CN113822313A - Method and device for detecting abnormity of graph nodes - Google Patents
Method and device for detecting abnormity of graph nodes Download PDFInfo
- Publication number
- CN113822313A CN113822313A CN202110433543.2A CN202110433543A CN113822313A CN 113822313 A CN113822313 A CN 113822313A CN 202110433543 A CN202110433543 A CN 202110433543A CN 113822313 A CN113822313 A CN 113822313A
- Authority
- CN
- China
- Prior art keywords
- node
- map
- graph
- detected
- target
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/243—Classification techniques relating to the number of classes
- G06F18/2433—Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
Abstract
The application discloses a method and a device for detecting graph node abnormity. One embodiment of the method comprises: acquiring a diagram to be detected; inputting the diagram to be detected into a pre-trained abnormal detection model based on a generated countermeasure network, and determining an abnormal value representing the abnormal degree of each node in the diagram to be detected, wherein the abnormal value is determined according to a first error between the diagram to be detected and the corresponding node in a target diagram and a second error between the corresponding nodes and the structural feature, and the target diagram is generated by referring to the diagram to be detected by a generation network in the abnormal detection model; and determining abnormal nodes in the to-be-detected map according to the abnormal values of each node in the to-be-detected map. The application provides a graph node abnormity detection method based on a generation countermeasure network, and the node abnormity detection accuracy is improved.
Description
Technical Field
The embodiment of the application relates to the technical field of computers, in particular to a method and a device for detecting graph node abnormity.
Background
Graph node anomaly detection is the identification of nodes in a graph that have anomalies. The exception of the node includes two aspects: firstly, the node characteristics are abnormal, namely the node characteristics have large difference with most other node characteristics in the graph; secondly, structural abnormality, a common assumption in graph theory is that the characteristics of nodes connecting two nodes have similarity, and structural abnormality shows that the difference of the characteristics of the two connected nodes is large. The traditional abnormal graph node detection algorithm only focuses on identifying the unilateral abnormality of the node characteristics or the structure, and the deep abnormality detection algorithm based on the neural network can consider the abnormalities of the node characteristics and the structure abnormality at the same time.
Disclosure of Invention
The embodiment of the application provides a method and a device for detecting the abnormity of a graph node.
In a first aspect, an embodiment of the present application provides a method for detecting an anomaly of a graph node, including: acquiring a diagram to be detected; inputting the diagram to be detected into a pre-trained abnormal detection model based on a generated countermeasure network, and determining an abnormal value representing the abnormal degree of each node in the diagram to be detected, wherein the abnormal value is determined according to a first error between the diagram to be detected and the corresponding node in a target diagram and a second error between the corresponding nodes and the structural feature, and the target diagram is generated by referring to the diagram to be detected by a generation network in the abnormal detection model; and determining abnormal nodes in the to-be-detected map according to the abnormal values of each node in the to-be-detected map.
In some embodiments, the inputting the to-be-inspected graph into a pre-trained anomaly detection model based on the generation countermeasure network, and the determining of the anomaly value representing the anomaly degree of each node in the to-be-inspected graph comprises: generating a target image through a generation network, and respectively generating coding matrixes corresponding to the to-be-detected image and the target image through a coder; determining adjacent matrixes respectively corresponding to the image to be detected and the target image according to the coding matrixes respectively corresponding to the image to be detected and the target image; determining a first error between the to-be-detected map and a corresponding node in the target map about the node feature, and determining a second error between the to-be-detected map and the corresponding node in the target map about the structure feature according to the adjacency matrixes respectively corresponding to the to-be-detected map and the target map; and for each node in the graph to be detected, determining a difference value of the node according to a first error and a second error corresponding to the node.
In some embodiments, the determining a first error between the suspect map and the corresponding node in the target map about the node feature and determining a second error between the suspect map and the corresponding node in the target map about the structure feature based on the adjacency matrices to which the suspect map and the target map respectively correspond includes: for each node in the map to be examined, the following operations are performed: determining an L2 norm of a difference between the feature vector of the node and the feature vector of the node corresponding to the node in the target graph as a first error corresponding to the node; and determining a second error corresponding to the node according to the structural characteristic representing the existence probability of the connecting edge between the node and the associated node in the adjacent matrix corresponding to the graph to be detected and the structural characteristic representing the existence probability of the connecting edge between the node corresponding to the node and the associated node in the adjacent matrix corresponding to the target graph.
In some embodiments, the generating network and the encoder each comprise a multi-layer perceptron or neural network.
In some embodiments, the anomaly detection model is trained by: acquiring a training sample set, wherein training samples in the training sample set comprise sample graphs; the method comprises the steps of utilizing a machine learning method, enabling an initial generation network in an initial anomaly detection model to take a sample image in a training sample set as expected output, generating a training process target image, obtaining an adjacent matrix corresponding to the sample image and the training process target image based on a coding matrix corresponding to the sample image and the training process target image obtained by a coder, taking the adjacent matrix corresponding to the sample image and the training process target image as input of an initial discrimination network, identifying whether the input adjacent matrix corresponds to the sample image or the training process target image through the initial discrimination network, training the initial anomaly detection model, and obtaining the anomaly detection model, wherein in the model training process, a target function representing the discrimination capability of the maximum discrimination network is adopted, and the discrimination capability of the discrimination network on the generation network is minimized.
