Detecting Unknown Threat Based on Continuous-Time Dynamic Heterogeneous Graph Network

Algorithm 1

Heterogeneous behaviour embedding.

Input: src, dst, e, src node type, dst node type, edge type

Output: dst’s node embedding H^L[dst]

forl ←1 to Ldo

 fori ←1 to mdo

  fordo

   forsrc node type, dst node type do

    calculate node attention score

    extract node src’s feature and assign/update

   end for

   foredge type

    calculate edge attention score and assign/update

    extract edge e’s feature and assign/update

   end for

  end for

 end for

 concat all node attention and featurerespectively

 concat all edge attention and feature respectively

 Aggregate Attention and Message by dot product to get

 dst ←

end for

returnH^L[dst]