WO2024114618A1

WO2024114618A1 - Method for detecting abnormal event, and method and apparatus for constructing abnormal-event detection model

Info

Publication number: WO2024114618A1
Application number: PCT/CN2023/134620
Authority: WO
Inventors: 石川; 任宇翔; 闫博
Original assignee: 华为技术有限公司
Priority date: 2022-12-02
Filing date: 2023-11-28
Publication date: 2024-06-06
Also published as: CN118133031A

Abstract

A method for detecting an abnormal event, and a method and apparatus for constructing an abnormal-event detection model. The method for detecting an abnormal event comprises: acquiring a first attribute heterogeneity graph used for representing at least one event, wherein the first attribute heterogeneity graph comprises a plurality of nodes and an association relationship between the plurality of nodes, and each event is represented by means of at least two nodes among the plurality of nodes and an association relationship between the at least two nodes, each node in each event comprising information of event elements forming the event; and taking the first attribute heterogeneity graph as an input of an abnormal-event detection model, so as to obtain an output result, wherein the output result is used for representing whether the at least one event comprises an abnormal event, the abnormal event being determined according to the similarity between events or the similarity between the nodes in the event.

Description

Abnormal event detection method, abnormal event detection model construction method and device

This application claims priority to the Chinese patent application filed with the State Intellectual Property Office on December 2, 2022, with application number 202211536903.2 and application name “Abnormal event detection method, abnormal event detection model construction method and device”, the entire contents of which are incorporated by reference in this application.

Technical Field

The present application relates to the field of artificial intelligence, and in particular to an abnormal event detection method, an abnormal event model construction training method and a device.

Background technique

Each event may contain multiple types of attribute entities and complex interactions between them, thus forming an attribute heterogeneous information network. With the booming development of social media, abnormal event detection in attribute heterogeneous information networks has become an important but rarely explored task.

In some commonly used detections for abnormal events, two events can be interacted with each other, and all scores can be weighted by interaction category to obtain the abnormal score of the entire event. The interaction score is in the form of vector dot product, and the higher the score, the more normal the interaction. By weighted summing the scores, the model can automatically learn the importance of different types of node interactions. By maximizing the score of normal events to optimize the final loss function, a normal event will have a higher score, while an abnormal event will have a lower score. However, this detection method can only detect anomalies for simple category events, and its detection accuracy is far from enough for some events with complex interactions.

Summary of the invention

The present application provides an abnormal event detection method, an abnormal event model construction training method and a device in the field of artificial intelligence, which are used to construct an abnormal event detection model based on an attribute heterogeneity graph and are applied to perform anomaly detection on a variety of complex event data generated by users.

In view of this, in a first aspect, the present application provides an abnormal event detection method, comprising: obtaining a first attribute heterogeneity graph, the first attribute heterogeneity graph is used to represent at least one event, the first attribute heterogeneity graph includes multiple nodes and association relationships between the multiple nodes, each event is represented by at least two nodes among the multiple nodes and the association relationship between the at least two nodes, and each node in each event includes information of event elements that form the event; using the first attribute heterogeneity graph as an input of an abnormal event detection model to obtain an output result, the output result is used to indicate whether at least one event includes an abnormal event, and the abnormal event is determined based on the similarity between events or the similarity between nodes within an event.

In the implementation manner of the present application, the abnormal event detection model can identify the abnormality of an event based on the similarity between nodes within an event or the similarity between events, so that abnormal events can be more accurately identified from multiple dimensions.

In a possible implementation, the abnormal event detection model includes one or more of the following modules: a node pair comparison module, a multivariate interaction module, or an event comparison module, the node comparison module is used to obtain the similarity between nodes within an event, the multivariate interaction module is used to obtain the similarity between nodes within an event and event categories, and the event comparison module is used to obtain the similarity between events. In the implementation of the present application, the abnormal event detection model may include an identification module for the degree of abnormality between nodes within an event or an identification module for the degree of abnormality between events, which can accurately identify abnormal events from multiple dimensions.

In a possible implementation, if the abnormal event detection model includes a node pair comparison module, taking the first attribute heterogeneity graph as the input of the abnormal event detection model to obtain an output result may include: outputting a first degree of abnormality for each event according to the node pair comparison module, wherein the node pair comparison module is used to obtain the similarity between the node pairs in each event, and obtaining the first degree of abnormality according to the similarity between the node pairs in each event; judging whether each event is an abnormal event according to the first degree of abnormality of each event to obtain an output result.

In the implementation manner of the present application, the similarity between nodes within an event can be calculated through a node pair comparison module, so that the abnormal event detection model can identify the abnormality of the event based on the similarity between nodes within the event and accurately identify the abnormal event.

In a possible implementation, if the abnormal event detection model includes a multivariate interaction module, the first attribute heterogeneity graph is used as the input of the abnormal event detection model to obtain an output result, and may also include: outputting the second abnormality degree of each event through the multivariate interaction module, wherein the multivariate interaction module is used to fuse multiple nodes in at least one event to obtain an identifier node, or to use the center point of each event as the identifier node, and to obtain the second abnormality degree of each event through the similarity between at least one node and the identifier node; based on the second abnormality degree of each event, judging whether each event is an abnormal event to obtain an output result.

Usually, there may be multiple interactions between nodes in an event. We can identify the interactions between nodes and events by building a multi-interaction module. The abnormal degree of interaction between the whole components can be accurately identified.

In a possible implementation, if the abnormal event detection model includes an event comparison module, the first attribute heterogeneity graph is used as the input of the abnormal event detection model to obtain an output result, and it may also include: outputting the third abnormality degree of each event through the event comparison module, wherein the event comparison module is used to obtain the similarity between event pairs, and calculate the third abnormality degree of each event according to the similarity between the event pairs; according to the third abnormality degree of each event, determine whether each event is an abnormal event to obtain an output result. In the implementation of the present application, an event comparison module may also be set in the abnormal event detection model to identify the abnormality degree between events, so as to identify abnormal events in units of events.

In a possible implementation, the event comparison module can be specifically used to: filter out a positive sample set corresponding to each event from multiple events; and obtain a third abnormality degree of each event based on the similarity between each event and the events in the corresponding positive sample set.

In the implementation manner of the present application, a positive sample set for each event may be determined, and whether an event is abnormal may be identified based on the similarity between adjacent times.

In a possible implementation, the event comparison module is specifically used to: perform semantic recognition on each event to obtain a representation of each event; and calculate the similarity between each event and the events in the corresponding positive sample set based on the representation of each event. Therefore, the embodiment of the present application can accurately calculate the similarity between events based on the extracted features.

In a possible implementation, if the abnormal event detection model includes a node pair comparison module, a multivariate interaction module and an event comparison module, the first attribute heterogeneity graph is used as the input of the abnormal event detection model to obtain an output result, and also includes: using the first attribute heterogeneity graph as the input of the node pair comparison module, the multivariate interaction module and the event comparison module respectively; fusing the first abnormality degree of each event output by the node pair comparison module, the second abnormality degree of each event output by the multivariate interaction module and the third abnormality degree of each event output by the event comparison module to obtain a fourth abnormality degree of each event; judging whether each event is an abnormal event according to the fourth abnormality degree of each event to obtain an output result.

In the implementation manner of the present application, when multiple modules are set in the abnormal event detection model, the results output by the multiple modules can be fused to identify abnormal events from multiple granularities and obtain accurate identification results.

In a possible implementation, the aforementioned use of the first attribute heterogeneity graph as input to the abnormal event detection model includes: mapping each node in each event in the first attribute heterogeneity graph to the same space to obtain a second data representation of each event in the same space; and using the second data representation as input to the abnormal event detection model to obtain an output result.

Usually, the nodes in the attribute heterogeneity graph may be nodes of different dimensions. Each node can be mapped to the same space to obtain the representation of each node in the same dimension, so as to facilitate identification based on the representation of each node in the same dimension.

In a possible implementation, at least one event in the first attribute heterogeneity graph is used to represent: a financial transaction behavior of a user, a comment behavior of a user, or an item transaction behavior of a user. Therefore, the abnormal event detection model constructed by the method provided in this application can be applied to a variety of scenarios, and has a very strong generalization ability.

In a second aspect, the present application provides a method for constructing an abnormal event detection model, comprising:

First, a second attribute heterogeneity graph is obtained, the second attribute heterogeneity graph represents multiple events, the second attribute heterogeneity graph includes multiple nodes and association relationships between the multiple nodes, each event is represented by at least two nodes among the multiple nodes and the association relationship between the at least two nodes, and the nodes in each event include information of event elements that form the event; then, an abnormal event detection model is constructed according to the second attribute heterogeneity graph, the abnormal event detection model is used to detect abnormal events among multiple events, and the abnormal events are determined according to the similarity between events or the similarity between nodes within an event.

Multiple nodes can be set in the attribute heterogeneity graph, and the multiple nodes can be related to each other, so that complex events can be represented. Therefore, the present application can model based on the attribute heterogeneity graph that can represent complex cases, and obtain a model that can be used to detect abnormal events, that is, an abnormal event detection model, so as to realize abnormal detection of more complex events.

In a possible implementation, the abnormal event detection model includes a node pair comparison module, which can be used to obtain the similarity of node pairs, that is, the similarity between nodes, and every at least two nodes form a node pair; the aforementioned construction of the abnormal event detection model based on the second attribute heterogeneity graph may include: first, multiple nodes in each event are grouped into at least one pair of node pairs, and each pair of node pairs may include at least two nodes; then, through the node pair comparison module, the first similarity of each pair of node pairs in at least one pair of node pairs is obtained, that is, the similarity between every at least two nodes; then, according to the first similarity of each pair of node pairs, the composition of each node in the multiple nodes is obtained. The pairwise contrast loss values are calculated, and the abnormal event detection model is updated according to the pairwise contrast loss values of each node pair to obtain an updated abnormal event detection model.

In the implementation manner of the present application, the similarity between nodes within an event can be calculated through a node pair comparison module, and comparative learning can be performed based on the similarity between the nodes, so that the abnormal event detection model can identify the degree of abnormality of the event based on the similarity between the nodes within the event, and accurately identify the abnormal event.

In a possible implementation, the aforementioned updating of the abnormal event detection model according to the pairwise contrast loss value of each node pair to obtain an updated abnormal event detection model may include: fusing the pairwise contrast loss values of multiple node pairs in each event to obtain a first loss value; updating the abnormal event detection model according to the first loss value to obtain an updated abnormal event detection model.

In the implementation manner of the present application, in updating the abnormal event detection model, the contrast loss of each node pair can be combined to calculate the node pair contrast loss of the event as a whole, so as to learn based on the entire event and learn an abnormal event detection model that can identify abnormal events based on the similarity between nodes.

In a possible implementation, the aforementioned obtaining of the pairwise contrast loss value of each node based on the first similarity of each pair of node pairs may include: obtaining a positive sample node set of the first node from multiple nodes, and constructing a negative sample node set, the first similarity between the nodes in the positive sample node set and the first node is higher than the first similarity between the nodes in the negative sample node set and the first node, and the first node is any one of the multiple nodes in each event; then calculating the pairwise contrast loss value corresponding to the first node through the first similarity between the first node and the nodes in the positive sample node set, and the similarity between the first node and the nodes in the negative sample node set.

In the implementation manner of the present application, when collecting data sets, there is no need to collect negative samples separately. A positive sample node set can be collected from the nodes within the event, and a negative sample node set can be constructed based on the nodes within the event, so as to perform comparative learning based on the positive sample node set and the negative sample node set, so that the learned node pair comparison module can identify abnormal nodes in the event.

In a possible implementation, the aforementioned calculation of the pairwise contrast loss value corresponding to the first node through the first similarity between the first node and the nodes in the positive sample node set, and the similarity between the first node and the nodes in the negative sample node set, may include: obtaining a temperature coefficient, where the temperature coefficient is related to the similarity between the nodes in the negative sample node set and the first node; and combining the temperature coefficient, calculating the pairwise contrast loss value corresponding to the first node through the first similarity between the first node and the nodes in the positive sample node set, and the similarity between the first node and the nodes in the negative sample node set.

In the implementation manner of the present application, a temperature coefficient can be set when calculating the paired contrast loss, so as to adjust the focus on difficult samples through the temperature coefficient, thereby reducing the influence of difficult samples on the training results and improving the training effect.

In a possible implementation, the abnormal event detection model further includes a multivariate interaction module, which is used to cluster nodes in the event to obtain at least one category, and obtain the similarity between each node in the event and at least one category, where the similarity is used to indicate the abnormality degree of the corresponding event;

The aforementioned construction of an abnormal event detection model based on the second attribute heterogeneity graph may also include: first, obtaining a second similarity between at least one node among multiple nodes in each event and an identifier node through a multivariate interaction module, and the identifier node may include a central node of each event or a node obtained by fusing multiple nodes; then calculating a second loss value based on the second similarity between at least one node and the identifier node; then updating the abnormal event detection model based on the second loss value to obtain an updated abnormal event detection model.

Usually, there may be multiple interactions between nodes within an event. By constructing a multivariate interaction module to identify the degree of abnormal interaction between the nodes within the event and the event as a whole, the degree of abnormality of the event can be accurately identified.

In a possible implementation, the multivariate interaction module can also be used to cluster multiple nodes in each event to obtain at least one category; when calculating the second loss value, the first node can be replaced by the second node, the first node is one of the points in the first event, and the second node has the same attributes as the first node but a different category; obtain the third similarity between the second node and the identifier node; calculate the loss value based on the second similarity and the third similarity to obtain the second loss value.

In the implementation manner of the present application, the nodes in the event can be replaced with nodes with the same attributes but different categories, thereby constructing negative samples and realizing unsupervised contrastive learning.

In a possible implementation, the abnormal event detection model further includes an event comparison module, which is used to obtain the similarity between events; the aforementioned construction of the abnormal event detection model based on the second attribute heterogeneity graph may also include: first, from multiple events The positive sample set and the negative sample set corresponding to each event are screened out; then, the third loss value is calculated according to the fourth similarity between each event and the events in the positive sample set and the fifth similarity between each event and the events in the negative sample set; then, the abnormal event detection model can be updated according to the third loss value to obtain an updated abnormal event detection model.

In the implementation manner of the present application, an event comparison module can also be constructed to identify the similarities between events, and comparative learning can be achieved by screening the positive sample set and the negative sample set of the event, thereby achieving unsupervised learning.

In a possible implementation, the aforementioned screening out of positive sample sets and negative sample sets corresponding to each event from multiple events may include: obtaining the number of shared nodes between each pair of events through an event comparison module; obtaining at least one event whose number of shared nodes with a second event is greater than a first threshold, and obtaining a positive sample set, wherein the second event is any one of the multiple events; obtaining at least one event whose number of shared nodes with the second event is not greater than the first threshold, and obtaining a negative sample set.

In the implementation manner of the present application, the positive sample set and the negative sample set of each event can be determined by the number of nodes shared between events, so that samples with higher similarity can be screened out as positive samples of the current sample, and samples with lower similarity can be screened out as negative samples of the current sample, so as to facilitate subsequent comparative learning.

In a possible implementation, the aforementioned obtaining of the fourth similarity between each pair of events in a plurality of events through an event comparison module may include: performing semantic recognition on each event through the event comparison module to obtain a representation of each event; and the event comparison module may calculate the fourth similarity between the events based on each event representation.

In the implementation manner of the present application, the representation of each event can be obtained through semantic recognition, so that the similarity can be accurately calculated through the representation.

In a possible implementation, the aforementioned construction of an abnormal event detection model based on the second attribute heterogeneity graph may also include: first, mapping the data corresponding to each node in each event in the second attribute heterogeneity graph to the same space to obtain a first data representation of each event in the same space; and constructing an abnormal event detection model based on the first data representation.

Usually, the nodes in the attribute heterogeneity graph may be nodes of different dimensions. By mapping each node to the same space, the representation of each node in the same dimension can be obtained, so as to facilitate comparative learning based on the representation of each node in the same dimension and obtain an abnormal event detection model.

Multiple events in the second attribute heterogeneity graph in the same dimension are used to represent: a financial transaction behavior of a user, a comment behavior of a user, or an item transaction behavior of a user. Therefore, the abnormal event detection model constructed by the method provided in this application can be applied to a variety of scenarios, and has a very strong generalization ability.

In a third aspect, the present application provides an abnormal event detection device, comprising:

An acquisition module is used to acquire a first attribute heterogeneity graph, wherein the first attribute heterogeneity graph includes at least one event, the first attribute heterogeneity graph includes a plurality of nodes and association relationships between the plurality of nodes, each event is represented by at least two nodes among the plurality of nodes and the association relationship between the at least two nodes, and each node in each event includes information of event elements forming the event;

The detection module is used to use the first attribute heterogeneity graph as the input of the abnormal event detection model to obtain an output result, and the output result is used to indicate whether at least one event includes an abnormal event, and the abnormal event is determined based on the similarity between events or the similarity between nodes within an event.

It should be noted that the effects achieved in the fourth aspect and any optional implementation manner of the fourth aspect can refer to the effects achieved in the aforementioned first aspect or any optional implementation manner of the first aspect, and will not be repeated here.

In one possible implementation, the abnormal event detection model includes one or more of the following modules: a node pair comparison module, a multivariate interaction module or an event comparison module. The node comparison module is used to obtain the similarity between nodes within an event. The multivariate interaction module is used to obtain the similarity between nodes within an event and event categories. The event comparison module is used to obtain the similarity between events.

In a possible implementation, if the abnormal event detection model includes a node pair comparison module, the detection module is specifically used to: output a first abnormality degree of each event according to the node pair comparison module, wherein the node pair comparison module is used to obtain the similarity between the node pairs in each event, and obtain the first abnormality degree according to the similarity between the node pairs in each event; according to the first abnormality degree of each event, determine whether each event is an abnormal event to obtain an output result.

In a possible implementation, if the abnormal event detection model includes a multivariate interaction module, the detection module is specifically used to: output the second abnormality degree of each event through the multivariate interaction module, wherein the multivariate interaction module is used to fuse multiple nodes in at least one event to obtain an identifier node, or use the center point of each event as the identifier node, and obtain the second abnormality degree of each event through the similarity between at least one node and the identifier node; determine whether each event is abnormal according to the second abnormality degree of each event; Normal events to get output results.

In a possible implementation, if the abnormal event detection model includes an event comparison module, the detection module is specifically used to: output the third abnormality degree of each event through the event comparison module, wherein the event comparison module is used to obtain the similarity between event pairs, and calculate the third abnormality degree of each event based on the similarity between the event pairs; based on the third abnormality degree of each event, determine whether each event is an abnormal event to obtain an output result.

In a possible implementation, the event comparison module is specifically used to: filter out a positive sample set corresponding to each event from multiple events; and obtain a third abnormality degree of each event based on the similarity between each event and an event in the corresponding positive sample set.

In a possible implementation, the event comparison module is specifically used to: perform semantic recognition on each event to obtain a representation of each event; and calculate the similarity between each event and an event in a corresponding positive sample set based on the representation of each event.

In a possible implementation, if the abnormal event detection model includes a node pair comparison module, a multivariate interaction module and an event comparison module, the detection module is specifically used to: use the first attribute heterogeneity graph as the input of the node pair comparison module, the multivariate interaction module and the event comparison module respectively; fuse the first abnormality degree of each event output by the node pair comparison module, the second abnormality degree of each event output by the multivariate interaction module and the third abnormality degree of each event output by the event comparison module to obtain the fourth abnormality degree of each event; judge whether each event is an abnormal event according to the fourth abnormality degree of each event to obtain an output result.

In a possible implementation, the detection module is specifically used to: map each node in each event in the first attribute heterogeneity graph to the same space to obtain a second data representation of each event in the same space; and use the second data representation as an input to an abnormal event detection model to obtain an output result.

In a possible implementation, at least one event in the first attribute heterogeneity graph is used to represent: a financial transaction behavior of a user, a comment-posting behavior of a user, or an item transaction behavior of a user.

In a fourth aspect, the present application provides a device for constructing an abnormal event detection model, comprising:

an acquisition module, configured to acquire a second attribute heterogeneity graph, wherein the second attribute heterogeneity graph represents a plurality of events, the second attribute heterogeneity graph includes a plurality of nodes and association relationships between the plurality of nodes, each event is represented by at least two nodes among the plurality of nodes and the association relationship between the at least two nodes, and the node in each event includes information of event elements forming the event;

A construction module is used to construct an abnormal event detection model according to the second attribute heterogeneity graph. The abnormal event detection model is used to detect abnormal events among multiple events. The abnormal events are determined based on the similarity between events or the similarity between nodes within an event.

It should be noted that the effects achieved in the fourth aspect and any optional implementation of the fourth aspect can refer to the effects achieved in the aforementioned second aspect or any optional implementation of the second aspect, and will not be repeated here.

In a possible implementation, the abnormal event detection model includes a node pair comparison module, which is used to obtain the similarity of the node pairs, and the similarity is used to indicate the abnormality degree of the event;

The construction module is specifically used to: group multiple nodes in each event into at least one pair of node pairs; obtain the first similarity of each pair of node pairs in at least one pair of node pairs through the node pair comparison module; obtain the pairwise comparison loss value of each node in the multiple nodes according to the first similarity of each pair of node pairs; update the abnormal event detection model according to the pairwise comparison loss value of each node pair to obtain the updated abnormal event detection model.

In a possible implementation, the construction module is specifically used to: fuse the pairwise comparison loss values of multiple node pairs in each event to obtain a first loss value; and update the abnormal event detection model according to the first loss value to obtain an updated abnormal event detection model.

In a possible implementation, a construction module is specifically used to: obtain a positive sample node set of a first node from multiple nodes, and construct a negative sample node set, the first similarity between the nodes in the positive sample node set and the first node is higher than the first similarity between the nodes in the negative sample node set and the first node, and the first node is any one of the multiple nodes in each event; calculate the pairwise comparison loss value corresponding to the first node through the first similarity between the first node and the nodes in the positive sample node set, and the similarity between the first node and the nodes in the negative sample node set.

In one possible implementation, a construction module is specifically used to: obtain a temperature coefficient, where the temperature coefficient is related to the similarity between the nodes in the negative sample node set and the first node; and calculate the pairwise comparison loss value corresponding to the first node in combination with the temperature coefficient through the first similarity between the first node and the nodes in the positive sample node set, and the similarity between the first node and the nodes in the negative sample node set.

In a possible implementation, the abnormal event detection model further includes a multivariate interaction module, which is used to Nodes are clustered to obtain at least one category, and the similarity between each node in the event and at least one category is obtained. The similarity is used to indicate the abnormality degree of the corresponding event;

The construction module is also used to obtain the second similarity between at least one node among multiple nodes in each event and the identifier node through the multivariate interaction module, the identifier node includes the central node of each event or a node obtained by fusing multiple nodes; calculate the second loss value according to the second similarity between at least one node and the identifier node; update the abnormal event detection model according to the second loss value to obtain the updated abnormal event detection model.

In a possible implementation, the multivariate interaction module is further used to cluster multiple nodes in each event to obtain at least one category;

The construction module is specifically used to: replace the first node with the second node, the first node is one of the points in the first event, and the second node has the same attributes as the first node but a different category; obtain the third similarity between the second node and the identifier node; calculate the loss value according to the second similarity and the third similarity to obtain the second loss value.

In a possible implementation, the abnormal event detection model further includes an event comparison module, which is used to obtain similarities between events;

The construction module is specifically used to: filter out a positive sample set and a negative sample set corresponding to each event from multiple events; calculate a third loss value based on a fourth similarity between each event and the events in the positive sample set and a fifth similarity between each event and the events in the negative sample set; update the abnormal event detection model based on the third loss value to obtain an updated abnormal event detection model.

In one possible implementation, a construction module is specifically used to: obtain the number of shared nodes between each pair of events through an event comparison module; obtain at least one event whose number of shared nodes with a second event is greater than a first threshold, and obtain a positive sample set, where the second event is any one of multiple events; obtain at least one event whose number of shared nodes with the second event is not greater than the first threshold, and obtain a negative sample set.

In a possible implementation, the construction module is specifically used to: perform semantic recognition on each event through an event comparison module to obtain each event representation; and calculate the fourth similarity between events according to each event representation through the event comparison module.

In a possible implementation, the construction module is also used to: map the data corresponding to each node in each event in the second attribute heterogeneity graph to the same space to obtain a first data representation of each event in the same space; and construct an abnormal event detection model based on the first data representation.

In a possible implementation, the multiple events in the second attribute heterogeneity graph are used to represent: a financial transaction behavior of a user, a comment-posting behavior of a user, or an item transaction behavior of a user.

In a fifth aspect, the present application provides an abnormal event detection model, comprising: at least one of a node pair comparison module, a multivariate interaction module or an event comparison module, the node comparison module is used to obtain the similarity between nodes within an event, the multivariate interaction module is used to obtain the similarity between nodes within an event and event categories, and the event comparison module is used to obtain the similarity between events.

The abnormal event detection model can be used to execute the steps in the aforementioned first aspect or any optional implementation manner of the first aspect, which will not be repeated here.

In a sixth aspect, an embodiment of the present application provides an abnormal event detection model construction device, comprising: a processor and a memory, wherein the processor and the memory are interconnected via a line, and the processor calls the program code in the memory to execute the processing-related functions in the abnormal event detection model construction method shown in any one of the second aspects above. Optionally, the abnormal event detection model construction device can be a chip.

In a seventh aspect, an embodiment of the present application provides an abnormal event detection device, comprising: a processor and a memory, wherein the processor and the memory are interconnected via a line, and the processor calls a program code in the memory to execute the processing-related functions in the abnormal event detection method shown in any one of the first aspects above. Optionally, the abnormal event detection device can be a chip.

In the eighth aspect, an embodiment of the present application provides an abnormal event detection model construction device, which can also be called a digital processing chip or chip. The chip includes a processing unit and a communication interface. The processing unit obtains program instructions through the communication interface, and the program instructions are executed by the processing unit. The processing unit is used to perform functions related to processing as described in the second aspect or any optional embodiment of the second aspect.

In the ninth aspect, an embodiment of the present application provides an abnormal event detection device, which may also be referred to as a digital processing chip or chip. The chip includes a processing unit and a communication interface. The processing unit obtains program instructions through the communication interface, and the program instructions are executed by the processing unit. The processing unit is used to perform functions related to processing in the above-mentioned first aspect or any optional embodiment of the first aspect.

In the tenth aspect, an embodiment of the present application provides a computer-readable storage medium, including instructions, which, when executed on a computer, enables the computer to execute a method in any optional implementation of the first aspect or the second aspect above.

In the eleventh aspect, an embodiment of the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute a method in any optional implementation of the first aspect or the second aspect.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of a system architecture provided by the present application;

FIG2 is a schematic diagram of another system architecture provided by the present application;

FIG3 is a schematic diagram of another system architecture provided by the present application;

FIG4 is a flow chart of a method for constructing an abnormal event detection model provided by the present application;

FIG5 is a schematic diagram of the structure of an attribute heterogeneity graph provided by the present application;

FIG6 is a schematic diagram of the structure of another attribute heterogeneity graph provided by the present application;

FIG7 is a schematic diagram of a structure of star-structured data provided by the present application;

FIG8 is a flow chart of an abnormal event detection method provided by the present application;

FIG9 is a schematic diagram of another system architecture provided by the present application;

FIG10 is a flow chart of another abnormal event detection model construction method provided by the present application;

FIG11 is a flow chart of another abnormal event detection method provided by the present application;

FIG12 is a schematic diagram of the structure of a common event detection model building device provided by the present application;

FIG13 is a schematic diagram of the structure of an abnormal event detection device provided by the present application;

FIG14 is a schematic diagram of the structure of another common event detection model building device provided by the present application;

FIG15 is a schematic diagram of the structure of another abnormal event detection device provided by the present application;

FIG16 is a schematic diagram of the structure of a chip provided in the present application.

Detailed ways

The following will describe the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

In various scenarios such as work or life, each user's behavior will be associated with some entities or generate some data. A user's behavior or the data generated by the behavior can be regarded as an event. Usually, an event may include event element nodes with multiple attributes, and there may be complex interactions between nodes, thus forming an attributed heterogeneous information network (AHIN). And with the development of information technology, such as the booming development of social media, abnormal event detection in attributed heterogeneous information networks has become an important task.

However, in the daily interaction of users, behaviors or data that are not conducive to user safety may be generated, such as financial fraud, social platform trolls, or prohibited goods transactions. In order to improve user safety, abnormal events can be detected and identified.

In some scenarios, such as APE, neural networks can be used to detect abnormal events. By modeling the interaction patterns between event elements in an event, the overall abnormality of the event can be obtained. The input data includes a set of events, each of which is composed of category attributes. The model first passes the input through the embedding lookup layer to obtain the representation of each category attribute, then models the pairwise interaction scores between attributes, and finally weights all scores according to the interaction category to obtain the abnormality score of the entire event. The interaction score is in the form of vector dot product, and the higher the score, the more normal the interaction. By weighted summing the scores, the model can automatically learn the importance of different types of node interactions. Since the scores of all possible events need to be summed, the computational complexity is too large, so noise-contrastive estimation is used, that is, not all possible event scores are calculated, but approximated by sampling noise events. For noise events, a context-dependent noise event construction method is proposed, that is, for each event, a noise event is obtained by replacing another entity of the same type. By maximizing the score of normal events to optimize the final loss function, a normal event will have a higher score, while an abnormal event will have a lower score. However, this detection method is only suitable for simple category event anomaly detection (i.e., the representation of each event element is just a simple attribute such as a value), and only models The pairwise interactions between entities are far from sufficient to model the rich attributes and large number of complex interactions of different types of entities in attribute heterogeneous graphs.

For another example, taking AEHE as an example, in some scenarios, the second-order neighbor information of entities based on meta-path in heterogeneous graphs can be integrated on the basis of modeling the pairwise interaction patterns between event entities. Abnormal events are detected by combining attribute and structural anomalies. Its input is a set of events, each of which is represented by a meta-path in a heterogeneous graph. The model first linearly transforms the attribute features of the entity to obtain the representation of each entity, and then reconstructs the second-order neighbor matrix of each entity using an autoencoder to obtain the intermediate representation of the autoencoder, and then concatenates this intermediate representation with the entity representation to obtain the final representation of the entity. The autoencoder models structural anomalies, and the intermediate representation of the autoencoder is different for abnormal structures and normal structures. After obtaining the final representation of the entity, the pairwise interaction between entities is modeled by vector dot multiplication, and finally the pairwise interaction scores are weighted summed to obtain the final abnormal event score. The model uses the method of replacing one entity in the event to obtain abnormal events, and the loss function includes autoencoder reconstruction loss, event score loss and regularization loss. By minimizing the loss function to maximize the score of normal events, a normal event will have a higher score, while an abnormal event will have a lower score. However, this detection method defines abnormal events as meta-path instances in heterogeneous graphs, but heterogeneous graphs contain more complex events (such as network pattern instances), which may be more common in users' lives. Detecting only abnormal events based on meta-paths cannot be extended to detecting richer events. Moreover, this scheme only models the pairwise interaction anomalies between entities, which is far from enough for modeling complex interactions in heterogeneous graphs. At the same time, the method of reconstructing global high-order neighbors is difficult to extend to dense large-scale graphs, and cannot fully utilize the local structural information of heterogeneous graphs.

Although the detection of abnormal events has attracted widespread attention from users, existing abnormal event detection methods mainly focus on modeling simple interactions between entities in a single event. However, events in common scenarios may contain multiple types of entities with rich attributes, as well as complex interactions between these entities, forming an attributed heterogeneous information network (AHIN). Detecting abnormal events in attribute heterogeneous graphs is a more general problem.

Therefore, the following problems need to be solved urgently:

How to model complex event patterns in AHIN. Events in AHIN contain different types of rich attribute nodes, which constitute a complete semantic unit. The interactions between these nodes are more complex. For example, the event of publishing a paper is associated with many types of attribute nodes, so that the interactions between nodes are not limited to structural interactions (e.g., authors write papers), but meaningful semantic interactions (e.g., authors specializing in data mining collaborate with radiologists to write text processing papers). Therefore, in addition to simple pairwise interaction anomaly patterns, there are more complex and diverse anomaly patterns in AHIN. In this regard, the present application proposes a general framework to model events in AHIN and fully consider various anomaly patterns.

How to detect abnormal events in AHIN without supervision. Due to the scarcity of anomalies and the high cost of the labeling process, the method provided in this application performs abnormal event detection in an unsupervised manner, that is, this application has no prior knowledge of abnormal events. In addition, unlike most abnormal event detection methods that only need to collect normal events for training, the training set set in this application includes abnormal events. That is, the abnormal event detection model must derive normal patterns from AHIN containing abnormal events without any supervision. Therefore, the key to abnormal event detection in AHIN is to make full use of valuable information in existing samples. Inspired by the previous detection of abnormal nodes in homogeneous graphs, some existing methods can directly model the normal patterns between nodes and their context nodes. However, this method is not enough to fully capture the complex event interaction patterns in AHIN, nor is it enough to measure the degree of abnormality in an unsupervised manner. An appropriate abnormal event scoring function is required, which should be able to truly reflect the degree of abnormality of the event.

Therefore, the present application provides a method for constructing an abnormal event model based on contrastive learning and an abnormal event detection method. The abnormal event detection model can be constructed based on AHIN and contrastive learning, more complex events can be detected, abnormal events can be accurately identified, and it can be applied to a variety of scenarios with very strong generalization ability.

The method provided in this application can be applied to artificial intelligence (AI) scenarios. AI is a theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a branch of computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that the machines have the functions of perception, reasoning and decision-making. Research in the field of artificial intelligence includes robotics, natural language processing, computer vision, decision-making and reasoning, human-computer interaction, recommendation and search, basic AI theory, etc.

First, the overall workflow of the artificial intelligence system is described. Next, the above artificial intelligence theme framework is explained from two dimensions: "intelligent information chain" (horizontal axis) and "IT value chain" (vertical axis). Among them, the "intelligent information chain" reflects the process from data acquisition to processing. A series of processes. For example, it can be a general process of intelligent information perception, intelligent information representation and formation, intelligent reasoning, intelligent decision-making, intelligent execution and output. In this process, data undergoes the condensation process of "data-information-knowledge-wisdom". The "IT value chain" reflects the value that artificial intelligence brings to the information technology industry from the underlying infrastructure of human intelligence, information (providing and processing technology implementation) to the industrial ecological process of the system.

(1) Infrastructure

The infrastructure provides computing power support for the artificial intelligence system, enables communication with the outside world, and is supported by the basic platform. It communicates with the outside world through sensors; computing power is provided by smart chips (CPU, NPU, GPU, ASIC, FPGA and other hardware acceleration chips); the basic platform includes distributed computing frameworks and networks and other related platform guarantees and support, which can include cloud storage and computing, interconnected networks, etc. For example, sensors communicate with the outside world to obtain data, and these data are provided to the smart chips in the distributed computing system provided by the basic platform for calculation.

(2) Data

The data on the upper layer of the infrastructure is used to represent the data sources in the field of artificial intelligence. The data involves graphics, images, voice, text, and IoT data of traditional devices, including business data of existing systems and perception data such as force, displacement, liquid level, temperature, and humidity.

(3) Data processing

Data processing usually includes data training, machine learning, deep learning, search, reasoning, decision-making and other methods.

Among them, machine learning and deep learning can symbolize and formalize data for intelligent information modeling, extraction, preprocessing, and training.

Reasoning refers to the process of simulating human intelligent reasoning in computers or intelligent systems, using formalized information to perform machine thinking and solve problems based on reasoning control strategies. Typical functions are search and matching.

Decision-making refers to the process of making decisions after intelligent information is reasoned, usually providing functions such as classification, sorting, and prediction.

(4) General capabilities

After the data has undergone the data processing mentioned above, some general capabilities can be further formed based on the results of the data processing, such as an algorithm or a general system, for example, translation, text analysis, computer vision processing, speech recognition, image recognition, etc.

(5) Smart products and industry applications

Smart products and industry applications refer to the products and applications of artificial intelligence systems in various fields. They are the encapsulation of the overall artificial intelligence solution, which productizes intelligent information decision-making and realizes practical applications. Its application areas mainly include: smart terminals, smart transportation, smart medical care, autonomous driving, smart cities, etc.

First of all, the method provided in this application involves concepts related to machine learning. To facilitate understanding, some of the concepts involved are first explained.

(1) Machine learning: Build a statistical model, use optimization methods to fit model parameters on sample data, and make predictions on new sample data.

A machine learning task usually includes a training part and a prediction part. In the prediction part, the parameters of the statistical model can be used to predict the training sample data, and the update direction of the parameters of the statistical model is calculated based on the prediction error. The process is repeated until the parameters converge. In the prediction part, the trained model can be used to predict new samples.

(2) Contrastive learning

Contrastive learning is a type of self-supervised learning. Positive and negative samples can be compared in feature space to learn the features of the samples. Using this method, machine learning models can be trained to distinguish between similar and different data sample images. The internal workings of contrastive learning can be expressed as a score function, which is a measure of the similarity between two features.

(3) Loss Function

It can also be called cost function, a measure of the interpolation between positive and negative samples, that is, it is used to measure the difference between the model's prediction output for positive samples and the prediction output for negative samples. The loss function can usually include mean square error, cross entropy, logarithm, exponential loss functions, etc. For example, the mean square error can be used as the loss function, defined as mse = The specific loss function can be selected according to the actual application scenario.

(4) Back propagation (BP):

An algorithm that calculates the gradient of model parameters based on the loss function and updates the model parameters. The error back propagation algorithm can be used to correct the size of the parameters in the initial network model during the training process, so that the reconstruction error loss of the model becomes smaller and smaller. Specifically, the forward transmission of the input signal to the output will generate error loss, and the error loss information is back-propagated to update the parameters in the initial model, so that the error loss converges. The back propagation algorithm is a back propagation movement dominated by error loss, aiming to obtain the optimal model parameters, such as the weight matrix.

(5) Gradient: The derivative vector of the loss function with respect to the parameters.

The method provided in the present application can be applied to a variety of abnormal event detection scenarios. The abnormal event model construction method provided in the present application can be deployed on a server, such as a cloud server or a local server, and the constructed abnormal event detection model can be deployed on the client or on the cloud. When the abnormal event detection model is deployed on the client, the user can directly request abnormal event detection on the client, and the client can obtain the data generated by the user behavior to perform abnormal event detection. When the abnormal event detection model is deployed on the cloud, the user can request the cloud to perform abnormal event detection through the client, and the cloud obtains the data generated by the user behavior to perform abnormal event detection.

The recommendation method provided in the embodiment of the present application can be executed on a server or on a terminal device. The terminal device can be a mobile phone with image processing function, a tablet personal computer (TPC), a media player, a smart TV, a laptop computer (LC), a personal digital assistant (PDA), a personal computer (PC), a camera, a video camera, a smart watch, a wearable device (WD) or an autonomous driving vehicle, etc., and the embodiment of the present application does not limit this.

The following introduces the system architecture provided by the embodiments of the present application.

Referring to FIG. 1 , an embodiment of the present application provides a system architecture 200 . As shown in the system architecture 200 , a data acquisition device 260 can be used to collect training data. After the data acquisition device 260 collects the training data, the training data is stored in a database 230 , and the training device 220 trains the abnormal event detection model 201 based on the training data maintained in the database 230 .

The following describes how the training device 220 obtains the abnormal event detection model 201 based on the training data. Exemplarily, the training device 220 constructs the abnormal event detection model based on the attribute heterogeneity graph, and updates the parameters of the abnormal event detection model through comparative learning, thereby completing the training of the abnormal event detection model 201. For a detailed description, see the training method below.

The abnormal event detection model 201 in the embodiment of the present application can specifically be a neural network. It should be noted that in actual applications, the training data maintained in the database 230 does not necessarily all come from the collection of the data acquisition device 260, and may also be received from other devices. It should also be noted that the training device 220 does not necessarily train the abnormal event detection model 201 based entirely on the training data maintained by the database 230, and may also obtain training data from the cloud or other places for model training. The above description should not be used as a limitation on the embodiments of the present application.

The abnormal event detection model 201 obtained by training the training device 220 can be applied to different systems or devices, such as the execution device 210 shown in FIG1 . The execution device 210 can be a terminal, such as a mobile phone terminal, a tablet computer, a laptop computer, augmented reality (AR)/virtual reality (VR), a vehicle terminal, a television, etc., and can also be a server or a cloud. In FIG1 , the execution device 210 is configured with a transceiver 212, which can include an input/output (I/O) interface or other wireless or wired communication interfaces, etc., for data interaction with external devices. Taking the I/O interface as an example, a user can input data to the I/O interface through the client device 240.

When the execution device 210 preprocesses the input data, or when the computing module 211 of the execution device 210 performs calculations and other related processing, the execution device 210 can call the data, code, etc. in the data storage system 250 for corresponding processing, and can also store the data, instructions, etc. obtained from the corresponding processing into the data storage system 250.

Finally, the I/O interface returns the processing result to the client device 240 for providing to the user.

It is worth noting that the training device 220 can generate a corresponding abnormal event detection model 201 based on different training data for different goals or different tasks. The corresponding abnormal event detection model 201 can be used to achieve the above goals or complete the above tasks, thereby providing the user with the desired results.

In the case shown in FIG. 1 , the user can manually input the data, which can be operated through the interface provided by the transceiver 212. In another case, the client device 240 can automatically send the input data to the transceiver 212. If the client device 240 is required to automatically send the input data, the user can set the corresponding permissions in the client device 240. The user can The device 240 checks the result output by the execution device 210, and the specific presentation form can be a specific method such as display, sound, action, etc. The client device 240 can also be used as a data collection terminal to collect the input data of the input transceiver 212 and the output result of the output transceiver 212 as shown in the figure as new sample data, and store them in the database 230. Of course, it is also possible to collect without going through the client device 240, and the transceiver 212 directly stores the input data of the input transceiver 212 and the output result of the output transceiver 212 as new sample data in the database 230.

It is worth noting that FIG1 is only a schematic diagram of a system architecture provided in an embodiment of the present application. The positional relationship between the devices, components, modules, etc. shown in the figure does not constitute any limitation. For example, in FIG1, the data storage system 250 is an external memory relative to the execution device 210. In other cases, the data storage system 250 can also be placed in the execution device 210.

Exemplarily, the system architecture of the application of the abnormal event detection model construction method provided by the present application can be shown in Figure 2. In the system architecture 300, the server cluster 310 is implemented by one or more servers, and optionally, cooperates with other computing devices, such as data storage, routers, load balancers and other devices. The server cluster 310 can use the data in the data storage system 250, or call the program code in the data storage system 250 to implement the steps of the abnormal event detection model construction method provided by the present application.

Users can operate their respective user devices (e.g., local device 301 and local device 302) to interact with server cluster 310. Each local device can represent any computing device, such as a personal computer, a computer workstation, a smart phone, a tablet computer, a smart camera, a smart car or other type of cellular phone, a media consumption device, a wearable device, a set-top box, a game console, etc.

The local device of each user can interact with the server cluster 310 through a communication network of any communication mechanism/communication standard, and the communication network can be a wide area network, a local area network, a point-to-point connection, or any combination thereof. Specifically, the communication network may include a wireless network, a wired network, or a combination of a wireless network and a wired network. The wireless network includes, but is not limited to: a fifth-generation mobile communication technology (5th-Generation, 5G) system, a long-term evolution (long term evolution, LTE) system, a global system for mobile communication (global system for mobile communication, GSM) or a code division multiple access (code division multiple access, CDMA) network, a wideband code division multiple access (wideband code division multiple access, WCDMA) network, wireless fidelity (wireless fidelity, WiFi), Bluetooth (bluetooth), Zigbee protocol (Zigbee), radio frequency identification technology (radio frequency identification, RFID), long-range (Lora) wireless communication, and near-field wireless communication (NFC) Any one or more combinations. The wired network may include an optical fiber communication network or a network composed of coaxial cables, etc.

In another implementation, one or more aspects of the execution device 210 may be implemented by each local device. For example, the local device 301 may provide local data or feedback calculation results to the execution device 210 .

It should be noted that all functions of the execution device 210 can also be implemented by the local device. For example, the local device 301 implements the functions of the execution device 210 and provides services to its own user, or provides services to the user of the local device 302.

For example, the application scenario of the method provided in this application can be seen in FIG3 .

An abnormal event detection model can be built and trained in the server, and the trained abnormal event detection model can be sent and deployed on the client. The user can enter an abnormal event detection request in the client, that is, request the client to detect the data generated by the user behavior to identify whether there is an abnormal event. The client can read data related to user behavior, such as reading data generated by user behavior uploaded by the user terminal, reading user log data stored in the server, or reading data generated by user behavior stored by itself, etc., and construct an attribute heterogeneity graph for the read data, so as to represent the entities involved in the user behavior and the association relationship between entities through the attribute heterogeneity graph, wherein the user-related entities or other associated information in the generated events can be used as event elements, and the attribute heterogeneity graph is used as the input of the abnormal event detection model to detect abnormal events, and output the detected abnormal events. For example, in the task of financial fraud detection, the abnormal event of user cashing out can be detected; in the task of detecting the water army on the social platform, the event of malicious comments by the water army can be detected; in the task of detecting contraband, the malicious event of sellers selling contraband can be detected, etc.

For example, for financial fraud detection tasks, events can be used to describe users and user-related operations (such as transferring money, logging into devices, etc.), indicating a user's financial transaction behavior. Given a series of transaction events, the method provided by this application can be used to model this abnormal event pattern, that is, to build an abnormal event detection model. For example, a user logs in to a computer that the user does not log in frequently, or makes an unusual large transaction, which may be an abnormal event. Through the abnormal event detection model provided by this application, the abnormality score of such events is relatively high.

Another example is the task of detecting water army on social platforms. Usually, social platforms are full of water army, that is, users who make profits by posting malicious comments to mislead buyers. In this type of task, an event can be defined as a user posting a comment. The associated elements include user, comment, Social platforms, etc. Given a series of events, the method provided by the present application can construct an attribute heterogeneous graph using the relationships in the social network, thereby deeply mining abnormal patterns in the attribute heterogeneous graph and better helping to detect water army.

For example, for the contraband detection task, usually in e-commerce platforms, merchants will illegally sell some contraband for profit, such as selling wild protected animals or banned drugs. Merchants can define product listing events, and other elements can also include users, etc., to form an attribute heterogeneous graph. Using the method provided by this application, complex abnormal buying and selling patterns can be captured, thereby detecting abnormal buying and selling events and improving the accuracy of contraband detection.

The method provided in this application is introduced below in conjunction with the aforementioned application scenarios.

The steps of the method provided in the present application can be divided into a training part and a reasoning part, wherein the training part is to construct and train an abnormal event detection model, and in the reasoning part, abnormal events can be detected by the abnormal event detection model obtained in the training part.

For ease of understanding, the training part and the reasoning part are introduced separately below. The training part is the abnormal event detection model construction method provided by the present application, and the reasoning part is the abnormal event detection method provided by the present application.

1. Training

First, refer to FIG4 , which is a flowchart of a method for building an abnormal event detection model provided in the present application.

401. Obtain an attribute heterogeneity graph.

The attribute heterogeneity graph may include data corresponding to multiple events, that is, it can be used to represent multiple events. The attribute heterogeneity graph may include multiple nodes and associations between the multiple nodes. Each event includes at least two nodes and associations between the at least two nodes. Each node in each event may include information of an event element that forms the event. For ease of distinction, the attribute heterogeneity graph used in the training part is called the second attribute heterogeneity graph.

The data of multiple events may include data generated by user behavior, and the data generated by each behavior can be called the data of an event. For example, the data generated by a user's financial transaction, an operation such as transfer, login or transaction can be called an event, and the nodes in the event can include the user, transfer operation, amount, etc.; for example, the data generated by a user's comment, an event can be defined as a user posting a comment, and the nodes in the event can include information such as the user, comment content, comment platform, etc.; for example, the data generated by a user's purchase of items, such as a purchase or additional purchase can be defined as an event, and the nodes in the event can include the user, the purchased or additional items, the additional purchase or purchase time, quantity, etc.

Optionally, in order to facilitate subsequent model construction, each node of each event in the second attribute heterogeneity graph can be mapped to the same space to obtain a data representation of the node of each event in the same space. For the sake of distinction, the data representation of the training part is referred to as the first data representation. Therefore, in the implementation of the present application, before modeling, the input data can be mapped to the same space to unify the data dimension so that subsequent modeling can be performed based on data of the same dimension, thereby improving modeling efficiency.

For example, an attribute heterogeneous graph is defined as Include node collection and an edge set ε, each edge in the edge set can be used to represent the association relationship between nodes. The attribute heterogeneous graph can also include an attribute matrix X∈R ^|V|×k . An attribute heterogeneous graph is also associated with a node type mapping function φ: and an edge type mapping function association, and Represents a predefined set of node and edge types, satisfying FIG5 shows an example of an AHIN of a citation network. It consists of three types of attribute nodes (i.e., author, paper, and conference) and their rich interactions (e.g., author writes a paper). As shown in FIG5, taking the publication of a paper by a user as an example, the attribute heterogeneity graph may include multiple events, and each event may include nodes of multiple attribute types, i.e., author, paper, and conference, as well as interactions between nodes, such as an author writing a paper as an edge. The network model (as shown in FIG6) specifies the type constraints of a set of nodes and their relationships. Generally, a star-shaped model network is a commonly used network structure. Under the guidance of the star network model, a model instance can be extracted from AHIN. That is, in the method provided by the present application, the data structure of the data required for input can refer to the data structure shown in FIG6, that is, each event can determine a central node, and the remaining nodes can be represented as nodes corresponding to the contextual semantics. FIG7 shows an example of an event, showing that a star-shaped model instance forms a complete semantic unit (i.e., publishing a paper). Therefore, the present application can use a star-shaped model instance to represent events in AHIN.

402. Construct an abnormal event detection model based on attribute heterogeneity graph.

After obtaining the second attribute heterogeneity graph, comparative learning can be performed based on the nodes and associations of each event included in the second attribute heterogeneity graph to construct an abnormal event detection model for abnormal event detection. The abnormal event detection model can identify abnormal events based on the similarity between nodes within an event or the similarity between events.

In the implementation of the present application, an abnormal event detection model can be constructed based on the attribute heterogeneity graph. The attribute heterogeneity graph can represent complex events, so the method provided by the present application can model more complex events, and can also perform abnormal identification for complex events, accurately identify abnormal events, and can adapt to a variety of application scenarios with strong generalization ability.

Specifically, an initial model may be constructed first, and then the second attribute heterogeneity graph may be used for comparative learning to obtain a trained abnormal event detection model.

Optionally, the abnormal event detection model includes one or more of the following modules: a node pair comparison module, a multivariate interaction module or an event comparison module, etc. The node comparison module can be used to obtain the similarity between nodes within an event, the multivariate interaction module can be used to cluster the nodes in the event and obtain the similarity between the nodes within the event and the event category, and the event comparison module can be used to obtain the similarity between events.

The training process of each module is introduced below.

1. Node comparison module

If the abnormal event detection includes a node pair comparison module, the multiple nodes in each event can be combined into at least one node pair, such as combining every two nodes into a node pair. The similarity between each pair of node pairs can be obtained through the node pair comparison module, which is called the first similarity for the convenience of distinction. The first similarity can be used to measure the degree of abnormality of the event. For example, the higher the similarity, the lower the degree of abnormality of the event, and the lower the similarity, the higher the degree of abnormality of the event. Subsequently, the pairwise comparison loss value of each pair of node pairs is obtained according to the similarity of each pair of node pairs, and the abnormal event detection model is updated based on the pairwise comparison loss value of each pair of node pairs to obtain an updated abnormal event detection model.

Optionally, the method of calculating the pairwise contrast loss value corresponding to each node may include: taking the calculation method of any node as an example, in order to facilitate the distinction of the first node, a positive sample node set of the first node is selected from multiple nodes, and a negative sample node set is constructed, such as selecting nodes in other events to join the negative sample node set. The first similarity between the nodes in the positive sample node set and the first node is higher than the first similarity between the nodes in the negative sample node set and the first node; the pairwise contrast loss value of the first node is calculated by the first similarity between the first node and the nodes in the positive sample node set, and the similarity between the first node and the nodes in the negative sample node set. In the implementation manner of the present application, a positive sample node set and a negative sample node set can be constructed for each node, such as taking a node with high similarity to each node as a positive sample node, and a node with low similarity to each node as a negative sample of each node, thereby realizing contrast learning through the positive sample node and the negative sample node of each node, and realizing unsupervised learning.

Optionally, the pairwise contrast losses of multiple node pairs in multiple events can be fused to obtain a loss value for the overall model output, which is called the first loss value for easy distinction. The first loss value is used to reversely update the abnormal event detection model to obtain an updated abnormal event detection model.

In some scenarios, there may be a situation where the similarity between the negative sample of the node and the node is too high. This kind of negative sample is usually called a difficult sample. Difficult samples will greatly increase the difficulty of identifying abnormal events, such as the situation where the negative sample node may be classified as a positive sample node set. The present application can set a temperature coefficient to adjust the attention paid to difficult samples. That is, when calculating the paired contrast loss, the temperature coefficient can be combined for calculation, so as to further reduce the influence of difficult samples on the loss value. For example, when calculating the paired contrast loss value, the similarity can be divided by the temperature coefficient. Generally, the smaller the temperature coefficient, the more attention is paid to distinguishing the current sample from similar negative samples, thereby improving the accuracy of identifying abnormal events.

Therefore, in the implementation mode of the present application, the abnormal event detection model may include a module for determining abnormal conditions between nodes in an event. During the training process, the loss value may be calculated based on the output result of the node pair comparison module, thereby learning abnormal node pairs in the event, so that the model can identify abnormal conditions between nodes in the event, thereby accurately identifying abnormal events.

2. Multiple interactive modules

If the abnormal event detection model includes a multivariate interaction module, the corresponding training process may include:

The identifier node can be obtained through the multivariate interaction module, and the similarity between one or more nodes in the event and the identifier can be obtained, which is called the second similarity for easy distinction. Then, the corresponding loss value can be calculated based on the second similarity, which is called the second loss value for easy distinction. Then, the abnormal event detection model is reversely updated based on the second loss value to obtain an updated abnormal event detection model.

Specifically, the central node of each event can be used as the identifier node, or multiple nodes of each event can be fused to obtain an identifier node, such as clustering the nodes in each event to obtain at least one category, and selecting a node in one of the categories as the identifier node. Identifier nodes, such as the cluster center or the node closest to the center, are used as identifier nodes; then the similarity between each node in the event and the identifier node is calculated, and the similarity can be used to indicate the abnormality of each node. The higher the similarity, the lower the abnormality of the event. If the similarity is lower, the abnormality of the event is higher. Then the loss value corresponding to each node can be calculated based on the similarity, and the event detection model is reversely updated based on the loss value to obtain an updated abnormal event detection model.

Optionally, in order to achieve contrastive learning, the present application can construct negative samples, so as to perform contrastive learning based on positive samples and constructed negative samples. Specifically, the method of calculating the second loss value can include, taking any event (referred to as the first event for ease of understanding) as an example, replacing the first node in the first event with a second node, the second node has the same attributes as the first node but is in a different cluster (or is called a different category), thereby forming a negative sample; calculating the similarity between the second node and the identifier, which is referred to as the third similarity for ease of distinction, and calculating the loss value based on the second similarity and the third similarity to obtain a second loss value.

In the implementation mode of the present application, negative samples can be constructed by replacing the same type but different clusters to calculate the loss value between positive samples and negative samples, and the abnormal event detection model can be updated according to the loss value, thereby realizing contrastive learning. This is equivalent to realizing contrastive learning by constructing negative samples to obtain an updated abnormal event detection model, thereby realizing unsupervised learning.

In addition, the multivariate interaction module can use a scoring function to calculate the third similarity. For example, a bilinear scoring function can be used to construct a model based on the similarity between the identifier node and the context node, in which a first linear transformation layer is set. When the abnormal event detection model is reversely updated, the parameters of the first linear transformation layer also need to be updated, so that the similarity value output by the multivariate interaction module is more accurate.

3. Event comparison module

If an event comparison module is provided in the abnormal event detection model, the event comparison module can be used to output the similarity between events. Specifically, in the embodiment of the present application, the event comparison module can be used to screen the positive sample set corresponding to each event and output the similarity between the positive samples corresponding to each event.

The training process of the event comparison module may specifically include:

The positive sample set and negative sample set corresponding to each event are screened out, and then the loss value is calculated according to the fourth similarity between each event and the events in the corresponding positive sample set and the fifth similarity between the event and the events in the corresponding negative sample set, which is called the third loss value for easy distinction; then the abnormal event detection model is reversely updated according to the third loss value to obtain an updated event detection model. Therefore, in the implementation of the present application, unsupervised learning can be achieved by constructing a positive sample set and a negative sample set for each event for comparative learning.

Optionally, the method of screening the positive sample set and the negative sample set may specifically include: calculating the number of shared nodes between events, and screening the positive sample set and the negative sample set corresponding to each event from multiple events according to the number of shared nodes. Taking any event as an example, in order to facilitate the distinction of the second event, at least one event whose number of shared nodes with the second event is greater than a first threshold is obtained to obtain a positive sample set, and the second event is any event among the multiple events; at least one event whose number of shared nodes with the second event is not greater than the first threshold is obtained to obtain a negative sample set.

Optionally, calculating the similarity between events may include multiple methods, such as extracting features of the events, calculating the similarity between the features, and using the similarity between the features as the similarity between the events.

In addition, positive samples and negative samples can also be screened by the similarity between events, such as taking events whose similarity with the second event is higher than a second threshold as positive samples to obtain a positive sample set, and taking events whose similarity with the second event is not higher than the second threshold as a negative sample set, etc.

Of course, the similarity between events can also be measured by the number of shared nodes between events. For example, the fourth similarity can be positively correlated with the number of shared nodes, that is, the more shared nodes there are, the higher the similarity between events.

Furthermore, the specific method of calculating the third loss value can be expressed as follows: taking the second event as an example, the similarity between the second event and the samples in the positive sample set can be output through the event comparison module, which is called the fourth similarity for easy distinction. For example, a second linear transformation layer can be set in the event comparison module, and the similarity between the second event and the samples in the positive sample set is output through the second linear transformation layer. It is also possible to combine the first linear transformation layer set in the aforementioned multivariate comparison module to output the similarity between the second event and the samples in the negative sample set, which is called the fifth similarity for easy distinction. The loss value is then calculated based on the fourth similarity and the fifth similarity to obtain the third loss value. In the process of updating the event detection model, the first linear transformation layer and the second linear transformation layer may be updated.

In addition, if the multivariate comparison module is not set in the event detection model, the first linear transformation layer can be set and trained separately, or the second linear transformation layer can be used to output the similarity between the second event and the samples in the negative sample set. The specific adjustment can be made according to the actual application scenario.

Therefore, in the process of constructing the abnormal event detection model provided by the present application, a positive sample set and a negative sample set corresponding to each event can be constructed, so as to perform comparative learning through the positive sample set and the negative sample set corresponding to each event to achieve unsupervised learning, so that the abnormal event detection model can combine the similarity between events to accurately identify whether an event is abnormal.

2. Reasoning

Among them, the reasoning part provided by this application can be deployed in the cloud, local server or local client, that is, the abnormal event detection method provided by this application can be implemented by the cloud, local server or local client. When deployed in the cloud, the user can interact with the cloud through the local client. In the following implementation of this application, the user interacts with the client as an example for exemplary introduction.

Referring to FIG8 , a flow chart of an abnormal event detection method provided by the present application is as follows.

801. Obtain an attribute heterogeneity graph.

The attribute heterogeneity graph may include multiple nodes and associations between the multiple nodes. The attribute heterogeneity graph may be used to represent at least one event, and each event may include at least two nodes and associations between the at least two nodes. Each node in each event may include information forming an event element of the event. For ease of distinction, it is called the first attribute heterogeneity graph, which may be the same as or different from the aforementioned second attribute heterogeneity graph.

Typically, in the reasoning part, the user can request abnormal event detection through the client. Taking the method provided in this application deployed in the cloud as an example, the cloud can provide a server for the user through the client. After the user requests abnormal event detection on the client, the client sends the request to the cloud. After receiving the user request, the cloud can read the user's relevant data from the local based on the user request, or request the user's relevant data from the server, terminal or other device that stores the user data. The cloud can generate an attribute heterogeneity graph based on the received data, which can be called the first attribute heterogeneity graph for ease of distinction.

For example, user-related data may include data related to the user's financial operations. After the cloud receives an abnormal event detection request initiated by the user or merchant, it can request data from the device that stores the user data. After the cloud receives data sent by other devices, an attribute heterogeneity graph and a corresponding event set can be generated based on the received data. The attribute heterogeneity graph may include multiple types of nodes, such as user, operation type, transaction amount, operation time, login device or login time nodes, and the event set includes specific user information, operation type, transaction amount, operation time, login device or login time information. There is a mapping relationship between the event set and the nodes in the attribute heterogeneity graph, so that the data generated by the user's financial operation behavior is represented by the attribute heterogeneity graph, the event set and the mapping relationship.

In addition, the cloud can also automatically generate a request for abnormal event detection for one or more users, and request data from a device that stores the data of the one or more users. The cloud can generate an attribute heterogeneity graph and a corresponding event set based on the received data. The attribute heterogeneity graph includes multiple types of nodes, and the attribute heterogeneity graph has a mapping relationship with the events in the event set.

For example, a water army detection task can be performed on social platforms. Usually, social platforms are full of water armies, which mislead users by posting malicious comments. Therefore, a social platform can initiate an abnormal event detection request. After receiving the request, the cloud can collect comments posted by multiple users on the social platform and generate an attribute heterogeneity graph. The attribute heterogeneity graph can include multiple nodes, such as users, posting time, login devices, or comment content, etc. as nodes; accordingly, the information of one or more users, the time of posting comments, the information of login devices, or the content of comments, etc. are collected to obtain an event set.

In an optional implementation, after obtaining the attribute heterogeneity graph and the corresponding event set, the event data in the event set can be mapped to the attribute heterogeneity graph, thereby mapping the specific information of the event to each node. This is equivalent to mapping the specific data of each event to the same space, unifying the dimensions of each event, and obtaining the data representation of each event in the same distribution, so that abnormal events can be identified based on the data in the same space in the future.

802. Using the attribute heterogeneity graph as an input of an abnormal event detection model to obtain an output result.

After obtaining the first attribute heterogeneity graph, the attribute heterogeneity graph and the corresponding specific data of each event represented can be used as the input of the abnormal event detection model to obtain the output result, which can be used to indicate whether each event in the input data is abnormal. Including abnormal events, abnormal events can be determined by the similarity between events calculated by the abnormal event detection model or the similarity between nodes in the event.

The abnormal event detection model may specifically include the abnormal event detection model learned through the steps corresponding to the aforementioned FIG. 4 , and the training process will not be described in detail herein.

Therefore, the abnormal event detection model provided by the present application can detect whether an event is abnormal by the similarity between events or the similarity between nodes within an event, so as to accurately identify abnormal events. Even in the case of complex events, such as a large number of nodes or a large number of events, abnormal events can be accurately identified, and the generalization ability is strong.

Specifically, the abnormal event detection model may include: at least one of a node pair comparison module, a multivariate interaction module, or an event comparison module. The node comparison module may be used to obtain the similarity between nodes in an event, the multivariate interaction module is used to obtain the similarity between nodes in an event and event categories, and the event comparison module is used to obtain the similarity between events.

The reasoning process of each module is introduced below.

1. Node pair comparison module

If the abnormal event detection model includes a node pair comparison module, the abnormality degree of each event can be output by the node pair comparison module. For the convenience of distinction, the abnormality degree output by the node pair comparison module is called the first abnormality degree. The node pair comparison module can be used to calculate the similarity between the node pairs in each event, and the first abnormality degree is calculated based on the similarity between the node pairs.

Specifically, the first abnormality degree can be calculated based on the similarity between one or more pairs of nodes with the lowest similarity in the event. For example, the similarity with the lowest value can be directly used as the value of the first abnormality degree, or the first abnormality degree can be obtained by weighted fusion of multiple nodes with the lowest similarity in the event.

In the implementation manner of the present application, the degree of abnormality of an event can be represented by the similarity between nodes. Therefore, whether an event is abnormal can be identified from the similarity between nodes within the event.

2. Multiple interactive modules

If the abnormal event detection model includes a multivariate interaction module, the abnormality degree of each event can be output through the multivariate interaction module. For the convenience of distinction, the abnormality degree output by the multivariate interaction module is called the second abnormality degree. Among them, the multivariate interaction module can be used to fuse multiple nodes in each event to obtain an identifier node, and other nodes in the event can be called context nodes. The abnormality degree of the event is measured by the similarity between each node and the identifier node to obtain the first abnormality degree. For example, the higher the similarity, the lower the abnormality degree, and the lower the similarity, the higher the abnormality degree.

Specifically, the multivariate interaction module may cluster multiple nodes in each event, classify the multiple nodes into one or more categories, and then determine a cluster center from the one or more categories as an identifier node.

Furthermore, the multivariate interaction module can calculate the degree of abnormality of an event by using a scoring function to calculate the similarity or compatibility between the identifier node and the context node. For example, a bilinear scoring function can be used to construct a model for calculating the degree of abnormality based on the identifier node and the context node.

In the implementation manner of the present application, the multivariate interaction module can calculate the degree of abnormality by identifying the similarity between the context node and the identification node, so that whether the event is abnormal can be measured from the dimension of the similarity between the node and the category, and abnormal events can be accurately identified.

3. Event comparison module

If the abnormal event detection model includes an event comparison module, the event comparison module can output the abnormality degree of the event by comparing the similarities between events, which is called the third abnormality degree for easy distinction.

Specifically, the event comparison module can be used to filter out the positive sample sets corresponding to each event from multiple events, and output the third abnormality degree corresponding to each event according to the similarity between each event and the events in the corresponding positive sample set.

Among them, the method of filtering out the positive sample set corresponding to each event from multiple events can specifically include: filtering out the events whose number of shared nodes with the current event is greater than a first threshold from the multiple events as positive samples with the current event, to obtain the positive sample set.

The event comparison module may calculate the degree of abnormality by performing semantic recognition on each event to obtain a representation of each event, and then calculating the similarity between each event and the events in the positive sample set based on the representation of each event, and calculating based on the similarity.

Specifically, a scoring function can be used to calculate the third abnormality degree, such as a bilinear scoring function can be used to calculate the third abnormality degree of each event. The third abnormality level. For example, a second linear transformation layer can be set in the event comparison module to calculate the abnormality level based on a bilinear function. When the abnormal event detection model is reversely updated, the parameters of the second linear transformation layer also need to be updated to make the similarity value output by the multivariate interaction module more accurate.

It should be understood that if one of the modules in the node pair comparison module, the multivariate interaction module or the event comparison module is set in the abnormal event detection model, the abnormal degree of the event output by the set module can be used as the output result. If at least two modules in the pair comparison module, the multivariate interaction module or the event comparison module are set in the abnormal event detection model, the abnormal degree output by the at least two modules can be fused to obtain the abnormal degree of each event after fusion, which is called the fourth abnormal degree for the convenience of distinction, and each event is judged to be an abnormal event according to the fourth abnormal degree of each event to obtain the final output result. The type and number of modules set in the abnormal event detection model can be selected according to the actual application scenario, and this application does not limit this. For example, if the node pair comparison module, the multivariate interaction module or the event comparison module is set in the abnormal event detection model, the first abnormal degree, the second abnormal degree and the third abnormal degree of each event can be mechanically weighted and fused to obtain the fourth abnormal degree, and each event can be judged to be an abnormal event according to the fourth abnormal degree of each event, such as identifying an event with a fourth abnormal degree higher than a preset value as an abnormal event, to obtain the output result.

Therefore, in the implementation of the present application, whether an event is abnormal can be identified by combining the similarity between nodes within the event, the similarity between nodes within the event and the identifier node, or the similarity between events. Therefore, even if the event is complex, such as each event has multiple nodes or nodes have multiple attributes, the abnormal event detection model provided by the present application can accurately identify the abnormal event, which has a very strong generalization ability.

The above describes the abnormal event detection model construction method and the abnormal event detection method process provided by the present application. For ease of understanding, in combination with specific application scenarios, the abnormal event detection model construction method and the abnormal event detection method process provided by the present application are further described in more detail.

The present application provides a new abnormal event detection framework (such as can be called AEHCL), that is, an abnormal event detection model based on hypergraph contrastive learning.

Specifically, events in AHIN are defined as star pattern instances, and the present application can further use the concept of hyperedges in the hypergraph to simulate complex interactions in events. The present application proposes a new hypergraph contrast learning method to fully capture complex and diverse abnormal patterns. Specifically, two contrast strategies are provided from the intra-event and inter-event levels. The intra-event contrast module focuses on mining abnormal patterns in events, and the module consists of two sub-modules. The pairwise contrast module captures pairwise interaction abnormal patterns, while the multivariate contrast module captures multivariate high-order interaction abnormal patterns. An event contrast module is also provided to model abnormal patterns between events, that is, situations where abnormal events are inconsistent with their contextual events. These modules are optimized simultaneously in an end-to-end manner and promote each other. In the training phase, a contrast-based abnormal event scoring function is provided to measure the degree of abnormality, which integrates the detection results of the above modules.

Therefore, this application defines events in attribute heterogeneous graphs as network pattern instances and further models them with hypergraphs, so that more complex interactions of abnormal elements in attribute heterogeneous graphs can be mined.

Exemplarily, the application architecture of the method provided in this application can be found in FIG9 .

First, obtain the attribute heterogeneity graph and the corresponding event set. The attribute heterogeneity graph can represent multiple events. The nodes included in each event and the association relationship between the nodes can be saved in the event set. Each event in the event set can be represented as a star topology graph. The attribute heterogeneity graph can be defined as a hypergraph. A hypergraph is a generalized graph in which an edge can connect any number of vertices. Each event is uniquely determined by the central node in the set, and the other nodes in the set are the context nodes of the event. For example, in e-commerce fraud detection, an event can be regarded as a transaction, the central node is the transaction device, and the context node is the event element involved in this transaction, such as users and products.

Subsequently, different types of node attributes are mapped to the same space and unified in dimension through linear transformation, which is used as the training set for training the abnormal event detection model. The training set is used to train the abnormal event detection model to obtain the trained abnormal event detection model.

The trained abnormal event detection model can be deployed in the cloud, server or client. For example, the model can be deployed in the client so that the client can calculate the abnormal event score to indicate the degree of abnormality of the event.

The abnormal event detection model constructed in this application can fully capture abnormal patterns in events, including intra-event and inter-event anomalies. Among them, the intra-event comparison module can include:

Paired comparison, that is, for each node, the positive samples are other nodes in the event, and the negative samples are nodes in other events.

Multivariate comparison, that is, for the central node of each event, the positive sample is the aggregated representation of the context nodes in this event, and the negative sample is constructed When , the nodes are first clustered, and then one or more nodes are selected for replacement with nodes from other clusters. The resulting context set is a negative sample.

The event comparison module first defines the neighbor events of an event, that is, the event with the largest number of meta-paths linking the nodes in two events. Then the set of neighbor events is used as the positive sample set, and the events with fewer meta-paths are negative samples.

Different from the existing scoring functions for abnormal nodes in homogeneous graphs, the abnormal event scoring function provided by this application needs to consider more complex abnormal patterns and various abnormalities, so the design is more complex. The abnormal event detection model provided by this application has low computational complexity and high universality, and can be applied to a variety of real-world attribute heterogeneous graph scenarios.

The following introduces the training part and the reasoning part respectively in combination with specific application scenarios.

1. Training

The training part can be divided into multiple steps, as shown in Figure 10.

1. Input

First, the input data for the training part is introduced.

For example, an event is defined as E = (e, C, X), which can be represented as a star schema instance in an attribute heterogeneous graph. It is the central node, which can be seen as an index of this event. is a context node, connected to the central node, and X∈R ^(1+|C|)×k is an attribute matrix. Figure 7 above shows an example of an event in a citation network. In this example, the central node is the paper node, which uniquely identifies a certain event of publishing a paper, and the context nodes are conferences and authors. In order to model the higher-order semantics of the event (for example, multiple authors co-authored a paper), the event is further modeled using a hypergraph, and all the nodes involved are studied as a whole. As shown in Figure 5 above, the event of publishing a paper is modeled by a hypergraph, and is thus associated with multiple types of nodes (i.e., papers, authors, and conferences). An event is abnormal if it exhibits a rare interaction pattern. Figure 5 above shows an abnormal collaboration event in a citation network. The event contains the semantics of a data mining expert collaborating with a radiologist to publish a paper, which rarely occurs, so it is considered an anomaly.

2. Entity attribute mapping

Since events contain multiple types of nodes (the node types used in Figures 5 to 7 are papers, authors, and conferences), directly using the original node representation for downstream tasks will usually degrade performance. Usually, if heterogeneous graph convolution is used, the aggregation operation may damage the original feature interaction pattern, resulting in a decrease in detection results. Therefore, this application directly converts each node representation to a shared latent space through a simple specific type conversion layer:
Z ^{( t )} = σ ( X ^{( t )} · W ^{( t )} + b ^{( t )} )

Here X ^(t) ∈R ^|V|×d is the original node feature, W ^(t) ∈Rd ^×h and b ^(t) ∈R1 ^×h are the transformation parameters of the t-type node. σ(·) represents the activation function. After the transformation, the h-dimensional representation of each node is in the same space, and z represents the representation set of the node.

3. Modeling.

Among them, the abnormal event detection model includes modules for identifying anomalies within events and identifying anomalies between events, which are introduced below.

(1) Paired comparison module

As a basic module for capturing the matching relationship of node pairs within an event, pairwise similarity is also used in many hypergraph representation learning methods. The basic basis behind it is that the matching degree of paired nodes in an event should be higher than that of other nodes, so incompatible abnormal node pairs can be found based on the similarity between node pairs, that is, node pairs with similarity below a certain value. First, the normal matching pattern of node pairs can be modeled, and then the node pairs that do not conform to the pattern are considered abnormal. If all pairwise interactions in the event are directly fused to obtain the event anomaly score, the degree of abnormality of the abnormal node pairs may be weakened.

In addition, in the pairwise contrast module, we focus on node pair anomalies rather than the entire event. We model the matching pattern of each node separately from other nodes. Specifically, for a single node v _i in the event, we optimize the following contrast loss:

Among them, sim(·) is the cosine similarity matching function, which can also be replaced by other similarity functions, that is, it represents the similarity between nodes, and exp(·) is an exponential function with the natural constant e as the base. _{z i} is the representation of node _vi . _{P i} and N _i are the positive sample set and Negative sample set. The role of the temperature coefficient τ is to adjust the degree of attention to difficult samples: the smaller the temperature coefficient, the more attention is paid to separating the current sample from the most similar other samples. Difficult samples can be understood as negative samples with high similarity to the current sample.

For a node _vi in event e, the positive sample node set _Pi = { _vj | _vj ∈e\ _vi }. We can randomly sample n nodes that do not belong to e as negative sample nodes. This simple negative sample sampling method has achieved good results. Some more complex sampling strategies are also demonstrated in subsequent experiments. Finally, we can add the contrast loss of all nodes in an event and the average loss of all events to get the final pairwise contrast loss, that is, the first loss value:

Then, the paired comparison module can be reversely updated based on the final paired comparison loss to obtain an updated paired comparison module. If the abnormal event detection model includes multiple modules, the results output by the multiple modules can be used to calculate the overall loss value, and the abnormal event detection model as a whole can be reversely updated to obtain an updated abnormal event detection model.

(2) Multiple Interaction Modules

More complex abnormal interactions in events can be identified through the multi-element interaction module provided in this application.

Even when paired interactions in an event are usually normal interactions, an event may be abnormal when interactions with more than two nodes are considered. The present application can use a multivariate comparison module to model such abnormal events. The module captures multivariate interaction patterns in events by modeling the compatibility between identifier nodes and context nodes (i.e., non-identifier nodes in events). Identifier nodes may include nodes fused from multiple nodes in an event, central nodes or clustering centers of an event, etc., and context nodes are nodes other than identifier nodes in an event. Typically, in normal node interactions, the compatibility of identifier nodes and context nodes is high, i.e., the similarity is high. For example, the content of a paper is highly correlated with the type of conference in which it is published and the interests of the author.

Specifically, for each node _vi in event e, we can first add a type embedding _ti , i.e., an identifier node, to obtain a type-aware node representation h _i :
_hi = z _i + _ti

Type embedding enables the model to capture the interactions between heterogeneous nodes, thereby capturing more meaningful interaction patterns. Then for the context node set in event e _i The above formula can be used to get their expression In order to model the multivariate interactions between the identifier node and the context node and obtain the final context representation c _i , this application can use the self-attention mechanism selfatt(·) followed by a maximum pooling layer:

Gets a representation of the context node associated with the identifier.

Subsequently, a bilinear scoring function can be used to model the compatibility between the identifier node and the context node, i.e., the second similarity:

Among them, _hi is the identifier node representation of event e _i , σ(·) is the sigmoid activation function, and _Wm is the linear transformation layer, that is, the first linear transformation layer mentioned above, which needs to be updated when performing reverse update. Usually, the score _si of normal events should be close to 1, while the score _si of abnormal events should be close to 0.

This application can use unsupervised learning, that is, there is no need to collect abnormal events as prior knowledge. However, negative samples can be constructed to achieve comparative learning. For example, the nodes in the current event can be replaced with other nodes, but the embedded nodes must not be too similar to the original nodes, such as not higher than the preset similarity, to avoid forming difficult samples.

For example, node clustering can be performed based on the original features of the nodes, and then for each type of context node, a node is randomly selected and replaced with another node with the same attribute type but a different cluster (i.e., a different category). Subsequently, the score s′ _i of the negative sample event is obtained through a bilinear function, and then the standard binary cross entropy (BCE) loss (of course, it can also be replaced by other loss functions) can be used as the multivariate contrast loss, i.e., the second loss value:

The abnormal event detection model can then be updated in reverse based on the multivariate contrast loss.

(3) Event comparison module

Abnormal event patterns may not only be limited to abnormal interactions of elements within an event, but also occur between events. Similar to mismatch anomalies between local nodes, mismatch anomalies also exist between local events. In general, normal events are more likely to have similar semantics with adjacent events, while abnormal events do not. Therefore, this application can use event-event contrastive learning to model the compatibility between adjacent events.

Specifically, this application first uses an attention layer to obtain event representation. Given an event e, a type-specific attention parameter P∈R ^h×h is applied to each context node _hi to obtain the key representation of the attention mechanism:

Then, the attention weight of node type t is calculated as follows:

Where z is the representation of the identifier node in the event, z _i is the representation of the identifier node in e _i , and the identifier node can refer to the introduction in the aforementioned multivariate interaction module. The context embedding can be obtained by the weighted sum of all context node embeddings and the learned weight α:

Concatenate the context embedding _hc and the identity node embedding z to obtain the event representation e:
e＝h _c ∥z

Next, define the set of adjacent events P(e) of e as its positive samples:
P(e)＝{ _ep | _ep |> _Tpos }

That is, when the number of shared nodes between two events exceeds the threshold T _pos , the two events are positive samples of each other. Similarly, when the number of shared nodes is less than the threshold T _neg , the negative sample set N(e) is defined. For the positive sample set P(e) and the negative sample set N(e), the following inter-event contrast loss, i.e., the third loss value, is set:

Among them, e _ip is sampled from P(e _i ), and e _in is sampled from N(e _i ). σ(·) is the activation function, W _inter is the linear transformation layer for abnormal event score evaluation in the event comparison module, that is, the second linear transformation layer, which is usually a matrix, and W _m is the linear transformation layer for abnormal event score evaluation in the aforementioned multivariate interaction module.

(4) Overall loss

During the training phase, the above three modules are optimized together. The overall optimization function can be expressed as:

Here, α, β and γ are parameters to adjust the impact of the three modules on the results, and they usually need to be updated when performing reverse updates. Specifically, they can be adjusted manually or according to other algorithms.

In the implementation manner of the present application, in the modeling process of the abnormal event detection model, there is no need to collect negative samples, and contrastive learning can be achieved by constructing negative samples, thereby achieving unsupervised learning. Among them, the abnormal event detection model is based on the mining of abnormal patterns within and between events through contrastive learning. First, for the intra-event contrastive learning task, the interaction anomalies of elements within the event are modeled; secondly, for the inter-event contrastive learning task, the contextual anomalies between events are modeled. Based on the above contrastive learning module, an abnormal event scoring function is finally provided, which provides a more accurate detection method for measuring the degree of abnormality of an event.

2. Reasoning

The method of detecting abnormal events in the inference stage is similar to the aforementioned training part. The difference is that there is no need to calculate the loss value in the inference stage. Each module can be used directly to output the detected similarity or abnormal value.

The structure and execution steps of the abnormal event detection model can be shown in Figure 11. For the reasoning stage, the events in the attribute heterogeneity graph can also be converted to the same space, and the converted data representation in the same space is used as the input of the abnormal event detection model to output the abnormal degree value for the event. Each stage is introduced below.

1. Input

The input data may refer to the input data in the description corresponding to the aforementioned FIG. 10 , which will not be described in detail here.

2. Entity attribute mapping

Similar to Figure 10 above, since events contain multiple types of nodes (the node types used in Figures 5 to 7 are papers, authors, and conferences), directly using the original node representation for downstream tasks will usually reduce performance. Usually, if heterogeneous graph convolution is used, the aggregation operation may damage the original feature interaction pattern, resulting in a decrease in detection results. Therefore, this application directly converts each node representation to a shared latent space through a simple specific type conversion layer:
Z ^{( t )} = σ ( X ^{( t )} · W ^{( t )} + b ^{( t )} )

3. Abnormality score

(1) Paired comparison module

The degree of anomaly can be expressed by identifying the similarity between nodes:
s _i =min(sim( _zi , _zj ))

Generally, the lower the similarity, the higher the abnormality, and the higher the similarity, the lower the abnormality. Therefore, in the subsequent abnormality measurement process, the abnormality can be expressed in the form of a negative number.

(2) Multiple Interaction Modules

Paired interactions in events are usually normal interactions, but when considering interactions with more than two nodes, events are usually abnormal. The present application can use a multivariate comparison module to model such abnormal events. This module captures multivariate interaction patterns in events by modeling the compatibility between identifier nodes and context nodes (i.e., non-identifier nodes in events). Identifier nodes may include nodes fused from multiple nodes in an event, central nodes or clustering centers of an event, etc., and context nodes are nodes other than identifier nodes in an event. Usually, in normal node interactions, the compatibility of identifier nodes and context nodes is very high, i.e., the similarity is very high. For example, the content of a paper is highly correlated with the type of conference in which it is published and the interests of the author.

Gets a representation of the context node associated with the identifier.

Among them, _hi is the identifier node representation of event e _i , σ(·) is the sigmoid activation function, and _Wm is the linear transformation layer, that is, the first linear transformation layer mentioned above, which needs to be updated when performing reverse update. Usually, the score _si of normal events should be close to 1, while the score si of abnormal events should _be Close to 0. Therefore, in the subsequent abnormality degree identification process, the abnormality degree can also be expressed in the form of negative numbers.

(3) Event comparison module

Then, the attention weight of node type t is calculated as follows:

Subsequently, a bilinear scoring function can be used to model the compatibility between adjacent events, i.e., the third similarity:
s _i =σ(e _i W _inter e _p )

_ep is the positive sample adjacent event of the current event e _i . For example, _ep can be an event whose number of shared nodes with e _i exceeds T _pos .

(4) Calculate the abnormal event score

The output values calculated by multiple modules can be weighted and fused to obtain the abnormal score of the event, which can be expressed as:
s＝-(α*min(sim( _zi , _zj ))+β*σ ₍ _ciWmzi ₎ +γ*σ ₍ _eiWinterep ₎ )

Among them, the α, β and γ parameters can be used to adjust the impact of the three modules on the results, and can be trained in the aforementioned training stage. The minimum value min(sim(z _i ,z _j )) indicates that this application uses the smallest node pair similarity in the event to measure the degree of abnormality of paired interactions. It can be understood that when a node pair similarity is relatively small, the event may be abnormal. It can also be replaced by the sum of all node pair similarity scores. σ(c _i W _m z _i ) and σ(e _i W _inter e _p ) indicate that this application uses the bilinear scores of positive sample pairs to measure the multivariate and event scores of positive pairs to measure the degree of abnormality between multivariate and events. The bilinear scores of abnormal events are re-added with the scores output by these three modules to obtain the final abnormal event score s. Due to the use of a negative sign, the larger the abnormal score s, the more likely the event is abnormal.

In the implementation mode of the present application, an abnormal event detection model is constructed based on complex interactive events in attribute heterogeneous graphs, while considering anomalies within events and anomalies between events, fully exploring various complex abnormal patterns, and providing a more comprehensive method for abnormal event detection. Since the architecture of the present application can be used for various types of tasks, it has a certain universality. Since most business scenarios in real life can be modeled using attribute heterogeneous graphs. Therefore, the method provided by the present application can be used in various attribute heterogeneous graph scenarios, such as in academic networks, recommendation scenarios, and movie networks, and has good effects.

Compared with APE and AEHE, the method provided by this application can be applied to the detection of complex interactive abnormal events in attribute heterogeneous graphs, and is not limited to events of a specific form. At the same time, this application also fully considers various abnormal and complex interactive patterns in attribute heterogeneous graphs, and can detect abnormal patterns that cannot be modeled by existing solutions. This application also proposes a scoring function for the degree of abnormality of events, which can measure the degree of abnormality of events in attribute heterogeneous graphs.

The following uses a specific comparison scenario as an example to introduce the effect achieved by the method provided in this application in more detail.

By performing reasoning on real data sets (taking academic networks, recommendation scenarios, and movie network data sets as examples), a comparison is provided between the effects achieved by the method provided in this application and some existing solutions.

For example, some existing schemes can be adopted: APE models the pairwise interactions of nodes in an event to obtain the probability of an event. AEHE utilizes rich node attributes and combines the pairwise interactions within an event and the second-order structural embedding of nodes to perform abnormal event detection. CoLA is a GNN-based model for detecting abnormal nodes in homogeneous graphs, using contrastive learning to model inconsistent patterns between abnormal nodes and their context nodes. ANEMONE adopts a similar scheme to CoLA, except that it uses multi-scale contrastive learning at the context level. Metapath2vec uses meta-path-based random walks to model node similarities. This application first obtains node embeddings through metapath2vec, and then performs pairwise dot products to obtain node pair similarity scores, and the lowest score in the event is used to measure the degree of abnormality. HeCo uses a collaborative contrast strategy to learn node representations in HIN, while this application uses the contrast loss of identified nodes as the abnormal event score. HeteHG-VAE uses a hypergraph variational autoencoder to learn robust node representations.

The model input can be some public data sets, such as Aminer, IMDB, and Meituan. For abnormal event input, anomalies can be created manually. The generation of artificial abnormal events is as follows: for each event, select c (consider c = 1, 2, 3 in the following experiments) elements in the event, for each target element, select other k elements, and calculate the Euclidean distance between their attribute vector x_i and the target attribute vector x. Then, select the node with the largest Euclidean distance to replace the target element.

A variety of indicators can be used to represent the output effect. For example, average precision (AP) and area under the curve (AUC) can be used. Generally speaking, AP can reflect the recall ability, that is, the ability to detect more abnormal events, and AUC reflects the accuracy of the model. The effects achieved are shown in Table 1.

Table 1

According to Table 1, the performance of this application is significantly better than all baselines in terms of AP and AUC, which proves the effectiveness of the model. Please note that there are memory issues in the Meituan data due to the full batch training of HeCo. It can be clearly seen that the attribute heterogeneity graph representation learning method performs poorly on all three datasets, which shows that pure graph representation learning methods are far from sufficient for abnormal event detection. Modules specifically for abnormal event detection should be further designed. The contrastive learning method HeCo also performs poorly, which shows that it is a challenge to apply contrastive learning to the task of abnormal event detection. APE and AEHE perform better on the Aminer dataset, but worse on other datasets, and are even worse than the abnormal node detection model because these methods only focus on paired anomalies in events.

The above has provided a detailed introduction to the method flow provided by the present application. Now, in combination with the above method flow, the device provided by the present application for executing the above method steps will be introduced.

Referring to FIG. 12 , a schematic diagram of a structure of an abnormal event detection model building device provided by the present application includes:

The acquisition module 1201 is used to acquire a second attribute heterogeneity graph, the second attribute heterogeneity graph represents multiple events, the second attribute heterogeneity graph includes multiple nodes and association relationships between the multiple nodes, each event is represented by at least two nodes of the multiple nodes and the association relationship between the at least two nodes, and the node in each event includes information of event elements forming the event;

The construction module 1202 is used to construct an abnormal event detection model according to the second attribute heterogeneity graph. The abnormal event detection model is used to detect abnormal events among multiple events. The abnormal events are determined according to the similarity between adjacent events or the similarity between nodes within an event.

Construction module 1202 is specifically used to: group multiple nodes in each event into at least one pair of node pairs; obtain the first similarity of each pair of node pairs in at least one pair of node pairs through the node pair comparison module; obtain the pairwise comparison loss value of each node in the multiple nodes according to the first similarity of each pair of node pairs; update the abnormal event detection model according to the pairwise comparison loss value of each node pair to obtain the updated abnormal event detection model.

In a possible implementation, the construction module 1202 is specifically used to: fuse the pairwise comparison loss values of multiple node pairs in each event to obtain a first loss value; and update the abnormal event detection model according to the first loss value to obtain an updated abnormal event detection model.

In a possible implementation, the construction module 1202 is specifically configured to: obtain a positive sample node set of the first node from multiple nodes. The first similarity between the nodes in the positive sample node set and the first node is higher than the first similarity between the nodes in the negative sample node set and the first node, and the first node is any one of the multiple nodes in each event; the pairwise comparison loss value corresponding to the first node is calculated by the first similarity between the first node and the nodes in the positive sample node set and the similarity between the first node and the nodes in the negative sample node set.

In one possible implementation, module 1202 is constructed to specifically: obtain a temperature coefficient, where the temperature coefficient is related to the similarity between the nodes in the negative sample node set and the first node; and calculate the pairwise comparison loss value corresponding to the first node in combination with the temperature coefficient by using the first similarity between the first node and the nodes in the positive sample node set and the similarity between the first node and the nodes in the negative sample node set.

Construction module 1202 is also used to obtain the second similarity between at least one node among multiple nodes in each event and the identifier node through the multi-element interaction module, the identifier node includes the central node of each event or a node obtained by fusing multiple nodes; calculate the second loss value according to the second similarity between at least one node and the identifier node; update the abnormal event detection model according to the second loss value to obtain an updated abnormal event detection model.

Construction module 1202 is specifically used to: replace the first node with the second node, the first node is one of the points in the first event, and the second node has the same attributes as the first node but a different category; obtain the third similarity between the second node and the identifier node; calculate the loss value based on the second similarity and the third similarity to obtain the second loss value.

Construction module 1202 is specifically used to: filter out a positive sample set and a negative sample set corresponding to each event from multiple events; calculate a third loss value based on the fourth similarity between each event and the events in the positive sample set and the fifth similarity between each event and the events in the negative sample set; update the abnormal event detection model based on the third loss value to obtain an updated abnormal event detection model.

In one possible implementation, construction module 1202 is specifically used to: obtain the number of shared nodes between each pair of events through an event comparison module; obtain at least one event whose number of shared nodes with the second event is greater than a first threshold, and obtain a positive sample set, where the second event is any one of multiple events; obtain at least one event whose number of shared nodes with the second event is not greater than the first threshold, and obtain a negative sample set.

In a possible implementation, the construction module 1202 is specifically configured to: perform semantic recognition on each event through an event comparison module to obtain each event representation; and calculate the fourth similarity between events according to each event representation through the event comparison module.

In a possible implementation, construction module 1202 is also used to: map the data corresponding to each node in each event in the second attribute heterogeneity graph to the same space to obtain a first data representation of each event in the same space; and construct an abnormal event detection model based on the first data representation.

Referring to FIG. 13 , a schematic diagram of the structure of an abnormal event detection device provided by the present application includes:

The acquisition module 1301 is used to acquire a first attribute heterogeneity graph, where the first attribute heterogeneity graph is used to represent at least one event, and the first attribute heterogeneity graph includes a plurality of nodes and association relationships between the plurality of nodes, each event is represented by at least two nodes among the plurality of nodes and the association relationship between the at least two nodes, and each node in each event includes information of event elements forming the event;

The detection module 1302 is used to use the first attribute heterogeneity graph as the input of the abnormal event detection model to obtain an output result, and the output result is used to indicate whether at least one event includes an abnormal event, and the abnormal event is determined based on the similarity between events or the similarity between nodes within an event.

In a possible implementation, the abnormal event detection model includes one or more of the following modules: a node pair comparison module, a multivariate interaction module, or an event comparison module. The node comparison module is used to obtain the similarity between nodes in an event, and the multivariate interaction module is used to obtain The similarity between nodes within an event and event categories,The event comparison module is used to obtain the similarity between events.

In a possible implementation, if the abnormal event detection model includes a node pair comparison module, the detection module 1302 is specifically used to: output a first abnormality degree of each event according to the node pair comparison module, wherein the node pair comparison module is used to obtain the similarity between the node pairs in each event, and obtain the first abnormality degree according to the similarity between the node pairs in each event; and determine whether each event is an abnormal event according to the first abnormality degree of each event to obtain an output result.

In a possible implementation, if the abnormal event detection model includes a multivariate interaction module, the detection module 1302 is specifically used to: output the second abnormality degree of each event through the multivariate interaction module, wherein the multivariate interaction module is used to fuse multiple nodes in at least one event to obtain an identifier node, or use the center point of each event as the identifier node, and obtain the second abnormality degree of each event through the similarity between at least one node and the identifier node; based on the second abnormality degree of each event, determine whether each event is an abnormal event to obtain an output result.

In a possible implementation, if the abnormal event detection model includes an event comparison module, the detection module 1302 is specifically used to: output the third abnormality degree of each event through the event comparison module, wherein the event comparison module is used to obtain the similarity between event pairs, and calculate the third abnormality degree of each event based on the similarity between the event pairs; based on the third abnormality degree of each event, determine whether each event is an abnormal event to obtain an output result.

In a possible implementation, if the abnormal event detection model includes a node pair comparison module, a multivariate interaction module and an event comparison module, the detection module 1302 is specifically used to: use the first attribute heterogeneity graph as the input of the node pair comparison module, the multivariate interaction module and the event comparison module respectively; fuse the first abnormality degree of each event output by the node pair comparison module, the second abnormality degree of each event output by the multivariate interaction module and the third abnormality degree of each event output by the event comparison module to obtain the fourth abnormality degree of each event; determine whether each event is an abnormal event according to the fourth abnormality degree of each event to obtain an output result.

In a possible implementation, the detection module 1302 is specifically used to: map each node in each event in the first attribute heterogeneity graph to the same space to obtain a second data representation of each event in the same space; and use the second data representation as an input to the abnormal event detection model to obtain an output result.

Please refer to FIG. 14 , which is a schematic diagram of the structure of another abnormal event detection model building device provided in the present application, as described below.

The abnormal event detection model building device may include a processor 1401 and a memory 1402. The processor 1401 and the memory 1402 are interconnected via a line. The memory 1402 stores program instructions and data.

The memory 1402 stores program instructions and data corresponding to the steps in the aforementioned FIGS. 4 to 11 .

The processor 1401 is used to execute the method steps performed by the abnormal event detection model building device shown in any of the embodiments in Figures 4 to 11 above.

Optionally, the abnormal event detection model building device may further include a transceiver 1403 for receiving or sending data.

A computer-readable storage medium is also provided in an embodiment of the present application, in which a program for generating a vehicle driving speed is stored. When the program is running on a computer, the computer executes the steps in the method described in the embodiments shown in the aforementioned Figures 4 to 11.

Optionally, the abnormal event detection model building device shown in the aforementioned FIG. 14 is a chip.

Please refer to FIG. 15 , which is a schematic diagram of the structure of another abnormal event detection device provided in the present application, as described below.

The abnormal event detection device may include a processor 1501 and a memory 1502. The processor 1501 and the memory 1502 are interconnected via a line. The memory 1502 stores program instructions and data.

The memory 1502 stores program instructions and data corresponding to the steps in the aforementioned FIGS. 4 to 11 .

The processor 1501 is used to execute the method steps performed by the abnormal event detection device shown in any of the embodiments in Figures 4 to 11 above.

Optionally, the abnormal event detection device may further include a transceiver 1503 for receiving or sending data.

Optionally, the abnormal event detection device shown in the aforementioned FIG. 15 is a chip.

An embodiment of the present application also provides an abnormal event detection model construction device, which can also be called a digital processing chip or chip. The chip includes a processing unit and a communication interface. The processing unit obtains program instructions through the communication interface, and the program instructions are executed by the processing unit. The processing unit is used to execute the method steps performed by the abnormal event detection model construction device shown in any of the embodiments in Figures 4 to 11 above.

An embodiment of the present application also provides an abnormal event detection device, which can also be called a digital processing chip or chip. The chip includes a processing unit and a communication interface. The processing unit obtains program instructions through the communication interface, and the program instructions are executed by the processing unit. The processing unit is used to execute the method steps performed by the abnormal event detection device shown in any of the embodiments in Figures 4 to 11 above.

The embodiment of the present application also provides a digital processing chip. The digital processing chip integrates a circuit and one or more interfaces for implementing the above-mentioned processor 1401, or the functions of the processor 1401. When the digital processing chip integrates a memory, the digital processing chip can complete the method steps of any one or more of the above-mentioned embodiments. When the digital processing chip does not integrate a memory, it can be connected to an external memory through a communication interface. The digital processing chip implements the actions performed by the abnormal event detection model construction device in the above-mentioned embodiment according to the program code stored in the external memory.

The abnormal event detection model building device provided in the embodiment of the present application can be a chip, and the chip includes: a processing unit and a communication unit, the processing unit can be, for example, a processor, and the communication unit can be, for example, an input/output interface, a pin or a circuit, etc. The processing unit can execute the computer execution instructions stored in the storage unit, so that the chip in the server executes the abnormal event detection model building method described in the embodiments shown in Figures 4 to 11 above. Optionally, the storage unit is a storage unit in the chip, such as a register, a cache, etc., and the storage unit can also be a storage unit located outside the chip in the wireless access device end, such as a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM), etc.

The embodiment of the present application also provides a digital processing chip. The digital processing chip integrates a circuit and one or more interfaces for implementing the above-mentioned processor 1501, or the functions of the processor 1501. When the digital processing chip integrates a memory, the digital processing chip can complete the method steps of any one or more of the above-mentioned embodiments. When the digital processing chip does not integrate a memory, it can be connected to an external memory through a communication interface. The digital processing chip implements the actions performed by the abnormal event detection device in the above-mentioned embodiment according to the program code stored in the external memory.

The data conversion device provided in the embodiment of the present application can be a chip, and the chip includes: a processing unit and a communication unit, the processing unit can be, for example, a processor, and the communication unit can be, for example, an input/output interface, a pin or a circuit, etc. The processing unit can execute the computer execution instructions stored in the storage unit, so that the chip in the server executes the data conversion method described in the embodiments shown in Figures 4 to 11 above. Optionally, the storage unit is a storage unit in the chip, such as a register, a cache, etc., and the storage unit can also be a storage unit located outside the chip in the wireless access device end, such as a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM), etc.

Also provided in an embodiment of the present application is a computer program product, which, when executed on a computer, enables the computer to execute the steps executed by the image decompression device or the image decompression device in the method described in the embodiments shown in the aforementioned FIGS. 4 to 11 .

Specifically, the aforementioned processing unit or processor may be a central processing unit (CPU), a neural-network processing unit (NPU), a graphics processing unit (GPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

For example, please refer to FIG. 16, which is a schematic diagram of a structure of a chip provided in an embodiment of the present application. The chip can be a neural network processor NPU 160. NPU 160 is mounted on the host CPU (Host CPU) as a coprocessor, and the host CPU assigns tasks. The core part of the NPU is the operation circuit 1603, which is controlled by the controller 1604 to extract the matrix data in the memory and Perform multiplication.

In some implementations, the operation circuit 1603 includes multiple processing units (process engines, PEs) inside. In some implementations, the operation circuit 1603 is a two-dimensional systolic array. The operation circuit 1603 can also be a one-dimensional systolic array or other electronic circuits capable of performing mathematical operations such as multiplication and addition. In some implementations, the operation circuit 1603 is a general-purpose matrix processor.

For example, assume there is an input matrix A, a weight matrix B, and an output matrix C. The operation circuit takes the corresponding data of matrix B from the weight memory 1602 and caches it on each PE in the operation circuit. The operation circuit takes the matrix A data from the input memory 1601 and performs matrix operation with matrix B, and the partial result or final result of the matrix is stored in the accumulator 1608.

The unified memory 1606 is used to store input data and output data. The weight data is directly transferred to the weight memory 1602 through the direct memory access controller (DMAC) 1605. The input data is also transferred to the unified memory 1606 through the DMAC.

The bus interface unit (BIU) 1610 is used for the interaction between the AXI bus and the DMAC and instruction fetch buffer (IFB) 1609.

The bus interface unit 1610 (BIU) is used for the instruction fetch memory 1609 to obtain instructions from the external memory, and is also used for the storage unit access controller 1605 to obtain the original data of the input matrix A or the weight matrix B from the external memory.

DMAC is mainly used to transfer input data in the external memory DDR to the unified memory 1606 or to transfer weight data to the weight memory 1602 or to transfer input data to the input memory 1601.

The vector calculation unit 1607 includes multiple operation processing units, which further process the output of the operation circuit when necessary, such as vector multiplication, vector addition, exponential operation, logarithmic operation, size comparison, etc. It is mainly used for non-convolutional/fully connected layer network calculations in neural networks, such as batch normalization, pixel-level summation, upsampling of feature planes, etc.

In some implementations, the vector calculation unit 1607 can store the processed output vector to the unified memory 1606. For example, the vector calculation unit 1607 can apply a linear function and/or a nonlinear function to the output of the operation circuit 1603, such as linear interpolation of the feature plane extracted by the convolution layer, and then, for example, a vector of accumulated values to generate an activation value. In some implementations, the vector calculation unit 1607 generates a normalized value, a pixel-level summed value, or both. In some implementations, the processed output vector can be used as an activation input to the operation circuit 1603, for example, for use in a subsequent layer in a neural network.

An instruction fetch buffer 1609 connected to the controller 1604 is used to store instructions used by the controller 1604;

Unified memory 1606, input memory 1601, weight memory 1602 and instruction fetch memory 1609 are all on-chip memories. External memories are private to the NPU hardware architecture.

Among them, the operations of each layer in the recurrent neural network can be performed by the operation circuit 1603 or the vector calculation unit 1607.

The processor mentioned in any of the above places may be a general-purpose central processing unit, a microprocessor, an ASIC, or one or more integrated circuits for controlling the execution of the programs of the methods of FIG. 3-FIG 5 .

It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state drive (SSD)), etc.

The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

Finally, it should be noted that the above is only a specific implementation method of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be covered by the protection scope of the present application.

Claims

A method for detecting abnormal events, comprising:

Acquire a first attribute heterogeneity graph, the first attribute heterogeneity graph represents at least one event, the first attribute heterogeneity graph includes a plurality of nodes and association relationships between the plurality of nodes, each event is represented by at least two nodes of the plurality of nodes and the association relationship between the at least two nodes, and each node in each event includes information forming an event element in the each event;

The first attribute heterogeneity graph is used as an input of an abnormal event detection model to obtain an output result, wherein the output result is used to indicate whether the at least one event includes an abnormal event, and the abnormal event is determined based on the similarity between events or the similarity between nodes within an event.
The method according to claim 1 is characterized in that the abnormal event detection model includes one or more of the following modules: a node pair comparison module, a multivariate interaction module or an event comparison module, the node comparison module is used to obtain the similarity between nodes within an event, the multivariate interaction module is used to obtain the similarity between nodes within an event and event categories, and the event comparison module is used to obtain the similarity between events.
The method according to claim 2, characterized in that if the abnormal event detection model includes the node pair comparison module, the step of using the first attribute heterogeneity graph as an input of the abnormal event detection model to obtain an output result comprises:

Outputting the first abnormality degree of each event according to the node pair comparison module, wherein the node pair comparison module is used to obtain the similarity between the node pairs in each event, and obtain the first abnormality degree according to the similarity between the node pairs in each event;

According to the first abnormality degree of each event, whether each event is an abnormal event is determined to obtain the output result.
The method according to claim 2 or 3, characterized in that if the abnormal event detection model includes the multivariate interaction module, then taking the first attribute heterogeneity graph as an input of the abnormal event detection model to obtain an output result further includes:

Outputting the second abnormality degree of each event through the multivariate interaction module, wherein the multivariate interaction module is used to fuse multiple nodes in the at least one event to obtain an identifier node, or taking the center point of each event as the identifier node, and obtaining the second abnormality degree of each event through the similarity between the at least one node and the identifier node;

According to the second abnormality degree of each event, whether each event is an abnormal event is determined to obtain the output result.
The method according to any one of claims 2 to 4, characterized in that if the abnormal event detection model includes the event comparison module, then taking the first attribute heterogeneity graph as an input of the abnormal event detection model to obtain an output result further comprises:

Outputting the third abnormality degree of each event through the event comparison module, wherein the event comparison module is used to obtain the similarity between event pairs, and calculate the third abnormality degree of each event according to the similarity between the event pairs;

According to the third abnormality degree of each event, whether each event is an abnormal event is determined to obtain the output result.
The method according to claim 5, characterized in that the event comparison module is specifically used to:

Filtering out a set of positive samples corresponding to each event from the multiple events;

According to the similarity between each event and the events in the corresponding positive sample set, a third abnormality degree of each event is obtained.
The method according to claim 5 or 6, characterized in that the event comparison module is specifically used to:

Performing semantic recognition on each of the events to obtain a representation of each of the events;

The similarity between each event and the events in the corresponding positive sample set is calculated according to the representation of each event.
The method according to any one of claims 2 to 7, characterized in that if the abnormal event detection model includes the node pair comparison module, the multivariate interaction module and the event comparison module, then taking the first attribute heterogeneity graph as the input of the abnormal event detection model to obtain the output result further includes:

The first attribute heterogeneity graph is used as the node pair comparison module, the multivariate interaction module and the event comparison module respectively. enter;

The first abnormality degree of each event output by the node pair comparison module, the second abnormality degree of each event output by the multivariate interaction module, and the third abnormality degree of each event output by the event comparison module are integrated to obtain a fourth abnormality degree of each event;

Whether each event is an abnormal event is determined according to the fourth abnormality degree of each event to obtain the output result.
The method according to any one of claims 2 to 8, characterized in that taking the first attribute heterogeneity graph as an input of an abnormal event detection model comprises:

Mapping each node in each event in the first attribute heterogeneity graph to the same space to obtain a second data representation of each event in the same space;

The second data representation is used as an input of an abnormal event detection model to obtain the output result.
The method according to any one of claims 1 to 9, characterized in that

The at least one event in the first attribute heterogeneity graph is used to represent: a financial transaction behavior of a user, a comment-posting behavior of a user, or an item transaction behavior of a user.
A method for constructing an abnormal event detection model, characterized by comprising:

Acquire a second attribute heterogeneity graph, the second attribute heterogeneity graph is used to represent multiple events, the second attribute heterogeneity graph includes multiple nodes and association relationships between the multiple nodes, and each node in each event includes information forming an event element in each event;

An abnormal event detection model is constructed according to the second attribute heterogeneity graph, and the abnormal event detection model is used to detect abnormal events among the multiple events, and the abnormal events are determined according to the similarity between events or the similarity between nodes within an event.
The method according to claim 11, characterized in that the abnormal event detection model includes a node pair comparison module, and the node pair comparison module is used to obtain the similarity of the node pair;

The step of constructing an abnormal event detection model according to the second attribute heterogeneity graph includes:

Grouping the multiple nodes in each event into at least one node pair;

Obtaining, by means of the node pair comparison module, a first similarity of each pair of node pairs in the at least one pair of node pairs;

Obtaining a pairwise comparison loss value of each node in the plurality of nodes according to the first similarity of each pair of node pairs;

Fusing the pairwise comparison loss values of multiple node pairs in each event to obtain a first loss value;

The abnormal event detection model is updated according to the first loss value to obtain an updated abnormal event detection model.
The method according to claim 12, characterized in that the step of obtaining the pairwise contrast loss value of each node according to the first similarity of each pair of nodes comprises:

Acquire a positive sample node set of a first node from the multiple nodes, and construct a negative sample node set, wherein a first similarity between nodes in the positive sample node set and the first node is higher than a first similarity between nodes in the negative sample node set and the first node, and the first node is any one of the multiple nodes in each event;

The pairwise contrast loss value corresponding to the first node is calculated by using the first similarity between the first node and the nodes in the positive sample node set and the similarity between the first node and the nodes in the negative sample node set.
The method according to claim 13, characterized in that the step of calculating the pairwise contrast loss value corresponding to the first node by using the first similarity between the first node and the nodes in the positive sample node set and the similarity between the first node and the nodes in the negative sample node set comprises:

Acquire a temperature coefficient, where the temperature coefficient is related to a similarity between a node in the negative sample node set and the first node;

In combination with the temperature coefficient, the first similarity between the first node and the nodes in the positive sample node set is used to determine the The similarity between the first node and the nodes in the negative sample node set is calculated to obtain a pairwise comparison loss value corresponding to the first node.
The method according to any one of claims 11 to 14 is characterized in that the abnormal event detection model further includes a multivariate interaction module, the multivariate interaction module is used to cluster the nodes in the event to obtain at least one category, and obtain the similarity between each node in the event and the at least one category, the similarity is used to indicate the abnormality degree of the corresponding event;

The constructing of an abnormal event detection model according to the second attribute heterogeneity graph further includes:

Acquire, by the multivariate interaction module, a second similarity between at least one of the multiple nodes in each event and an identifier node, wherein the identifier node includes a central node of each event or a node obtained by fusing the multiple nodes;

calculating a second loss value based on a second similarity between the at least one node and the identifier node;

The abnormal event detection model is updated according to the second loss value to obtain an updated abnormal event detection model.
The method according to claim 15, characterized in that the multivariate interaction module is further used to cluster the multiple nodes in each event to obtain at least one category;

The calculating a second loss value according to the second similarity includes:

Replace the first node with the second node, the first node is one of the points in the first event, and the second node has the same attribute as the first node but a different category;

Obtaining a third similarity between the second node and the identifier node;

A loss value is calculated according to the second similarity and the third similarity to obtain the second loss value.
The method according to any one of claims 11 to 16, characterized in that the abnormal event detection model further comprises an event comparison module, and the event comparison module is used to obtain the similarity between events;

The constructing of an abnormal event detection model according to the second attribute heterogeneity graph further includes:

Filtering out a positive sample set and a negative sample set corresponding to each event from the multiple events;

Calculate a third loss value according to a fourth similarity between each event and the events in the positive sample set and a fifth similarity between each event and the events in the negative sample set;

The abnormal event detection model is updated according to the third loss value to obtain an updated abnormal event detection model.
The method according to claim 17, characterized in that the step of screening out the positive sample set and the negative sample set corresponding to each event from the multiple events comprises:

Acquire the number of shared nodes between each pair of events through the event comparison module;

Acquire at least one event whose number of shared nodes with a second event is greater than a first threshold to obtain the positive sample set, wherein the second event is any one of the multiple events;

At least one event, the number of nodes shared with the second event being no greater than a first threshold, is acquired to obtain the negative sample set.
An abnormal event detection device, characterized in that it includes a processor, the processor is coupled to a memory, the memory stores a program, and when the program instructions stored in the memory are executed by the processor, the steps of the method described in any one of claims 1 to 10 are implemented.
A device for building an abnormal event detection model, characterized in that it includes a processor, the processor is coupled to a memory, the memory stores a program, and when the program instructions stored in the memory are executed by the processor, the steps of the method described in any one of claims 11 to 18 are implemented.
A computer-readable storage medium, characterized in that it includes computer program instructions, and when the computer program instructions are executed by a processor, the processor executes the method according to any one of claims 1 to 18.
A computer program product, characterized in that the computer program product comprises software code, and the software code is used to execute the steps of any one of the methods according to claims 1 to 18.