In a second aspect, an embodiment of the present application provides an apparatus for detecting an anomaly of a graph node, including: an acquisition unit configured to acquire a to-be-inspected map; a first determination unit configured to input the to-be-inspected image into a pre-trained abnormality detection model based on a generation countermeasure network, and determine an abnormal value characterizing a degree of abnormality of each node in the to-be-inspected image, wherein the abnormal value is determined based on a first error regarding a node feature between the to-be-inspected image and a corresponding node in a target image generated by the generation network in the abnormality detection model with reference to the to-be-inspected image, and a second error regarding a structural feature between the corresponding nodes; and a second determination unit configured to determine an abnormal node in the to-be-detected map based on the abnormal value of each node in the to-be-detected map.
In some embodiments, the first determining unit is further configured to: generating a target image through a generation network, and respectively generating coding matrixes corresponding to the to-be-detected image and the target image through a coder; determining adjacent matrixes respectively corresponding to the image to be detected and the target image according to the coding matrixes respectively corresponding to the image to be detected and the target image; determining a first error between the to-be-detected map and a corresponding node in the target map about the node feature, and determining a second error between the to-be-detected map and the corresponding node in the target map about the structure feature according to the adjacency matrixes respectively corresponding to the to-be-detected map and the target map; and for each node in the graph to be detected, determining a difference value of the node according to a first error and a second error corresponding to the node.
In some embodiments, the first determining unit is further configured to: for each node in the map to be examined, the following operations are performed: determining an L2 norm of a difference between the feature vector of the node and the feature vector of the node corresponding to the node in the target graph as a first error corresponding to the node; and determining a second error corresponding to the node according to the structural characteristic representing the existence probability of the connecting edge between the node and the associated node in the adjacent matrix corresponding to the graph to be detected and the structural characteristic representing the existence probability of the connecting edge between the node corresponding to the node and the associated node in the adjacent matrix corresponding to the target graph.
In some embodiments, the generating network and the encoder each comprise a multi-layer perceptron or neural network.
In some embodiments, the above apparatus further comprises: a training unit configured to train an abnormality detection model by: acquiring a training sample set, wherein training samples in the training sample set comprise sample graphs; the method comprises the steps of utilizing a machine learning method, enabling an initial generation network in an initial anomaly detection model to take a sample image in a training sample set as expected output, generating a training process target image, obtaining an adjacent matrix corresponding to the sample image and the training process target image based on a coding matrix corresponding to the sample image and the training process target image obtained by a coder, taking the adjacent matrix corresponding to the sample image and the training process target image as input of an initial discrimination network, identifying whether the input adjacent matrix corresponds to the sample image or the training process target image through the initial discrimination network, training the initial anomaly detection model, and obtaining the anomaly detection model, wherein in the model training process, a target function representing the discrimination capability of the maximum discrimination network is adopted, and the discrimination capability of the discrimination network on the generation network is minimized.
In a third aspect, the present application provides a computer-readable medium, on which a computer program is stored, where the program, when executed by a processor, implements the method as described in any implementation manner of the first aspect.
In a fourth aspect, an embodiment of the present application provides an electronic device, including: one or more processors; a storage device having one or more programs stored thereon, which when executed by one or more processors, cause the one or more processors to implement a method as described in any implementation of the first aspect.
According to the method and the device for detecting the abnormity of the graph nodes, the graph to be detected is obtained; inputting the diagram to be detected into a pre-trained abnormal detection model based on a generated countermeasure network, and determining an abnormal value representing the abnormal degree of each node in the diagram to be detected, wherein the abnormal value is determined according to a first error between the diagram to be detected and the corresponding node in a target diagram and a second error between the corresponding nodes and the structural feature, and the target diagram is generated by referring to the diagram to be detected by a generation network in the abnormal detection model; according to the abnormal value of each node in the diagram to be detected, the abnormal node in the diagram to be detected is determined, so that the method for detecting the abnormal node of the diagram based on the generation countermeasure network is provided, and the accuracy of detecting the abnormal node is improved.
Drawings
Other features, objects and advantages of the present application will become more apparent upon reading of the following detailed description of non-limiting embodiments thereof, made with reference to the accompanying drawings in which:
FIG. 1 is an exemplary system architecture diagram in which one embodiment of the present application may be applied;
FIG. 2 is a flow diagram according to one embodiment of a node anomaly detection method of the present application;
fig. 3 is a schematic diagram of an application scenario of the graph node abnormality detection method according to the present embodiment;
FIG. 4 is a flow diagram of yet another embodiment of a graph node anomaly detection method according to the present application;
FIG. 5 is a block diagram of one embodiment of a graph node anomaly detection apparatus according to the present application;
FIG. 6 is a block diagram of a computer system suitable for use in implementing embodiments of the present application.
Detailed Description
The present application will be described in further detail with reference to the following drawings and examples. It is to be understood that the specific embodiments described herein are merely illustrative of the relevant invention and not restrictive of the invention. It should be noted that, for convenience of description, only the portions related to the related invention are shown in the drawings.
It should be noted that the embodiments and features of the embodiments in the present application may be combined with each other without conflict. The present application will be described in detail below with reference to the embodiments with reference to the attached drawings.
Fig. 1 illustrates an exemplary architecture 100 to which the graph node anomaly detection methods and apparatus of the present application may be applied.
As shown in fig. 1, the system architecture 100 may include terminal devices 101, 102, 103, a network 104, and a server 105. The communication connections between the terminal devices 101, 102, 103 form a topological network, and the network 104 serves to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. Network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, to name a few.
The terminal devices 101, 102, 103 may be hardware devices or software that support network connections for data interaction and data processing. When the terminal devices 101, 102, 103 are hardware, they may be various electronic devices supporting network connection, information acquisition, interaction, display, processing, and the like, including but not limited to smart phones, tablet computers, e-book readers, laptop portable computers, desktop computers, and the like. When the terminal apparatuses 101, 102, 103 are software, they can be installed in the electronic apparatuses listed above. It may be implemented, for example, as multiple software or software modules to provide distributed services, or as a single software or software module. And is not particularly limited herein.
The server 105 may be a server that provides various services, such as a background processing server that acquires a to-be-detected map transmitted by a user through the terminal devices 101, 102, 103, and performs map node abnormality detection based on an abnormality detection model obtained by generating an countermeasure network. Optionally, the server may feed back a detection result of the map to be detected to the terminal device. As an example, the server 105 may be a cloud server.
The server may be hardware or software. When the server is hardware, it may be implemented as a distributed server cluster formed by multiple servers, or may be implemented as a single server. When the server is software, it may be implemented as multiple pieces of software or software modules (e.g., software or software modules used to provide distributed services), or as a single piece of software or software module. And is not particularly limited herein.
It should be further noted that the graph node abnormality detection method provided in the embodiment of the present application may be executed by a server, may also be executed by a terminal device, and may also be executed by the server and the terminal device in cooperation with each other. Accordingly, each part (for example, each unit) included in the graph node abnormality detection apparatus may be entirely provided in the server, may be entirely provided in the terminal device, or may be provided in the server and the terminal device, respectively.
It should be understood that the number of terminal devices, networks, and servers in fig. 1 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation. When the electronic device on which the graph node abnormality detection method operates does not need to perform data transmission with other electronic devices, the system architecture may only include the electronic device (e.g., a server or a terminal device) on which the graph node abnormality detection method operates.
With continuing reference to FIG. 2, a flow 200 of one embodiment of a graph node anomaly detection method is shown, comprising the steps of:
In this embodiment, an execution subject (for example, the server in fig. 1) of the graph node abnormality detection method may obtain the to-be-detected graph from a remote location or from a local location by using a wired network connection manner or a wireless network connection manner.
In this embodiment, the to-be-detected map may be a map including arbitrary information and formed of nodes and connection relationships between the nodes. As an example, in the financial field, the diagram to be detected may be a diagram in which a user's bank account is a node and interaction information between different bank accounts is a connection relationship. As yet another example, in the social domain, the to-be-detected graph may be a graph in which a social account of the user is a node and interaction information between different social accounts is a connection relation.
In some optional implementations of the embodiment, the execution subject may perform data analysis according to the acquired raw data to generate a to-be-detected map. As an example, in the financial field, the executing body may use a bank account number in the raw data as a node, determine transaction information such as transfer between different bank accounts, further determine a connecting edge between different nodes, and generate a to-be-detected graph.
In this embodiment, the executing body may input the to-be-detected map into a pre-trained anomaly detection model, and determine an anomaly value representing the anomaly degree of each node in the to-be-detected map. The abnormal detection model represents the corresponding relation between the to-be-detected graph and the abnormal value of each node in the to-be-detected graph and is obtained based on generation of confrontation network training. The abnormal value is determined according to a first error between the to-be-detected graph and corresponding nodes in the target graph and a second error between the corresponding nodes and structural features, and the target graph is generated by a generation network in the abnormal detection model according to the to-be-detected graph. And the corresponding two node representations respectively belong to the nodes of the node information with the same representation as the mapping to be detected and the target graph.
As an example, the first error may be a reconstruction error characterized by a distance between node features of nodes of the to-be-inspected map corresponding to the target map. For example, if the node a in the to-be-inspected map corresponds to the node a 'in the target map, the distance between the node feature of the node a and the node feature of the node a' is determined as the first error.
The structural features between nodes in the same graph are generally expressed as the presence or absence of connecting edges between nodes and the possibility of the presence of connecting edges. When a connecting edge exists between the nodes, the two nodes can be considered as the associated nodes. It is understood that one node may have no associated node, one associated node, or multiple associated nodes.
Continuing with the example where node a in the to-be-inspected graph corresponds to node a 'in the target graph, the associated nodes of node a in the to-be-inspected graph include B, C, and the associated nodes of node a' include B 'and C', then the error between the structural feature between node a and node B, and the structural feature between node a 'and node B', and the error between the structural feature between node a and node C, and the structural feature between node a 'and node C' are determined to be the second error.
In this embodiment, the anomaly detection model may be obtained as follows: acquiring a training sample set, wherein training samples in the training sample set comprise sample graphs; and by using a machine learning method, an initial generation network in the initial anomaly detection model takes a sample graph in a training sample set as expected output to generate a training process target graph, the sample graph and the training process target graph are taken as input of an initial discrimination network, whether the input graph is the sample graph or the training process target graph is recognized through the initial discrimination network, and the initial anomaly detection model is trained to obtain the anomaly detection model. In the model training process, on the premise of representing the discrimination capability of the maximum discrimination network, the objective function of the discrimination capability of the generation network of the discrimination network is minimized.
In some optional implementations of the present embodiment, the anomaly detection model includes a generation network, an encoder, and a discrimination network. The execution main body may execute the step 202 as follows:
first, an object map is generated by generating a network, and encoding matrices corresponding to the to-be-inspected map and the object map are generated by an encoder, respectively.
In this implementation, first, the execution body may generate a target map by referring to the image to be detected. Wherein the target image has high similarity with the image to be detected. And then, inputting the mapping to be detected and the target map into an encoder in sequence to obtain encoding matrixes corresponding to the mapping to be detected and the target map respectively.
Secondly, according to the coding matrixes corresponding to the to-be-detected map and the target map, the adjacent matrixes corresponding to the to-be-detected map and the target map are determined.
In this implementation manner, the execution main body may determine an adjacent matrix corresponding to the to-be-detected image according to the coding matrix of the to-be-detected image and the transposed matrix of the coding matrix; and determining an adjacent matrix corresponding to the target graph according to the coding matrix of the target graph and the transposed matrix of the coding matrix.
Specifically, the execution body may determine the adjacency matrix by the following formula:
A＝sigmod(ZZT)
wherein A represents an adjacency matrix, Z represents an encoding matrix, ZTRepresenting the transpose of the encoding matrix.
Value A of i row and j column of adjacent matrixijRepresenting the probability that a connecting edge exists between node i and node j. Through the adjacency matrix, structural features between nodes in the graph can be characterized.
Thirdly, a first error of the corresponding nodes in the map to be detected and the target map about the node features is determined, and a second error of the corresponding nodes in the map to be detected and the target map about the structural features is determined according to the adjacent matrixes respectively corresponding to the map to be detected and the target map.
In the implementation mode, for each node in the to-be-detected map, determining a distance between a node feature of the node in the to-be-detected map and a node feature corresponding to the node in the target map as a first error; and determining the structural feature corresponding to the node from the adjacency matrix corresponding to the graph to be detected, determining the structural feature corresponding to the node from the adjacency matrix corresponding to the target graph, and further determining a second error based on the structural features of the node and the target graph.
Fourthly, for each node in the graph to be detected, determining a difference value of the node according to the first error and the second error corresponding to the node.
In this implementation, the first error and the second error may be weighted to obtain a difference value. Specifically, the difference value can be determined by the following formula:
score(vi)＝αLG(vi)+(1-α)LD(vi)
wherein, score (v)i) Representing a node viDifference value of (2)And alpha represents a node viFirst error L ofG(vi) Weight of (1), LD(vi) Representing a node viThe second error of (2).
In some optional implementations of this embodiment, the executing body may execute the third step by:
for each node in the map to be examined, the following operations are performed:
first, the L2 norm of the difference between the feature vector of the node and the feature vector of the node corresponding to the node in the target graph is determined as the first error corresponding to the node.
Specifically, the first error may be determined as follows:
LG(vi)＝||xi-x′i||2
wherein x isiRepresenting node feature x 'of one node in to-be-detected mapping'iNode characteristics of corresponding nodes in the target graph are represented.
And then, according to the structural characteristics which characterize the existence probability of the connecting edge between the node and the associated node in the adjacent matrix corresponding to the graph to be detected and the structural characteristics which characterize the existence probability of the connecting edge between the node corresponding to the node and the associated node in the adjacent matrix corresponding to the target graph, determining a second error corresponding to the node.
Specifically, the second error may be determined as follows:
wherein A isijRepresenting structural features, A ', between nodes and associated nodes in the target graph'ijRepresenting structural features between nodes and associated nodes in the to-be-inspected graph, n representing node viσ denotes the sigmod function.
In some alternative implementations of this embodiment, the generating network and the encoder each comprise a multi-layer perceptron or neural network.
As an example, when the generating network and the encoder are both multilayer perceptrons, the number of layers of the perceptron can be specifically set according to actual situations. For example, the number of layers of the perceptron may be 3. The perceptron may be represented by the following equation:
Hi+1＝f(WiHi+bi)
wherein, Wi、Hi、biRespectively representing the weight, input, bias of the i-th layer perceptron, f representing the activation function, e.g. relu activation function, Hi+1And the output of the i-th layer perceptron is shown, namely the input of the i + 1-th layer perceptron.
As yet another example, the generating network and the encoder are each a plurality of stacked neural networks, such as convolutional neural networks, residual neural networks, and the like.
And step 203, determining abnormal nodes in the to-be-detected map according to the abnormal values of each node in the to-be-detected map.
In this embodiment, the execution subject may determine an abnormal node in the to-be-detected map according to an abnormal value of each node in the to-be-detected map
As an example, the execution subject may set an abnormal threshold in advance, and when an abnormal value of a node exceeds the abnormal threshold, the node is determined to be an abnormal node. The anomaly threshold may be specifically set based on an empirical value or an actual situation, and is not limited herein.
With continued reference to fig. 3, fig. 3 is a schematic diagram 300 of an application scenario of the graph node anomaly detection method according to the present embodiment. In the application scenario of fig. 3, first, the server acquires a diagram to be examined 301. Then, to-be-inspected map 301 is input to a previously trained abnormality detection model 302 based on generation of a countermeasure network, and an abnormality value representing the degree of abnormality of each node in to-be-inspected map 301 is determined. Wherein the abnormal value is determined based on a first error with respect to the node feature between the diagram to be inspected 301 and the corresponding node in the target diagram 303, and a second error with respect to the structural feature between the corresponding nodes, the target diagram 303 being generated by the generation network 3021 in the abnormality detection model with reference to the diagram to be inspected 301. Finally, the abnormal nodes in map to be detected 301 are determined according to the abnormal value of each node in map to be detected 301.
The method provided by the above embodiment of the present application, by obtaining a to-be-detected map; inputting the diagram to be detected into a pre-trained abnormal detection model based on a generated countermeasure network, and determining an abnormal value representing the abnormal degree of each node in the diagram to be detected, wherein the abnormal value is determined according to a first error between the diagram to be detected and the corresponding node in a target diagram and a second error between the corresponding nodes and the structural feature, and the target diagram is generated by referring to the diagram to be detected by a generation network in the abnormal detection model; according to the abnormal value of each node in the diagram to be detected, the abnormal node in the diagram to be detected is determined, so that a diagram node abnormal detection mode based on a generated countermeasure network is provided, and the accuracy of node abnormal detection is improved.
In some optional implementations of the embodiment, the execution subject may obtain the abnormality detection model through training in the following manner:
first, a training sample set is obtained.
Wherein the training samples in the training sample set comprise sample graphs.
Secondly, by using a machine learning method, an initial generation network in the initial anomaly detection model takes a sample graph in a training sample set as expected output, generates a training process target graph, obtains an adjacent matrix corresponding to each of the sample graph and the training process target graph based on a coding matrix corresponding to each of the sample graph and the training process target graph obtained by a coder, takes the adjacent matrix corresponding to each of the sample graph and the training process target graph as input of an initial discrimination network, identifies whether the input adjacent matrix corresponds to the sample graph or the training process target graph through the initial discrimination network, and trains the initial anomaly detection model to obtain the anomaly detection model.
In the model training process, on the premise of representing the discrimination capability of the maximum discrimination network, the objective function of the discrimination capability of the generation network of the discrimination network is minimized.
Specifically, the objective function is as follows:
d, E, G denotes a discrimination network, an encoder, and a generation network,
the graph representing the input is a real sample graph,
the adjacency matrix Z representing the correspondence of the sample graph comes from the encoded representation E (x) of the encoder E,
the graph representing the input is the training process target graph generated by the generation network G,
the adjacency matrix Z 'representing the target graph of the training process comes from the encoded representation E (x') of the encoder E,
and on the premise of maximizing the discrimination capability of the discrimination network, the discrimination capability of the discrimination network on the generation network is minimized.
During the training process of the model, the generation network and the discrimination network can be alternately trained. Specifically, in each round of training, the network G is optimized and generated, and then the discrimination network D is optimized and determined. For example, consider the optimization generation network G and the optimization discrimination network D as two optimization problems, and decompose the above objective formula into the following two formulas:
when the network G is generated in an optimized mode, the following steps are adopted:
when optimizing and distinguishing the network D, the following steps are adopted:
with continuing reference to FIG. 4, an exemplary flow 400 of one embodiment of a graph node anomaly detection method according to the present application is shown, comprising the steps of:
And 402, generating a target graph through the generation network, and respectively generating coding matrixes corresponding to the graph to be detected and the target graph through a coder.
And step 403, determining the adjacent matrixes respectively corresponding to the to-be-detected map and the target map according to the coding matrixes respectively corresponding to the to-be-detected map and the target map.
And step 406, determining abnormal nodes in the to-be-detected map according to the abnormal values of each node in the to-be-detected map.
As can be seen from this embodiment, compared with the embodiment corresponding to fig. 2, the flow 400 of the method for detecting an anomaly of a graph node in this embodiment specifically illustrates an information processing procedure of an anomaly detection model, so as to further improve the accuracy of node anomaly detection.
With continuing reference to fig. 5, as an implementation of the method shown in the above-mentioned figures, the present application provides an embodiment of a graph node abnormality detection apparatus, where the embodiment of the apparatus corresponds to the embodiment of the method shown in fig. 2, and the apparatus may be specifically applied to various electronic devices.
As shown in fig. 5, the map node abnormality detection apparatus includes: an acquisition unit 501 configured to acquire a diagram to be inspected; a first determination unit 502 configured to input the to-be-inspected map into a pre-trained abnormality detection model based on a generation countermeasure network, and determine an abnormal value characterizing the degree of abnormality of each node in the to-be-inspected map, wherein the abnormal value is determined based on a first error with respect to a node feature between the to-be-inspected map and a corresponding node in a target map generated by the generation network in the abnormality detection model with reference to the to-be-inspected map, and a second error with respect to a structural feature between the corresponding nodes; a second determining unit 503 configured to determine an abnormal node in the to-be-detected map based on the abnormal value of each node in the to-be-detected map.
In some embodiments, the first determining unit 502 is further configured to: generating a target image through a generation network, and respectively generating coding matrixes corresponding to the to-be-detected image and the target image through a coder; determining adjacent matrixes respectively corresponding to the image to be detected and the target image according to the coding matrixes respectively corresponding to the image to be detected and the target image; determining a first error between the to-be-detected map and a corresponding node in the target map about the node feature, and determining a second error between the to-be-detected map and the corresponding node in the target map about the structure feature according to the adjacency matrixes respectively corresponding to the to-be-detected map and the target map; and for each node in the graph to be detected, determining a difference value of the node according to a first error and a second error corresponding to the node.
In some embodiments, the first determining unit 502 is further configured to: for each node in the map to be examined, the following operations are performed: determining an L2 norm of a difference between the feature vector of the node and the feature vector of the node corresponding to the node in the target graph as a first error corresponding to the node; and determining a second error corresponding to the node according to the structural characteristic representing the existence probability of the connecting edge between the node and the associated node in the adjacent matrix corresponding to the graph to be detected and the structural characteristic representing the existence probability of the connecting edge between the node corresponding to the node and the associated node in the adjacent matrix corresponding to the target graph.
In some embodiments, the generating network and the encoder each comprise a multi-layer perceptron or neural network.
In some embodiments, the above apparatus further comprises: a training unit (not shown in the figure) configured to train an anomaly detection model by: acquiring a training sample set, wherein training samples in the training sample set comprise sample graphs; the method comprises the steps of utilizing a machine learning method, enabling an initial generation network in an initial anomaly detection model to take a sample image in a training sample set as expected output, generating a training process target image, obtaining an adjacent matrix corresponding to the sample image and the training process target image based on a coding matrix corresponding to the sample image and the training process target image obtained by a coder, taking the adjacent matrix corresponding to the sample image and the training process target image as input of an initial discrimination network, identifying whether the input adjacent matrix corresponds to the sample image or the training process target image through the initial discrimination network, training the initial anomaly detection model, and obtaining the anomaly detection model, wherein in the model training process, a target function representing the discrimination capability of the maximum discrimination network is adopted, and the discrimination capability of the discrimination network on the generation network is minimized.
In this embodiment, an acquisition unit in the map node abnormality detection apparatus acquires a diagram to be detected; the first determining unit inputs the to-be-detected map into a pre-trained anomaly detection model based on a generation countermeasure network, and determines an abnormal value representing the degree of anomaly of each node in the to-be-detected map, wherein the abnormal value is determined according to a first error between the to-be-detected map and a corresponding node in a target map, which is generated by a generation network in the anomaly detection model with reference to the to-be-detected map, with respect to node features, and a second error between the corresponding nodes with respect to structural features; the second determination unit determines abnormal nodes in the to-be-detected map according to the abnormal value of each node in the to-be-detected map, so that the map node abnormality detection device based on the generation countermeasure network is provided, and the accuracy of node abnormality detection is improved.
Referring now to FIG. 6, shown is a block diagram of a computer system 600 suitable for use in implementing devices of embodiments of the present application (e.g., devices 101, 102, 103, 105 shown in FIG. 1). The apparatus shown in fig. 6 is only an example, and should not bring any limitation to the function and use range of the embodiments of the present application.
As shown in fig. 6, the computer system 600 includes a processor (e.g., CPU, central processing unit) 601 that can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM)602 or a program loaded from a storage section 608 into a Random Access Memory (RAM) 603. In the RAM603, various programs and data necessary for the operation of the system 600 are also stored. The processor 601, the ROM602, and the RAM603 are connected to each other via a bus 604. An input/output (I/O) interface 605 is also connected to bus 604.
The following components are connected to the I/O interface 605: an input portion 606 including a keyboard, a mouse, and the like; an output portion 607 including a display such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, and a speaker; a storage section 608 including a hard disk and the like; and a communication section 609 including a network interface card such as a LAN card, a modem, or the like. The communication section 609 performs communication processing via a network such as the internet. The driver 610 is also connected to the I/O interface 605 as needed. A removable medium 611 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 610 as necessary, so that a computer program read out therefrom is mounted in the storage section 608 as necessary.
In particular, according to embodiments of the application, the processes described above with reference to the flow diagrams may be implemented as computer software programs. For example, embodiments of the present application include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method illustrated by the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication section 609, and/or installed from the removable medium 611. The computer program, when executed by the processor 601, performs the above-described functions defined in the method of the present application.
It should be noted that the computer readable medium of the present application can be a computer readable signal medium or a computer readable storage medium or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present application, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In this application, however, a computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, fiber optic cable, RF, etc., or any suitable combination of the foregoing.
Computer program code for carrying out operations for aspects of the present application may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the client computer, partly on the client computer, as a stand-alone software package, partly on the client computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the client computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider).
The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The units described in the embodiments of the present application may be implemented by software or hardware. The described units may also be provided in a processor, and may be described as: a processor includes an acquisition unit, a first determination unit, and a second determination unit. Where the names of these units do not constitute a limitation on the unit itself in some cases, for example, the first determination unit may also be described as "a unit that inputs the to-be-inspected map into a pre-trained abnormality detection model based on generation of a countermeasure network, and determines an abnormality value that characterizes the degree of abnormality of each node in the to-be-inspected map".
As another aspect, the present application also provides a computer-readable medium, which may be contained in the apparatus described in the above embodiments; or may be separate and not incorporated into the device. The computer readable medium carries one or more programs which, when executed by the apparatus, cause the computer device to: acquiring a diagram to be detected; inputting the diagram to be detected into a pre-trained abnormal detection model based on a generated countermeasure network, and determining an abnormal value representing the abnormal degree of each node in the diagram to be detected, wherein the abnormal value is determined according to a first error between the diagram to be detected and the corresponding node in a target diagram and a second error between the corresponding nodes and the structural feature, and the target diagram is generated by referring to the diagram to be detected by a generation network in the abnormal detection model; and determining abnormal nodes in the to-be-detected map according to the abnormal values of each node in the to-be-detected map.
The above description is only a preferred embodiment of the application and is illustrative of the principles of the technology employed. It will be appreciated by those skilled in the art that the scope of the invention herein disclosed is not limited to the particular combination of features described above, but also encompasses other arrangements formed by any combination of the above features or their equivalents without departing from the spirit of the invention. For example, the above features may be replaced with (but not limited to) features having similar functions disclosed in the present application.
Claims (12)
1. A method for detecting the abnormity of a graph node comprises the following steps:
acquiring a diagram to be detected;
inputting the diagram to be detected into a pre-trained abnormal detection model based on a generation countermeasure network, and determining an abnormal value representing the abnormal degree of each node in the diagram to be detected, wherein the abnormal value is determined according to a first error between the diagram to be detected and the corresponding node in a target diagram and a second error between the corresponding nodes and a structural feature, and the target diagram is generated by the generation network in the abnormal detection model referring to the diagram to be detected;
and determining abnormal nodes in the to-be-detected map according to the abnormal values of each node in the to-be-detected map.
2. The method of claim 1, wherein said inputting said to-be-inspected map into a pre-trained anomaly detection model based on generation of a countermeasure network, determining an anomaly value characterizing a degree of anomaly for each node in said to-be-inspected map, comprises:
generating the target graph through the generation network, and respectively generating coding matrixes corresponding to the to-be-detected graph and the target graph through a coder;
determining adjacent matrixes respectively corresponding to the to-be-detected map and the target map according to the coding matrixes respectively corresponding to the to-be-detected map and the target map;
determining a first error between the to-be-detected map and a corresponding node in the target map about node features, and determining a second error between the to-be-detected map and the corresponding node in the target map about structural features according to the adjacency matrixes respectively corresponding to the to-be-detected map and the target map;
and for each node in the graph to be detected, determining a difference value of the node according to a first error and a second error corresponding to the node.
3. The method of claim 2, wherein said determining a first error in node features between said suspect map and corresponding nodes in said target map, and determining a second error in structural features between said suspect map and corresponding nodes in said target map based on an adjacency matrix to which said suspect map and said target map each correspond, comprises:
for each node in the map to be examined, performing the following operations:
determining an L2 norm of a difference between the feature vector of the node and the feature vector of the node corresponding to the node in the target graph as a first error corresponding to the node;
and determining a second error corresponding to the node according to the structural characteristic representing the existence probability of the connecting edge between the node and the associated node in the adjacent matrix corresponding to the graph to be detected and the structural characteristic representing the existence probability of the connecting edge between the node corresponding to the node and the associated node in the adjacent matrix corresponding to the target graph.
4. The method of claim 2, wherein the generating network and the encoder each comprise a multi-layer perceptron or neural network.
5. The method of claim 2, wherein the anomaly detection model is trained by:
acquiring a training sample set, wherein training samples in the training sample set comprise sample graphs;
by utilizing a machine learning method, an initial generation network in an initial anomaly detection model takes a sample graph in the training sample set as expected output to generate a training process target graph, obtains adjacent matrixes corresponding to the sample graph and the training process target graph based on coding matrixes corresponding to the sample graph and the training process target graph obtained by a coder, and takes the adjacent matrixes corresponding to the sample graph and the training process target graph as input of an initial discrimination network, identifying whether the input adjacency matrix corresponds to the sample graph or the training process target graph through the initial discrimination network, training the initial anomaly detection model to obtain the anomaly detection model, in the model training process, on the premise of representing the discrimination capability of the maximum discrimination network, the objective function of the discrimination capability of the generation network of the discrimination network is minimized.
6. A graph node abnormality detection apparatus comprising:
an acquisition unit configured to acquire a to-be-inspected map;
a first determination unit configured to input the to-be-inspected map into a pre-trained abnormality detection model based on a generation countermeasure network, and determine an abnormal value characterizing an abnormality degree of each node in the to-be-inspected map, wherein the abnormal value is determined based on a first error regarding a node feature between the to-be-inspected map and a corresponding node in a target map generated by the generation network in the abnormality detection model with reference to the to-be-inspected map, and a second error regarding a structural feature between the corresponding nodes;
a second determination unit configured to determine an abnormal node in the to-be-detected map based on the abnormal value of each node in the to-be-detected map.
7. The apparatus of claim 6, wherein the first determining unit is further configured to:
generating the target graph through the generation network, and respectively generating coding matrixes corresponding to the to-be-detected graph and the target graph through a coder; determining adjacent matrixes respectively corresponding to the to-be-detected map and the target map according to the coding matrixes respectively corresponding to the to-be-detected map and the target map; determining a first error between the to-be-detected map and a corresponding node in the target map about node features, and determining a second error between the to-be-detected map and the corresponding node in the target map about structural features according to the adjacency matrixes respectively corresponding to the to-be-detected map and the target map; and for each node in the graph to be detected, determining a difference value of the node according to a first error and a second error corresponding to the node.
8. The apparatus of claim 7, wherein the first determining unit is further configured to:
for each node in the map to be examined, performing the following operations: determining an L2 norm of a difference between the feature vector of the node and the feature vector of the node corresponding to the node in the target graph as a first error corresponding to the node; and determining a second error corresponding to the node according to the structural characteristic representing the existence probability of the connecting edge between the node and the associated node in the adjacent matrix corresponding to the graph to be detected and the structural characteristic representing the existence probability of the connecting edge between the node corresponding to the node and the associated node in the adjacent matrix corresponding to the target graph.
9. The apparatus of claim 7, wherein the generating network and the encoder each comprise a multi-layer perceptron or neural network.
10. The apparatus of claim 7, further comprising: a training unit configured to train the anomaly detection model by:
acquiring a training sample set, wherein training samples in the training sample set comprise sample graphs; by utilizing a machine learning method, an initial generation network in an initial anomaly detection model takes a sample graph in the training sample set as expected output to generate a training process target graph, obtains adjacent matrixes corresponding to the sample graph and the training process target graph based on coding matrixes corresponding to the sample graph and the training process target graph obtained by a coder, and takes the adjacent matrixes corresponding to the sample graph and the training process target graph as input of an initial discrimination network, identifying whether the input adjacency matrix corresponds to the sample graph or the training process target graph through the initial discrimination network, training the initial anomaly detection model to obtain the anomaly detection model, in the model training process, on the premise of representing the discrimination capability of the maximum discrimination network, the objective function of the discrimination capability of the generation network of the discrimination network is minimized.
11. A computer-readable medium, on which a computer program is stored, wherein the program, when executed by a processor, implements the method of any one of claims 1-5.
12. An electronic device, comprising:
one or more processors;
a storage device having one or more programs stored thereon,
when executed by the one or more processors, cause the one or more processors to implement the method of any one of claims 1-5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110433543.2A CN113822313A (en) | 2021-04-20 | 2021-04-20 | Method and device for detecting abnormity of graph nodes |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110433543.2A CN113822313A (en) | 2021-04-20 | 2021-04-20 | Method and device for detecting abnormity of graph nodes |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN113822313A true CN113822313A (en) | 2021-12-21 |
Family
ID=78923759
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110433543.2A Pending CN113822313A (en) | 2021-04-20 | 2021-04-20 | Method and device for detecting abnormity of graph nodes |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113822313A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114363212A (en) * | 2021-12-27 | 2022-04-15 | 绿盟科技集团股份有限公司 | Equipment detection method, device, equipment and storage medium |
-
2021
- 2021-04-20 CN CN202110433543.2A patent/CN113822313A/en active Pending
Non-Patent Citations (1)
| Title |
|---|
| ZHENXING CHEN ETAL: "Generative Adversarial Atributed Network Anomaly Detection", CIKM \'20, pages 1989 - 1992 * |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114363212A (en) * | 2021-12-27 | 2022-04-15 | 绿盟科技集团股份有限公司 | Equipment detection method, device, equipment and storage medium |
| CN114363212B (en) * | 2021-12-27 | 2023-12-26 | 绿盟科技集团股份有限公司 | Equipment detection method, device, equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11163991B2 (en) | Method and apparatus for detecting body | |
| US11227187B1 (en) | Generating artificial intelligence solutions using raw data and simulated data | |
| CN108197652B (en) | Method and apparatus for generating information | |
| EP3819790A2 (en) | Method and apparatus for visual question answering, computer device and medium | |
| CN110659723B (en) | Data processing method and device based on artificial intelligence, medium and electronic equipment | |
| CN111046027B (en) | Missing value filling method and device for time series data | |
| US20200110965A1 (en) | Method and apparatus for generating vehicle damage information | |
| EP3859560A2 (en) | Method and apparatus for visual question answering, computer device and medium | |
| EP4006909B1 (en) | Method, apparatus and device for quality control and storage medium | |
| CN109766418B (en) | Method and apparatus for outputting information | |
| WO2023015935A1 (en) | Method and apparatus for recommending physical examination item, device and medium | |
| US20210312288A1 (en) | Method for training classification model, classification method, apparatus and device | |
| CN111222981A (en) | Credibility determination method, device, equipment and storage medium | |
| CN112949767A (en) | Sample image increment, image detection model training and image detection method | |
| CN112966701A (en) | Method and device for classifying objects | |
| CN113837151A (en) | Table image processing method and device, computer equipment and readable storage medium | |
| CN112990281A (en) | Abnormal bid identification model training method, abnormal bid identification method and abnormal bid identification device | |
| CN110490304B (en) | Data processing method and device | |
| CN115034315A (en) | Business processing method and device based on artificial intelligence, computer equipment and medium | |
| CN114357170A (en) | Model training method, analysis method, device, equipment and medium | |
| CN114120454A (en) | Training method and device of living body detection model, electronic equipment and storage medium | |
| CN113822313A (en) | Method and device for detecting abnormity of graph nodes | |
| CN116155628B (en) | Network security detection method, training device, electronic equipment and medium | |
| US11341394B2 (en) | Diagnosis of neural network | |
| CN113762454A (en) | Track abnormity detection method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |