CN116128024A - Multi-view contrast self-supervision attribute network abnormal point detection method - Google Patents

Multi-view contrast self-supervision attribute network abnormal point detection method Download PDF

Info

Publication number
CN116128024A
CN116128024A CN202211445037.6A CN202211445037A CN116128024A CN 116128024 A CN116128024 A CN 116128024A CN 202211445037 A CN202211445037 A CN 202211445037A CN 116128024 A CN116128024 A CN 116128024A
Authority
CN
China
Prior art keywords
view
node
attribute
graph
target node
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202211445037.6A
Other languages
Chinese (zh)
Inventor
冯潞飞
孙越恒
王文俊
邵明来
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tianjin University
Original Assignee
Tianjin University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tianjin University filed Critical Tianjin University
Priority to CN202211445037.6A priority Critical patent/CN116128024A/en
Publication of CN116128024A publication Critical patent/CN116128024A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • G06N3/084—Backpropagation, e.g. using gradient descent
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G06V10/74—Image or video pattern matching; Proximity measures in feature spaces
    • G06V10/761—Proximity, similarity or dissimilarity measures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G06V10/764—Arrangements for image or video recognition or understanding using pattern recognition or machine learning using classification, e.g. of video objects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G06V10/77—Processing image or video features in feature spaces; using data integration or data reduction, e.g. principal component analysis [PCA] or independent component analysis [ICA] or self-organising maps [SOM]; Blind source separation
    • G06V10/774—Generating sets of training patterns; Bootstrap methods, e.g. bagging or boosting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G06V10/82—Arrangements for image or video recognition or understanding using pattern recognition or machine learning using neural networks

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Evolutionary Computation (AREA)
  • Artificial Intelligence (AREA)
  • General Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Computing Systems (AREA)
  • Software Systems (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Multimedia (AREA)
  • Medical Informatics (AREA)
  • Databases & Information Systems (AREA)
  • Biomedical Technology (AREA)
  • Mathematical Physics (AREA)
  • General Engineering & Computer Science (AREA)
  • Molecular Biology (AREA)
  • Data Mining & Analysis (AREA)
  • Computational Linguistics (AREA)
  • Biophysics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Testing And Monitoring For Control Systems (AREA)

Abstract

The invention discloses a multi-view comparison self-supervision attribute network abnormal point detection method, which combines the node structure and attribute information characteristics of an attribute network, provides a new comparison example pair, and applies multi-view sampling to comparison learning abnormal detection, so that the network abnormal detection can grasp the abnormality on the structure and the abnormality on the attribute at the same time. Mainly comprises the following steps: performing exception injection on the attribute network; performing multi-view sampling to obtain multi-view comparison example pairs; designing and training a multi-view graph neural network contrast learning model; using a trained comparison learning model to carry out an reasoning stage and calculating an abnormality score; and judging whether the node is abnormal or not according to the abnormality score, and marking the abnormal node. By carrying out extensive experiments on various data sets, the method not only can effectively improve the abnormality detection accuracy, but also can mine the abnormality with practical significance existing in the network.

Description

Multi-view contrast self-supervision attribute network abnormal point detection method
Technical Field
The invention relates to the field of network security, in particular to a multi-view comparison self-supervision attribute network abnormal point detection method.
Background
In recent years, a great deal of research has focused on the task of detecting attribute network anomalies, and attribute network anomalies are mainly classified into two types, namely traditional non-deep anomaly detection and deep anomaly detection.
Traditional non-deep anomaly detection adopts different decomposition strategies to extract valuable information from graph structures and node attributes, then finds abnormal nodes through scoring functions or residual analysis, and uses a matrix decomposition (MF) technology in an important way. AMEN [1] considers each node's own network information and discovers the abnormal neighborhood on the attribute network. In addition, some research has focused on finding outlier nodes in the node feature subspace. ANOMALOUS [2] further incorporates CUR decomposition into residual analysis to mitigate the adverse effects of noise features on anomaly detection. However, these methods are limited by their shallow mechanisms and cannot address key issues of attribute networks such as network sparsity, data nonlinearity, and complex pattern interactions and computational challenges between different information sources. With the rapid development of deep learning for anomaly detection, researchers have proposed a deep learning-based approach to solve anomaly detection problems on attribute networks.
Recently, deep learning has become an extremely important part in artificial intelligence and machine learning, and potentially complex patterns in extracted data exhibit superior performance, and have been widely used in the fields of audio, image, natural language processing, and the like. The deep learning method can effectively process complex attribute information and learn implicit rules from data. The following is a common method of depth anomaly detection:
learning based on network representation: encoding the graph structure into an embedded vector space, aggregating neighbor information into a central node, and finding the relative scale between the abnormal node and the normal node edge through training a loss function.
Based on graph convolution neural network: the representation of the node is generated by the GCN layer and then anomalies are detected from the reconstruction of its neural network (where reconstruction loss is the anomaly score) or the distribution of the embedded space (where anomaly ranking is based on density estimates). DOMINANT 3 construction map auto-encoder simultaneously reconstructs attribute and structure information and evaluates the anomaly by reconstruction error.
Graph-based attention network: given an input graph, the node embedding is learned with a attentive mechanism for any vertex on the graph. The unsupervised technique AnomalyDAE [4] scores each node according to reconstruction loss and marks top-k nodes as outliers.
Based on contrast learning: nodes are learned by comparing positive instance pairs with negative instance pairs. A contrast learning model is designed to learn the vector representation of the node-subgraph instance pairs, and the abnormal score calculation is carried out on the nodes through a discriminator.
[ reference ]
[1]Perozzi B,Akoglu L.Scalable anomaly ranking of attributed neighborhoods[C].In Proceedings of the 2016SIAM International Conference on Data Mining,2016:207–215.
[2]Peng Z,Luo M,Li J,et al.ANOMALOUS:A Joint Modeling Approach for Anomaly Detection on Attributed Networks.[C].In IJCAI,2018:3513–3519.
[3]Ding K,Li J,Bhanushali R,et al.Deep anomaly detection on attributed networks[C].In Proceedings of the 2019SIAM International Conference on Data Mining,2019:594–602.
[4]Fan H,Zhang F,Li Z.AnomalyDAE:Dual autoencoder for anomaly detection on attributed networks[C].In ICASSP 2020-2020IEEE International Conference on Acoustics,Speech and Signal Processing(ICASSP),2020:5685–5689.
Disclosure of Invention
Because the traditional attribute network anomaly detection algorithm cannot process large-scale data, feature attribute information is ignored, and the deep learning algorithm processes feature information more strongly, but most of the work aims at learning data representation and is not directed at detecting anomalies. Therefore, the invention provides a multi-view comparison self-supervision attribute network abnormal point detection method to realize the abnormal detection of a large-scale attribute network.
In order to solve the technical problems, the invention provides a multi-view contrast self-supervision attribute network abnormal point detection method, which comprises the following steps:
firstly, carrying out abnormal injection on an attribute network, wherein the abnormal injection comprises structural abnormal injection and attribute abnormal injection;
step two, multi-view sampling is carried out to obtain a multi-view comparison example pair, which comprises the following steps:
2-1) selecting a target node from the attribute network after the anomaly injection, and randomly traversing each node in the attribute network as the target node;
2-2) sub-sampling the same target node through a sampler based on the structural importance and the attribute phase similarity to obtain a local sub-graph 1 and a local sub-graph 2 corresponding to the target node, wherein the local sub-graph 1 and the local sub-graph 2 are marked as view angles 1 based on the structural importance and view angles 2 based on the attribute phase similarity; in the process of obtaining the local sub-graph 1, the introduced breadth-first parameter p and depth-first parameter q are used for controlling the wander, p is greater than 1, q is less than 1, and in the process of obtaining the local sub-graph 2, the wander is controlled by calculating the attribute similarity of the target node;
2-3) anonymizing the two partial subgraphs obtained in the step 2-2), and setting the attribute vector of the target node as a zero vector;
2-4) merging the anonymized target node with the partial sub-graph 1 into one set of instance pairs, and merging the anonymized target node with the partial sub-graph 2 into another set of instance pairs; respectively storing the positive sample pairs and the negative sample pairs of the two groups of example pairs into two corresponding sample pools;
step three, designing and training a multi-view graph neural network contrast learning model, which comprises the following steps:
3-1) designing a multi-view neural network contrast learning model, wherein the multi-view neural network contrast learning model comprises a multi-view neural network module, a reading module and a discriminator module; the multi-view graph neural network module respectively obtains sub-graph representations and target node representations of two views through two graph convolution neural networks; the readout module changes the sub-graph representation into a sub-graph vector representation, using an average pool function as a readout function; the discriminator module compares the node vector representation and the sub-graph vector representation in the instance pair using a bilinear scoring function;
3-2) initializing parameters (W) of the multi-view neural network contrast learning model (0) ，W (L) ，W (d) ) W is a weight matrix of the discriminator; training the contrast learning model by using a binary classification objective function to obtain a prediction score of a node for training, and updating contrast learning model parameters by using the prediction score and the binary classification objective function in a back propagation way;
step four, performing an reasoning stage by using a trained contrast learning model, obtaining a predicted score of the node by using updated contrast learning model parameters and simultaneously using a binary classification objective function, and obtaining a final abnormal score by taking an average value through multiple rounds of calculation;
and fifthly, regarding a target node with an anomaly score of 0.5+/-0.05 as an anomaly node, marking the anomaly node as 1, and marking a non-anomaly node as 0.
Further, the multi-view contrast self-supervision attribute network outlier detection method of the invention, wherein:
in step 2-4): the two sets of example pairs are represented as follows:
Figure BDA0003949898160000031
Figure BDA0003949898160000032
in the formula (1), the components are as follows,
Figure BDA0003949898160000033
is an example pair corresponding to view 1, +.>
Figure BDA0003949898160000034
Is an example pair corresponding to view 2, +.>
Figure BDA0003949898160000035
For view 1 target node, +.>
Figure BDA0003949898160000036
For view 2 target node, +.>
Figure BDA0003949898160000037
For partial sub-picture 2->
Figure BDA0003949898160000038
For partial sub-picture 1, ">
Figure BDA0003949898160000039
Is a label of view 1 example pair, wherein +.>
Figure BDA00039498981600000310
Representation->
Figure BDA00039498981600000311
Is a negative example pair, ++>
Figure BDA00039498981600000312
Representation->
Figure BDA00039498981600000313
Is a positive example pair. />
Figure BDA00039498981600000314
Is a label of view 2 example pair, wherein +.>
Figure BDA00039498981600000315
Representation->
Figure BDA00039498981600000316
Is a negative example pair, ++>
Figure BDA00039498981600000317
Representation->
Figure BDA00039498981600000318
Is a positive example pair.
In step 3-1): the sub-graph representation is shown in equation (2):
Figure BDA00039498981600000319
in the formula (2), the amino acid sequence of the compound,
Figure BDA00039498981600000320
representing a matrix for the hidden layer->
Figure BDA00039498981600000321
Is a hidden layer weight matrix->
Figure BDA00039498981600000322
Is a sub-graph adjacency matrix, phi is an activation function, < ->
Figure BDA00039498981600000323
Is the degree matrix of the subgraph;
equation (3) shows the target node representation:
Figure BDA00039498981600000324
in the formula (3), the amino acid sequence of the compound,
Figure BDA00039498981600000325
hidden representation row vectors for target nodes learned by layer (l-1) and layer (l), respectively, will be input +.>
Figure BDA00039498981600000326
Defined as the attribute row vector of the target node,and marks the output as the target node vector representation +.>
Figure BDA00039498981600000327
The read-out function is shown as a formula (4):
Figure BDA00039498981600000328
in the formula (4), the amino acid sequence of the compound,
Figure BDA0003949898160000041
representing vectors for subgraphs, (E) i ) Subgraph representation matrix, (E) i ) k Is (E) i ) Readout represents the read function.
In step 3-2), the predictive score of the node for training is calculated by the equation (5) and the equation (6):
Figure BDA0003949898160000042
Figure BDA0003949898160000043
in the formulas (5) and (6),
Figure BDA0003949898160000044
the predictor representing the view 1 target node is a bilinear scoring function, dispeimator +.>
Figure BDA0003949898160000045
Representing view 1 target node vector representation, +.>
Figure BDA0003949898160000046
Representing view 2 sub-picture vector representation, < >>
Figure BDA0003949898160000047
Weight for view angle 1 discriminatorMatrix, σ is an sigmoid function; />
Figure BDA0003949898160000048
Representing the predictive score of view 2 target node, +.>
Figure BDA0003949898160000049
Representing view 2 target node vector representation, +.>
Figure BDA00039498981600000410
Representing view 1 sub-picture representation vector, ">
Figure BDA00039498981600000411
Is a view angle 2 discriminant weight matrix. />
In the third and fourth steps, the binary classification objective function is as follows:
Figure BDA00039498981600000412
in equation (7), CLM () is a multiview neural network contrast learning model.
In the fourth step, the abnormal score calculation formula is as follows:
Figure BDA00039498981600000413
in equation (8), f () is an anomaly score mapping function,
Figure BDA00039498981600000414
is the predictive fraction of the view 1 negative example pair, for example>
Figure BDA00039498981600000415
Is the predictive fraction of the view 1 positive example pair, for example>
Figure BDA00039498981600000416
Is the predictive fraction of the view 2 negative example pair, for example>
Figure BDA00039498981600000417
Is the predictive score for a positive instance pair for view 2.
Compared with the prior art, the invention has the beneficial effects that:
the multi-view comparison self-supervision attribute network anomaly point detection method (which is simply called MV-CoLA in the invention) provided by the invention is compared with four attribute network anomaly detection methods (an attribute network anomaly detection-based joint modeling method-ANOMALOUS, an attribute network depth anomaly detection method-DOMINANT, a graph depth maximization mutual information method-DGI, and a comparison self-supervision learning attribute network anomaly detection method-CoLA). AUC value: the ROC curve is a graph of true positive rate (abnormality is identified as abnormal) and false positive rate (normal node is identified as abnormal) based on the ground true abnormality label and the abnormality detection result. AUC values are the areas under the ROC curves and represent the probability that randomly selected outlier nodes are ranked higher than outlier nodes. AUC is close to 1, indicating that the method has higher performance. By calculating the area under the ROC curve, the AUC values of the different comparison methods at the 6 data sets are shown in table 3, and the method of the present invention achieves the best abnormality detection performance on all 6 data sets. The average AUC of the method of the invention is improved compared to the optimal result of the comparison method CoLA. The main reason is that the relation and attribute characteristics between each node and the local subgraph thereof are successfully captured through multi-view instance pair sampling in the method, and the anomaly scores are calculated from the context and structure information by using a multi-view GNN contrast learning model.
Drawings
FIG. 1 is a block diagram of a multi-view contrast self-supervision attribute network outlier detection method of the present invention;
FIG. 2 is a schematic diagram of the multi-view sampling shown in FIG. 1;
FIG. 3 is a flow chart of a method for detecting abnormal points of a multi-view contrast self-supervision attribute network according to the invention;
FIG. 4 is a graph showing the result of detecting anomalies in a local paper collaboration network for 6000 nodes in an embodiment of the present invention;
FIGS. 5-1 and 5-2 are distributions of the mechanism to which the top 1000 anomaly nodes correspond in an embodiment of the present invention.
Detailed Description
The invention provides a design conception of a multi-view contrast self-supervision attribute network abnormal point detection method, which comprises the following steps: by combining the node structure and attribute information characteristics of the attribute network, a new comparison example pair is provided, and multi-view sampling is applied to comparison learning anomaly detection, so that the anomaly on the structure and the anomaly on the attribute can be simultaneously grasped by the network anomaly detection.
The invention will now be further described with reference to the accompanying drawings and specific examples, which are in no way limiting.
The invention provides a multi-view contrast self-supervision attribute network abnormal point detection method as shown in fig. 1 and 3, which mainly comprises the following steps:
step one, carrying out abnormal injection on an attribute network;
step two, multi-view sampling is carried out to obtain a multi-view comparison example pair;
step three, designing and training a multi-view graph neural network contrast learning model;
step four, using a trained contrast learning model to carry out an reasoning stage and calculating an abnormality score;
and fifthly, judging whether the node is abnormal or not through the abnormal score, and marking the abnormal node.
The steps are described in detail as follows:
step one: and inputting an attribute network, and performing abnormal injection, including structural abnormal injection and attribute abnormal injection.
The NNSF data set is processed into a data format required by the method, and because the NNSF data set contains a real abnormal label, abnormal injection of the data set is not required.
The present embodiment is on 6 widely used datasetsThe MV-CoLA method was evaluated. These data sets include two social network data sets and four quotation network data sets. The data set details are shown in table 1. Since there are no real anomalies in the data set described above, anomalies need to be injected into the attribute network. After the cluster size is designated as m, m nodes in the cluster are randomly selected from the network to enable the nodes to be completely connected, and then the m nodes in the cluster are regarded as abnormal. This process is iteratively repeated until the middle n cliques are generated, the total number of structural anomalies being the middle mxn. Attribute anomaly injection, first randomly selecting m×n nodes in another node as attribute disturbance candidates. For i in each selected node, randomly selecting another i nodes from the data by maximizing the i x in Euclidean distance _{i} -x _{j} || {2} And selecting a node j with the largest deviation between the attribute and the node i in the k nodes. Then, node x _{i} The attribute of (2) is changed to x _{j} . Inputting MV-CoLA method parameters, training period T and batch size: b, sampling round number R, and walk probability p, q.
Table 1, 6 experimental data sets
Data set Node Edge(s) Attributes of Abnormality of
Cora 2,708 5,429 1,433 150
Citeseer 3,327 4,732 3,703 150
BlogCatalog 5,196 171,743 8,189 300
Flickr 7,575 239,738 112,407 450
ACM 16,484 71,980 8,337 600
Pubmed 19,717 44,338 500 600
Social network: blogCatalog and Flickr, in which nodes represent users of a website and edges represent relationships between users. In social networks, users typically generate personalized content, such as posting blogs or sharing photographs with tag descriptions, which are considered node attributes.
Citation network: cora, citeseer, pubmed, ACM are four available public data sets, which consist of scientific publications. In these networks, nodes represent published papers, while edges represent quotation relationships between papers.
The number of convolution layers is set to 1. The embedding dimension is set to 64. The batch size B of each dataset is set to 300.BlogCatalog, flickr and ACM data sets are 400 and the training period T for the cora, citeser and Pubmed data sets is 100.Cora, citeseer, pubmed and Flickr learning rates were 0.001, and BlogCatalog and ACM learning rates were set to 0.003 and 0.0005, respectively.
And step two, multi-view sampling is carried out to obtain a multi-view comparison example pair.
First, selecting a target node, wherein each node in the random traversal diagram is used as the target node. Then multi-view sampling is performed, the same node is sub-sampled from two views by one sampler, and the sampler performs local sub-sampling by two sampling methods. The first view (based on structural importance, view 1) sampling approach introduces two parameters p (breadth first BFS) and q (depth first DFS) to control the walk strategy. When the p and q values are different, the sampling subgraphs are different. If p >1, the walk tends to node neighbors, reflecting BFS characteristics, and if q <1 walk tends to run far, reflecting DFS characteristics. And meanwhile, p and q are controlled to obtain a local sub-graph 1 based on the structural importance sampling. The second view (view 2 based on the genus similarity) samples walk according to the computed node attribute similarity. The specific steps are shown in fig. 2. Secondly anonymizing, setting the attribute vector of the initial node as zero vector, and preventing the contrast learning model from easily identifying the existence of the target node in the local subgraph. And finally, combining into an instance pair, constructing the multi-view comparison instance pair based on multi-view mutual fusion, combining the target node of view 1 and the local sub-graph 2 into one group of instance pairs, forming the other group of instance pairs by the target nodes of the local sub-graph 1 and the view 2, and respectively storing the positive instance pair (the target node instance pair) and the negative instance pair (the instance pair except the target node) of the two groups of instance pairs into corresponding sample pools.
Inspired by the recent progress of multi-view contrast learning of visual representation learning, node and graph representations are learned by maximizing mutual information between node representations of one view and graph representations of another view, and two-view contrast may result in better node representations than contrast global or multi-view. Therefore, the invention designs a novel multi-view contrast learning method, and the same nodes are sub-sampled from two view angles through a sampler, wherein the sub-sampling consists of two effective walk mechanisms, and the advantages of random walk with attributes and random walk with a structure are combined. Wherein the node has not only the characteristics of the network connection a but also the rich auxiliary information described by the node attribute X. The joint sampling a and X will make the random walk more informative. The sampling is divided into four steps: target node selection, multi-view sampling, anonymization, and combination into instance pairs.
