# CDSTAEP: Cross-Domain Spatial-Temporal Association Learning for Abnormal Events Prediction
## 4 Methodology
### Abnormal Behavior Prediction  
This section aims to obtain weighted representations of event vectors via LSTM-ATT, including association fusion over time series. Ultimately, we use MLP to predict the probability that anomalous events may occur in subsequent periods. When the input feature vector sequence is too long, the traditional LSTM model has problems such as slow parameter update and gradient disappearance, which will increase the time complexity of model training and reduce the accuracy of the results. We introduce the Attention mechanism to solve the above problems by retaining intermediate results and calculating the support between related events in a targeted manner. First, we convert the output of events in the mixed-curvature space to Euclidean space output to facilitate the computation of existing deep learning models. For multi-curvature spaces, the center point is \(\{c_{1},c_{2},\dots,c_{k}\}\), given the representation of an event \(x^{R}=\big{\{}x_{1}^{R},x_{2}^{R},\dots,x_{k}^{R}\big{\}}\) in multiple curvature spaces, the Euclidean space output is \(\Big{\{}d_{\mathcal{M}_{1}}^{x_{1}}(x_{1}^{R},c_{1}),d_{\mathcal{M}_{2}}^{x_{ 2}}(x_{2}^{R},c_{2}),\dots,d_{\mathcal{M}_{k}}^{x_{k}}(x_{k}^{R},c_{k})\Big{\}}\), that is, the final conversion result is the combination of mixed-curvature space conversion vector with Euclidean space vector. **LSTM-ATT. ** Given a cross-domain event sequence \(\mathcal{E}_{t}^{d}=\left[\left(t_{c-h},e_{x}^{d}\right),\left(t_{c-h+1},e_{x}^{d} \right),\left(t_{c-h+2},e_{x}^{d}\right),\ldots,\left(t_{c},e_{x}^{d}\right)\right]\) of an entity \(i\in I\) in the time range \(t_{c-h}\) to \(t_{c}\), where \(d\in D\) means different domains, \(\left[\left(t_{c-h},v_{x}^{d}\right),\left(t_{c-h+1},v_{x}^{d}\right),\left(t_ {c-h+2},v_{x}^{d}\right),\ldots,\left(t_{c},v_{x}^{d}\right)\right]\) is the event vector sequence obtained after characterization and input into the Attention-based LSTM model. As shown in Figure 4, for the convenience of expression, we denote the vector sequence value of \(\left[\left(t_{c-h},v_{x}^{d}\right),\left(t_{c-h+1},v_{x}^{d}\right),\left(t_ {c-h+2},v_{x}^{d}\right),\ldots,\left(t_{c},v_{x}^{d}\right)\right]\) as \(\left[x_{c-h},x_{c-h+1},x_{c-h+2},\ldots,x_{c}\right]\). For the sequence \(\left[x_{c-h},x_{c-h+1},x_{c-h+2},\ldots,x_{c}\right]\), the output of the LSTM cell is \(\left[h_{c-h},h_{c-h+1},h_{c-h+2},\ldots,h_{c}\right]\), respectively, and the attention calculation formula of each LSTM cell output is as follows:  
\[\alpha_{i}=softmax\left(w^{T}\cdot h_{i}+b\right)=\frac{\exp\left(w^{T}\cdot h _{i}+b\right)}{\sum_{j=c-h}^{c}\exp\left(w^{T}\cdot h_{j}+b\right)} \tag{31}\]  
where \(w\) and \(b\) are the weight vector and bias vector of the softmax layer. The final output of Attention-based LSTM is the weighted representation \(r\) of the associated event vector, as shown in Figure 4. The resulting formula is as follows:  
\[r=\sum_{i=c-h}^{c}\alpha_{i}\cdot h_{i} \tag{32}\]  
We input the weighted event vector r into the MLP to obtain the final predicted probability of abnormal event occurrence. Since the MLP with one hidden layer can approximate the complex network system with arbitrary precision, this model introduces the MLP with one hidden layer. The output of the MLP hidden layer is as follows:  
\[\hat{A}_{i}=\text{ReLU}(W_{1}r+b_{1}) \tag{33}\]  
where \(W_{1}\) and \(b_{1}\) are the weight vectors between the hidden layer and the input layer and the bias vector of the hidden layer node, respectively, \(\text{ReLU}(x)=\max(0,x)\). The output of the MLP is as follows:  
\[y=\text{sigmoid}(W_{2}\hat{A}_{i}+b_{2}) \tag{34}\]  
where \(W_{2}\) is the weight vector between the hidden layer and the output layer, and \(b_{2}\) is the bias vector of the output layer nodes. The activation function is defined as follows:  
\[\text{sigmoid}(x)=\frac{1}{1+e^{-x}} \tag{35}\]  
Figure 4: Attention-based LSTM Model (LSTM-ATT): This model aims to calculate the weighted representation \(r\) of the event vector.