Insider threat detection approach for tobacco industry based on heterogeneous graph embedding

In the tobacco industry,insider employee attack is a thorny problem that is difficult to detect.To solve this issue,this paper proposes an insider threat detection method based on heterogeneous graph embedding.First,the interrelationships between logs are fully considered,and log entries are converted into heterogeneous graphs based on these relationships.Second,the heterogeneous graph embedding is adopted and each log entry is represented as a low-dimensional feature vector.Then,normal logs and malicious logs are classified into different clusters by clustering algorithm to identify malicious logs.Finally,the effectiveness and superiority of the method is verified through experiments on the CERT dataset.The experimental results show that this method has better performance compared to some baseline methods.

Attack Behavior Extraction Based on Heterogeneous Cyberthreat Intelligence and Graph Convolutional Networks

The continuous improvement of the cyber threat intelligence sharing mechanism provides new ideas to deal with Advanced Persistent Threats(APT).Extracting attack behaviors,i.e.,Tactics,Techniques,Procedures(TTP)from Cyber Threat Intelligence(CTI)can facilitate APT actors’profiling for an immediate response.However,it is difficult for traditional manual methods to analyze attack behaviors from cyber threat intelligence due to its heterogeneous nature.Based on the Adversarial Tactics,Techniques and Common Knowledge(ATT&CK)of threat behavior description,this paper proposes a threat behavioral knowledge extraction framework that integrates Heterogeneous Text Network(HTN)and Graph Convolutional Network(GCN)to solve this issue.It leverages the hierarchical correlation relationships of attack techniques and tactics in the ATT&CK to construct a text network of heterogeneous cyber threat intelligence.With the help of the Bidirectional EncoderRepresentation fromTransformers(BERT)pretraining model to analyze the contextual semantics of cyber threat intelligence,the task of threat behavior identification is transformed into a text classification task,which automatically extracts attack behavior in CTI,then identifies the malware and advanced threat actors.The experimental results show that F1 achieve 94.86%and 92.15%for the multi-label classification tasks of tactics and techniques.Extend the experiment to verify the method’s effectiveness in identifying the malware and threat actors in APT attacks.The F1 for malware and advanced threat actors identification task reached 98.45%and 99.48%,which are better than the benchmark model in the experiment and achieve state of the art.The model can effectivelymodel threat intelligence text data and acquire knowledge and experience migration by correlating implied features with a priori knowledge to compensate for insufficient sample data and improve the classification performance and recognition ability of threat behavior in text.

Topic-Aware Abstractive Summarization Based on Heterogeneous Graph Attention Networks for Chinese Complaint Reports

Automatic text summarization(ATS)plays a significant role in Natural Language Processing(NLP).Abstractive summarization produces summaries by identifying and compressing the most important information in a document.However,there are only relatively several comprehensively evaluated abstractive summarization models that work well for specific types of reports due to their unstructured and oral language text characteristics.In particular,Chinese complaint reports,generated by urban complainers and collected by government employees,describe existing resident problems in daily life.Meanwhile,the reflected problems are required to respond speedily.Therefore,automatic summarization tasks for these reports have been developed.However,similar to traditional summarization models,the generated summaries still exist problems of informativeness and conciseness.To address these issues and generate suitably informative and less redundant summaries,a topic-based abstractive summarization method is proposed to obtain global and local features.Additionally,a heterogeneous graph of the original document is constructed using word-level and topic-level features.Experiments and analyses on public review datasets(Yelp and Amazon)and our constructed dataset(Chinese complaint reports)show that the proposed framework effectively improves the performance of the abstractive summarization model for Chinese complaint reports.

Graph Transformers研究进展综述

随着图结构数据在各种实际场景中的广泛应用,对其进行有效建模和处理的需求日益增加。Graph Transformers(GTs)作为一类使用Transformers处理图数据的模型,能够有效缓解传统图神经网络(GNN)中存在的过平滑和过挤压等问题,因此可以学习到更好的特征表示。根据对近年来GTs相关文献的研究,将现有的模型架构分为两类:第一类通过绝对编码和相对编码向Transformers中加入图的位置和结构信息,以增强Transformers对图结构数据的理解和处理能力;第二类根据不同的方式(串行、交替、并行)将GNN与Transformers进行结合,以充分利用两者的优势。介绍了GTs在信息安全、药物发现和知识图谱等领域的应用,对比总结了不同用途的模型及其优缺点。最后,从可扩展性、复杂图、更好的结合方式等方面分析了GTs未来研究面临的挑战。

Resilience Augmentation in Unmanned Weapon Systems via Multi-Layer Attention Graph Convolutional Neural Networks

The collective Unmanned Weapon System-of-Systems(UWSOS)network represents a fundamental element in modern warfare,characterized by a diverse array of unmanned combat platforms interconnected through hetero-geneous network architectures.Despite its strategic importance,the UWSOS network is highly susceptible to hostile infiltrations,which significantly impede its battlefield recovery capabilities.Existing methods to enhance network resilience predominantly focus on basic graph relationships,neglecting the crucial higher-order dependencies among nodes necessary for capturing multi-hop meta-paths within the UWSOS.To address these limitations,we propose the Enhanced-Resilience Multi-Layer Attention Graph Convolutional Network(E-MAGCN),designed to augment the adaptability of UWSOS.Our approach employs BERT for extracting semantic insights from nodes and edges,thereby refining feature representations by leveraging various node and edge categories.Additionally,E-MAGCN integrates a regularization-based multi-layer attention mechanism and a semantic node fusion algo-rithm within the Graph Convolutional Network(GCN)framework.Through extensive simulation experiments,our model demonstrates an enhancement in resilience performance ranging from 1.2% to 7% over existing algorithms.

A lightweight false alarm suppression method in heterogeneous change detection

Overlooking the issue of false alarm suppression in heterogeneous change detection leads to inferior detection per-formance.This paper proposes a method to handle false alarms in heterogeneous change detection.A lightweight network of two channels is bulit based on the combination of convolutional neural network(CNN)and graph convolutional network(GCN).CNNs learn feature difference maps of multitemporal images,and attention modules adaptively fuse CNN-based and graph-based features for different scales.GCNs with a new kernel filter adaptively distinguish between nodes with the same and those with different labels,generating change maps.Experimental evaluation on two datasets validates the efficacy of the pro-posed method in addressing false alarms.

A novel modeling approach for vertical handover based on dynamic k-partite graph in heterogeneous networks

The future network world will be embedded with different generations of wireless technologies,such as 3G,4G and 5G.At the same time,the development of new devices equipped with multiple interfaces is growing rapidly in recent years.As a consequence,the vertical handover protocol is developed in order to provide ubiquitous connectivity in the heterogeneous wireless environment.Indeed,by using this protocol,the users have opportunities to be connected to the Internet through a variety of wireless technologies at any time and anywhere.The main challenge of this protocol is how to select the best access network in terms of Quality of Service(QoS)for users.For that,many algorithms have been proposed and developed to deal with the issue in recent studies.However,all existing algorithms permit only the selection of one access network from the available networks during the vertical handover process.To cope with this problem,in this paper we propose a new approach based on k-partite graph.Firstly,we introduce k-partite graph theory to model the vertical handover problem.Secondly,the selection of the best path is performed by a robust and lightweight mechanism based on cost function and Dijkstra’s algorithm.The experimental results show that the proposed approach can achieve better performance of QoS than the existing algorithms for FTP traffic and video streaming.

Heterogeneous graph construction and node representation learning method of Treatise on Febrile Diseases based on graph convolutional network

Objective To construct symptom-formula-herb heterogeneous graphs structured Treatise on Febrile Diseases(Shang Han Lun,《伤寒论》)dataset and explore an optimal learning method represented with node attributes based on graph convolutional network(GCN).Methods Clauses that contain symptoms,formulas,and herbs were abstracted from Treatise on Febrile Diseases to construct symptom-formula-herb heterogeneous graphs,which were used to propose a node representation learning method based on GCN−the Traditional Chinese Medicine Graph Convolution Network(TCM-GCN).The symptom-formula,symptom-herb,and formula-herb heterogeneous graphs were processed with the TCM-GCN to realize high-order propagating message passing and neighbor aggregation to obtain new node representation attributes,and thus acquiring the nodes’sum-aggregations of symptoms,formulas,and herbs to lay a foundation for the downstream tasks of the prediction models.Results Comparisons among the node representations with multi-hot encoding,non-fusion encoding,and fusion encoding showed that the Precision@10,Recall@10,and F1-score@10 of the fusion encoding were 9.77%,6.65%,and 8.30%,respectively,higher than those of the non-fusion encoding in the prediction studies of the model.Conclusion Node representations by fusion encoding achieved comparatively ideal results,indicating the TCM-GCN is effective in realizing node-level representations of heterogeneous graph structured Treatise on Febrile Diseases dataset and is able to elevate the performance of the downstream tasks of the diagnosis model.

Relational graph location network for multi-view image localization

In multi-view image localization task,the features of the images captured from different views should be fused properly.This paper considers the classification-based image localization problem.We propose the relational graph location network(RGLN)to perform this task.In this network,we propose a heterogeneous graph construction approach for graph classification tasks,which aims to describe the location in a more appropriate way,thereby improving the expression ability of the location representation module.Experiments show that the expression ability of the proposed graph construction approach outperforms the compared methods by a large margin.In addition,the proposed localization method outperforms the compared localization methods by around 1.7%in terms of meter-level accuracy.

Heterogeneous Network Embedding: A Survey

Real-world complex networks are inherently heterogeneous;they have different types of nodes,attributes,and relationships.In recent years,various methods have been proposed to automatically learn how to encode the structural and semantic information contained in heterogeneous information networks(HINs)into low-dimensional embeddings;this task is called heterogeneous network embedding(HNE).Efficient HNE techniques can benefit various HIN-based machine learning tasks such as node classification,recommender systems,and information retrieval.Here,we provide a comprehensive survey of key advancements in the area of HNE.First,we define an encoder-decoder-based HNE model taxonomy.Then,we systematically overview,compare,and summarize various state-of-the-art HNE models and analyze the advantages and disadvantages of various model categories to identify more potentially competitive HNE frameworks.We also summarize the application fields,benchmark datasets,open source tools,andperformance evaluation in theHNEarea.Finally,wediscuss open issues and suggest promising future directions.We anticipate that this survey will provide deep insights into research in the field of HNE.

Reliable knowledge graph fact prediction via reinforcement learning

Knowledge graph(KG)fact prediction aims to complete a KG by determining the truthfulness of predicted triples.Reinforcement learning(RL)-based approaches have been widely used for fact prediction.However,the existing approaches largely suffer from unreliable calculations on rule confidences owing to a limited number of obtained reasoning paths,thereby resulting in unreliable decisions on prediction triples.Hence,we propose a new RL-based approach named EvoPath in this study.EvoPath features a new reward mechanism based on entity heterogeneity,facilitating an agent to obtain effective reasoning paths during random walks.EvoPath also incorporates a new postwalking mechanism to leverage easily overlooked but valuable reasoning paths during RL.Both mechanisms provide sufficient reasoning paths to facilitate the reliable calculations of rule confidences,enabling EvoPath to make precise judgments about the truthfulness of prediction triples.Experiments demonstrate that EvoPath can achieve more accurate fact predictions than existing approaches.

基于异质图嵌入和会话交互的课程推荐模型

大规模在线教育平台所形成的网络具有数据量大、实体类型丰富、关系复杂等特性。一方面,在线教育正在被大力普及,而另一方面,在线课程却面临低使用率、低完成度及高辍学率的问题。个性化的课程推荐有利于提高学习者的学习积极性,其中,课程能否顺利合格完成是学习者在选课时所考虑的重要因素。鉴于此,提出一种基于学习完成度预测的个性化课程推荐模型。对学生的课程学习会话图进行建模,根据学生的课程学习顺序以及课程的完成情况,生成学生的学习状态表征;同时考虑在线学习环境因素对课程的影响,构建在线课程学习异质图,采用图神经网络生成异质图中课程节点的嵌入;然后通过交互机制融合学习状态表征和课程嵌入,预测学生下一门将学课程的完成度,根据完成度排序从而实现课程推荐。在CNPC、HMXPC和Scho1at3个大规模在线课程学习数据集上的实验结果表明,该模型能有效提升推荐的准确度,在归一化折损累计增益(NDCG)和平均倒数排名(MRR)2个指标上相较于基线模型最优结果均有显著提升,评估指标K值取5时,其NDCG@5指标在3个数据集上分别提升21.08%、17.73%和5.41%,MRR@5指标在3个数据集上分别提升25.66%、31.59%和26.96%。

联合异质图卷积网络和注意力机制的假新闻检测

社交媒体平台的开放性和包容性为人们提供了自由的表达方式,但也引发了新的社会问题,假新闻在社交平台层出不穷,会引起公众恐慌,侵害人们的精神健康,这使得假新闻检测尤为必要.现有的假新闻检测方法大多侧重于从文本内容、用户和传播模式中挖掘有效信息,但是这些方法没有充分利用文本内容的全局语义关系.为了有效融合新闻内容的全局语义信息和新闻传播的全局结构关系,本文提出一种基于元路径的推文-词-用户异质图卷积注意力框架HGCAN,根据元路径将构建的推文-词-用户异质图分解为两个子图,通过图卷积网络提取传播结构特征,利用注意力机制聚合邻居节点的信息并学习子图重要性,从而有效学习节点的特征表示.在两个公开数据集上的实验结果表明,相比于其他方法,本文方法在准确率和F1指标上都取得了较为先进的结果.

基于全局图注意力元路径异构网络的药物-疾病关联预测

提出了一个基于全局图注意力元路径异构网络模型(MHNGA)来进行药物-疾病关联预测。首先,收集整理药物和疾病数据,将已知的药物-疾病关联、药物相似性、疾病相似性构建为一个异构网络;其次,引入多个基于元路径的子图,使用图注意力神经网络提取这些子图的邻居节点的特征,并且通过通道注意力和空间注意力机制来增强特征;最后,通过十折交叉验证的评估,MHNGA取得了93.5%的精确召回曲线下的面积和99.4%的准确率。

融合遗忘机制的多模态知识追踪模型

知识追踪是构建自适应教育系统的核心和关键,常被用以捕获学生的知识状态、预测学生的未来表现。以往的知识追踪模型仅根据结构信息对问题、技能进行建模,无法利用问题、技能的多模态信息构造其相互依赖关系。同时,关于学生的记忆水平仅以时间做量化,未考虑不同模态对记忆水平的影响。因此,提出了融合遗忘机制的多模态知识追踪模型。首先,对问题、技能节点,以图文匹配作为训练任务优化单模态嵌入,并通过计算多模态融合后节点间的相似度,获得问题和技能的关联权重从而计算生成问题节点的嵌入。其次,通过长短期记忆网络获取带有遗忘因素的学生知识状态,并将其融入学生的答题记录中生成学生节点的嵌入。最后,根据学生的答题次数和不同模态的有效记忆率计算学生和问题间的关联强度,通过图注意力网络进行信息传播,预测学生对不同问题的答题情况。在两个真实课堂自采数据集上进行了对比实验和消融实验,结果表明所提方法比其他基于图的知识追踪模型具有更好的预测精度,且针对多模态和遗忘机制的设计能有效提升原始模型的预测效果。同时,通过对一个具体案例的可视化分析,进一步说明了所提方法的实际应用效果。

基于胶囊异构图注意力网络的中文表格型数据事实验证

事实验证旨在检查一个文本陈述是否被给定的证据所支持.由于表格结构上具有依赖性、内容上具有隐含性,以表格作为证据的事实验证任务仍面临很多挑战.现有工作或者利用逻辑表达式来解析基于表格证据的陈述,或者设计表格感知神经网络来编码陈述-表格对,以此实现基于表格的事实验证任务.但是,这些方法没有充分利用陈述背后隐含的表格信息,从而导致模型的推理性能下降,并且基于表格证据的中文陈述具有更加复杂的语法和语义,也给模型推理带来更大的困难.为此,提出基于胶囊异构图注意力网络(CapsHAN)的中文表格型数据事实验证方法,所提方法能充分理解陈述的结构和语义,进而挖掘和利用陈述所隐含的表格信息,有效提升基于表格的事实验证任务准确性.具体而言,首先通过对陈述进行依存句法分析和命名实体识别来构建异构图,接着对该图采用异构图注意力网络和胶囊图神经网络进行学习和理解,然后将得到的陈述文本表示与经过编码的表格文本表示进行拼接,最后完成结果的预测.更进一步,针对现有中文表格型事实验证数据集匮乏而难以支持基于表格的事实验证方法性能评价的难题,首先对主流TABFACT和INFOTABS表格事实验证英文数据集进行中文转化,并且专门针对中文表格型数据的特点构建了基于UCL国家标准的数据集UCLDS,该数据集将维基百科信息框作为人工注释的自然语言陈述的证据,并被标记为蕴含、反驳或中立3类.UCLDS在同时支持单表和多表推理方面比传统TABFACT和INFOTABS数据集更胜一筹.在上述3个中文基准数据集上的实验结果表明,所提模型的表现均优于基线模型,证明该模型在基于中文表格的事实验证任务上的优越性.

基于异构图和语义融合的实体关系抽取

关系抽取是信息抽取中的一项重要任务,其目的是从非结构化文本中抽取出所有关系三元组。然而,如何有效地处理这一问题仍然是一个挑战,特别是对于关系重叠问题。为了有效处理重叠问题,该文提出一种基于异构图和语义融合的实体关系抽取方法:使用异构图将关系信息作为先验知识融入词表示,增强词表示的表示能力,使得模型能有效地处理单词实体重叠问题;使用语义融合模块将不同层次特征融合在一起作为关系分类模型的输入,使得模型能够有效地处理实体对重叠问题。所提方法在NYT和WebNLG数据集上取得了最好的效果,详细的实验也表明所提方法可以处理复杂的场景。

基于多元语义特征和图卷积神经网络的短文本分类模型

在互联网和社交媒体迅猛发展的背景下,网络中出现了大量的短文本数据,这些数据在舆情监控、情感分析和新闻分类等自然语言处理领域展现出了非常高的经济和学术价值.但短文本数据固有的特征给短文本分类带来了不小的挑战,如文本稀疏和缺乏丰富的上下文语义等.针对这些问题,提出了一种结合多元语义特征和图卷积神经网络(GCN)的短文本分类模型,该模型通过哈尔滨工业大学的语言技术平台获取短文本的多种语义特征,并将这些语义特征同短文本一起构建一个多元异构图,然后将其作为GCN的输入,利用GCN学习短文本更深层特征,最后通过Softmax函数获取每个类别的概率分布,进而实现短文本分类.试验结果表明,本模型在短文本分类的F1评分上比传统单一模型提高了4%.

融合异质层次因果图的尾矿堆积坝安全状态分析

为探究尾矿堆积坝内外部因素对堆积坝体安全状态的影响,提出基于异质层次图的尾矿堆积坝安全状态分析方法。该方法通过构建异质层次因果图,将环境、渗流场和应力场等关键因素与堆积坝安全状态建立联系,并结合异质节点属性特征,形成环-渗-应安全状态分析指标体系;通过提出定量指标动态等级区间计算方法和安全状态等级计算模型,将坝体安全状态定性问题的模糊性转化为定量化表达,实现对尾矿堆积坝安全等级评价;以洛阳某尾矿坝为例验证模型的科学性。结果表明:该模型能合理定量分析因素与状态之间联系,并找出堆积坝负向演化的敏感性因素,给后续筑坝过程的安全管理提供决策依据。

基于动态异构网络的股价预测

股票预测通常被形式化为非线性的时间序列预测任务,但很少有研究者试图通过技术面数据去系统地揭示股票市场内在结构,例如股票上涨或下跌背后的原因可能是业务领域之间的合作或冲突,这些额外信息的增加有助于判断股票的未来趋势。为了充分真实刻画股票市场的交易状态,表达股票之间显式或隐式的关系,提出一种基于动态异构网络的股价预测模型sDHN(stock dynamic heterogeneous network),综合股票以及所属行业和地域,将其建模为动态异构网络。该模型在网络上引入动态时序特征,创新融合股票节点的四种不同技术层面的相似性图,生成富信息异构图,最后聚合不同元路径中隐含的语义信息生成嵌入,从异构图的角度充分探索股票之间的潜在关联。此外,在三个真实世界的股票数据集上进行了大量实验,所提出的模型准确率比所有基线模型均高出5%~34%,F_(1)-score则高出11.5%~37%,并且在图解释上证明了该方法的有效性。