inputting the dynamic graph sequence into a graph neural network, introducing a causal driven control module, constructing a causal path graph, and generating a causal enhanced graph embedding vector; s3, generating a park operation state prediction index based on the graph embedding vector; s4, according to the prediction indexes, generating a scheduling scheme by adopting an improved self-regulation elastic scheduling system, and issuing and executing the scheduling scheme; and S5, collecting feedback data of each subsystem, updating a dynamic graph structure, a causal path graph weight and a scheduling scheme, and constructing a closed-loop optimization system. According to the invention, the intelligent operation optimization of the park is realized by fusing the graph neural network and the improved self-regulation elastic scheduling system.

The invention discloses a BGP (Border Gateway Protocol) routing anomaly detection method and system based on a graph attention auto-encoder. The method comprises the following steps: step 1, collecting normal BGP data when routing anomaly does not occur on the Internet, and constructing an AS-level topological graph; 2, obtaining AS-level topological graph representation according to a graph attention auto-encoder model encoder; 3, obtaining a reconstructed adjacent matrix according to a graph attention auto-encoder model decoder; step 4, training a graph attention auto-encoder model; 5, obtaining target BGP data and constructing an AS-level topological graph sequence corresponding to the target BGP data; step 6, obtaining AS node embedding of the AS-level topological graph sequence according to an encoder in the pre-trained graph attention auto-encoder model; and 7, embedding and inputting the AS nodes into the multi-layer perceptron model to obtain an anomaly detection result. According to the invention, the key AS is convenient to pay attention, and the accuracy of anomaly detection is improved.

The invention provides a threat detection method and device, and the method comprises the steps: constructing a time sequence diagram sequence corresponding to each time window through the preprocessed multi-source log data of a target network; embedding nodes in the time sequence diagram sequence corresponding to each time window by using a relational graph neural network to obtain an embedded sequence matrix; inputting the embedded sequence matrix into a Transform model, and performing autoregressive prediction to obtain a node prediction matrix of a next sub-graph node; constructing an attention score matrix through the predicted node prediction matrix of the next sub-graph node, so as to predict a connection matrix at the next moment; and calculating an error between the connection matrix at the next moment and the real adjacent matrix at the next moment to determine whether a security threat exists at the next moment. According to the scheme, the technical problems of data imbalance and data annotation in the prior art are solved, and efficient identification of low-frequency and hidden attack behaviors is achieved.

The invention discloses a spherical panoramic image feature matching method and system, a terminal and a storage medium, and the method comprises the steps: obtaining a spherical panoramic image, and carrying out the preprocessing of the spherical panoramic image; screening the preprocessed spherical panoramic image based on a spatial constraint model, and constructing a scene graph based on the screened spherical panoramic image; segmenting the scene graph into a plurality of sub-scene graphs, and performing priority ranking on the sub-scene graphs based on a graph sequence scheduling algorithm; and performing geometric correction and feature extraction on all the screened spherical panoramic images, and executing a feature matching task of the spherical panoramic images in the sub-scene images according to the priority ranking of the sub-scene images. Through a spatial constraint model, a graph order scheduling algorithm, geometric correction and a cascade Hash matching algorithm, the problem that feature matching efficiency and precision are difficult to consider when a spherical image feature matching technology processes large-scale high-resolution spherical images is solved.

The embodiment of the invention provides an electroencephalogram emotion recognition method based on a graph neural network and federal learning. The method is applied to the technical field of artificial intelligence. The method comprises the following steps: acquiring a resting state functional magnetic resonance imaging time sequence and non-image personalized data; preprocessing the resting state functional magnetic resonance imaging time sequence, and constructing a dynamic graph sequence for the preprocessed resting state functional magnetic resonance imaging time sequence based on a plurality of preset brain maps by adopting a sliding window technology; inputting the dynamic graph sequence into a shared feature layer for feature extraction to obtain a space-time shared feature vector; inputting the non-image personalized data into an independent personalized layer for feature extraction to obtain a personalized feature vector; performing feature fusion processing on the space-time sharing feature vector and the personalized feature vector to obtain a fused feature; and the fused features are mapped into the electroencephalogram emotion category probability through the classifier, an electroencephalogram emotion recognition result is obtained, and the electroencephalogram emotion recognition accuracy and the generalization ability of the model are improved.

The invention relates to the field of network security, and discloses a network security situation awareness method and system based on deep learning, and the method comprises the following steps: obtaining multi-source network data; extracting time feature representation of nodes in the dynamic space-time diagram sequence through a multi-scale time feature extraction network; extracting spatial feature representation of the nodes through a graph neural network; fusing the time feature representation and the spatial feature representation; constructing a decoupling encoder based on the information bottleneck; and performing anomaly detection and attack path tracing based on the time hidden variable, the space hidden variable and the coupling hidden variable. By constructing a multi-scale time feature extraction network and introducing a dynamic receptive field adjustment mechanism, space-time coupling features are separated into a time hidden variable, a space hidden variable and a coupling hidden variable, and coupling information is comprehensively utilized during anomaly detection to improve detection precision. And an attack propagation path is accurately reconstructed based on pure spatial features during attack path tracing.

The present application relates to the technical field of marine data processing and spatio-temporal prediction, and specifically discloses a sea surface core variable prediction method and system based on a wavelet-enhanced graph neural network.The method comprises the following steps: obtaining multivariate graph sequence data of a target sea surface; performing multilevel wavelet decomposition and gated fusion on each variable through a variable-level multiscale wavelet gated fusion module, and outputting enhanced multiscale time series features; inputting the enhanced multiscale time series features into a KAN-LSTM encoder module, performing recursive updating through gated fusion of a conventional convolution and a KAN convolution branch, and outputting encoder spatio-temporal features; inputting the encoder spatio-temporal features into a signed adaptive spatial graph convolution module, learning a signed sparse adaptive adjacency matrix and performing multi-order diffusion aggregation, and outputting a prediction result.The present application realizes long-term prediction of a target sea surface with high precision and high stability.

The invention discloses a terminal anomaly detection system based on a graph neural network, and the system comprises the steps: collecting a terminal side process, a file, a registry, an account, network connection and an external IP, and constructing a terminal heterogeneous behavior graph sequence; executing causal disturbance baseline extraction to generate a causal constraint set; forming a dynamic security semantic meta-path set according to the causal constraint set; generating a node pre-scoring sequence; performing Bayesian online change point detection to generate a state mutation posterior probability sequence, an operation length sequence and a receptive field modulation parameter; generating a node graph anomaly score sequence based on an improved FreeGAD algorithm; constructing an anti-fact normal evolution diagram and generating a verification score sequence; and generating a terminal abnormity alarm result according to the node graph abnormity score sequence, the state mutation posterior probability sequence, the verification score sequence and the operation length sequence. According to the method, collaborative anomaly detection of terminal heterogeneous correlation modeling, time sequence change point feedback, adaptive graph scoring and anti-fact verification is realized.

The invention relates to the technical field of transformer magnetic field simulation, and discloses a transformer magnetic field simulation method based on a graph neural network and a related device, and the method comprises the steps: obtaining the magnetic field data of a transformer under a plurality of operation conditions; preprocessing the magnetic field data to obtain preprocessed magnetic field data; constructing a graph structure of each historical time step of the preprocessed magnetic field data; constructing a graph sequence sample; inputting the graph sequence sample into a preset graph neural network model for model training, and learning an evolution law of the magnetic field in space and time to obtain a trained model; and predicting an estimated value of the magnetic field intensity of the transformer in the future by using the trained model. By the adoption of the method, the transformer magnetic field simulation method based on the graph neural network can be achieved, compared with a traditional finite element simulation method, the magnetic field simulation efficiency can be improved, dependence on a finite element tool can be reduced, and rapid electromagnetic field sensing and intelligent analysis of complex power equipment can be achieved.

The present application discloses a method for recognizing architectural patterns, which is based on multiple spatial proximity graph distances and architectural attribute features, and is used to identify architectural complexes with complex nonlinear spatial distribution patterns. The present application constructs three graph sequences to capture the spatial adjacent structures and non-spatial features of different feature views, and then obtains three improved graphs through a graph diffusion process, and fuses them into a joint graph shared by all views, which can depict the mutual relationships between them and produce the final clustering results. The recognition method of the present application uses two distance metrics, contour distance and centroid distance, to make full use of the complementary information of spatial structure and non-spatial attributes, and to determine architectural patterns by combining spatial proximity relationships and non-spatial similarities, providing technical support for aspects such as map making synthesis and urban scene semantic segmentation, and representing geographical reality as realistically as possible within the limitations of map scale.

The invention discloses a multi-ship meeting similar scene identification method based on a topological graph sequence. The method comprises the following steps: 1) collecting multi-ship meeting scene information; 2) extracting a multi-ship meeting scene; the method comprises the following steps: constructing a multi-ship meeting topological graph sequence, and extracting a multi-ship meeting scene; 3) identifying similar scenes encountered by multiple ships; and 4) arranging a plurality of graph sequences in an identification result queue obtained by scene hierarchical identification from small to large according to the similarity of the graph sequences to obtain a final result, and completing the acquisition of the similar scene of the multi-ship encounter scene. Aiming at the problem that a similar scene is difficult to find through similarity measurement in a multi-ship meeting scene, the invention provides a multi-ship meeting scene identification method based on a topological graph sequence, and a research result can provide a method reference for related research of ship collision avoidance decision and meeting risk analysis.

The invention belongs to the field of identity authentication, and discloses an identity authentication method based on a dynamic graph network and a related device, and the method comprises the steps: collecting interaction data of a plurality of touch screen sliding events of a user, constructing a single-event sliding graph of each touch screen sliding event of the user according to the interaction data, and combining the single-event sliding graphs according to a time sequence to obtain a sliding graph sequence; inputting the sliding graph sequence into a pre-trained dynamic graph network authentication model to obtain a user identity authentication result; wherein the dynamic graph network authentication model comprises a feature extraction part used for extracting feature vectors of a sliding graph sequence and a classification authentication part used for carrying out identity classification according to the feature vectors; the feature extraction part comprises a graph convolutional network and a long-short-term memory network which are connected in sequence, and the classification authentication part is constructed based on a full-connection module. The whole-process identity authentication can be completed only through interaction data generated when the user interacts with the touch screen, and compared with an existing identity authentication method, an authentication mode better in performance and higher in generalization is provided.

The application relates to a pedestrian trajectory prediction method based on a multi-disconnected mode learning, a prediction trajectory is generated based on a social disconnected mode generation adversarial network model, an encoder is used to extract visual features and observed pedestrian trajectory features, physical scene and social attention features are obtained based on an attention module; a structured graph sequence based on attention labeling is established by using the social attention, and the structured graph sequence is encoded by using a space-time encoder to extract transient changes of a physical background and pedestrian movement; the physical scene attention, the social attention and space-time encoder output features are spliced and input into a multi-generator architecture, and the future trajectory of a predicted pedestrian is output; a generator selector is used for prior learning of the multi-generator, and a spectral trajectory clustering module is used for updating an upper limit of the number of generators in the prior learning process. Compared with the prior art, the application can capture transient changes of space-time information, reduce model redundancy, and be flexibly adapted to multiple prediction scenes.

The invention belongs to the technical field of radar data processing, particularly relates to a compact ground wave radar track association method and system, aims to solve the problem of fuzzy association of T / R and T-R dual radars in a multi-target dense scene, and generates time-space aligned short-time track segments by acquiring and preprocessing track data of the two radars; constructing a local topological graph with a main target as a center and a neighborhood target as a node for each fragment, and forming a graph sequence pair to be compared according to a time sequence; the graph sequence pairs are input into a twinning GAT-LSTM network, spatial features are extracted through a graph attention network (GAT), time sequence features are fused through a long short-term memory network (LSTM), double-branch high-dimensional spatial-temporal feature vectors are output, and segment-level association scores are obtained through splicing and similarity estimation; and calculating a consistency index based on the score set of all the fragments in the track overlapping region and judging track association. The accuracy and robustness of track association in a target dense environment are improved by combining time and space features of a modeling target.

The application discloses a kind of based on deep learning's building construction monitoring system, it is related to building construction safety monitoring technical field, including: data generation module, for gathering construction monitoring associated data and pre-processing, generates standardized construction monitoring data set;Target state module, for identifying construction site target and its operation state, generates construction object state result;Interaction graph construction module, for constructing construction interaction graph sequence;Region constraint module, for generating region constraint representation;State calibration module, for generating calibrated construction interaction graph sequence;Space-time graph identification module, for generating cross-operation risk identification result by region constraint GraphWaveNet model;Hierarchical early warning module, for generating building construction monitoring result.The application has the advantages of good identification continuity, high accuracy and timely warning.

The invention discloses a computer resource allocation management method and system based on deep learning, and the method comprises the steps: obtaining multi-source heterogeneous data, constructing a system topological graph based on the multi-source heterogeneous data, enabling server nodes, virtual machine instances and network connections to serve as nodes of the graph, and enabling a connection relation between the nodes to serve as edges, thereby obtaining a dynamic graph sequence; constructing a GCN-GAT mixed graph neural network model based on a GCN graph convolutional network and a GAT graph attention network, and adaptively learning an important relationship between nodes by using multilayer graph convolution and an attention mechanism to obtain a target GCN-GAT mixed graph neural network model; and establishing a multi-objective optimization function according to the prediction index and the current system topological structure, performing resource allocation decision through an improved DQN deep reinforcement learning algorithm, and outputting an optimal allocation strategy. The resource demand prediction error is reduced, and the resource utilization rate is improved.

The invention relates to the technical field of network security protection, in particular to a mimicry traffic defense method and system based on dynamic graph residual comparison. The method comprises the steps of collecting network traffic logs to construct a dynamic graph sequence; obtaining a node embedding matrix through sequential diagram attention network coding, calculating a node-level residual error and a graph-level residual error, and performing weighted fusion to construct a unified residual error vector; inputting the unified residual vector sequence into a Transform network, and outputting a node-level anomaly score and graph-level attack prediction probability distribution in parallel; fusing the two to calculate an abnormal strength index, and setting double thresholds to divide the traffic into three classes; and identifying abnormal nodes for uncertainty abnormal traffic according to node-level abnormal scores and guiding the abnormal nodes to a standard mimicry executor, guiding high-risk traffic to a heterogeneous induction executor, and adjusting a response strategy according to an attack type. According to the invention, the detection capability and defense flexibility of complex attacks are improved.

The invention discloses a skeleton action recognition method based on motion center space-time diagram convolution. The method comprises the following steps: acquiring a human body skeleton diagram sequence of a moving object; performing time sequence feature extraction on the human body skeleton graph sequence to obtain a time sequence feature graph used for representing time features of each moving object; extracting the time sequence feature map to obtain a motion center of the moving object; based on the motion center and the three-dimensional space position information, obtaining skeleton characteristics including spatio-temporal information; establishing a skeleton action recognition model, and training the skeleton action recognition model based on the skeleton features to obtain a trained skeleton action recognition model; the skeleton action recognition model comprises a feature extraction module and a classification module; and recognizing a skeleton action based on the trained skeleton action recognition model to obtain an action classification result of the moving object. According to the method, the space structure information and the time change characteristics of each moving object are fully utilized, and the motion center is introduced to express the characteristics of each moving object in different motions, so that the motion recognition accuracy is improved.

The invention relates to the technical field of security monitoring, in particular to an intelligent decision-making system and method based on a space-time diagram neural network. Comprising the steps that coordinate information of all joint points is extracted from a monitoring video, an initial graph sequence containing time dimensions is constructed, spatial-temporal feature representation is obtained through a spatial-temporal graph neural network, abnormal propagation features reflecting the abnormal association relation of the joints are extracted, and time sequence dependency data describing the abnormal evolution process are formed; generating a time-dependent feature, determining a posture change trend vector, and screening to obtain an abnormal candidate sequence; and further performing feature enhancement on the abnormal candidate sequence to obtain enhanced feature representation, determining the position and time of abnormal behavior occurrence according to the enhanced feature representation, and making an intervention decision. According to the method, the problem that abnormal behaviors are difficult to accurately identify, position and intelligently intervene and make decisions in a complex monitoring scene is solved, and efficient detection, accurate space-time positioning and intelligent intervention decision making of the abnormal behaviors are realized.

The application relates to a causal graph neural network prediction method and medium for eliminating AD false correlation. The method first constructs a graph structure of SNPs and brain images, extracts features using a time series graph network and maps the features to a disease quasi-time axis, and then divides stages and generates a graph sequence. The causal contribution degree between nodes is calculated through a time series prediction network to obtain a causal prior graph; direction correction is performed by using counterfactual flipping and graph convolution to obtain a refined causal graph. The features are subjected to causal enhancement, and double-mode information is fused through cross-attention. Finally, a classifier is input to realize AD staging prediction. The method overcomes the limitation that existing methods are difficult to distinguish between causality and false correlation in cross-sectional data, and through explicit modeling of disease time evolution and causal structure, the ability to capture early Alzheimer's disease and subtle pathological patterns is enhanced, thereby improving the accuracy, interpretability and cross-domain generalization ability of classification prediction.

The invention discloses a heavy electric vehicle on-line gear shifting method and device based on an enhanced graph learning framework, and the method comprises the steps: firstly solving a full-stroke optimal gear shifting track through a dynamic programming algorithm based on a known driving condition and a vehicle dynamics model at an offline stage, and obtaining a time sequence optimal solution of a vehicle state quantity; secondly, dispersing the optimal track into a series of graph structure samples according to time steps, constructing a graph time sequence data set for gear shifting decision by taking optimal middle and rear axle gears output by dynamic planning as labels, and finally designing EE-GAT, and carrying out encoding and time sequence aggregation on graph sequence data in a sliding time window, so as to obtain an EE-GAT set; and outputting an intermediate axle and rear axle gear decision at the next moment. According to the method, the key physical coupling relation in the power assembly is coded in the graph structure, and the edge feature enhancement graph attention network can learn the deep correlation between the vehicle running state and the optimal gear shifting logic from the system level, so that the model has higher generalization and decision stability for unseen working conditions.

The invention discloses an APT attack traceability graph construction method based on a dynamic sliding window and multi-dimensional time sequence scoring. The method comprises the following steps: collecting multi-source heterogeneous system audit log data, analyzing the multi-source heterogeneous system audit log data into a standardized entity interaction tetrad flow, and constructing a continuous time sequence evolution dynamic traceability graph snapshot through a sliding window mechanism; in order to solve the problems that an existing total traceability graph causes scale explosion along with long-term operation of a system and a traditional statistical pruning method is prone to losing low-frequency key attack semantics, topological connection strength of nodes, time sequence burstiness of interaction frequency and causal association with threat intelligence are utilized, and the probability of low-frequency key attack semantics is lowered. A three-dimensional lightweight scoring model is constructed to quantify node values, and a safety anchor point mechanism is introduced for forced retention for high-risk nodes hitting threat intelligence or key assets, so that the high-risk nodes are prevented from being rejected as noise due to relatively low frequency; and for other background nodes, an exponential moving average algorithm is utilized to capture behavior burst characteristics and perform dynamic Top-K pruning, system interaction with high information content is reserved while denoising is performed, and finally a traceability graph sequence considering scale simplification and semantic completeness is generated. According to the method provided by the invention, the key semantic information of the APT attack can be effectively reserved while the data scale and the calculation overhead are greatly reduced.