2-1) target node selection. The selection of the target node is performed on the attribute network after the anomaly injection (not required in the present embodiment), and each node in the attribute network is randomly traversed as the target node.
2-2) Multi-map sampling. And respectively sub-sampling the same target node from two views, namely, view 1 based on structural importance and view 2 based on the degree of similarity of the genus through a sampler, so as to obtain a local sub-graph 1 based on the view 1 of structural importance and a local sub-graph 2 based on the view 2 of the degree of similarity of the genus, which correspond to the target node.
The sampler uses two random walk methods as a local sub-sampling strategy, and in the process of obtaining the local sub-image 1, the sampler is used for controlling walk through the introduced breadth first parameter p and depth first parameter q, wherein p is more than 1, and q is less than 1. In the process of obtaining the local subgraph 2, the walk is controlled by calculating the attribute similarity of the target node, as shown in fig. 2.
2-3) anonymization, the purpose of which is to prevent the existence of target nodes in the partial subgraph from being easily identified by contrast learning methods. Anonymizing the two partial subgraphs obtained in the step 2-2), and setting the attribute vector of the target node as a zero vector.
2-4) are combined into instance pairs. Combining the anonymized target node and the subgraph into a set of instance pairs, specifically: combining the anonymized target node and the local sub-graph 1 into one set of instance pairs, and combining the anonymized target node and the local sub-graph 2 into another set of instance pairs; and respectively storing the positive sample pairs and the negative sample pairs of the two groups of example pairs into two corresponding sample pools.
The two sets of example pairs are represented as follows:
Figure BDA0003949898160000081
Figure BDA0003949898160000082
in the formula (1), the components are as follows,
Figure BDA0003949898160000083
is an example pair corresponding to view 1, +.>
Figure BDA0003949898160000084
Is an example pair corresponding to view 2, +.>
Figure BDA0003949898160000085
For view 1 target node, +.>
Figure BDA0003949898160000086
For view 2 target node, +.>
Figure BDA0003949898160000087
For partial sub-picture 2->
Figure BDA0003949898160000088
For partial sub-picture 1, ">
Figure BDA0003949898160000089
Is a label for an example pair of view 1, wherein,
Figure BDA00039498981600000810
representation->
Figure BDA00039498981600000811
Is a negative example pair, ++>
Figure BDA00039498981600000812
Representation->
Figure BDA00039498981600000813
Is a positive example pair. />
Figure BDA00039498981600000814
Is a label for an example pair of view 2, wherein,
Figure BDA00039498981600000815
representation->
Figure BDA00039498981600000816
Is a negative example pair, ++>
Figure BDA00039498981600000817
Representation->
Figure BDA00039498981600000818
Is a positive example pair.
And thirdly, designing and training a multi-view image neural network contrast learning model, and updating the multi-view image neural network contrast learning model.
The sampled pairs of multi-view contrast examples are used to train a multi-view neural network contrast learning model. The multi-view neural network contrast learning model consists of three main components: the system comprises a multi-view neural network module, a reading module and a discriminator module. The multi-view graph neural network module respectively obtains sub-graph representations of two views through the two graph convolution neural network modules. The readout module changes the sub-graph representation into a vector representation using the average pool function as the readout function. The discriminator module compares the embedding of the two elements in an instance pair using a bilinear scoring function and outputs the final predictive score. Finally, the label of the comparison example pair is predicted by integrating three components of the multi-view image neural network module, the reading module and the discriminator module and taking the multi-view image neural network comparison learning model as a binary classification objective function. The specific description is as follows:
3-1) designing a multi-view neural network contrast learning model, wherein the multi-view neural network contrast learning model comprises a multi-view neural network module, a reading module and a discriminator module.
A multi-view neural network module. The goal is to aggregate information between nodes in a local subgraph and transfer high-dimensional attributes into a low-dimensional embedding space. The invention designs two graph convolution neural networks to respectively obtain sub-graph representations of two visual angles.
Figure BDA00039498981600000819
Wherein, the liquid crystal display device comprises a liquid crystal display device,
Figure BDA00039498981600000820
representing a matrix for the hidden layer->
Figure BDA00039498981600000821
To learn parameters, the invention employs GCN, then the above equation can be written specifically as:
Figure BDA00039498981600000822
in the formula (2), the amino acid sequence of the compound,
Figure BDA00039498981600000823
representing a matrix for the hidden layer->
Figure BDA00039498981600000824
Is a hidden layer weight matrix->
Figure BDA00039498981600000825
Is a sub-graph adjacency matrix, phi is an activation function, < ->
Figure BDA00039498981600000826
Is the degree matrix of the subgraph.
The target node represents:
Figure BDA00039498981600000827
in the formula (3), the amino acid sequence of the compound,
Figure BDA00039498981600000828
hidden representation row vectors for target nodes learned by layer (l-1) and layer (l), respectively, will be input +.>
Figure BDA00039498981600000829
An attribute row vector defined as a target node and marking the output as a target node vector representation +.>
Figure BDA00039498981600000830
And a read-out module. The goal is to change the sub-graph representation into a vector representation. For simplicity, the readout function using the average pool function as the readout function is written as follows:
Figure BDA0003949898160000091
in the formula (4), the amino acid sequence of the compound,
Figure BDA0003949898160000092
representing vectors for subgraphs, (E) i ) Subgraph representation matrix, (E) i ) k Is (E) i ) Readout represents the read function.
And an authentication module. The authentication module is a core component of the contrast learning method. It compares the embedding of two elements in an instance pair, using a bilinear scoring function to compare the node vector representation and the sub-graph vector representation in the instance pair.
3-2) initializing parameters (W) of the multi-view neural network contrast learning model (0) ，W (L) ，W (d) ) W is a weight matrix of the discriminator; training the contrast learning model by using a binary classification objective function to obtain a prediction score of a node for training, and updating contrast learning model parameters by using the prediction score and the binary classification objective function in a back propagation way;
calculating a predictive score of the node for training by the equation (5) and the equation (6):
Figure BDA0003949898160000093
Figure BDA0003949898160000094
in the formulas (5) and (6),
Figure BDA0003949898160000095
the predictor representing the view 1 target node is a bilinear scoring function, dispeimator +.>
Figure BDA0003949898160000096
Representing view 1 target node vector representation, +.>
Figure BDA0003949898160000097
Representing view 2 sub-picture vector representation, < >>
Figure BDA0003949898160000098
For a view 1 discriminator weight matrix, σ is an sigmoid function; />
Figure BDA0003949898160000099
Representing the predictive score of view 2 target node, +.>
Figure BDA00039498981600000910
Representing view 2 target node vector representation, +.>
Figure BDA00039498981600000911
Representing view 1 sub-picture representation vector, ">
Figure BDA00039498981600000912
Is a view angle 2 discriminant weight matrix.
In the invention, by integrating the three components, the proposed graph neural network-based contrast learning method is used as a binary classification method to predict the labels of contrast example pairs, and the binary classification objective function is as follows:
Figure BDA00039498981600000913
in equation (7), CLM () is a multiview neural network contrast learning model.
And step four, performing an reasoning stage by using a trained contrast learning model, obtaining a predicted score of the node by using a binary classification objective function through a classifier at the same time by using updated contrast learning model parameters, and obtaining a final abnormal score by taking an average value through multiple rounds of calculation.
After the contrast learning method is well trained, consistency between the node representation of one view and the sub-graph representation of the other view is obtained through the classifier. Under ideal conditions, for a normal node, it is opposite s (+) The predictive score of (2) should be close to 1, while the negative pair s (-) Should be close to 0. For an outlier, the method does not distinguish its matching pattern well, and its prediction score for positive and negative pairs is poor (near 0.5).
Figure BDA0003949898160000101
In equation (8), f () is an anomaly score mapping function,
Figure BDA0003949898160000102
is the predictive fraction of the view 1 negative example pair, for example>
Figure BDA0003949898160000103
Is the predictive fraction of the view 1 positive example pair, for example>
Figure BDA0003949898160000104
Is the predictive fraction of the view 2 negative example pair, for example>
Figure BDA0003949898160000105
Is the predictive score for a positive instance pair for view 2.
And fifthly, regarding a target node with an anomaly score of 0.5+/-0.05 as an anomaly node, marking the anomaly node as 1, and marking a non-anomaly node as 0.
In this embodiment, 256 rounds of anomaly score averaging are calculated to obtain an anomaly score for a node, which would be considered an anomaly if the score were near 0.5. The MV-CoLA method was compared with four attribute network anomaly detection methods (ANOMALOUS, DOMINANT, DGI, coLA). AUC value: the ROC curve is a graph of true positive rate (abnormality is identified as abnormal) and false positive rate (normal node is identified as abnormal) based on the ground true abnormality label and the abnormality detection result. AUC values are the areas under the ROC curves and represent the probability that randomly selected outlier nodes are ranked higher than outlier nodes. AUC is close to 1, indicating that the method has higher performance. By calculating the area under the ROC curve, the AUC values for the 6 data sets for the different comparison methods are shown in table 2, with the best anomaly detection performance achieved for the present method over all 6 data sets.
TABLE 2
Method Cora Citeseer BlogCatalog Flickr ACM Pubmed
ANOMALOUS 0.5770 0.6307 0.7237 0.7434 0.7038 0.7316
DOMINANT 0.8155 0.8251 0.7468 0.7442 0.7601 0.8081
DGI 0.7532 0.8293 0.5827 0.6237 0.6240 0.6962
CoLA 0.9043 0.8965 0.7854 0.7620 0.8237 0.9512
MV-CoLA 0.9162 0.9294 0.8035 0.7813 0.8502 0.9620
The method is applied to detecting the abnormality in the real scene, ranking the abnormality scores of the nodes, selecting the front nodes for analysis, finding the author names and the mechanisms corresponding to the original self-family data sets corresponding to the nodes, and exploring the principle of the self-family project data implications.
MV-CoLA was applied to millions of large-scale network NNSF datasets—national natural science foundation (National Natural Science Foundation) datasets listing 2000 to 2021 a total of 2052 academic institutions 789,669 academic papers and corresponding foundation project information for 763,311. The research fields are classified according to national subjects and cover various fields of chemistry, biology, construction, agriculture, computers and the like. Details of this dataset are shown in Table 3.
TABLE 3 Table 3
Data set Node Edge(s) Attributes of Abnormality of
NNSF 1,521,995 7,555,319 1,405 2,0785
Fig. 4 shows a partial paper collaboration network with 6000 nodes, where the grey dots are outlier nodes with value screening. The mesh structure is a paper author cooperative network. From the figure, it can be found that the paper author cooperation network has small world attributes, and smaller community networks are formed among researchers who are in the same research institution, so that the people exercise tightly inside the community, and academic exchanges outside the community are relatively less. Fig. 5-1 and 5-2 show the distribution of the top 1000 abnormal nodes corresponding to the affiliated institutions, and statistical analysis shows that the 985 college researchers have the largest proportion, wherein the proportion of the staff participating in the self-department projects by the university of beijing, the university of Qinghai, the university of Zhongshan and the academy of chinese sciences is very high. Other non-985 common colleges account for 20%. The staff of 985 universities such as universities of the company, and the like, participating in the self-department projects are relatively low.
Although the invention has been described above with reference to the accompanying drawings, the invention is not limited to the above-described embodiments, which are merely illustrative and not restrictive, and many modifications may be made by those of ordinary skill in the art without departing from the spirit of the invention, which fall within the protection of the invention.

Claims (6)

1. A multi-view contrast self-supervision attribute network abnormal point detection method is characterized by comprising the following steps:
firstly, carrying out abnormal injection on an attribute network, wherein the abnormal injection comprises structural abnormal injection and attribute abnormal injection;
step two, multi-view sampling is carried out to obtain a multi-view comparison example pair, which comprises the following steps:
2-1) selecting a target node from the attribute network after the anomaly injection, and randomly traversing each node in the attribute network as the target node;
2-2) sub-sampling the same target node through a sampler based on the structural importance and the attribute phase similarity to obtain a local sub-graph 1 and a local sub-graph 2 corresponding to the target node, wherein the local sub-graph 1 and the local sub-graph 2 are marked as view angles 1 based on the structural importance and view angles 2 based on the attribute phase similarity;
in the process of obtaining the local subgraph 1, the breadth first parameter p and the depth first parameter q are introduced to control the walk, p >1, q <1,
in the process of obtaining the local subgraph 2, controlling wander by calculating attribute similarity of the target node;
2-3) anonymizing the two partial subgraphs obtained in the step 2-2), and setting the attribute vector of the target node as a zero vector;
2-4) merging the anonymized target node with the partial sub-graph 1 into one set of instance pairs, and merging the anonymized target node with the partial sub-graph 2 into another set of instance pairs; respectively storing the positive sample pairs and the negative sample pairs of the two groups of example pairs into two corresponding sample pools;
step three, designing and training a multi-view graph neural network contrast learning model, which comprises the following steps:
3-1) designing a multi-view neural network contrast learning model, wherein the multi-view neural network contrast learning model comprises a multi-view neural network module, a reading module and a discriminator module;
the multi-view graph neural network module respectively obtains sub-graph representations and target node representations of two views through two graph convolution neural networks;
the readout module changes the sub-graph representation into a sub-graph vector representation, using an average pool function as a readout function;
the discriminator module compares the node vector representation and the sub-graph vector representation in the instance pair using a bilinear scoring function;
3-2) initializing parameters (W) of the multi-view neural network contrast learning model (0) ，W (L) ，W (d) ) W is a weight matrix of the discriminator; training the contrast learning model by using a binary classification objective function to obtain a prediction score of a node for training, and updating contrast learning model parameters by using the prediction score and the binary classification objective function in a back propagation way;
step four, performing an reasoning stage by using a trained contrast learning model, obtaining a predicted score of the node by using updated contrast learning model parameters and simultaneously using a binary classification objective function, and obtaining a final abnormal score by taking an average value through multiple rounds of calculation;
and fifthly, regarding a target node with an anomaly score of 0.5+/-0.05 as an anomaly node, marking the anomaly node as 1, and marking a non-anomaly node as 0.
2. The multi-view contrast self-supervision attribute network outlier detection method according to claim 1, wherein in step 2-4): the two sets of example pairs are represented as follows:
Figure FDA0003949898150000021
Figure FDA0003949898150000022
in the formula (1), the components are as follows,
Figure FDA0003949898150000023
is an example pair corresponding to view 1, +.>
Figure FDA0003949898150000024
Is an example pair corresponding to view 2, +.>
Figure FDA0003949898150000025
For a view 1 target node,
Figure FDA0003949898150000026
for view 2 target node, +.>
Figure FDA0003949898150000027
For partial sub-picture 2->
Figure FDA0003949898150000028
Is a partial sub-graph 1; />
Figure FDA0003949898150000029
Is a label for an example pair of view 1, wherein,
Figure FDA00039498981500000210
representation->
Figure FDA00039498981500000211
Is a negative example pair, ++>
Figure FDA00039498981500000212
Representation->
Figure FDA00039498981500000213
Is a positive example pair; />
Figure FDA00039498981500000214
Is a label of view 2 example pair, wherein +.>
Figure FDA00039498981500000215
Representation->
Figure FDA00039498981500000216
Is a negative example pair, ++>
Figure FDA00039498981500000217
Representation->
Figure FDA00039498981500000218
Is a positive example pair.
3. The multi-view contrast self-supervision attribute network outlier detection method according to claim 1, wherein in step 3-1):
the sub-graph representation is shown in equation (2):
Figure FDA00039498981500000219
in the formula (2), the amino acid sequence of the compound,
Figure FDA00039498981500000220
representing a matrix for the hidden layer->
Figure FDA00039498981500000221
Is a hidden layer weight matrix->
Figure FDA00039498981500000222
Is a sub-graph adjacency matrix, phi is an activation function, < ->
Figure FDA00039498981500000223
Is the degree matrix of the subgraph;
equation (3) shows the target node representation:
Figure FDA00039498981500000224
in the formula (3), the amino acid sequence of the compound,
Figure FDA00039498981500000225
hidden representation row vectors for target nodes learned by layer (l-1) and layer (l), respectively, will be input +.>
Figure FDA00039498981500000226
An attribute row vector defined as a target node and marking the output as a target node vector representation +.>
Figure FDA00039498981500000227
The read-out function is shown as a formula (4):
Figure FDA00039498981500000228
in the formula (4), the amino acid sequence of the compound,
Figure FDA00039498981500000229
representing vectors for subgraphs, (E) i ) Subgraph representation matrix, (E) i ) k Is (E) i ) Readout represents the read function.
4. The multi-view contrast self-supervision attribute network outlier detection method according to claim 3, wherein in step 3-2), the predictive score of the node for training is calculated by equation (5) and equation (6):
Figure FDA00039498981500000230
Figure FDA00039498981500000231
in the formulas (5) and (6),
Figure FDA00039498981500000232
the predictor representing the view 1 target node is a bilinear scoring function, dispeimator +.>
Figure FDA0003949898150000031
Representing view 1 target node vector representation, +.>
Figure FDA0003949898150000032
Representing view 2 sub-picture vector representation, < >>
Figure FDA0003949898150000033
For a view 1 discriminator weight matrix, σ is an sigmoid function; />
Figure FDA0003949898150000034
Representing the predictive score of view 2 target node, +.>
Figure FDA0003949898150000035
Representing view 2 target node vector representation, +.>
Figure FDA0003949898150000036
Representing view 1 sub-picture representation vector, ">
Figure FDA0003949898150000037
Is a view angle 2 discriminant weight matrix.
5. The method for detecting abnormal points of a multi-view contrast self-supervision attribute network according to claim 1, wherein in the third and fourth steps,
the binary classification objective function is as follows:
Figure FDA0003949898150000038
in equation (7), CLM () is a multiview neural network contrast learning model.
6. The method for detecting abnormal points of a multi-view contrast self-supervision attribute network according to claim 1, wherein in the fourth step, the abnormal score calculation formula is as follows:
Figure FDA0003949898150000039
in equation (8), f () is an anomaly score mapping function,
Figure FDA00039498981500000310
is the predictive fraction of the view 1 negative example pair, for example>
Figure FDA00039498981500000311
Is the predictive fraction of the view 1 positive example pair, for example>
Figure FDA00039498981500000312
Is the predictive fraction of the view 2 negative example pair, for example>
Figure FDA00039498981500000313
Is the predictive score for a positive instance pair for view 2. />
CN202211445037.6A 2022-11-18 2022-11-18 Multi-view contrast self-supervision attribute network abnormal point detection method Pending CN116128024A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202211445037.6A CN116128024A (en) 2022-11-18 2022-11-18 Multi-view contrast self-supervision attribute network abnormal point detection method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202211445037.6A CN116128024A (en) 2022-11-18 2022-11-18 Multi-view contrast self-supervision attribute network abnormal point detection method

Publications (1)

Publication Number Publication Date
CN116128024A true CN116128024A (en) 2023-05-16

Family

ID=86298073

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202211445037.6A Pending CN116128024A (en) 2022-11-18 2022-11-18 Multi-view contrast self-supervision attribute network abnormal point detection method

Country Status (1)

Country Link
CN (1) CN116128024A (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117828513A (en) * 2024-03-04 2024-04-05 北京邮电大学 Thesis subject irrelevant citation checking method and device

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117828513A (en) * 2024-03-04 2024-04-05 北京邮电大学 Thesis subject irrelevant citation checking method and device

Similar Documents

Publication Publication Date Title
Liang et al. An end-to-end transformer model for crowd localization
CN108334574B (en) Cross-modal retrieval method based on collaborative matrix decomposition
CN112966127A (en) Cross-modal retrieval method based on multilayer semantic alignment
CN112307995B (en) Semi-supervised pedestrian re-identification method based on feature decoupling learning
Tian et al. Small object detection via dual inspection mechanism for UAV visual images
CN113627463A (en) Citation network diagram representation learning system and method based on multi-view comparison learning
Li et al. DLEP: A deep learning model for earthquake prediction
Cai et al. A robust interclass and intraclass loss function for deep learning based tongue segmentation
CN110598022B (en) Image retrieval system and method based on robust deep hash network
Ning et al. Conditional generative adversarial networks based on the principle of homologycontinuity for face aging
Tian et al. Multi-scale hierarchical residual network for dense captioning
Gao et al. Semantic trajectory representation and retrieval via hierarchical embedding
Zhang et al. An open set domain adaptation algorithm via exploring transferability and discriminability for remote sensing image scene classification
CN116128024A (en) Multi-view contrast self-supervision attribute network abnormal point detection method
Maddumala A Weight Based Feature Extraction Model on Multifaceted Multimedia Bigdata Using Convolutional Neural Network.
CN115310589A (en) Group identification method and system based on depth map self-supervision learning
Huang et al. Higher order connection enhanced community detection in adversarial multiview networks
Gao et al. Distinguishing oracle variants based on the isomorphism and symmetry invariances of oracle-bone inscriptions
CN116861923A (en) Multi-view unsupervised graph contrast learning model construction method, system, computer, storage medium and application
Feng et al. Bidirectional flow decision tree for reliable remote sensing image scene classification
CN114882288B (en) Multi-view image classification method based on hierarchical image enhancement stacking self-encoder
Gong et al. Autonomous learning of foreign language based on facial emotion recognition and cloud computing
CN116188428A (en) Bridging multi-source domain self-adaptive cross-domain histopathological image recognition method
Ling et al. Iae-clustergan: A new inverse autoencoder for generative adversarial attention clustering network
Nguyen et al. Fusion schemes for image-to-video person re-identification

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination