# CDSTAEP: Cross-Domain Spatial-Temporal Association Learning for Abnormal Events Prediction
## 2 Related Work
Most of the prediction and research rely on the time series of events to expect, ignoring the correlation between events, such as the correlation of different events on the attack chain for the same target subject, which is difficult to be found in the process of covert attack behavior analysis. At present, the temporal or spatial dependent event prediction methods usually use machine learning and depth learning. Generally, the spatial relationship is defined as the relationship between nodes [17] (nodes here refer to network nodes and terminal nodes), and the temporal relationship is defined as the sequence of events or behaviors. The prediction is still summarized as a time series problem. For example, the association prediction method based on time feature sequence [8; 21; 39] uses the association relationship of events or behaviors in the time dimension to predict future events, but this prediction method is only suitable for situations where the attack target is constant; in recent years, a correlation prediction method based on spatiotemporal features has emerged [17; 40; 41], which uses graph convolutional networks to extract spatial node relationships, and extracts temporal correlations of features through LSTM to generate time series of security events. The comparison of abnormal event prediction methods related to this study is shown in Table 2.  
Unlike the above studies, CDSTAEP uses the event vector sequence generated by the basic graph representation to train the LSTM-ATT model to capture the temporal relationship between events. Finally, the self-supervised model is used to fuse the spatial correlation and temporal correlation of entity events. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Class** & **Algorithm** & **Features** & **Applicability** \\ \hline \multirow{3}{*}{Hyperbolic space} & \(\mathbb{S}^{1}\)[29], & Shallow learning & The relationship between hyperbolic distance and connection probability can be explained. Suitable for representing hierarchical data. \\  & \(\mathbb{H}^{2}\)[14; 30]. & representation models & It has the ability to capture the nonlinear structure of the graph, but only considers the local network structure, and the computational complexity is high. \\  & \(\text{ACE-HGNN}\)[12], LGCN[32], & DNN learning & Using hyperbolic geometry Lorentz model, Poincaré model, suitable for representing hierarchical data. \\  & \(\text{TGNN}\)[36]. & \(\text{SPD}\)[37]. & DNN learning & Suitable for representing complex network data, with high model freedom. \\  & \(\mathbb{S}\times\mathbb{H}\times\mathbb{E}\)[9], & \(\text{SPL}\)[38]. & \(\text{DNN learning}\)[38]. & Suitable for representing complex network data, with high model freedom. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison of network representation learning methods. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Class** & **Algorithm** & **Features** & **Applicability** \\ \hline \multirow{3}{*}{Temporal-based features} & RNN[21], & & Use the relationship between events or behaviors in the temporal dimension to predict future events. Only applicable when the attack target is constant. \\  & TIFS[17], BIRS[40]. & & Static graph representation & (VAE) to represent spatial relationships, and time series to make predictions. \\  & \(\text{M-VGRAE}\)[41]. & Dynamic graph representation & Adaptable dynamic graph change prediction. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Comparison of network event prediction methods.