CN117591755A

CN117591755A - Dynamic heterogeneous network potential abnormal relation prediction method and device

Info

Publication number: CN117591755A
Application number: CN202410074560.5A
Authority: CN
Inventors: 王滨; 王伟; 卫相宇; 谢瀛辉; 王星
Original assignee: Hangzhou Hikvision Digital Technology Co Ltd
Current assignee: Hangzhou Hikvision Digital Technology Co Ltd
Priority date: 2024-01-18
Filing date: 2024-01-18
Publication date: 2024-02-23
Anticipated expiration: 2044-01-18
Also published as: CN117591755B

Abstract

The embodiment of the application provides a method and a device for predicting potential abnormal relations of a dynamic heterogeneous network. When the potential abnormal relation among the nodes is predicted, dynamic changes (such as caused by the interaction behavior of the nodes and the neighbor nodes) of the node representations of different nodes are captured by means of neighbor interaction behavior (represented by the neighbor interaction set of each node) and neighborhood structure information (represented by the adjacency matrix of each node and the common neighbor matrix of each node and other nodes) of each node, the potential abnormal relation among the nodes is predicted based on the dynamic changes of the node representations of each different node, the potential abnormal relation prediction of the neighbor-enhanced dynamic heterogeneous network is realized, and the accuracy of the potential abnormal relation prediction is improved.

Description

Dynamic heterogeneous network potential abnormal relation prediction method and device

Technical Field

The application relates to the field of data detection, in particular to a method and a device for predicting potential abnormal relations of a dynamic heterogeneous network.

Background

Potential anomaly relationship prediction aims at speculating anomalies that are hidden in complex links. The potential abnormal relation prediction can be applied to application scenes such as social networks, finances and the like and used for predicting potential risks possibly existing in the application scenes. For example, in a financial scenario, potential anomaly prediction may be utilized to predict fraudulent activity that may exist, and so forth. Predicting potential abnormal relationships is essential to preventing unknown risks.

Currently, a common way of predicting potential abnormal relationships is based on node representations of different nodes (meaning feature vectors that can characterize the nodes). The dynamic change of the node representation caused by the interaction behavior of the node and the neighbor node is ignored, and the prediction of the potential abnormal relationship is inaccurate.

Disclosure of Invention

The embodiment of the application provides a method and a device for predicting potential abnormal relation of a dynamic heterogeneous network, which are used for realizing the prediction of the potential abnormal relation of the dynamic heterogeneous network by capturing dynamic node representations of different nodes and improving the accuracy of the prediction of the potential abnormal relation.

According to a first aspect of an embodiment of the present application, there is provided a method for predicting a potential abnormal relationship of a dynamic heterogeneous network, the method including:

for any edge type in any network snapshot in the obtained dynamic heterogeneous network set, determining a common neighbor matrix corresponding to the edge type according to an adjacent matrix corresponding to the edge type, and determining a neighbor interaction set of nodes on the edge corresponding to the edge type; the common neighbor matrix corresponding to any edge type represents whether common neighbor nodes exist in different nodes on the edge corresponding to the edge type; the neighbor interaction set of any node characterizes the interaction relationship among all neighbor nodes of the node;

Aiming at a node u on an edge corresponding to an edge type b in the network snapshot f, determining a neighbor node representation of the node u under the edge type b in the network snapshot f according to an adjacent matrix corresponding to the edge type b and a neighbor interaction set based on the node u, and determining a common neighbor node representation of the node u under the edge type b in the network snapshot f according to a common neighbor matrix corresponding to the edge type b; the network snapshot f represents any network snapshot, the edge type b represents any edge type on the network snapshot f, and the node u represents any node on the edge corresponding to the edge type b; the neighbor node represents a feature vector of the neighbor node for representing the node u; the common neighbor node represents a feature vector for characterizing a common neighbor node c of a node u and other nodes;

aggregating the neighbor node representations of the node u in the network snapshot f under different edge types and the common neighbor node representations to obtain an aggregation result of the node u in the network snapshot f; determining a target node representation of the node u based on aggregation results of the node u under different network snapshots; and predicting potential abnormal relations according to the target node representation of each node.

According to a second aspect of embodiments of the present application, there is provided a dynamic heterogeneous network potential abnormal relation prediction apparatus, the apparatus including:

The determining module is used for determining a common neighbor matrix corresponding to the edge type according to an adjacent matrix corresponding to the edge type aiming at any edge type in any network snapshot in the obtained dynamic heterogeneous network set, and determining a neighbor interaction set of nodes on the edge corresponding to the edge type; the common neighbor matrix corresponding to any edge type represents whether common neighbor nodes exist in different nodes on the edge corresponding to the edge type; the neighbor interaction set of any node characterizes the interaction relationship among all neighbor nodes of the node;

the node representation module is used for determining the neighbor node representation of the node u under the edge type b in the network snapshot f according to the adjacent matrix corresponding to the edge type b and the neighbor interaction set based on the node u aiming at the node u on the edge corresponding to the edge type b in the network snapshot f, and determining the common neighbor node representation of the node u under the edge type b in the network snapshot f according to the common neighbor matrix corresponding to the edge type b; the network snapshot f represents any network snapshot, the edge type b represents any edge type on the network snapshot f, and the node u represents any node on the edge corresponding to the edge type b; the neighbor node represents a feature vector of the neighbor node for representing the node u; the common neighbor node represents a feature vector for characterizing a common neighbor node c of a node u and other nodes; and aggregating the first neighbor node representation and the first common neighbor node representation of the node u under different edge types in the network snapshot f to obtain an aggregation result of the node u under the network snapshot f; determining a target node representation of the node u based on aggregation results of the node u under different network snapshots;

And the prediction module is used for predicting potential abnormal relations according to the target node representation of each node.

According to a third aspect of embodiments of the present application, there is provided an electronic device, including: a processor and a memory;

wherein the memory is configured to store machine-executable instructions;

the processor is configured to read and execute the machine executable instructions stored in the memory to implement the method as described above.

According to a third aspect of embodiments of the present application, there is provided a computer program product having a computer program stored therein, which when executed by a processor, implements a method as described above.

The technical scheme provided by the embodiment of the application can comprise the following beneficial effects:

when the potential abnormal relation among the nodes is predicted, dynamic changes (such as caused by the interaction behavior of the nodes and the neighbor nodes) of the node representations of different nodes are captured by means of neighbor interaction behavior (represented by the neighbor interaction set of each node) and neighborhood structure information (represented by the adjacency matrix of each node and the common neighbor matrix of each node and other nodes) of each node, the potential abnormal relation among the nodes is predicted based on the dynamic changes of the node representations of each different node, the potential abnormal relation prediction of the neighbor-enhanced dynamic heterogeneous network is realized, and the accuracy of the potential abnormal relation prediction is improved.

Drawings

FIG. 1 is a flow chart of a method provided in an embodiment of the present application;

FIG. 2 is a flowchart illustrating the determination of a neighbor node representation in step 102 provided in an embodiment of the present application;

FIG. 3 is a flowchart for determining a common neighbor node representation provided in an embodiment of the present application;

FIG. 4 is a flow chart of the aggregation at step 103 provided in an embodiment of the present application;

FIG. 5 is a block diagram of an apparatus according to an embodiment of the present application;

fig. 6 is a block diagram of an electronic device provided in an embodiment of the present application.

Detailed Description

Reference will now be made in detail to exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, the same numbers in different drawings refer to the same or similar elements, unless otherwise indicated. The implementations described in the following exemplary examples are not representative of all implementations consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with some aspects of the present application as detailed in the accompanying claims.

The terminology used in the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the present application. As used in this application and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used herein refers to and encompasses any or all possible combinations of one or more of the associated listed items.

It should be understood that although the terms first, second, third, etc. may be used herein to describe various information, these information should not be limited by these terms. These terms are only used to distinguish one type of information from another. For example, a first message may also be referred to as a second message, and similarly, a second message may also be referred to as a first message, without departing from the scope of the present application. The word "if" as used herein may be interpreted as "at … …" or "at … …" or "responsive to a determination", depending on the context.

The method provided by the present embodiment focuses on the dynamic node representation of the node. Specifically, the embodiment focuses on mutual neighbor and neighbor interaction (representing dynamic node representation of nodes) of nodes, captures dynamic changes of node representations of different nodes, and effectively predicts potential abnormal relations among the nodes based on the dynamic changes of the node representations of different nodes. The following describes the method provided in the embodiments of the present application:

referring to fig. 1, fig. 1 is a flowchart of a method provided in an embodiment of the present application. The method is applied to electronic equipment, such as a terminal, a server and the like, and embodiments of the present application are not particularly limited.

In this embodiment, a dynamic heterogeneous network set is obtained first. Here, the dynamic heterogeneous network set is composed of network snapshots collected at different time points in the current application scenario. Here, the network snapshots taken at different points in time are equivalent to heterogeneous graphs. The current application scenario, such as an internet of things anti-attack scenario, a financial network, etc., is not particularly limited in this embodiment.

In this embodiment, the network snapshot collected at any time point may include a plurality of nodes, for example, the network snapshot is applied to an anti-attack scenario of the internet of things, and the plurality of nodes in the network snapshot may be an attacker, an attacked person, an attack type, and the like.

In this embodiment, the web snapshot taken at any point in time may include at least one edge. Optionally, as an embodiment, the edge types of different edges in the network snapshot collected at any one point in time may be the same or different, and the network snapshot collected at any one point in time may include at least one edge type. For example, the embodiment is not particularly limited, and is applied to an anti-attack scenario of the internet of things, for any network snapshot, where an edge type of an edge between an attack device serving as a node and an attacked device serving as a node is attack, an edge type of an edge between an attack type serving as a node and an attack device serving as a node is utilization, and the like.

In this embodiment, a corresponding adjacency matrix is constructed for the edge type in any network snapshot in the dynamic heterogeneous network set, and a feature vector (i.e., an initial feature vector) for each node is constructed. Here, the adjacency matrix corresponding to any edge type (e.g., edge type r) characterizes whether the edge between nodes in the network snapshot is the edge type r. For example, in the adjacency matrix, if adjacency information corresponding to two nodes is a first value, such as 1, it indicates that there is one edge for the two nodes, and the edge type of the edge is the edge type r, whereas if adjacency information is a second value, such as 0, it indicates that there is no edge for the two nodes, or that there is one edge but the edge type of the edge is not the edge type r.

Thereafter, the flow shown in fig. 1 is performed:

as shown in fig. 1, the process may include the steps of:

step 101, determining a common neighbor matrix corresponding to an edge type according to an adjacent matrix corresponding to the edge type for any edge type in any network snapshot in the obtained dynamic heterogeneous network set, and determining a neighbor interaction set of nodes on the edge corresponding to the edge type.

Illustratively, in this embodiment, the common neighbor matrix corresponding to any edge type characterizes whether or not there are common neighbor nodes for different nodes on the edge corresponding to the edge type.

Alternatively, the following formula illustrates a determination of the common neighbor matrix:；

where t represents the time at which the web snapshot was taken, r represents an edge type,representing a common neighbor matrix corresponding to the type r above the network snapshot acquired at time t (denoted as network snapshot t), ++>Representing the adjacency matrix corresponding to type r above the network snapshot t taken at time t,/>Representation pair->Is added up for each row ofObtain a 1 ×>M is->The number of rows in a row.

It should be noted that, in the embodiment of the present application, when determining the common neighbor matrix corresponding to any edge type, nodes with low degrees (i.e., fewer neighboring nodes, such as fewer than a set threshold value) are not ignored, and in the manner of determining the common neighbor matrix, since all edge types are considered as a whole, this is equivalent to assigning a relatively large weight to nodes with relatively low degrees (i.e., fewer neighboring nodes) when predicting the potential abnormal relationship of the dynamic heterogeneous network.

In addition, in the present embodiment, the neighbor interaction set of any node characterizes the interaction relationship between the neighbors of the node. As an embodiment, the above-mentioned neighbor interaction set for determining the node on the edge corresponding to the edge type is: determining a neighbor node pair of any node on the edge corresponding to the edge type; any neighbor node pair consists of two neighbor nodes of the node; and determining a neighbor interaction set of each neighbor node pair according to the feature vectors of the two neighbor nodes which are constructed.

Alternatively, taking the node o as an example, determining the neighbor interaction set of the node o according to the feature vectors that have been constructed by two neighbor nodes in each neighbor node pair can be represented by the following formula:；

wherein t represents the time of collecting the network snapshot, and r represents an edge type; o represents a node on the edge corresponding to the edge type r;neighbor nodes, respectively node o, +.>Composition nodeo neighbor node pairs; />Node o representing the edge corresponding to edge type r on the network snapshot t taken at time t is based on the neighbor node pair (++>) A determined neighbor interaction set, k representing neighbor interactions; />A feature vector representing that node p is constructed; />A feature vector representing that node q is constructed; />A neighbor node set representing node o; as indicated by the multiplication, k indicates neighbor interaction. In the above formula, +.>K in (2) is not +.>To the power of k, which simply represents neighbor interactions. Likewise, a->K in (2) is not +.>And also simply represents neighbor interactions.

Step 102, for a node u on an edge corresponding to an edge type b in the network snapshot f, determining a neighbor node representation of the node u under the edge type b in the network snapshot f according to an adjacent matrix corresponding to the edge type b and a neighbor interaction set based on the node u, and determining a common neighbor node representation of the node u under the edge type b in the network snapshot f according to a common neighbor matrix corresponding to the edge type b.

Here, the network snapshot f represents any network snapshot in the dynamic heterogeneous network set, the edge type b represents any edge type on the network snapshot f, and the node u represents any node on the edge corresponding to the edge type b.

In the present embodiment, the neighbor node represents a feature vector for characterizing the neighbor node of the node u. As an embodiment, the neighbor node representation of node u under edge type b within the network snapshot f may be determined from the first reference node representation and the second reference node representation. Optionally, the first reference node represents a feature vector determination of a neighboring node g determined from a feature vector of the node u and based on an adjacency matrix corresponding to the edge type b. The neighbor node g is any node determined based on the adjacency matrix corresponding to the edge type b, and the node g is positioned on the edge corresponding to the edge type b. The second reference node represents a feature vector determination of a neighboring node k determined from the feature vector of node u and the neighboring interaction set based on node u. The neighbor node k is any node determined based on the neighbor interaction set of the node u, and the node k is positioned on the edge corresponding to the edge type b. One implementation is shown by way of example in fig. 2.

In this embodiment, the node u is represented by a common neighbor node under the edge type b in the network snapshot f, and is used to represent the feature vector of the common neighbor node c of the node u and other nodes.

As an embodiment, the node u is represented by a common neighbor node under the edge type b in the network snapshot f, and is determined according to the feature vector of the node u and the feature vector of the neighbor node c determined based on the common neighbor matrix corresponding to the edge type b. The neighbor node c is any node determined based on the common neighbor matrix corresponding to the edge type b, and the node c is positioned on the edge corresponding to the edge type b. Fig. 3 is described below by way of example, and is not intended to be limiting.

Step 103, aggregating the neighbor node representation and the common neighbor node representation of the node u under different edge types in the network snapshot f to obtain an aggregation result of the node u under the network snapshot f; determining a target node representation of the node u based on aggregation results of the node u under different network snapshots; and predicting potential abnormal relations according to the target node representation of each node.

In this embodiment, the neighbor node representation and the common neighbor node representation of the node u in the network snapshot f under different edge types may be weighted and aggregated, which will be described by way of example below and will not be described herein.

It can be seen that in this embodiment, in the final destination node representation of the node u, the adjacency matrix under the node u, the common neighbor matrix of the node u and other nodes, and the neighbor interaction set of the node u are considered, and on the premise that the destination node representation of each node predicts the potential anomaly relationship, the method is equivalent to the adjacency matrix which does not consider the node singly when predicting the potential anomaly, and compared with the method which relies on the adjacency matrix with a single node to predict the potential anomaly relationship between the nodes, the accuracy of the prediction of the potential anomaly relationship is obviously and effectively improved.

Thus, the flow shown in fig. 1 is completed.

As can be seen from the flow shown in fig. 1, when predicting potential abnormal relationships between nodes, the embodiment captures dynamic changes (such as caused by the interaction behavior between the nodes and the neighboring nodes) of node representations of different nodes by means of neighbor interaction behavior (represented by the neighbor interaction set of each node) and neighborhood structure information (represented by the adjacency matrix of each node and the common neighbor matrix of each node and other nodes) of each node, predicts the potential abnormal relationships between the nodes based on the dynamic changes of the node representations of each different node, realizes the prediction of the potential abnormal relationships of the neighbor-enhanced dynamic heterogeneous network, and improves the accuracy of the prediction of the potential abnormal relationships.

Fig. 2 provided in the embodiment of the present application is described below:

referring to fig. 2, fig. 2 is a flowchart illustrating determination of a neighbor node representation in step 102 according to an embodiment of the present application. As shown in fig. 2, the process may include the steps of:

step 201, determining a weight coefficient of a node pair (u, g) formed by the node u and the node g according to the feature vector of the node u, the feature vector of the neighboring node g determined based on the adjacency matrix corresponding to the edge type b, and the feature vectors of other neighboring nodes determined based on the adjacency matrix corresponding to the edge type b.

In this embodiment, the node g is any node determined based on the adjacency matrix corresponding to the edge type b, and the node g is located on the edge corresponding to the edge type b.

Alternatively, in this embodiment, if the attention model in the current application scenario is trained currently, this step 201 may be implemented by the node self-attention layer in the attention model. The weight coefficient of the node pair (u, a 1) output by the final node from the attention layer is:

；

wherein,weight coefficient representing node pair (u, g) composed of node u and node g, < ->Is an activation function->Representing the connection operation. />Is node->Feature vector of >Is a feature vector of the node g, j represents any node except the node g and located on the side corresponding to the side type b determined based on the adjacency matrix corresponding to the side type b, +.>Represents a set of all nodes on the edge corresponding to edge type b determined based on the adjacency matrix corresponding to edge type b. />、/>For node attention layer parameters, e.g., +.>Is a node attention vector representation of edge type b; />Is the feature transformation matrix of edge type b.

Of course, if the attention model in the current application scenario has not been trained currently, the node attention layer parameters in the weight coefficients expressed by the above formula determined in step 201、/>The waiting time is the attention layer parameter (equivalent to the unknown quantity) of the node to be trained.

Step 202, determining a first reference node representation corresponding to the node u under the edge type b in the network snapshot f according to the weight coefficients of the node pair formed by the node u and each first candidate neighbor node.

In this embodiment, each first candidate neighboring node is each node that is determined based on the adjacency matrix corresponding to the edge type b and is located on the edge corresponding to the edge type b. That is, in this embodiment, when any one of the first candidate neighbor nodes is obtained, the node u and the obtained first candidate neighbor node form a node pair, and the weight coefficient of the node pair is determined according to the above step 201. Finally, when the step 202 is executed, the weight coefficient of each node pair formed by the node u and each first candidate neighbor node is obtained.

After obtaining the weight coefficients of each node pair formed by the node u and each first candidate neighbor node, as described in step 202, the embodiment may determine the first corresponding to the node u under the edge type b in the network snapshot f according to the weight coefficients of each node pair formed by the node u and each first candidate neighbor nodeReference nodes. As one embodiment, the following formula illustrates how node u computes a corresponding first reference node representation under edge type b within network snapshot f:；

wherein,representing node u corresponding to a first reference node representation under edge type b within network snapshot f,/>Representing a first set of candidate neighbor nodes, +.>1 is any one of the first candidate neighbor nodes in the first candidate neighbor node set,/for>Feature vector representing any one of the first candidate neighbor nodes (exemplified by node d 1), +.>The weight coefficient of the node pair (u, d 1) representing the node u and the node d 1. />As described above.

Step 203, determining the weight coefficient of the node pair (u, k) formed by the node u and the node k according to the feature vector of the node u, the feature vector of the neighbor node k determined based on the neighbor interaction set of the node u, and the feature vectors of other neighbor nodes determined based on the neighbor interaction set of the node u.

In this embodiment, the node k is any node determined based on the neighbor interaction set of the node u, where the node k is on the edge corresponding to the edge type b.

In this step 203, the weight coefficient of the node pair (u, k) composed of the node u and the node k can be specifically referred to as described above. For example, in the present embodiment, if the attention model in the current application scenario is trained currently, this step 203 may be implemented by the node self-attention layer in the attention model. The weight coefficient of the node pair (u, k) output by the final node from the attention layer is:

；

wherein,a weight coefficient representing the node pair (u, k); />Is the feature vector of node k, j represents any node except node k and on the edge corresponding to edge type b determined based on the neighbor interaction set of node u, +.>The set of all the nodes on the edge corresponding to the edge type b determined based on the neighbor interaction set of the node u is represented, and the remaining parameters are described above and are not repeated. Of course, if the attention model in the current application scenario has not been trained currently, the node attention layer parameter in the weight coefficient expressed by the above formula determined in the step 203 is the node attention layer parameter to be trained (equivalent to an unknown quantity).

And 204, determining a second reference node representation corresponding to the edge type b in the network snapshot f according to the weight coefficient of each node pair formed by the node u and the second candidate neighbor node.

In this embodiment, each second candidate neighboring node is a node on the edge corresponding to the edge type b, which is determined based on the neighboring interaction set of the node u.

In this step 204, the determination of the second reference node representation corresponding to the edge type b of the node u in the network snapshot f may be referred to in step 202 above, for example, the second reference node representation corresponding to the edge type b of the node u in the network snapshot f is calculated according to the following formula:；

wherein,representing node u corresponding to a second reference node representation under edge type b within network snapshot f,/>Representing a second set of candidate neighbor nodes, +.>2 is any one of the second candidate neighbor nodes in the second candidate neighbor node set,/or%>Feature vector representing any one of the second candidate neighbor nodes (for example node d 2), +.>The weight coefficient of the node pair (u, d 2) representing the node u and the node d 2. />As described above.

Step 205, determining a neighbor node representation of the node u under the edge type b in the network snapshot f according to the first reference node representation and the second reference node representation corresponding to the edge type b in the network snapshot f.

As described above, in this embodiment, the neighbor interaction set based on the node u only includes the neighbor relation, and the adjacency matrix of the node u only retains the first-order neighborhood information of the node u (the neighbor information of only one hop centered on the node), and therefore, in this embodiment, after the first reference node representation (the node representation based on the adjacency matrix) and the second reference node representation (the node representation based on the neighbor interaction set) are obtained, a set operation such as a mean value operation is performed on the first reference node representation and the second reference node representation, and the first reference node representation is updated to be the operation result, and the updated first reference node representation is denoted as the first neighbor node representation.

Taking the setting operation as the average operation as an example, the representation of the neighboring node of the node u under the edge type b in the network snapshot f can be represented by the following formula:；

wherein Mean represents the average value operation, and the average value operation is performed,the first neighbor node representation is represented.

Thus, the flow shown in fig. 2 is completed.

By the flow shown in fig. 2, how to determine the neighbor node representation of the node u under the edge type b for the node u on the edge corresponding to the edge type b in the network snapshot f can be realized.

How to determine the common neighbor node representation of node u under edge type b is described by way of example below with respect to FIG. 3:

referring to fig. 3, fig. 3 is a flowchart of determining a common neighbor node representation according to an embodiment of the present application. As shown in fig. 3, the process may include:

step 301, determining a weight coefficient of a node pair (u, c) formed by the node u and the node c according to the feature vector of the node u, the feature vector of the neighbor node c determined based on the common neighbor matrix corresponding to the edge type b, and the feature vectors of other neighbor nodes determined based on the common neighbor matrix corresponding to the edge type b.

Optionally, in step 301, the node c is any node determined based on the common neighbor matrix corresponding to the edge type b, where the node c is located on the edge corresponding to the edge type b.

The weight coefficients of the node pair (u, c) formed by the node u and the node c in this step 301 can be determined by referring to the above steps 201 and 203. For example, in the present embodiment, if the attention model in the current application scenario is trained currently, this step 301 may be implemented by the node self-attention layer in the attention model. The weight coefficient of the node pair (u, c) output by the final node from the attention layer is:

；

Wherein,a weight coefficient representing the node pair (u, c); />Is a feature vector of the node c, j represents any node except the node c and located on the edge corresponding to the edge type b determined based on the common neighbor matrix corresponding to the edge type b, ++>And representing the set of all the nodes on the edge corresponding to the edge type b, which is determined based on the common neighbor matrix corresponding to the edge type b, wherein the remaining parameters are described above and are not repeated. Of course, if the attention model in the current application scenario is not trained currently, the node attention layer parameter in the weight coefficient expressed by the above formula determined in step 301 is the node attention layer parameter to be trained (equivalent to an unknown quantity).

Step 302, determining the common neighbor node representation of the node u under the edge type b in the network snapshot f according to the weight coefficient of each node pair formed by the node u and each third candidate neighbor node.

Here, each third candidate neighbor node is each node on the edge corresponding to the edge type b determined based on the common neighbor matrix corresponding to the edge type b.

In step 302, the determination of the node u's common neighbor node representation corresponding to the edge type b in the network snapshot f may be referred to above in step 202 or step 204. For example, node u's common neighbor node representation under edge type b within network snapshot f is calculated as follows: ；

Wherein,representing node u's common neighbor node representation under edge type b within network snapshot f, +.>Representing a third set of candidate neighbor nodes, +.>3 is any one of the third candidate neighbor nodes in the third candidate neighbor node set,/for>Feature vector representing any one of the third candidate neighbor nodes (for example node d 3), +.>The weight coefficient of the node pair (u, d 3) representing the node u and the node d 3. />As described above.

Thus, the flow shown in fig. 3 is completed.

By the flow shown in fig. 3, it is achieved how to determine the common neighbor node representation of node u under the edge type b within the network snapshot f.

The polymerization in the above step 103 is described below:

referring to fig. 4, fig. 4 is a flow chart of aggregation in step 103 provided in an embodiment of the present application. As shown in fig. 4, the process may include the steps of:

step 401, aggregating the neighbor node representations of the node u under different edge types in the network snapshot f to obtain a first sub-aggregation result of the node u under the network snapshot f.

In this embodiment, the importance of the edges corresponding to the different edge types in the network snapshot f is different, and in this embodiment, it is required to determine the importance (that is, the weight coefficient) of the edges corresponding to the different edge types in the network snapshot f (including the node u) first, and then aggregate the neighboring node representations of the node u in the network snapshot f under the different edge types according to the weight coefficient of the different edges, where the aggregate result (that is, the first sub-aggregate result of the node u under the network snapshot f) is substantially the neighboring node representation of the node u under the network snapshot f.

Based on this, in this embodiment, in step 401, the aggregation of the neighbor node representations of the node u under different edge types in the network snapshot f to obtain the first sub-aggregation result of the node u under the network snapshot f may include: determining a weight coefficient of the node u under each side type according to the neighbor node representation of the node u under each side type; and determining a first sub-aggregation result of the node u under the network snapshot f according to the weight coefficient of the node u under different edge types and the neighbor node representation.

As an embodiment, if the attention model in the current application scenario is trained currently, this step 401 may be implemented by an edge self-attention layer in the attention model. The weight coefficient of the node u output by the final edge self-attention layer under any edge type is as follows:；

wherein i represents any one side type,weight coefficient representing node u under either side type i, +.>Is an activation function; />Representing the neighbor node representation of node u under either edge type i, L representing the set of edge types, ++>、/>Q are side self-attention layer parameters, e.g.>、/>Weight matrix and bias vector, respectively, +.>The vector is parameterized for edge level attention.

As an embodiment, the determining the first sub-aggregation result of the node u under the network snapshot f according to the weight coefficient of the node u under the different edge types and the first neighboring node representation may be represented by the following formula:

；

wherein,representing a first sub-aggregation result of node u under network snapshot f, i representing either side type, ++>Weight coefficient representing node u under either side type i, +.>Representing the neighbor node representation of node u under either edge type i, L represents the set of edge types.

Of course, if the attention model in the current application scenario has not been trained currently, the side note meaning layer parameters in the weight coefficients expressed by the above formula determined in the step 401、/>Q is the node attention layer parameter to be trained (equivalent to an unknown quantity).

And step 402, aggregating the common neighbor node representations of the node u under different edge types to obtain a second sub-aggregation result of the node u under the network snapshot f.

This step 402 is similar to step 401 described above, and may include, for example: determining a weight coefficient of the node u under each side type according to the common neighbor node representation of the node u under each side type; and determining a second sub-aggregation result of the node u under the network snapshot f according to the weight coefficient of the node u under different edge types and the common neighbor node representation.

As an example, if the attention model in the current application scenario is trained currently, this step 402 may be implemented by an edge self-attention layer in the attention model.

For example, the final edge self-attention layer is represented by common neighbor nodes under each edge type according to the node u, and the weight coefficient of the output node u under the edge type can be；

Wherein i represents any one side type,weight coefficient representing node u under either side type i, +.>Is an activation function; />Representing common neighbor node representation of node u under either edge type i, L representing the set of edge types,/>、/>Q are side self-attention layer parameters, e.g.>、/>Weight matrix and bias vector, respectively, +.>For edge levelAttention parameterizes the vector.

As an embodiment, the determining the second sub-aggregation result of the node u under the network snapshot f according to the weight coefficient of the node u under different edge types and the common neighbor node representation may be represented by the following formula:

；

wherein,representing a second sub-aggregation result of node u under network snapshot f, i representing either side type, ++>Weight coefficient representing node u under either side type i, +.>Representing the common neighbor node representation of node u under either edge type i, L represents the set of edge types.

Of course, if the attention model in the current application scenario has not been trained currently, the side note effort layer parameters in the weight coefficients expressed by the above formula determined in step 402、/>Q is the node attention layer parameter to be trained (equivalent to an unknown quantity).

And step 403, carrying out weighted fusion on the first sub-aggregation result and the second aggregation result of the node u under the network snapshot f to obtain the aggregation result of the node u under the network snapshot f.

Optionally, step 403 is illustrated by way of example by the following formula:=add（/>、/>）；

wherein,representing the aggregation result of node u under network snapshot f, add represents weighted aggregation.

Thus, the flow shown in fig. 4 is completed.

By the flow shown in fig. 4, how to aggregate the neighbor node representation and the common neighbor node representation of the node u under different edge types in the network snapshot f is realized, and an aggregation result of the node u under the network snapshot f is obtained.

In addition, it should be noted that, in the present embodiment, if the attention model in the current application scenario is trained currently, in the step 103, the target node representation of the node u is determined based on the aggregation result of the node u under different network snapshots, which may also be implemented by the convolution time sequence attention layer in the attention model.

Specifically, the target node representation of node u may be represented by the following formula:

wherein,a target node representation representing node u; />Representing normalized exponential function, ++>Representing a convolution operation; />、/>、/>All are the parameters of the attention layer of the convolution time sequence; />A matrix representing the aggregate result of node u in different network snapshots, e.g. the aggregate result of node u in any one network snapshot is a 5-dimensional vector, if there are 10 network snapshots +.>Matrix representing 10 x 5, +.>The aggregation result of each behavior node u in any network snapshot;representing a transpose; />Representing a mask matrix>I and j represent the sequence numbers of the collection time points of the network snapshot, < >>Representation->Is defined in the vector dimension of (a).

Of course, if the attention model in the current application scenario is not trained currently, the convolution time sequence attention layer parameter is the convolution time sequence attention layer parameter to be trained (which is equivalent to an unknown quantity).

As an embodiment, if the attention model under the current application scenario is trained currently, after the current target node representation of each node is obtained, the potential abnormal relationship may be predicted according to the current target node representation of each node, for example, based on the current target node representations of any two nodes, and the similarity of the two nodes may be predicted; predicting whether the relationship between any two nodes is a potential abnormal relationship according to the similarity of any two nodes and by adopting a set logistic regression algorithm.

Here, based on the current target node representation of any two nodes, the similarity of the two nodes is predicted, and the obtained result can be used for representing the similarity of the two nodes by performing Hadamard inner product operation on the target node representations of the two nodes.

Here, the logistic regression algorithm is implemented based on a statistical model for predicting the probability that an event, such as a relationship between any two nodes, is a potential anomaly relationship. Based on this, in this embodiment, according to the similarity of any two nodes and using a set logistic regression algorithm, predicting whether the relationship between the two nodes is a potential abnormal relationship may be: inputting the similarity of any two nodes into a set logistic regression algorithm to obtain an output result, wherein the output result indicates whether the relationship between the two nodes is the probability of potential abnormal relationship or not; and when the probability is larger than or equal to the set probability value, determining that the relationship between the two nodes is a potential abnormal relationship, otherwise, when the probability is smaller than the set probability value, determining that the potential abnormal relationship does not exist between the two nodes. And finally, the prediction of the potential abnormal relation of the neighbor-enhanced dynamic heterogeneous network is realized.

As another embodiment, if the attention model in the current application scenario is not trained currently, the target node representation of the node u described above may find that the target node representation of any node includes attention model parameters to be trained, such as the node attention layer parameters, the edge self-attention layer parameters, and the convolution time sequence attention layer parameters.

Based on this, optionally, the present embodiment may execute the following steps before predicting the potential abnormal relationship according to the target node representation of each node:

obtaining a target node representation of the training node, the target node representation of the training node being a subset of the determined target node representations of the nodes; using the current target node of the training node to represent a training attention model; checking whether the trained attention model meets the model iteration stop requirement, if not, adjusting the current target node representation of the training node by adjusting the attention model parameters in the target node representation of the training node, and returning to the step of training the attention model by using the current target node representation of the training node; if so, the current trained attention model is taken as the target attention model (namely, the trained attention model is convenient to use in the future prediction of the relationship between nodes in the current application scene).

As an embodiment, the training node is selected from the nodes according to a conventional random walk manner, and the embodiment is not particularly limited.

In addition, in the present embodiment, checking whether the trained attention model satisfies the model iteration stop requirement may be: and checking whether the loss value meets the set requirement (such as being smaller than or equal to a set minimum loss value, or the loss value is kept unchanged, or the loss value is changed from a decreasing trend to an increasing trend, and the like), if so, determining that the trained attention model meets the model iteration stop requirement, otherwise, determining that the trained attention model does not meet the model iteration stop requirement.

As an embodiment, the loss value may be calculated by setting a loss function, for example, the loss function is a cross entropy function, which is not particularly limited in this embodiment.

Optionally, the present embodiment also needs to sample a negative training sample immediately, where the negative training sample may include node pairs with no connection relationship.

If a training node is selected in a random walk manner from node u, the loss value calculation illustrated by taking the loss function as the cross entropy function may be:

wherein,representing a loss value; />Indicating at the last point in time, e.g. +.>In the network snapshot collected below, the neighbor node set of the node u is determined according to a random walk mode,/or #>Representation->Any neighbor node->As described above, for the activation function, +.>Indicating that node u is +_at the last point in time>Aggregation results in the network snapshot collected below; />Representing node->At the last time point->Aggregation results in the network snapshot collected below; />For the number of node pairs in the negative training sample, +.>Is a penalty term for the objective function that prevents overfitting. />Is a hyper-parameter for balancing penalty functions. The implementation isFor example, use the last time point +. >The purpose of the network snapshot collected below is to ensure that the aggregation result of the network snapshot collected by the node u at the last time point is more similar to the aggregation result of the neighbor nodes of the node u randomly moving according to the fixed length in the network snapshot collected at the last time point.

As an embodiment, when the trained attention model is found to meet the model iteration stop requirement, a description of the target node representation of the training node is adapted during the training based on the attention model, where the current target node representation of at least one node is likely not the initially determined target node representation, but the adapted target node representation during the training of the attention model. On the premise of this, the present embodiment predicts the potential abnormal relationship according to the latest current target node representation of each node, which can enhance the capability of the dynamic evolution feature of the network.

As to how to predict the potential abnormal relationship according to the current target node representation of each node, reference should be made to the above description, and details are not repeated here.

The method provided by the embodiment of the present application is described above, and the device provided by the embodiment of the present application is described below:

Referring to fig. 5, fig. 5 is a block diagram of an apparatus according to an embodiment of the present application. The apparatus may include:

As one embodiment, the determining the common neighbor matrix corresponding to the edge type according to the adjacent matrix corresponding to the edge type includes:

determining a common neighbor matrix corresponding to the edge type according to the following formula:

where t represents the time at which the web snapshot was taken, r represents an edge type,representing a common neighbor matrix corresponding to the type r above the network snapshot t acquired at time t,/>Representing the adjacency matrix corresponding to the type r above the network snapshot t taken at time t.

As one embodiment, the determining the neighbor interaction set of the node on the edge corresponding to the edge type includes:

determining a neighbor node pair of any node on the edge corresponding to the edge type; any neighbor node pair consists of two neighbor nodes of the node;

and determining a neighbor interaction set of each neighbor node pair according to the feature vectors of the two neighbor nodes which are constructed.

As one embodiment, the determining the neighbor interaction set of each neighbor node according to the feature vectors of the two neighbor nodes in the pair of neighbor nodes includes:

The neighbor interaction set of the node is calculated as follows:

wherein t represents the time of collecting the network snapshot, and r represents an edge type; o represents a node on the edge corresponding to the edge type r;neighbor nodes, respectively node o, +.>Forming neighbor node pairs of the node o; />Representing node o on the edge corresponding to edge type r on the network snapshot t taken at time t as being on the neighbor node pair (++>) A determined neighbor interaction set; />A feature vector representing that node p is constructed; />A feature vector representing that node q is constructed; />A neighbor node set representing node o; as indicated by the multiplication, k indicates neighbor interaction.

As an example of an implementation of this embodiment,

the determining the neighbor node representation of the node u under the edge type b in the network snapshot f according to the adjacency matrix corresponding to the edge type b and the neighbor interaction set based on the node u comprises the following steps:

determining a weight coefficient of a node pair (u, g) formed by the node u and the node g according to the feature vector of the node u, the feature vector of the neighbor node g determined based on the adjacent matrix corresponding to the edge type b and the feature vectors of other neighbor nodes determined based on the adjacent matrix corresponding to the edge type b; the node g is any node determined based on an adjacency matrix corresponding to the edge type b, and the node g is positioned on the edge corresponding to the edge type b;

Determining a first reference node representation corresponding to the edge type b in the network snapshot f according to the weight coefficient of a node pair formed by the node u and each first candidate neighbor node; the first candidate neighbor node is a node which is determined based on an adjacency matrix corresponding to the edge type b and is positioned on the edge corresponding to the edge type b;

determining a weight coefficient of a node pair (u, k) formed by the node u and the node k according to the feature vector of the node u, the feature vector of the neighbor node k determined based on the neighbor interaction set of the node u and the feature vectors of other neighbor nodes determined based on the neighbor interaction set of the node u; the node k is any node determined based on the neighbor interaction set of the node u, and the node k is positioned on the edge corresponding to the edge type b;

determining a second reference node representation corresponding to the edge type b in the network snapshot f according to the weight coefficient of each node pair formed by the node u and each second candidate neighbor node; the second candidate neighbor node is a node which is determined based on the neighbor interaction set of the node u and is positioned on the edge corresponding to the edge type b;

and determining the neighbor node representation of the node u under the edge type b in the network snapshot f according to the first reference node representation and the second reference node representation corresponding to the edge type b in the network snapshot f.

As an example of an implementation of this embodiment,

the determining the common neighbor node representation of the node u under the edge type b in the network snapshot f according to the common neighbor matrix corresponding to the edge type b comprises the following steps:

determining a weight coefficient of a node pair (u, c) formed by the node u and the node c according to the feature vector of the node u, the feature vector of the neighbor node c determined based on the common neighbor matrix corresponding to the edge type b and the feature vectors of other neighbor nodes determined based on the common neighbor matrix corresponding to the edge type b; the node c is any node determined based on a common neighbor matrix corresponding to the edge type b, and the node c is positioned on the edge corresponding to the edge type b;

determining the common neighbor node representation of the node u under the edge type b in the network snapshot f according to the weight coefficient of each node pair formed by the node u and each third candidate neighbor node; the third candidate neighbor node is a node which is determined based on the common neighbor matrix corresponding to the edge type b and is positioned on the edge corresponding to the edge type b.

As an example of an implementation of this embodiment,

the aggregation of the neighbor node representation and the common neighbor node representation of the node u in the network snapshot f under different edge types, the obtaining of the aggregation result of the node u in the network snapshot f comprises the following steps:

Aggregating neighbor node representations of the node u in the network snapshot f under different edge types to obtain a first sub-aggregation result of the node u in the network snapshot f;

aggregating the common neighbor node representations of the node u under different edge types to obtain a second sub-aggregation result of the node u under the network snapshot f;

and carrying out weighted fusion on the first sub-aggregation result and the second aggregation result of the node u under the network snapshot f to obtain the aggregation result of the node u under the network snapshot f.

As an example of an implementation of this embodiment,

the aggregation of the neighbor node representations of the node u under different edge types in the network snapshot f, and the obtaining of the first sub-aggregation result of the node u under the network snapshot f comprises the following steps: determining a weight coefficient of the node u under each side type according to the neighbor node representation of the node u under each side type in the network snapshot f; determining a first sub-aggregation result of the node u under the network snapshot f according to the weight coefficient of the node u under different edge types and the neighbor node representation;

the aggregation of the common neighbor node representations of the node u under different edge types, and the obtaining of the second sub-aggregation result of the node u under the network snapshot f comprises the following steps: determining a weight coefficient of the node u under each side type according to the common neighbor node representation of the node u under each side type in the network snapshot f; and determining a second sub-aggregation result of the node u under the network snapshot f according to the weight coefficient of the node u under different edge types and the common neighbor node representation.

As an example of an implementation of this embodiment,

the target node representation of the node u comprises attention model parameters to be trained;

before predicting the potential anomaly relationship from the target node representation for each node, the method further comprises: obtaining a target node representation of the training node, the target node representation of the training node being a subset of the determined target node representations of the nodes; using the current target node of the training node to represent a training attention model; checking whether the trained attention model meets the model iteration stop requirement, if not, adjusting the current target node representation of the training node by adjusting the attention model parameters in the target node representation of the training node, and returning to the step of training the attention model by using the current target node representation of the training node; if yes, taking the current trained attention model as a target attention model;

the predicting potential abnormal relation according to the target node representation of each node comprises: predicting potential abnormal relations according to the current target node representation of each node;

or the target node representation of the node u contains trained attention model parameters; the predicting potential abnormal relation according to the target node representation of each node comprises: and predicting potential abnormal relations according to the current target node representation of each node.

As one embodiment, the predicting the potential anomaly relationship according to the current target node representation of each node includes: predicting the similarity of any two nodes based on the current target node representation of the two nodes; predicting whether the relationship between any two nodes is a potential abnormal relationship according to the similarity of any two nodes and by adopting a set logistic regression algorithm.

The description of the apparatus shown in fig. 5 is thus completed.

For the device embodiments, reference is made to the description of the method embodiments for the relevant points, since they essentially correspond to the method embodiments. The apparatus embodiments described above are merely illustrative, wherein the modules illustrated as separate components may or may not be physically separate, and the components shown as modules may or may not be physical, i.e., may be located in one place, or may be distributed over a plurality of network modules. Some or all of the modules may be selected according to actual needs to achieve the purposes of the present description. Those of ordinary skill in the art will understand and implement the present invention without undue burden.

Correspondingly, the embodiment of the application also provides a hardware structure diagram of the device shown in fig. 5, and in particular, as shown in fig. 3, the electronic device may be a device for implementing the method. As shown in fig. 6, the hardware structure includes: a processor and a memory.

Wherein the memory is configured to store machine-executable instructions;

the processor is configured to read and execute the machine executable instructions stored in the memory, so as to implement the method embodiment of dynamic heterogeneous network potential abnormal relation prediction corresponding to the method embodiment shown above.

The memory may be any electronic, magnetic, optical, or other physical storage device that may contain or store information, such as executable instructions, data, or the like, for one embodiment. For example, the memory may be: volatile memory, nonvolatile memory, or similar storage medium. In particular, the memory may be RAM (Radom Access Memory, random access memory), flash memory, a storage drive (e.g., hard drive), a solid state disk, any type of storage disk (e.g., optical disk, DVD, etc.), or a similar storage medium, or a combination thereof.

Based on the same inventive concept, the present embodiment also provides a computer-readable storage medium. The computer readable storage medium storing a computer program; the computer program, when being executed by a processor, implements the method embodiments as described above.

Based on the same inventive concept, the present embodiment also provides a computer program product having a computer program stored therein, which, when being executed by a processor, implements the method embodiments as described above.

The foregoing describes specific embodiments of the present disclosure. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Other embodiments of the present description will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This specification is intended to cover any variations, uses, or adaptations of the specification following, in general, the principles of the specification and including such departures from the present disclosure as come within known or customary practice within the art to which the specification pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the specification being indicated by the following claims.

It is to be understood that the present description is not limited to the precise arrangements and instrumentalities shown in the drawings, which have been described above, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present description is limited only by the appended claims.

The foregoing description of the preferred embodiments is provided for the purpose of illustration only, and is not intended to limit the scope of the disclosure, since any modifications, equivalents, improvements, etc. that fall within the spirit and principles of the disclosure are intended to be included within the scope of the disclosure.

Claims

1. A method for predicting potential anomaly relations of a dynamic heterogeneous network, the method comprising:

2. The method of claim 1, wherein determining the common neighbor matrix for the edge type based on the adjacency matrix for the edge type comprises:

3. The method of claim 1, wherein determining the neighbor interaction set for the node on the edge to which the edge type corresponds comprises:

4. A method according to claim 3, wherein said determining the neighbor interaction set for each neighbor node based on the feature vectors that have been constructed for the two neighbor nodes in the node pair comprises:

the neighbor interaction set of the node is calculated as follows:

wherein t represents the time of collecting the network snapshot, and r represents an edge classA shape; o represents a node on the edge corresponding to the edge type r;neighbor nodes, respectively node o, +.>Forming neighbor node pairs of the node o; />Representing node o on the edge corresponding to edge type r on the network snapshot t taken at time t as being on the neighbor node pair (++>) A determined neighbor interaction set;a feature vector representing that node p is constructed; />A feature vector representing that node q is constructed; />A neighbor node set representing node o; as indicated by the multiplication, k indicates neighbor interaction.

5. The method of claim 1, wherein determining the neighbor node representation of the node u under the edge type b within the network snapshot f from the adjacency matrix corresponding to the edge type b and the neighbor interaction set based on the node u comprises:

6. The method according to claim 1, wherein determining the common neighbor node representation of the node u under the edge type b in the network snapshot f according to the common neighbor matrix corresponding to the edge type b comprises:

7. The method according to claim 1, wherein aggregating the neighboring node representations of the node u under the different edge types and the common neighboring node representation in the network snapshot f to obtain an aggregate result of the node u under the network snapshot f comprises:

8. The method of claim 7, wherein aggregating the neighbor node representations of the node u under the different edge types in the network snapshot f to obtain the first sub-aggregate result of the node u under the network snapshot f comprises: determining a weight coefficient of the node u under each side type according to the neighbor node representation of the node u under each side type in the network snapshot f; determining a first sub-aggregation result of the node u under the network snapshot f according to the weight coefficient of the node u under different edge types and the neighbor node representation;

9. The method according to claim 1, characterized in that the target node representation of node u contains attention model parameters to be trained;

10. The method of claim 9, wherein predicting potential anomaly relationships based on the current target node representation for each node comprises: predicting the similarity of any two nodes based on the current target node representation of the two nodes; predicting whether the relationship between any two nodes is a potential abnormal relationship according to the similarity of any two nodes and by adopting a set logistic regression algorithm.

11. A dynamic heterogeneous network potential anomaly relationship prediction apparatus, the apparatus comprising:

12. An electronic device, characterized in that the electronic device comprises: a processor and a memory;

wherein the memory is configured to store machine-executable instructions;

the processor is configured to read and execute the machine executable instructions stored in the memory to implement the steps in the method according to any one of claims 1 to 10.

13. A computer program product, characterized in that the computer program product has stored therein a computer program which, when executed by a processor, implements the method of any of claims 1-10.