# CDSTAEP: Cross-Domain Spatial-Temporal Association Learning for Abnormal Events Prediction
## 4 Methodology
### Analysis and Representation of Entity-Level Cross-Domain Event Correlation
#### 4.1.1 Demarcate Event Sequences with Entities as Anchors  
In the cross-domain network \(G=\{V,E,T\}\), the edge \(e_{i}\) in the graph is generated according to the interaction log between entity \(i\in\mathcal{I}\) (i.e., user). In other words, one event may be generated by different entities, and one entity may generate multiple events. All the events generated by users at time \(t\) is \(\mathcal{E}_{t}=\{(t,e_{x})_{1},(t,e_{x})_{2},\cdots,(t,e_{x})_{i}\cdots,(t,e_ {x})_{n}\}\in\mathbb{R}^{N\times\mathbbm{d}}\), where \(N\) is the number of entities in the dataset, and \(\mathbbm{d}\) is the feature dimension of the event. Here, the event is represented by a tuple \((t,e_{x})\) with a time dimension to facilitate the representation of cross-domain events in a certain time window.  
The method of dividing the event sequence with the entity as the anchor point can refer to four dimensions, domain \(\mathcal{D}\), entity \(\mathcal{I}\), event \(\mathcal{E}\) and time \(\mathcal{T}\) (the event occurs). Each event corresponds to a timestamp \(t\), where the timestamp can be network time or a sequence number. If the event is generated by the same entity, the timestamp in the local process is \(t+1\). If the event is generated by different entities (i.e., interactive events), the timestamp of the event increased by one. Based on the data set, the event sequence generation method as shown in Figure 2.  
The events generated by each entity are reorganized in chronological order to obtain entity-level cross-domain event sequences, as shown in the sequence of events for Entity 0 in Figure 2. For entity \(i\), the final sequence of events as follows:  
\[\mathcal{E}_{t}^{d}=\left[\left(t_{0},e_{x}^{d}\right),\left(t_{1},e_{x}^{d} \right),\left(t_{2},e_{x}^{d}\right),\ldots,\left(t_{n},e_{x}^{d}\right)\right] \tag{6}\]  
where each 2-tuple \(\left(t_{i},e_{x}^{d}\right)\) is an event \(e_{x}^{d}\) that occurs in domain \(d\in\mathcal{D}\) at time \(t_{i}\). This is the data basis for the subsequent construction of event correlation diagrams.  
Figure 1: The overall architecture of CDSTAEP: In CDSTAEP, we first divide the complex network data from different domains D, using the target host as the anchor point to separate the behavior sequence, form a correlation sequence of local events through behavior, and construct an event association graph \(G_{events\ correlation}\) based on the entity local event sequence. The blue square shows the intermediate sampling process of building a cross-domain event association graph, see Section 4.1.2 for details. Particularly, we feed the event correlation sequence and the constructed event association graph into the mixed-curvature GNN, and perform representation learning on the graph in the Riemannian space M, and the intermediate result of this step is output as a sequence of entity event vectors. At the same time, the entity event vector sequence is sent to the attention-based LSTM to obtain the relationship weight between events, and the final abnormal event prediction probability distribution is obtained through multi-layer perceptron (MLP). The final abnormal event prediction probability and accuracy comparison is shown in Algorithm 1.