CN111277433A - Network service abnormity detection method and device based on attribute network characterization learning - Google Patents
Network service abnormity detection method and device based on attribute network characterization learning Download PDFInfo
- Publication number
- CN111277433A CN111277433A CN202010042262.XA CN202010042262A CN111277433A CN 111277433 A CN111277433 A CN 111277433A CN 202010042262 A CN202010042262 A CN 202010042262A CN 111277433 A CN111277433 A CN 111277433A
- Authority
- CN
- China
- Prior art keywords
- network
- data
- attribute
- network service
- information network
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
- H04L41/5003—Managing SLA; Interaction between SLA and QoS
- H04L41/5009—Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/22—Matching criteria, e.g. proximity measures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/243—Classification techniques relating to the number of classes
- G06F18/2433—Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N20/00—Machine learning
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/50—Testing arrangements
- H04L43/55—Testing of service level quality, e.g. simulating service usage
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- General Engineering & Computer Science (AREA)
- Signal Processing (AREA)
- General Physics & Mathematics (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Computer Networks & Wireless Communication (AREA)
- Evolutionary Computation (AREA)
- Physics & Mathematics (AREA)
- Artificial Intelligence (AREA)
- Software Systems (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Evolutionary Biology (AREA)
- Life Sciences & Earth Sciences (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computing Systems (AREA)
- Computer Security & Cryptography (AREA)
- Quality & Reliability (AREA)
- Medical Informatics (AREA)
- Mathematical Physics (AREA)
- Computer Hardware Design (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a network service abnormity detection method and device based on attribute network characterization learning, which comprises the following steps: acquiring initial network service data, constructing a heterogeneous information network based on the initial network service data, and acquiring a node attribute set; constructing an attribute vector set based on the node attribute set, and constructing an attribute information network according to the attribute vector set and the heterogeneous information network; constructing an objective function based on the attribute information network, and constructing a mapping relation between nodes in the attribute information network and vector representations corresponding to the nodes based on the network representation learning to be learned obtained by solving the objective function; and training based on the training set data to obtain an anomaly detection model, and calculating the anomaly probability of each piece of network service data in the test set data according to the anomaly detection model. The invention enhances the relevance of the nodes in the attribute information network, improves the generalization capability of the anomaly detection model, and has better guarantee for detecting the anomaly, intercepting the anomaly and protecting the fund security of users and enterprises.
Description
Technical Field
The invention relates to the technical field of network service abnormity detection, in particular to a method and a device for detecting attribute network characterization learning abnormity in network service.
Background
At present, along with the gradual expansion of network service services, a number of fraudulent means are developed, and a practical and effective network service abnormality detection system needs to be established in order to ensure the service safety of a convergence mechanism and normal users in network services.
Potential association generally exists in abnormal information in network services, and the anomaly detection based on the knowledge graph mainly converts the information of a single point into a correlated network structure of a plane, so that specific potential risks existing in complex relationships are effectively analyzed. In recent years, network characterization learning has a powerful effect in mining the association between data on a network structure, solves the difficulty of big data calculation on the network structure, and is widely applied to the fields of marketing, community discovery, anomaly detection and the like. However, most of the current anomaly detection systems related to knowledge graph usually focus on deep mining of network topology, which cannot adapt to weak correlation of network service data, and neglects observed and recorded node attribute information in a real system, for example, network service data not only has various interpersonal relationships, but also contains abundant personal information and personal attributes. In addition, data of normal network services are often mutually independent or have low relevance with other data, the relation on a network topological structure is simply mined, other abundant semantic information is ignored, the method cannot be effectively applied to an anomaly detection task in a network service scene, abundant node attributes and network structures need to be fused urgently, and the performance of network representation learning is further improved.
Through the above research, it is found that one of the main problems of anomaly detection for network services is to analyze specific potential risks existing in complex relationships. The traditional detection method is slow in auditing process and difficult to capture the association relation between information, and further lacks good generalization capability. The general anomaly detection means based on network characterization learning cannot process excessively isolated network service information, and is weak in universality in various scenes of network services.
Disclosure of Invention
The invention aims to solve the technical problems that the conventional anomaly detection method in the network service is slow in auditing, difficult to capture the incidence relation between information and lack of better generalization capability, and the existing anomaly detection means based on network characterization learning cannot process excessively isolated network service information and has weak universality in various scenes of the network service.
In order to solve the technical problem, the invention provides a network service abnormity detection method based on attribute network characterization learning, which comprises the following steps:
acquiring initial network service data according to original network service data, constructing a heterogeneous information network based on the initial network service data, and acquiring a node attribute set in the original network service data based on all nodes in the heterogeneous information network;
constructing an attribute vector set based on the node attribute set, and constructing an attribute information network according to the attribute vector set and the heterogeneous information network;
based on the attribute information network, finding an optimal vector representation form to construct an objective function in the maximum posterior problem, solving the objective function according to a preset algorithm to obtain a node corresponding vector to be learned by network representation learning, and constructing a mapping relation between nodes in the attribute information network and vector representations corresponding to the nodes based on the node corresponding vector to be learned by the network representation learning;
the method comprises the steps that the mapping relation between nodes in the attribute information network and vector representations corresponding to the nodes in the attribute information network is used for calculating the feature data of each network service single number type node in the attribute information network, an abnormality detection model is obtained through training based on all network service single number type nodes in the attribute information network and training set data in the feature data corresponding to the network service single number type nodes, and the abnormality probability of each network service data in test set data in all network service single number type nodes in the attribute information network and the feature data corresponding to the network service single number type nodes is calculated according to the abnormality detection model.
Preferably, the obtaining initial network service data according to original network service data, constructing a heterogeneous information network based on the initial network service data, and obtaining a node attribute set in the original network service data based on all nodes in the heterogeneous information network includes:
dividing training set data and test set data from the original network service data, wherein the training set data and the test set data form initial network service data;
discretizing the initial network service data, extracting the relationship of the discretized initial network service data, and combining all the association relationships extracted by the relationship extraction to obtain a relationship set;
constructing a heterogeneous information network based on the relationship set;
and sequentially acquiring corresponding node attributes in the original network service data based on all nodes in the heterogeneous information network, and establishing an attribute set aiming at all nodes and the corresponding node attributes thereof.
Preferably, the dividing training set data and test set data in the original network service data comprises:
setting a training set time window and a test set time window;
partitioning training set data from the original network service data based on the training set time window;
partitioning test set data in the original network service data based on the test set time window;
the training set time window and the test set time window are continuous time windows, and the training set time window is prior to the test set time window in time.
Preferably, the step of constructing an attribute vector set based on the node attribute set, and the step of constructing an attribute information network according to the attribute vector set and the heterogeneous information network includes:
vectorizing all node attributes in the node attribute set to obtain an attribute vector set;
and constructing an attribute information network according to the attribute vector set and the heterogeneous information network.
Preferably, based on the attribute information network, finding an optimal vector representation form to construct an objective function by using a maximum posterior problem, solving the objective function according to a preset algorithm to obtain a node corresponding vector to be learned by network representation learning, and constructing a mapping relation between a node in the attribute information network and a vector representation corresponding to the node based on the node corresponding vector to be learned by network representation learning, the steps include:
sampling the attribute information network based on a preset sampling method to obtain complete sampling data suitable for characterization learning;
searching an optimal vector representation form by using a maximum posterior problem based on the attribute information network to obtain a target function;
designing a structure score function for a network structure of the attribute information network and designing an attribute score function for an attribute of the attribute information network based on the sampling data;
solving the target function based on the structure score function and the attribute score function to obtain a node corresponding vector to be learned by network characterization learning;
and setting the mapping relation between the nodes and the corresponding vectors in the attribute information network based on the corresponding vectors of the nodes to be learned by the network characterization learning.
Preferably, the step of sampling the attribute information network based on a preset sampling method to obtain complete sampling data suitable for characterization learning includes:
sampling the attribute information network through random walk sampling to obtain normal sampling data;
sampling the normal sampling data through negative sampling to obtain negative sampling data;
acquiring complete sampling data suitable for characterization learning based on the normal sampling data and the negative sampling data.
Preferably, the step of solving the objective function based on the structure score function and the attribute score function to obtain a node corresponding vector to be learned by network characterization learning includes:
and solving the target function through a random gradient descent algorithm based on the structure score function and the attribute score function to obtain a node corresponding vector to be learned by network characterization learning.
Preferably, the step of calculating the feature data of each network service single number type node in the attribute information network based on the mapping relationship between the node in the attribute information network and the vector representation corresponding to the node in the attribute information network, training the feature data based on all the network service single number type nodes in the attribute information network and the training set data in the feature data corresponding to the network service single number type nodes in the attribute information network to obtain an anomaly detection model, and calculating the anomaly probability of each network service data in the test set data of all the network service single number type nodes in the attribute information network and the feature data corresponding to the network service single number type nodes in the attribute information network according to the anomaly detection model includes:
calculating the vector similarity of each network service single number type node and a first-order neighbor thereof in the attribute information network based on the mapping relation between the nodes in the attribute information network and the vector representations corresponding to the nodes as the microscopic features corresponding to the network service single number type nodes;
calculating the vector similarity of each network service single-number type node and a second-order neighbor thereof in the attribute information network based on the mapping relation between the nodes in the attribute information network and the vector representations corresponding to the nodes as the macroscopic characteristics corresponding to the network service single-number type nodes;
taking each network service single number type node in the attribute information network and the corresponding micro-feature and macro-feature as new network data;
and importing the training set data in the new network service data into a preset classifier to perform secondary classification training to obtain an anomaly detection model, and inputting the test set data in the new network service data into the anomaly detection model to obtain the anomaly probability of each network service data in the test set data.
Preferably, the preset classifier is an XGBoost classifier.
In order to solve the technical problem, the invention provides a network service anomaly detection device based on attribute network characterization learning, which comprises a heterogeneous information network construction module, an attribute information network construction module, a mapping relation construction module and an anomaly probability calculation module which are sequentially connected;
the heterogeneous information network construction module is used for acquiring initial network service data according to original network service data, constructing a heterogeneous information network based on the initial network service data, and acquiring a node attribute set in the original network service data based on all nodes in the heterogeneous information network;
the attribute information network construction module is used for constructing an attribute vector set based on the node attribute set and constructing an attribute information network according to the attribute vector set and the heterogeneous information network;
the mapping relation construction module is used for searching an optimal vector representation form to construct an objective function based on the attribute information network by using a maximum posterior problem, solving the objective function according to a preset algorithm to obtain a node corresponding vector to be learned by network representation learning, and constructing a mapping relation between nodes in the attribute information network and vector representations corresponding to the nodes based on the node corresponding vector to be learned by the network representation learning;
the abnormal probability calculation module is used for calculating the feature data of each network service single number type node in the attribute information network based on the mapping relation between the nodes in the attribute information network and the corresponding vector representations thereof, and training the training set data in all the network service single number type nodes in the attribute information network and the corresponding feature data thereof to obtain an abnormal detection model, and calculating the abnormal probability of each network service data in all the network service single number type nodes in the attribute information network and the test set data in the corresponding feature data thereof according to the abnormal detection model.
Compared with the prior art, one or more embodiments in the above scheme can have the following advantages or beneficial effects:
by applying the network service abnormity detection method based on attribute network characterization learning provided by the embodiment of the invention, the node attributes corresponding to all nodes in the heterogeneous information network are collected and then combined with the heterogeneous information network to obtain the attribute information network, the attribute information network introduces the node attributes on the basis of the existing network characterization learning algorithm to form the attribute network characterization learning algorithm to obtain the vector characterization corresponding to the nodes in the attribute information network, so that the potential correlation characteristics are automatically extracted from the data, and the degree of dependence of the system on service knowledge is reduced; meanwhile, the vector representation in the method contains richer semantic information and is more suitable for low-association data in a network service scene. Further constructing features from a macroscopic angle and a microscopic angle according to the obtained vector representations, and inputting the macroscopic features and the microscopic features into a two-classification model for training and testing to obtain the abnormal probability of the network service data; compared with the traditional method, the method has higher accuracy and robustness by depicting the network service data from macroscopic and microscopic angles.
Additional features and advantages of the invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by the practice of the invention. The objectives and other advantages of the invention will be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.
Drawings
The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the description serve to explain the principles of the invention and not to limit the invention. In the drawings:
FIG. 1 is a schematic flow chart illustrating a method for detecting network service anomaly based on attribute network characterization learning according to an embodiment of the present invention;
FIG. 2 is a process diagram of a network service anomaly detection method based on attribute network characterization learning according to an embodiment of the present invention;
FIG. 3 is a diagram illustrating an exemplary network of attribute information in a network service anomaly detection method based on attribute network characterization learning according to an embodiment of the present invention;
FIG. 4 shows a schematic diagram of a HIN2Vec neural network model in a network service anomaly detection method based on attribute network characterization learning according to an embodiment of the present invention;
FIG. 5 is a schematic structural diagram of a network service anomaly detection apparatus based on attribute network characterization learning according to a second embodiment of the present invention;
fig. 6 shows a schematic structural diagram of a four-terminal according to an embodiment of the present invention.
Detailed Description
The following detailed description of the embodiments of the present invention will be provided with reference to the drawings and examples, so that how to apply the technical means to solve the technical problems and achieve the technical effects can be fully understood and implemented. It should be noted that, as long as there is no conflict, the embodiments and the features of the embodiments of the present invention may be combined with each other, and the technical solutions formed are within the scope of the present invention.
The network service has wide application in the application fields of e-commerce, e-government affairs, company business process electronization and the like, and is regarded as the next key point of the internet by the insiders. With the rapid development of the internet, various traditional offline services gradually change to online scenes, and are rapidly developed. The prosperity and growth of network services bring a large amount of e-commerce data, and meanwhile, the accompanying fraud means are also large and endless. The loan service in the network service is rapidly developed in the world, particularly China, and the accumulated network loan volume in the China in 2018 breaks through 8 trillion customs and rises by 15.37 percent. Moreover, the hidden surface of the Chinese network service, namely the network gray product practitioners, exceeds 150 thousands, presents the characteristics of specialization, group formation, regionalization and the like, and the lawbreakers illegally grab benefits and hurt normal users, and the market scale of the lawbreakers reaches the billions level. The abnormity in the network service mainly comprises medium agency, group event, machine behavior, account embezzlement, identity masquerade, tandem transaction and the like. The identity fraud is a relatively common network service anomaly, and means that a user counterfeits materials such as provided personal identity, property certificate and the like, and even adopts illegal means such as deception and the like to acquire other person information, so as to pretend to be other person identity fraud.
In order to guarantee the business safety of the fusion mechanism and normal users in the network service, a practical and effective network service abnormity detection system needs to be established. However, the traditional detection method is slow in auditing process and difficult to capture the association relationship between information, so that better generalization capability is lacked, and a general anomaly detection means based on network characterization learning cannot process excessively isolated network service information and is weak in universality in various scenes of network services.
Example one
In order to solve the technical problems in the prior art, the embodiment of the invention provides a network service abnormity detection method based on attribute network characterization learning.
FIG. 1 is a schematic flow chart illustrating a method for detecting network service anomaly based on attribute network characterization learning according to an embodiment of the present invention; FIG. 2 is a process diagram of a network service anomaly detection method based on attribute network characterization learning according to an embodiment of the present invention; referring to fig. 1 and fig. 2, a network service anomaly detection method based on attribute network characterization learning according to an embodiment of the present invention includes the following steps.
Step S101, obtaining initial network service data according to original network service data, constructing a heterogeneous information network based on the initial network service data, and obtaining a node attribute set in the original network service data based on all nodes in the heterogeneous information network.
Specifically, original network service data is obtained, and a training set time window and a test set time window are set based on test requirements for dividing the training set data and the test set data from the original network service data. The training set time window and the test set time window are both continuous time windows, and in order to avoid the problem of time crossing, the occurrence time of the network service data in all the training set data is ensured to be earlier than that of the network service data in any test set data, namely the set training set time window is earlier than the test set time window in time. Preferably, the training set time window is generally sized to be a half-year test set time window sized to three days, and the training set time window and the test set time window are consecutive time periods. After the training set time window and the test set time window are set, training set data are divided from the original network service data based on the training set time window, test set data are divided from the original network service data based on the test set time window, and the training set data and the test set data form initial network service data.
It should be noted that, when setting the training set time window and the test set time window, attention needs to be paid, and if a larger training set time window is set, the network service data will be more, and at this time, the detection speed of the method is reduced; meanwhile, a larger test set time window is set, and network service data of a certain time period needs to be accumulated for detection, so that longer result waiting time can be brought; although increasing the sizes of the training set time window and the test set time window causes time loss, the method performance is improved to some extent, and therefore, the setting of the training set time window and the test set time window needs to be performed according to the original network service data and the test requirements.
And then discretizing the initial network service data, extracting the relationship of the discretized initial network service data, and combining all the association relationships extracted by the relationship extraction to obtain a relationship set. Further, available original fields (for example, table 1) are screened from the initial network service data, if a field is a continuous value, a discretization rule is formulated for the field, and the data precision is reduced by discretizing the value; for example, the present embodiment divides the amount of money into a limited number of categories according to different intervals; time is accurate to units of seconds, etc. The initial network service data is further divided into two types, namely a single number and an entity, wherein the entity is other data which has independent significance except the single number in the initial network service data, such as: mobile phone number, identification number, company name, address, etc. Regarding a piece of network service data, the single number a and any entity s are regarded as an association relationship, and the relationship type r is the type of the entity s. And extracting the relation of all the data in the dispersed initial network service data, and combining all the association relations (a, s, r) to obtain a relation set A.
Table 1 may utilize the original field
After a relationship set a of initial network service data is obtained, a heterogeneous information network HIN is constructed based on the relationship set a, that is, HIN ═ V, E, R, where V is a node set, E is an edge set, and R is a relationship set. The construction process of the heterogeneous information network HIN comprises the steps of adding a and s into a node set V aiming at each incidence relation (a, s, R) in a relation set A, then adding the incidence relation (a, s, R) into an edge set E as a (source node, destination node, relation), finally adding R into a relation set R,
and finally, sequentially acquiring corresponding node attributes in the original network service data based on all nodes in the heterogeneous information network, and establishing an attribute set aiming at all nodes and the corresponding node attributes thereof. Further, data with an affiliation relationship with a node is selected as a node attribute for each node in the node set V by combining data of non-entity and non-single number in the original network service data and the heterogeneous information network HIN. For example, the detailed address (precisely obtained house number) in this embodiment is used as an entity, and the administrative region (province, city, district) where the detailed address is located is used as its attribute; the mobile phone number is used as an entity, and the name of the owner of the mobile phone number and the operator of the mobile phone number are used as the attributes of the mobile phone number. Meanwhile, the degree (the number of first-order neighbors) of any node in the heterogeneous information network HIN is used as the attribute of the node. Then, establishing an attribute set theta { (v, theta) }aiming at all nodes in the heterogeneous information network HIN and corresponding node attributes thereofv∈V。
And S102, constructing an attribute vector set based on the node attribute set, and constructing an attribute information network according to the attribute vector set and the heterogeneous information network.
In particular, all node attributes in a node attribute set are orientedQuantizing to obtain an attribute vector set; and constructing an attribute information network according to the attribute vector set and the heterogeneous information network. Further, for each element (v, θ) in the attribute set Θ, θ is randomly initialized to an attribute vector of d dimension
(d is the same as the vector dimension of subsequent network characterization learning), that is, each node v in the heterogeneous information network HIN is attached with a plurality of attribute vectors
Then all the attribute vectors are added
Joining collections
And obtaining an attribute vector set. Wherein different attribute values cannot correspond to the same attribute vector. Then, an attribute information network AHIN is established based on the heterogeneous information network HIN and the attribute vector set, namely
Wherein V and R are the same as V and R in the heterogeneous information network HIN; specifically, attribute vectors corresponding to nodes a and s are respectively obtained for each element (a, s, r) of E in the attribute information network HIN and the attribute vector set
And
the reaction product of (a),
s,
r) as an edge-added edge set E in the attribute information network,
fig. 3 is a diagram illustrating an example of an attribute information network in a network service anomaly detection method based on attribute network characterization learning according to an embodiment of the present invention.
And S103, based on the attribute information network, finding an optimal vector representation form to construct an objective function in the maximum posterior problem, solving the objective function according to a preset algorithm to obtain a node corresponding vector to be learned by network representation learning, and constructing a mapping relation between nodes in the attribute information network and vector representations corresponding to the nodes based on the node corresponding vector to be learned by the network representation learning.
Specifically, sampling is carried out on the attribute information network through random walk sampling to obtain normal sampling data L (x, y, r); sampling the previously obtained normal sampling data through negative sampling to obtain negative sampling data; and acquiring normal sampling data and negative sampling data so as to acquire complete sampling data suitable for attribute network characterization learning. The data format of the complete sampling data is<Node 1, node 1 corresponding to the attribute vector, node 2 corresponding to the attribute vector, edge type between node 1 and node 2, and whether edge type between node 1 and node 2 is correct>And define the data format as<x，
y，
，r，L(x,y,r)>. Wherein L (x, y, r) is 1, which indicates that the edge type r between the node x and the node y is correct; l (x, y, r) is 0, indicating that the edge type r between node x and node y is incorrect. The negative sampling refers to that for any one normal sampling data L (x, y, R), one value of x or y is replaced correspondingly by randomly selecting x ' or y ' from a node set V of the attribute information network HIN, and the value of R can also be replaced by randomly selecting R ' from a relation set R of the attribute information network AHIN. Note that data with L (x, y, r) of 0 can only be obtained by negative sampling.
And secondly, searching an optimal vector representation form to obtain a target function based on the attribute information network by using the maximum posterior problem. Further, in attribute network characterization learning, the present embodiment simultaneously retains the approximations of the network structure and the node attributes, and provides the objective function of the present embodiment in the form of finding the optimal vector characterization by a Maximum A Posteriori (MAP) problem under the condition of giving an attribute information network AHIN:
wherein x is a node corresponding vector to be learned by network characterization learning, r is a relationship corresponding vector to be learned by network characterization learning, S is a network structure of the attribute information network AHIN, and Θ is a node attribute of the attribute information network AHIN. Since p (S, Θ) is independent of x and r, p (S, Θ) is a constant term. To simplify the calculation, the present embodiment assumes that there is no a priori knowledge, so p (x, r) is a constant term that can be ignored in the optimization process. Further, assuming that S and Θ are independent of each other, the objective function can be simplified as:
argmaxx，rp(x，r|S，Θ)＝arg maxx，rp(S|x，r)p(Θ|x，r) (2)
and then designing a structure score function aiming at the network structure of the attribute information network and designing an attribute score function aiming at the attribute of the attribute information network based on the obtained complete sampling data. Further, inspired by the existing algorithm HIN2Vec, the following structure score function is designed for the network structure of the attribute information network in the embodiment:
As shown in FIG. 4, the HIN2Vec model is a two-class neural network model, WX、WY、WRAre respectively provided withRepresenting a parameter in a neural network, function f01() Is a normalization function that severely limits each element of the input vector to 0 or 1. Still further, a bijective mapping function is defined
The mapping function is a linear mapping relation
It realizes the node V to the attribute set in the node set V
Middle attribute
The mapping relation of the vector space is located,
and obtaining a vector representation for the node v in the attribute network representation learning. For the attribute of any node, defining the attribute to be subjected to multivariate normal distribution, and obtaining the following attribute score function:
where N (-) is a multivariate normal distribution function, α is a constant dependent on the magnitude of the normal distribution variance, and I is the identity matrix.
And solving the target function based on the structure score function and the attribute score function to obtain a node corresponding vector to be learned by the network characterization learning. Further, the objective function (2) may be equivalent to, based on the structure score function (3) and the attribute score function (4):
wherein β is a value range in the interval [0,1 ]]The super-parameters of (2) determine the influence degree of the node attributes on the network structure. Then should beAnd solving the optimal x, r, W and b of the formula (5) by using a random gradient descent algorithm (SGD), wherein x is a corresponding vector of the node to be learned for the required network characterization learning. Finally, setting mapping relation between nodes and corresponding vectors in the attribute information network based on the corresponding vectors of the nodes to be learned in network representation learning
And step S104, calculating the characteristic data of each network service single number type node in the attribute information network based on the mapping relation between the nodes in the attribute information network and the corresponding vector representations thereof, training the nodes based on the training set data in all the network service single number type nodes in the attribute information network and the corresponding characteristic data thereof to obtain an abnormality detection model, and calculating the abnormality probability of each network service data in the test set data in all the network service single number type nodes in the attribute information network and the corresponding characteristic data thereof according to the abnormality detection model.
Specifically, firstly, the mapping relation between the nodes in the attribute information network and the corresponding vector representations of the nodes calculates the feature data of each network service single number type node in the attribute information network. Further, in the attribute information network AHIN, a first-order neighbor of a network service ticket number corresponds to a plurality of fields of network service data where the network service ticket number is located, that is, a combination of the first-order neighbors thereof may be regarded as the network service data corresponding to the network service ticket number. The method introduces the vector similarity of the network service single number and the first-order neighbor as microscopic features from a microscopic angle, re-represents the relationship between the network service single number and the first-order neighbor thereof, and judges the abnormal risk of the network service single number through consistency verification. For example, a company telephone and a company address appear in a plurality of normal network service data for a plurality of times, and when the company telephone and another company address appear in one network service data together, a risk point is formed, and the microscopic characteristics are represented as vector similarity different from the vector similarity corresponding to the normal network service data. There is therefore a need for a mapping based on attribute information network node and vector representations corresponding thereto
And calculating the vector similarity (Euclidean distance) between each network service single number type node and the first-order neighbor thereof in the attribute information network, and taking the vector similarity as the microscopic characteristic of the corresponding network service single number type node. Further, the facing vector X ═ X (X)1，····，xdim)、Y＝(y1，····，ydim) The calculation of the euclidean distance is shown in the following formula:
further, in the attribute information network AHIN, the second-order neighbor of a network service single number corresponds to another network service single number having the same field as the network service single number, that is, the combination of the second-order neighbors thereof can be regarded as the relationship between the network service single number and the similar network service data. From the macroscopic perspective, the method introduces the vector similarity of the network service single number and the second-order neighbor as a macroscopic feature, re-expresses the relationship between the network service single number and the second-order neighbor thereof, and judges the abnormal risk of the network service single number through the group partner information. For example, in some exceptions, a group cheating member applies for loan by using a false identity, but part of information is shared, and in macroscopic features, the vector similarity between a network service single number and a second-order neighbor is much smaller than the vector similarity corresponding to normal network service data. Therefore, the vector similarity of each network service single-number type node and the second-order neighbor thereof in the attribute information network is calculated based on the mapping relation between the nodes in the attribute information network and the vector representations corresponding to the nodes, and the vector similarity is used as the macroscopic feature of the corresponding network service single-number type node. And taking each network service single number type node in the attribute information network and the corresponding micro-feature and macro-feature as new network data.
After the microscopic features of the network service single number type nodes and the macroscopic features of the network service single number type nodes are obtained, the training set data in the new network service data are led into a preset classifier to carry out secondary classification training to obtain an abnormal detection model, andand inputting the test set data in the new network service data into the anomaly detection model to obtain the anomaly probability of each network service data in the test set data. Further, the training set data and the test set data of the new network data are divided based on the training set data and the test set data acquired in step S101, that is, the training set data B is further dividedtrainAnd test set data BtestThe raw data was replaced with macroscopic and microscopic features in the manner of the calculations described above. Training set data BtrainAn XGboost classifier is led in to perform two-classification training to obtain an abnormality detection model M, and then test data B are obtainedtestAnd inputting the anomaly detection model M to obtain the anomaly probability of each piece of network service data in the test set data.
And then setting a threshold value according to the type of the original network service data and working experience, comparing the abnormal probability of each network service data in the obtained test set data with the threshold value, and regarding the abnormal probability larger than the threshold value as abnormal and regarding the abnormal probability smaller than the threshold value as normal behavior so as to utilize the obtained abnormal probability.
The invention aims at overcoming the weakness of the traditional anomaly detection method aiming at the data isolation of the network service scene, increasing the adaptability of an anomaly detection system to various data in the network service scene, introducing the node attribute to enhance the relevance of the node in the attribute information network, improving the generalization capability of an anomaly detection model, and better ensuring the detection of the anomaly, the interception of the anomaly and the protection of the capital safety of users and enterprises.
Example two
In order to solve the technical problems in the prior art, the embodiment of the invention provides a speed adjusting device of a virtual passive walking robot.
FIG. 5 is a schematic structural diagram of a network service anomaly detection apparatus based on attribute network characterization learning according to a second embodiment of the present invention; referring to fig. 5, the network service anomaly detection apparatus based on attribute network characterization learning according to the embodiment of the present invention includes a heterogeneous information network construction module, an attribute information network construction module, a mapping relationship construction module, and an anomaly probability calculation module, which are connected in sequence;
the heterogeneous information network construction module is used for acquiring initial network service data according to the original network service data, constructing a heterogeneous information network based on the initial network service data, and acquiring a node attribute set in the original network service data based on all nodes in the heterogeneous information network;
the attribute information network construction module is used for constructing an attribute vector set based on the node attribute set and constructing an attribute information network according to the attribute vector set and the heterogeneous information network;
the mapping relation construction module is used for searching an optimal vector representation form to construct a target function based on the attribute information network by using a maximum posterior problem, solving the target function according to a preset algorithm to obtain a node corresponding vector to be learned by network representation learning, and constructing a mapping relation between nodes in the attribute information network and vector representations corresponding to the nodes based on the node corresponding vector to be learned by the network representation learning;
the abnormal probability calculation module is used for calculating the characteristic data of each network service single number type node in the attribute information network based on the mapping relation between the nodes in the attribute information network and the vector representations corresponding to the nodes, training the training set data in all the network service single number type nodes in the attribute information network and the corresponding characteristic data to obtain an abnormal detection model, and calculating the abnormal probability of each network service data in the test set data in all the network service single number type nodes in the attribute information network and the corresponding characteristic data according to the abnormal detection model.
According to the network service abnormity detection device based on attribute network characterization learning, provided by the embodiment of the invention, the node attributes corresponding to all nodes in the heterogeneous information network are collected and then combined with the heterogeneous information network to obtain the attribute information network, the attribute information network introduces the node attributes on the basis of the existing network characterization learning algorithm to form the attribute network characterization learning algorithm to obtain the vector characterization corresponding to the nodes in the attribute information network, so that the potential association characteristics are automatically extracted from the data, and the degree of dependence of the system on service knowledge is reduced; meanwhile, the vector representation in the device contains richer semantic information and is more suitable for low-association data in a network service scene. Further constructing features from a macroscopic angle and a microscopic angle according to the obtained vector representations, and inputting the macroscopic features and the microscopic features into a two-classification model for training and testing to obtain the abnormal probability of the network service data; compared with the traditional method, the device can depict the network service data from macroscopic and microscopic angles, and has higher accuracy and robustness.
EXAMPLE III
In order to solve the foregoing technical problems in the prior art, an embodiment of the present invention further provides a storage medium, which stores a computer program, and when the computer program is executed by a processor, the computer program can implement all the steps in the network service anomaly detection method based on attribute network characterization learning in the first embodiment.
The specific steps of the network service anomaly detection method based on attribute network characterization learning and the beneficial effects obtained by applying the readable storage medium provided by the embodiment of the invention are the same as those of the embodiment one, and are not described herein again.
It should be noted that: the storage medium includes: various media that can store program codes, such as ROM, RAM, magnetic or optical disks.
Example four
In order to solve the technical problems in the prior art, the embodiment of the invention also provides a terminal.
Fig. 6 is a schematic structural diagram of a four-terminal according to an embodiment of the present invention, and referring to fig. 6, the terminal according to this embodiment includes a processor and a memory, which are connected to each other; the memory is used for storing computer programs, and the processor is used for executing the computer programs stored by the memory, so that the terminal can realize all the steps in the network service abnormity detection method based on attribute network characterization learning.
The specific steps of the network service anomaly detection method based on attribute network characterization learning and the beneficial effects of terminal acquisition provided by applying the embodiment of the invention are the same as those of the embodiment one, and are not described herein again.
It should be noted that the Memory may include a Random Access Memory (RAM), and may also include a non-volatile Memory (non-volatile Memory), such as at least one disk Memory. Similarly, the Processor may also be a general-purpose Processor, and includes a Central Processing Unit (CPU), a Network Processor (NP), and the like; the device can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other Programmable logic device, a discrete Gate or transistor logic device, or a discrete hardware component.
Although the embodiments of the present invention have been described above, the above description is only for the convenience of understanding the present invention, and is not intended to limit the present invention. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.
Claims (10)
1. A network service abnormity detection method based on attribute network characterization learning comprises the following steps:
acquiring initial network service data according to original network service data, constructing a heterogeneous information network based on the initial network service data, and acquiring a node attribute set in the original network service data based on all nodes in the heterogeneous information network;
constructing an attribute vector set based on the node attribute set, and constructing an attribute information network according to the attribute vector set and the heterogeneous information network;
based on the attribute information network, finding an optimal vector representation form to construct an objective function in the maximum posterior problem, solving the objective function according to a preset algorithm to obtain a node corresponding vector to be learned by network representation learning, and constructing a mapping relation between nodes in the attribute information network and vector representations corresponding to the nodes based on the node corresponding vector to be learned by the network representation learning;
the method comprises the steps that the mapping relation between nodes in the attribute information network and vector representations corresponding to the nodes in the attribute information network is used for calculating the feature data of each network service single number type node in the attribute information network, an abnormality detection model is obtained through training based on all network service single number type nodes in the attribute information network and training set data in the feature data corresponding to the network service single number type nodes, and the abnormality probability of each network service data in test set data in all network service single number type nodes in the attribute information network and the feature data corresponding to the network service single number type nodes is calculated according to the abnormality detection model.
2. The method of claim 1, wherein obtaining initial network service data from original network service data, constructing a heterogeneous information network based on the initial network service data, and obtaining a set of node attributes in the original network service data based on all nodes in the heterogeneous information network comprises:
dividing training set data and test set data from the original network service data, wherein the training set data and the test set data form initial network service data;
discretizing the initial network service data, extracting the relationship of the discretized initial network service data, and combining all the association relationships extracted by the relationship extraction to obtain a relationship set;
constructing a heterogeneous information network based on the relationship set;
and sequentially acquiring corresponding node attributes in the original network service data based on all nodes in the heterogeneous information network, and establishing an attribute set aiming at all nodes and the corresponding node attributes thereof.
3. The method of claim 2, wherein partitioning training set data and test set data in the raw network service data comprises:
setting a training set time window and a test set time window;
partitioning training set data from the original network service data based on the training set time window;
partitioning test set data in the original network service data based on the test set time window;
the training set time window and the test set time window are continuous time windows, and the training set time window is prior to the test set time window in time.
4. The method of claim 1, wherein constructing a set of attribute vectors based on the set of node attributes, and wherein constructing an attribute information network from the set of attribute vectors and the heterogeneous information network comprises:
vectorizing all node attributes in the node attribute set to obtain an attribute vector set;
and constructing an attribute information network according to the attribute vector set and the heterogeneous information network.
5. The method according to claim 1, wherein the step of finding an optimal vector representation form to construct an objective function by a maximum a posteriori problem based on the attribute information network, solving the objective function according to a preset algorithm to obtain a node corresponding vector to be learned by network representation learning, and constructing a mapping relation between nodes in the attribute information network and vector representations corresponding to the nodes based on the node corresponding vector to be learned by network representation learning comprises the steps of:
sampling the attribute information network based on a preset sampling method to obtain complete sampling data suitable for characterization learning;
searching an optimal vector representation form by using a maximum posterior problem based on the attribute information network to obtain a target function;
designing a structure score function for a network structure of the attribute information network and designing an attribute score function for an attribute of the attribute information network based on the sampling data;
solving the target function based on the structure score function and the attribute score function to obtain a node corresponding vector to be learned by network characterization learning;
and setting the mapping relation between the nodes and the corresponding vectors in the attribute information network based on the corresponding vectors of the nodes to be learned by the network characterization learning.
6. The method of claim 5, wherein the step of sampling the attribute information network based on a predetermined sampling method to obtain complete sampling data suitable for characterization learning comprises:
sampling the attribute information network through random walk sampling to obtain normal sampling data;
sampling the normal sampling data through negative sampling to obtain negative sampling data;
acquiring complete sampling data suitable for characterization learning based on the normal sampling data and the negative sampling data.
7. The method of claim 5, wherein the step of solving the objective function based on the structure score function and the attribute score function to obtain a node correspondence vector to be learned by network characterization learning comprises:
and solving the target function through a random gradient descent algorithm based on the structure score function and the attribute score function to obtain a node corresponding vector to be learned by network characterization learning.
8. The method according to claim 1, wherein the step of calculating the feature data of each network service single number type node in the attribute information network based on the mapping relationship between the nodes in the attribute information network and the vector representations corresponding thereto, training the feature data based on all the network service single number type nodes in the attribute information network and the training set data in the feature data corresponding thereto to obtain an anomaly detection model, and calculating the anomaly probability of each network service data in the test set data of all the network service single number type nodes in the attribute information network and the feature data corresponding thereto according to the anomaly detection model comprises:
calculating the vector similarity of each network service single number type node and a first-order neighbor thereof in the attribute information network based on the mapping relation between the nodes in the attribute information network and the vector representations corresponding to the nodes as the microscopic features corresponding to the network service single number type nodes;
calculating the vector similarity of each network service single-number type node and a second-order neighbor thereof in the attribute information network based on the mapping relation between the nodes in the attribute information network and the vector representations corresponding to the nodes as the macroscopic characteristics corresponding to the network service single-number type nodes;
taking each network service single number type node in the attribute information network and the corresponding micro-feature and macro-feature as new network data;
and importing the training set data in the new network service data into a preset classifier to perform secondary classification training to obtain an anomaly detection model, and inputting the test set data in the new network service data into the anomaly detection model to obtain the anomaly probability of each network service data in the test set data.
9. The method of claim 8, wherein the predetermined classifier is an XGBoost classifier.
10. A network service anomaly detection device based on attribute network characterization learning comprises a heterogeneous information network construction module, an attribute information network construction module, a mapping relation construction module and an anomaly probability calculation module which are sequentially connected;
the heterogeneous information network construction module is used for acquiring initial network service data according to original network service data, constructing a heterogeneous information network based on the initial network service data, and acquiring a node attribute set in the original network service data based on all nodes in the heterogeneous information network;
the attribute information network construction module is used for constructing an attribute vector set based on the node attribute set and constructing an attribute information network according to the attribute vector set and the heterogeneous information network;
the mapping relation construction module is used for searching an optimal vector representation form to construct an objective function based on the attribute information network by using a maximum posterior problem, solving the objective function according to a preset algorithm to obtain a node corresponding vector to be learned by network representation learning, and constructing a mapping relation between nodes in the attribute information network and vector representations corresponding to the nodes based on the node corresponding vector to be learned by the network representation learning;
the abnormal probability calculation module is used for calculating the feature data of each network service single number type node in the attribute information network based on the mapping relation between the nodes in the attribute information network and the corresponding vector representations thereof, and training the training set data in all the network service single number type nodes in the attribute information network and the corresponding feature data thereof to obtain an abnormal detection model, and calculating the abnormal probability of each network service data in all the network service single number type nodes in the attribute information network and the test set data in the corresponding feature data thereof according to the abnormal detection model.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010042262.XA CN111277433B (en) | 2020-01-15 | 2020-01-15 | Network service abnormity detection method and device based on attribute network characterization learning |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010042262.XA CN111277433B (en) | 2020-01-15 | 2020-01-15 | Network service abnormity detection method and device based on attribute network characterization learning |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111277433A true CN111277433A (en) | 2020-06-12 |
| CN111277433B CN111277433B (en) | 2021-02-12 |
Family
ID=71000311
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010042262.XA Active CN111277433B (en) | 2020-01-15 | 2020-01-15 | Network service abnormity detection method and device based on attribute network characterization learning |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111277433B (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111931485A (en) * | 2020-08-12 | 2020-11-13 | 北京建筑大学 | Multi-mode heterogeneous associated entity identification method based on cross-network representation learning |
| CN112822191A (en) * | 2021-01-06 | 2021-05-18 | 大连理工大学 | Method for multi-dimensional data security detection in networked cooperative system |
Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106384273A (en) * | 2016-10-08 | 2017-02-08 | 江苏通付盾科技有限公司 | Malicious order scalping detection system and method |
| CN108848068A (en) * | 2018-05-29 | 2018-11-20 | 上海海事大学 | Based on deepness belief network-Support Vector data description APT attack detection method |
| CN108900432A (en) * | 2018-07-05 | 2018-11-27 | 中山大学 | A kind of perception of content method based on network Flow Behavior |
| CN109815335A (en) * | 2019-01-26 | 2019-05-28 | 福州大学 | A kind of paper domain classification method suitable for document network |
| CN109829721A (en) * | 2019-02-13 | 2019-05-31 | 同济大学 | Online trading multiagent behavior modeling method based on heterogeneous network representative learning |
| CN110009093A (en) * | 2018-12-07 | 2019-07-12 | 阿里巴巴集团控股有限公司 | For analyzing the nerve network system and method for relational network figure |
| CN110191110A (en) * | 2019-05-20 | 2019-08-30 | 山西大学 | Social networks exception account detection method and system based on network representation study |
| WO2019218699A1 (en) * | 2018-05-18 | 2019-11-21 | 深圳壹账通智能科技有限公司 | Fraud transaction determining method and apparatus, computer device, and storage medium |
| CN110555455A (en) * | 2019-06-18 | 2019-12-10 | 东华大学 | Online transaction fraud detection method based on entity relationship |
-
2020
- 2020-01-15 CN CN202010042262.XA patent/CN111277433B/en active Active
Patent Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106384273A (en) * | 2016-10-08 | 2017-02-08 | 江苏通付盾科技有限公司 | Malicious order scalping detection system and method |
| WO2019218699A1 (en) * | 2018-05-18 | 2019-11-21 | 深圳壹账通智能科技有限公司 | Fraud transaction determining method and apparatus, computer device, and storage medium |
| CN108848068A (en) * | 2018-05-29 | 2018-11-20 | 上海海事大学 | Based on deepness belief network-Support Vector data description APT attack detection method |
| CN108900432A (en) * | 2018-07-05 | 2018-11-27 | 中山大学 | A kind of perception of content method based on network Flow Behavior |
| CN110009093A (en) * | 2018-12-07 | 2019-07-12 | 阿里巴巴集团控股有限公司 | For analyzing the nerve network system and method for relational network figure |
| CN109815335A (en) * | 2019-01-26 | 2019-05-28 | 福州大学 | A kind of paper domain classification method suitable for document network |
| CN109829721A (en) * | 2019-02-13 | 2019-05-31 | 同济大学 | Online trading multiagent behavior modeling method based on heterogeneous network representative learning |
| CN110191110A (en) * | 2019-05-20 | 2019-08-30 | 山西大学 | Social networks exception account detection method and system based on network representation study |
| CN110555455A (en) * | 2019-06-18 | 2019-12-10 | 东华大学 | Online transaction fraud detection method based on entity relationship |
Non-Patent Citations (1)
| Title |
|---|
| 任会彩 等: "一种面向特定网络服务的异常检测方法", 《华中科技大学学报（自然科学版）》 * |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111931485A (en) * | 2020-08-12 | 2020-11-13 | 北京建筑大学 | Multi-mode heterogeneous associated entity identification method based on cross-network representation learning |
| CN112822191A (en) * | 2021-01-06 | 2021-05-18 | 大连理工大学 | Method for multi-dimensional data security detection in networked cooperative system |
| CN112822191B (en) * | 2021-01-06 | 2021-11-02 | 大连理工大学 | Method for multi-dimensional data security detection in networked cooperative system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111277433B (en) | 2021-02-12 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110781308B (en) | Anti-fraud system for constructing knowledge graph based on big data | |
| CN111309822B (en) | User identity recognition method and device | |
| CN109379377A (en) | Encrypt malicious traffic stream detection method, device, electronic equipment and storage medium | |
| CN109672674A (en) | A kind of Cyberthreat information confidence level recognition methods | |
| Rathore et al. | Identifying groups of fake reviewers using a semisupervised approach | |
| CN112488716B (en) | Abnormal event detection system | |
| CN111143838B (en) | Database user abnormal behavior detection method | |
| CN110287292B (en) | Judgment criminal measuring deviation degree prediction method and device | |
| CN109190698B (en) | Classification and identification system and method for network digital virtual assets | |
| CN109829721B (en) | Online transaction multi-subject behavior modeling method based on heterogeneous network characterization learning | |
| CN110348516B (en) | Data processing method, data processing device, storage medium and electronic equipment | |
| CN112287020B (en) | Big data mining method based on graph analysis | |
| CN110929525B (en) | Network loan risk behavior analysis and detection method, device, equipment and storage medium | |
| CN113283909B (en) | Ether house phishing account detection method based on deep learning | |
| CN111277433B (en) | Network service abnormity detection method and device based on attribute network characterization learning | |
| Choi et al. | Machine learning based approach to financial fraud detection process in mobile payment system | |
| CN116318928A (en) | Malicious traffic identification method and system based on data enhancement and feature fusion | |
| CN113343123B (en) | Training method and detection method for generating confrontation multiple relation graph network | |
| CN113438239B (en) | Network attack detection method and device based on depth k nearest neighbor | |
| CN114692593A (en) | Network information safety monitoring and early warning method | |
| CN113762703A (en) | Method and device for determining enterprise portrait, computing equipment and storage medium | |
| CN113259369B (en) | Data set authentication method and system based on machine learning member inference attack | |
| Mishra et al. | Improving the efficacy of clustering by using far enhanced clustering algorithm | |
| Ding et al. | Improved density peaks clustering based on natural neighbor expanded group | |
| CN113779520A (en) | Cross-space target virtual identity correlation method based on multilayer attribute analysis |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |