CN117201122A - Unsupervised attribute network anomaly detection method and system based on view level graph comparison learning - Google Patents

Unsupervised attribute network anomaly detection method and system based on view level graph comparison learning Download PDF

Info

Publication number
CN117201122A
CN117201122A CN202311162248.3A CN202311162248A CN117201122A CN 117201122 A CN117201122 A CN 117201122A CN 202311162248 A CN202311162248 A CN 202311162248A CN 117201122 A CN117201122 A CN 117201122A
Authority
CN
China
Prior art keywords
view
attribute
self
original input
matrix
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202311162248.3A
Other languages
Chinese (zh)
Inventor
徐博
王锦鹏
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Dalian University of Technology
Original Assignee
Dalian University of Technology
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Dalian University of Technology filed Critical Dalian University of Technology
Priority to CN202311162248.3A priority Critical patent/CN117201122A/en
Publication of CN117201122A publication Critical patent/CN117201122A/en
Pending legal-status Critical Current

Links

Abstract

The invention provides an unsupervised attribute network anomaly detection method and system based on view level graph comparison learning, comprising the steps of preprocessing effective data to obtain an original input graph data set; constructing a target view and a self-enhancement view; normalizing the target view and the self-enhancement view, and modeling to generate an embedded representation of the target view and an embedded representation of the self-enhancement view; decoding the embedded representation of the self-enhanced view, generating a reconstructed original input map adjacency matrix and calculating a structural reconstruction error; decoding the embedded representation of the self-enhancement view to obtain a reconstructed original input graph node attribute matrix and calculating an attribute reconstruction error; constructing an anomaly score function, calculating the anomaly score of each node, and identifying the anomaly node according to the anomaly score of each node; the method comprises the steps of performing combined training to obtain an unsupervised attribute network anomaly detection model based on view level graph comparison learning; and inputting the attribute network to be detected into an unsupervised attribute network anomaly detection model based on view level graph comparison learning to obtain a detection result.

Description

Unsupervised attribute network anomaly detection method and system based on view level graph comparison learning
Technical Field
The invention belongs to the field of network anomaly detection, and particularly discloses an unsupervised attribute network anomaly detection method and system based on view level graph comparison learning.
Description of the background
The attribute network is widely applied to various real world application programs, and compared with the traditional common network only comprising the interaction relation among the nodes, the attribute network comprises the characteristic information which is rich in the nodes, and the modeling of a more complex interaction system is possible. Detecting anomalous nodes in a property network has significant implications for many security-related applications, and has become a research problem of immediate concern today, such as social spam detection, financial fraud detection, and network intrusion detection. However, node anomalies in an attribute network are related not only to the way they interact with other nodes, but also to inconsistencies in node attributes, so detecting anomalies on an attribute network is extremely challenging.
To solve the above problems, researchers have focused on anomaly detection, and early anomaly detection methods used shallow mechanisms such as CUR matrix decomposition, subspace selection, self-network analysis, and residual analysis to identify anomaly nodes, but these methods generally rely on feature engineering or observed node interactions, which cannot capture highly nonlinear properties in the network well. In recent years, graph neural networks have been widely used for anomaly detection tasks, aiming at using deep neural networks to capture nonlinearities of the network and learn node representations in anomaly modes, but since marking anomalies is an expensive and generally impossible task, identifying anomalies in an unsupervised manner is more reliable.
In addition, the rise of contrast learning techniques provides new directions for anomaly detection tasks in attribute networks. Contrast learning is a self-supervised learning method that models the general characteristics of a network by letting the model learn whether unlabeled nodes are similar or different. In recent years, contrast learning has shown competitive performance in terms of computer vision and has become increasingly popular in graphic representation learning. Graph contrast learning follows the principle of mutual information maximization, i.e., pulling representations of nodes with similar semantic information closer together, while keeping representations of irrelevant nodes away. However, existing anomaly detection methods based on contrast learning typically construct positive and negative instance pairs based on node graphs, learning node representations by maximizing mutual information between target nodes and positive instances, and minimizing mutual information between target nodes and negative instances. This approach focuses more on the local information of the node, and ignores the use of global information. Therefore, how to fully utilize the local information and the global information, extract high-quality structure and attribute information and effectively combine the two, so that the detection of abnormal nodes in the attribute network effectively without external information guidance is worth more intensive research.
Disclosure of Invention
The invention provides an unsupervised attribute network anomaly detection method and system based on view level graph comparison learning, which are used for solving the problems that in the prior art, anomaly interaction and attribute difference between an anomaly node and other corresponding nodes cannot be well identified and the accuracy of identifying an anomaly network is low.
The invention provides an unsupervised attribute network anomaly detection method based on view level graph comparison learning, which comprises the following steps:
s1, preprocessing effective data, and manually injecting attribute abnormality and structural abnormality into a clean attribute network to obtain a real-world attribute network with an abnormality mode, and integrating the real-world attribute network into an original input diagram data set;
s2, constructing a target view through an original input diagram adjacent matrix, an original input diagram node attribute matrix and an edge attribute matrix of the original input diagram in the original input diagram data set obtained in the step S1; modeling an original input image in the original input image data set obtained in the step S1 through a self-enhancement view learner to generate a fully-connected self-enhancement view adjacency matrix, selecting the first k nodes which are semantically similar to the fully-connected self-enhancement view adjacency matrix for each node based on the fully-connected self-enhancement view adjacency matrix, and constructing a sparse self-enhancement view adjacency matrix by taking the k nodes as neighborhood nodes of each node;
S3, normalizing the target view and the self-enhancement view obtained in the step S2, ensuring that adjacent matrixes in the target view and the self-enhancement view are symmetrical and each element in the adjacent matrixes is non-negative, modeling the normalized target view and self-enhancement view by using a graph convolution neural network with two weights to generate an embedded representation of the target view and an embedded representation of the self-enhancement view, and constructing a contrast learning loss between the target view and the self-enhancement view according to the embedded representation of the target view and the embedded representation of the self-enhancement view, wherein the contrast learning loss between the target view and the self-enhancement view is used as a loss function of a graph contrast learning module;
s4, decoding the embedded representation of the self-enhancement view obtained in the step S3 through a structure reconstruction decoder to obtain a decoding vector, predicting whether a link exists between each pair of nodes according to the decoding vector, generating a reconstructed original input diagram adjacent matrix and calculating a structure reconstruction error; decoding the embedded representation of the self-enhancement view obtained in the step S3 through an attribute reconstruction decoder to obtain a reconstructed original input graph node attribute matrix and calculating an attribute reconstruction error;
S5, obtaining a reconstructed original input diagram structure vector and a reconstructed original input diagram attribute vector through the reconstructed original input diagram adjacency matrix and the reconstructed original input diagram node attribute matrix obtained in the step S4, constructing an anomaly score function, calculating the anomaly score of each node, and sorting the nodes according to the anomaly score of each node to identify the anomaly node; constructing a loss function of a network reconstruction module through the structure reconstruction error and the attribute reconstruction error obtained in the step S4, combining the loss function of the graph comparison learning module and the loss function of the network reconstruction module to obtain a total loss function of an unsupervised attribute network anomaly detection model based on view level graph comparison learning, and obtaining the unsupervised attribute network anomaly detection model based on view level graph comparison learning through joint training;
s6, inputting the attribute network to be detected into the unsupervised attribute network anomaly detection model based on view level graph comparison learning, and obtaining a detection result.
According to some embodiments of the present application, in the step S2, constructing the target view includes reading data of the original input graph to construct an adjacent matrix of the original input graph and a node feature matrix of the original input graph, and calculating edge attributes of each edge in the original input graph by using similarity indexes of two connected nodes in the original input graph to obtain an edge attribute matrix of the original input graph;
Constructing an edge attribute matrix of the original input graph and calculating an original input graph adjacency matrix A with edge attributes t As shown in formula (1):
wherein lambda is EA Is the edge attribute matrix of the original input graph calculated by the similarity index of two connected nodes, the degree represents Hadamard product,representing an adjacency matrix of the original input graph, wherein n is the number of nodes;
using the original input graph adjacency matrix A with edge attributes t Constructing a target view with the node attribute matrix X of the original input diagramWherein (1)>Representing a node attribute matrix of an original input diagram, wherein n is the number of nodes, and d is the feature dimension of the nodes;
the self-enhancement view learner adopts a full-view parameterization method to directly model each element of the adjacency matrix of the original input view through an independent parameter to generate the fully-connected self-enhancement view adjacency matrixAs shown in formula (2):
wherein,the node attribute matrix of the original input diagram is represented, wherein n is the number of nodes, d is the characteristic dimension of the nodes, ω=w represents the parameter matrix, and σ is a nonlinear activation function;
the first k nodes with the highest connection value are reserved for each node to serve as neighborhood nodes of each node, and the sparse self-enhancement view adjacency matrix S is constructed; constructing a self-enhanced view through a sparse self-enhanced view adjacency matrix S using a k-nearest neighbor algorithm as shown in equation (3):
Wherein,representing row vector +.>Is set of the first k maxima, +.>Self-enhanced view adjacency matrix representing full connection>The value of the ith row and jth column of S ij Values representing the ith row and jth column of a sparse self-enhanced view adjacency matrix S, constructing a self-enhanced view +.>
According to some embodiments of the present application, an unsupervised attribute network anomaly detection method based on view level graph contrast learning, in the step S3: normalizing the target viewAnd said self-enhanced view->Ensuring adjacency matrix A of target view t And the adjacency matrix S of the self-enhanced view is symmetrical and each element in the adjacency matrix is non-negative as shown in equation (4) and equation (5):
where sym (-) is a symmetric function, nor (-) is a normalized function, σ is a nonlinear activation function that maps element values to [0,1 ]]Interval () T Is a transposition operation;
the embedded representation Z of the target view t The embedded representation Z of the self-enhanced view, as shown in equation (6) s As shown in formula (7):
wherein,representing an adjacency matrix A for said target view t Performing symmetric normalization operations, ">Representing a symmetric normalization operation performed on the adjacency matrix S of the self-enhanced view, Representing the node attribute matrix of the original input diagram, W (0) ，W (1) ，W (2) Is a learnable weight matrix in a graph rolling network encoder, D t Is (A) t +I) degree matrix, D s Is the degree matrix of (S+I), and I is the identity matrix.
According to some embodiments of the application, in the step S3, the graph contrast learning module loses the functionThe calculation is shown in the formula (8) -formula (10):
where N represents the total number of nodes in the original input graph, sim () is a similarity function that calculates the similarity between two node representations, θ represents the temperature factor that controls the concentration level of the distribution.
According to some embodiments of the application, in the method for detecting an unsupervised attribute network anomaly based on view level graph contrast learning, in step S4,the structure reconstruction decoder embeds a representation Z for a self-enhanced view through a graph convolution network s Decoding is carried out to obtain a decoding vector H, as shown in a formula (11):
wherein W is (3) ，W (4) A learnable weight matrix in the decoder is reconstructed for the structure,is to perform a symmetric normalization operation on the original input graph adjacency matrix a, D is the degree matrix of (a + I), I is the identity matrix,
predicting whether a link exists between each pair of nodes according to the decoding vector H, and generating the reconstructed original input diagram adjacency matrix As shown in formula (12):
wherein Sigmoid (.) represents a Sigmoid function, (. S.) T For the transpose operation,
an adjacency matrix based on the reconstructed original input mapCalculating a structural reconstruction error as shown in formula (13):
wherein R is S Representing the reconstruction error of the structure,representing the square of the F-norm of the matrix,
the attribute reconstruction decoder embeds a representation Z for a self-enhanced view over a graph convolution network s Decoding to obtain the reconstructed original input graph node attribute matrixAs shown in equation (14):
wherein W is (5) ，W (6) ，W (7) Is a learnable weight matrix in the attribute reconstruction decoder,
node attribute matrix according to the reconstructed original input diagramCalculating an attribute reconstruction error as shown in formula (15):
wherein R is A Representing the error in the reconstruction of the attribute,representing the square of the F-norm of the matrix.
According to some embodiments of the application, in the method for detecting an anomaly in an unsupervised attribute network based on view level graph comparison learning, in step S5, the anomaly score function is as shown in formula (16):
wherein v is i Representing nodes, alpha is an important control parameter for balancing the reconstruction of a structure and the reconstruction of an attribute, and x i For node v i Is used to determine the original input map attribute vector,for node v i A) reconstructed original input map attribute vector of (a) i The ith row vector of the adjacency matrix A for the original input graph represents the node v i Is the original input diagram structure vector, ">Reconstructed original input diagram adjacency matrix +.>I-th row vector of (a) represents node v i Is used to reconstruct the original input map structure vector.
According to some embodiments of the application, in step S5, an error R is reconstructed by the structure S And the attribute reconstruction error R A Obtaining a loss function of the network reconstruction moduleAs shown in formula (17):
where alpha is an important control parameter for balancing the effects of structure reconstruction and attribute reconstruction,representing the square of the F-norm of the matrix;
the overall loss function of the unsupervised attribute network anomaly detection model based on view level graph comparison learningAs shown in equation (18):
μ is a non-negative tuning parameter for measuring importance of the graph to the learning module and the network reconstruction module;
the joint training includes minimizing an overall loss function with an adaptive moment estimation optimizerAnd updating weight parameters of a graph comparison learning module and a network reconstruction module in the model by adopting a back propagation method to obtain an unsupervised attribute network anomaly detection model based on view level graph comparison learning.
According to some embodiments of the application, an unsupervised attribute network anomaly detection method based on view level graph contrast learning further comprises a target view update mechanism, wherein the embedded representation Z of the self-enhanced view is continuously learned s Calculating the probability of existence of links between each pair of nodes, and updating the target structure of the target view, so as to continuously correct the abnormal mode existing in the target view, alleviate the structural abnormality in the target view, and enable the self-enhancement view to be more towards the normal mode, specifically:
embedded representation Z using the self-enhanced view s Predicting the probability P that there is a link between each pair of nodes as shown in equation (19):
updating the target view as shown in equation (20):
A t ＝δA t +(1-δ)P (20)
wherein, delta represents the attenuation rate, delta is 0,1]For adjusting the target viewThe speed of the update.
The application also discloses an unsupervised attribute network anomaly detection system based on view level graph comparison learning, which comprises:
the data preprocessing module is used for preprocessing effective data, and acquiring a real world attribute network with an abnormal mode by manually injecting attribute abnormality and structural abnormality into a clean attribute network, and integrating the real world attribute network into an original input diagram data set;
The graph contrast learning module comprises
The target view generation component is used for constructing a target view through the adjacent matrix of the original input diagram, the node attribute matrix in the original input diagram and the edge attribute matrix of the original input diagram;
a self-enhanced view learning component for modeling the original input graph by a self-enhanced view learner to generate a fully connected self-enhanced view adjacency matrix; selecting the first k nodes which are semantically similar to each node based on the fully connected self-enhancement view adjacency matrix, taking the k nodes as neighborhood nodes of each node, constructing a sparse self-enhancement view adjacency matrix, and constructing a self-enhancement view through the sparse self-enhancement view adjacency matrix;
a contrast learning component for normalizing the target view and the self-enhanced view and ensuring that adjacency matrices in the target view and the self-enhanced view are symmetrical and each element in the adjacency matrices is non-negative; modeling the normalized target view and the self-enhancement view by using a graph convolution neural network with two weights sharing to generate an embedded representation of the target view and an embedded representation of the self-enhancement view; constructing a contrast learning loss between the target view and the self-enhancement view according to the embedded representation of the target view and the embedded representation of the self-enhancement view, and taking the contrast learning loss between the target view and the self-enhancement view as a loss function of a graph contrast learning module;
A network reconfiguration module comprising
The structure reconstruction component is used for decoding the embedded representation of the self-enhancement view through a structure reconstruction decoder to obtain a decoding vector, predicting whether a link exists between each pair of nodes according to the decoding vector, generating a reconstructed original input diagram adjacent matrix and calculating a structure reconstruction error;
the attribute reconstruction component is used for decoding the embedded representation of the self-enhancement view through an attribute reconstruction decoder to obtain a reconstructed original input graph node attribute matrix and calculating an attribute reconstruction error;
the abnormal node detection component is used for obtaining a reconstructed original input diagram structure vector and a reconstructed original input diagram attribute vector through the obtained reconstructed original input diagram adjacency matrix and the reconstructed original input diagram node attribute matrix, constructing an abnormal score function, calculating the abnormal score of each node, and sorting the nodes according to the abnormal score of each node to identify the abnormal node; and constructing a loss function of a network reconstruction module through the structure reconstruction error and the attribute reconstruction error, combining the loss function of the graph comparison learning module and the loss function of the network reconstruction module to obtain a total loss function of an unsupervised attribute network anomaly detection model based on view level graph comparison learning, and obtaining the unsupervised attribute network anomaly detection model based on view level graph comparison learning through joint training.
According to some embodiments of the application, the unsupervised attribute network anomaly detection system based on view level graph contrast learning further comprises a target view update mechanism module, wherein the target view update mechanism module is used for updating a target structure of the target view according to the continuously learned probability that a link exists between each pair of nodes in the self-enhanced view embedded representation, so that an anomaly mode existing in the target view is continuously corrected, structural anomalies in the target view are relieved, and the self-enhanced view is more prone to a normal mode.
The unsupervised attribute network anomaly detection method and system based on view level graph comparison learning solves the problem that anomaly interaction and attribute difference between an anomaly node and other corresponding nodes cannot be well identified in the existing anomaly detection method, can accurately identify the anomaly node in an attribute network under the condition of no external information guidance, constructs a target view through edge attribute information, constructs a learnable self-enhancement view, maximizes consistency between the target view and the self-enhancement view by using a view level graph comparison learning method, and encodes network deep information without external information guidance; decoding the encoded information of the self-enhanced view by a network reconstruction module so as to reconstruct node attributes and network structures of the original input view; the combined training diagram is compared with two complementary modules, namely a learning module and a network reconstruction module, and abnormal nodes are found according to the sequence of the reconstruction losses of all the nodes, so that an unsupervised attribute network abnormality detection task is realized.
Drawings
FIG. 1 is a flow diagram of an unsupervised attribute network anomaly detection method based on view level graph contrast learning;
FIG. 2 is a schematic diagram of an unsupervised attribute network anomaly detection system based on view level graph contrast learning;
fig. 3 is a graph of the results of experimental verification of the scaling parameters μ of importance of the learning module and the network reconstruction module against the scaling maps of different sizes.
Detailed Description
Embodiments of the present invention are described in further detail below with reference to the accompanying drawings and examples. The following examples are illustrative of the invention but are not intended to limit the scope of the invention.
Example 1
The embodiment provides a detection method of an unsupervised attribute network anomaly detection model based on view level graph comparison learning, as shown in fig. 1, comprising the following steps:
s1, preprocessing effective data, and manually injecting attribute abnormality and structural abnormality into a clean attribute network to obtain a real-world attribute network with an abnormality mode, and integrating the real-world attribute network into an original input diagram data set;
s2, constructing a target view through an original input diagram adjacent matrix, an original input diagram node attribute matrix and an edge attribute matrix of the original input diagram in the original input diagram data set obtained in the step S1; modeling the original input graph in the original input graph data set obtained in the step S1 through a self-enhancement view learner to generate a fully-connected self-enhancement view adjacency matrix, selecting the first k nodes which are semantically similar to the fully-connected self-enhancement view adjacency matrix for each node based on the fully-connected self-enhancement view adjacency matrix, and constructing a sparse self-enhancement view adjacency matrix by taking the k nodes as neighborhood nodes of each node;
Constructing a target view comprises the steps of reading data of an original input image to construct an original input image adjacent matrix and an original input image node characteristic matrix, and calculating edge attributes of each edge in the original input image by using similarity indexes of two connected nodes in the original input image to obtain an edge attribute matrix of the original input image;
constructing an edge attribute matrix of the original input graph and calculating an original input graph adjacency matrix A with edge attributes t As shown in formula (1):
wherein lambda is EA Is the edge attribute matrix of the original input graph calculated from the similarity index of the two connected nodes,representing Hadamard product, ->Representing an adjacency matrix of the original input graph, wherein n is the number of nodes;
using an original input graph adjacency matrix a with edge attributes t Constructing a target view with a node attribute matrix X of the original input graphWherein (1)>Node attribute matrix representing original input graph, wherein n is node number and d is node characteristicDimension number;
the self-enhancement view learner adopts a full-view parameterization method to directly model each element of the adjacent matrix of the original input view through an independent parameter to generate a full-connection self-enhancement view adjacent matrixAs shown in formula (2):
Wherein,the node attribute matrix of the original input diagram is represented, wherein n is the number of nodes, d is the characteristic dimension of the nodes, ω=w represents the parameter matrix, and σ is a nonlinear activation function.
The first k nodes with the highest connection value are reserved for each node to serve as neighborhood nodes of each node, and a sparse self-enhancement view adjacency matrix S is constructed; constructing a self-enhanced view through a sparse self-enhanced view adjacency matrix S using a k-nearest neighbor algorithm as shown in equation (3):
wherein,representing row vector +.>Is set of the first k maxima, +.>Self-enhanced view adjacency matrix representing full connection>The value of the ith row and jth column of S ij Values representing the ith row and jth column of a sparse self-enhanced view adjacency matrix S, constructing a self-enhanced view +.>
S3, normalizing the target view and the self-enhancement view obtained in the step S2, ensuring that adjacent matrixes in the target view and the self-enhancement view are symmetrical and each element in the adjacent matrixes is non-negative, modeling the normalized target view and self-enhancement view by using a graph convolution neural network with two weights to generate an embedded representation of the target view and an embedded representation of the self-enhancement view, constructing a contrast learning loss between the target view and the self-enhancement view according to the embedded representation of the target view and the embedded representation of the self-enhancement view, and taking the contrast learning loss between the target view and the self-enhancement view as a loss function of a graph contrast learning module;
Normalizing a target viewAnd self-enhanced view->Ensuring adjacency matrix A of target view t And the adjacency matrix S of the self-enhanced view is symmetrical and each element in the adjacency matrix is non-negative as shown in equation (4) and equation (5):
where sym (-) is a symmetric function, nor (-) is a normalized function, σ is a nonlinear activation function that maps element values to [0,1 ]]Interval () T Is transposed toOperating;
embedded representation Z of a target view t As shown in equation (6), the embedded representation Z of the self-enhanced view s As shown in formula (7):
wherein,representing an adjacency matrix A for a target view t A symmetric normalization operation is performed and, representing a symmetric normalization operation performed on the adjacency matrix S of the self-enhanced view>Representing the node attribute matrix of the original input diagram, W (0) ，W (1) ，W (2) Is a learnable weight matrix in a graph rolling network encoder, D t Is (A) t +I) degree matrix, D s Is a degree matrix of (S+I), I being an identity matrix;
loss function of graph comparison learning moduleThe calculation is shown in the formula (8) -formula (10):
wherein N represents the total number of nodes in the original input graph, sim () is a similarity function that calculates the similarity between two node representations, θ represents a temperature factor that controls the concentration level of the distribution;
S4, decoding the embedded representation of the self-enhancement view obtained in the step S3 through a structure reconstruction decoder to obtain a decoding vector, predicting whether a link exists between each pair of nodes according to the decoding vector, generating a reconstructed original input diagram adjacent matrix and calculating a structure reconstruction error; decoding the embedded representation of the self-enhancement view obtained in the step S3 through an attribute reconstruction decoder to obtain a reconstructed original input graph node attribute matrix and calculating an attribute reconstruction error;
structure reconstruction decoder embeds representation Z for self-enhanced view through a graph convolution network s Decoding is carried out to obtain a decoding vector H, as shown in a formula (11):
wherein W is (3) ，W (4) A learnable weight matrix in the decoder is reconstructed for the structure,is to perform a symmetric normalization operation on the original input graph adjacency matrix a, D is the degree matrix of (a + I), I is the identity matrix,
predicting whether a link exists between each pair of nodes according to the decoding vector H to generate a reconstructed original input diagram adjacency matrixAs shown in formula (12):
wherein Sigmoid (.) represents a Sigmoid function, (. S.) T For the transpose operation,
adjacent matrix based on reconstructed original input mapCalculating a structural reconstruction error as shown in formula (13):
wherein R is S Representing the reconstruction error of the structure, Representing the square of the F-norm of the matrix,
attribute reconstruction decoder embeds representation Z for self-enhanced view over a graph convolution network s Decoding to obtain reconstructed original input graph node attribute matrixAs shown in equation (14):
wherein W is (5) ，W (6) ，W (7) Is a learnable weight matrix in the attribute reconstruction decoder,
node attribute matrix according to reconstructed original input diagramCalculating an attribute reconstruction error as shown in formula (15):
wherein R is A Representing the error in the reconstruction of the attribute,representing the square of the F-norm of the matrix;
s5, obtaining a reconstructed original input diagram structure vector and a reconstructed original input diagram attribute vector through the reconstructed original input diagram adjacency matrix and the reconstructed original input diagram node attribute matrix obtained in the step S4, constructing an anomaly score function, calculating the anomaly score of each node, and sorting the nodes according to the anomaly score of each node to identify the anomaly node; constructing a loss function of a network reconstruction module through the structure reconstruction error and the attribute reconstruction error obtained in the step S4, combining the loss function of the graph comparison learning module and the loss function of the network reconstruction module to obtain a total loss function of an unsupervised attribute network anomaly detection model based on the view level graph comparison learning, and obtaining the unsupervised attribute network anomaly detection model based on the view level graph comparison learning through joint training;
The anomaly score function is shown in equation (16):
wherein v is i Representing nodes, alpha is an important control parameter for balancing the reconstruction of a structure and the reconstruction of an attribute, and x i For node v i Is used to determine the original input map attribute vector,for node v i A) reconstructed original input map attribute vector of (a) i The ith row vector of the adjacency matrix A for the original input graph represents the node v i Is the original input diagram structure vector, ">Reconstructed original input diagram adjacency matrix +.>I-th row vector of (a) represents node v i Is used for reconstructing the original input diagram structure vector;
reconstructing the error R by structure S And attribute reconstruction error R A Obtaining the loss function of the network reconstruction moduleAs shown in formula (17):
where alpha is an important control parameter for balancing the effects of structure reconstruction and attribute reconstruction,representing the square of the F-norm of the matrix;
overall loss function of unsupervised attribute network anomaly detection model based on view level graph comparison learningAs shown in equation (18):
mu is a non-negative tuning parameter used for measuring the importance of the graph contrast learning module and the network reconstruction module;
joint training includes minimizing overall loss functions with an adaptive moment estimation optimizerUpdating weight parameters of a graph comparison learning module and a network reconstruction module in the model by adopting a back propagation method to obtain an unsupervised attribute network anomaly detection model based on view level graph comparison learning;
S6, inputting the attribute network to be detected into an unsupervised attribute network anomaly detection model based on view level graph comparison learning, and obtaining a detection result.
The unsupervised attribute network anomaly detection method based on view level graph comparison learning of the embodiment further comprises a target view update mechanism, wherein the embedded representation Z is represented according to the continuously learned self-enhancement view s Calculating the probability of existence of links between each pair of nodes to update the target structure of the target view, thereby continuously correcting the abnormal mode existing in the target view, relieving the structural abnormality in the target view and enabling the self-enhancement view to be more towards the normal mode, and specifically:
embedded representation Z using self-enhanced views s Predicting the probability P that there is a link between each pair of nodes as shown in equation (19):
updating the target view as shown in equation (20):
A t ＝δA t +(1-δ)P (20)
wherein, delta represents the attenuation rate, delta is 0,1]For adjusting the view of the objectThe speed of the update.
The embodiment also provides an unsupervised attribute network anomaly detection system based on view level graph comparison learning, which comprises the following steps as shown in fig. 2:
the data preprocessing module is used for preprocessing the effective data, and manually injecting attribute anomalies and structural anomalies into the clean attribute network to obtain a real-world attribute network with an anomaly mode, and integrating the real-world attribute network into an original input diagram data set;
The graph contrast learning module comprises
The target view generation component is used for constructing a target view through the adjacent matrix of the original input diagram, the node attribute matrix in the original input diagram and the edge attribute matrix of the original input diagram;
a self-enhanced view learning component for modeling the original input graph by a self-enhanced view learner to generate a fully connected self-enhanced view adjacency matrix; based on the fully connected self-enhancement view adjacency matrix, selecting the first k nodes which are semantically similar to each node, using the k nodes as neighborhood nodes of each node, constructing a sparse self-enhancement view adjacency matrix, and constructing a self-enhancement view through the sparse self-enhancement view adjacency matrix;
a contrast learning component for normalizing the target view and the self-enhanced view and ensuring that the adjacency matrix in the target view and the self-enhanced view is symmetrical and each element in the adjacency matrix is non-negative; modeling the normalized target view and the self-enhancement view by using a graph convolution neural network with two weights sharing to generate an embedded representation of the target view and an embedded representation of the self-enhancement view; constructing a contrast learning loss between the target view and the self-enhancement view according to the embedded representation of the target view and the embedded representation of the self-enhancement view, and taking the contrast learning loss between the target view and the self-enhancement view as a loss function of the graph contrast learning module;
A network reconfiguration module comprising
The structure reconstruction component is used for decoding the embedded representation of the self-enhancement view through the structure reconstruction decoder to obtain a decoding vector, predicting whether a link exists between each pair of nodes according to the decoding vector, generating a reconstructed original input diagram adjacent matrix and calculating a structure reconstruction error;
the attribute reconstruction component is used for decoding the embedded representation of the self-enhancement view through an attribute reconstruction decoder to obtain a reconstructed original input graph node attribute matrix and calculating an attribute reconstruction error;
the abnormal node detection component is used for obtaining a reconstructed original input diagram structure vector and a reconstructed original input diagram attribute vector through the obtained reconstructed original input diagram adjacency matrix and the reconstructed original input diagram node attribute matrix, constructing an abnormal score function, calculating the abnormal score of each node, and identifying the abnormal node by sequencing the nodes according to the abnormal score of each node; and constructing a loss function of the network reconstruction module through the structure reconstruction error and the attribute reconstruction error, combining the loss function of the graph comparison learning module and the loss function of the network reconstruction module to obtain a total loss function of the unsupervised attribute network anomaly detection model based on the graph comparison learning, and obtaining the unsupervised attribute network anomaly detection model based on the graph comparison learning through joint training.
The unsupervised attribute network anomaly detection system based on view level graph comparison learning further comprises a target view update mechanism module, wherein the target view update mechanism module is used for updating a target structure of a target view according to the probability of calculating the existence of links between each pair of nodes according to the self-enhancement view embedding representation which is continuously learned, so that an anomaly mode existing in the target view is continuously corrected, structural anomalies in the target view are relieved, and the self-enhancement view is more prone to a normal mode.
Example 2
The data set of the unsupervised attribute network anomaly detection method based on view level graph comparison learning adopts a social network data set BlogCatalog, and performs performance comparison based on the social network data set BlogCatalog and other attribute network anomaly detection methods, and the method comprises the following steps:
step one, acquiring a social network data set BlogCatalog from a blog sharing website, preprocessing, and manually injecting attribute abnormality and structural abnormality into a clean attribute network BlogCatalog to acquire a real world attribute network with an abnormality mode;
the pretreatment comprises the following specific processes:
(1) Structural anomaly injection: randomly selecting m in a network 1 The nodes are fully connected to generate a small group as a structural abnormal group, and the method is repeated iteratively until m is generated 2 The abnormal structure groups are then added to the m 1 ×m 2 The individual nodes are regarded as abnormal structure nodes, and are implemented as follows:
(a) Size m of the designated group 1 Sum of mass number m 2 ；
(b) Randomly selecting m nodes from the set of attribute network nodes, and completely connecting the m nodes to generate a structural anomaly group;
(c) Repeating process (b) m 2 Second, co-generate m 2 The number of structurally abnormal groups, mark the m 1 ×m 2 The individual nodes are abnormal structure nodes;
in the embodiment m is fixed 1 ＝15，m 2 =10, thereby generating 150 structurally abnormal nodes;
(2) Attribute anomaly injection: to ensure that the number of anomalies injected into the attribute network is the same from both a structural and attribute perspective, the other m is randomly selected 3 ×m 4 The individual nodes are used as attribute abnormal nodes, attribute abnormal injection is realized by replacing node attributes, and the method is concretely implemented as follows:
(a) Randomly selecting a node v i Targeted, then another k nodes are extractedAs a candidate set;
(b) For node v in each candidate set (c) ∈V (c) Calculate its attribute vector x (c) And a target node v i Attribute vector x of (2) i Euclidean distance between them;
selecting and destination node v i Node with maximum euclidean distanceAnd will target node v i Attribute vector x of (2) i Change to +.>
Repeating processes (a) to (c) m 3 ×m 4 Second, co-generate m 3 ×m 4 Marking the m 3 ×m 4 The individual nodes are attribute abnormal nodes;
in the embodiment m is fixed 3 ＝15，m 4 =10, thereby generating 150 attribute anomaly nodes, and k=50 is set to ensure that the disturbance amplitude is sufficiently large.
Constructing a target view by using an original input diagram adjacency matrix, an original input diagram node attribute matrix and an edge attribute matrix of the original input diagram in the original input diagram data set, and calculating the edge attribute of each side in the original input diagram by using a similarity index between two connected nodes, wherein six similarity indexes are considered in the embodiment, and the method comprises the following steps:
a. node v i The degree of: connected to node v i The number of sides of (2);
b. node v i Is the degree of the neighborhood node: connected to node v i Is the number of edges of the neighbors;
c. common neighbors: node v i And node v j Common neighbors of (a), i.e. with node v i And node v j The number of nodes connected is the same;
advac-Adar index: weight information is added on the basis of public neighbors;
jaccard index: for comparing differences between limited samples;
f. priority link index: preferential attachment similarity between two nodes is described;
constructing an edge attribute matrix of the original input graph by using the six similarity indexes and calculating an original input graph adjacent matrix A with edge attributes t As shown in formula (21):
wherein lambda is EA Is an edge attribute matrix calculated from similarity indicators of two connected nodes,an adjacency matrix representing the original input graph, where n is the number of nodes, < >>The product of the Hadamard is represented,
using the original input graph adjacency moment with edge attributesArray A t Constructing an edge attribute anchor view with a node attribute matrix X of an original input graph
(2) Constructing a self-enhancement view; using the full graph parameterization method as a self-enhancing view learner, each element of the original input graph adjacency matrix is modeled directly by an independent parameter to generate a fully connected self-enhancing view adjacency matrix without any additional input, as shown in equation (22):
wherein,is a fully connected self-enhanced view adjacency matrix, ω=w is a parameter matrix, σ nonlinear activation function,
self-enhancement view adjacency matrix based on full connectionUsing k-nearest neighbor algorithm, reserving the top k nodes with the highest connection value for each node as neighborhood nodes thereof, constructing a sparse self-enhancement view adjacency matrix S, and preventing the self-enhancement view adjacency matrix S from being fully connected>Masking important features of the network and greatly consuming computing resources, the sparseness formula is shown in formula (23):
Wherein,is a row vector +.>Constructing a self-enhanced view +.>In this embodiment, for the BlogCatalog dataset, the k value is set to 40, and the similarity function uses cosine similarity.
Normalizing the target view and the self-enhancement view, ensuring that the adjacent matrixes in the target view and the self-enhancement view are symmetrical and each element in the adjacent matrixes is non-negative, and ensuring that the adjacent matrixes of the two views are undirected and non-negative for the target viewAnd self-enhanced view->The normalization operation is performed, and the specific calculation method is shown in a formula (24) and a formula (25):
where sym (-) is a symmetric function, nor (-) is a normalized function, σ is a nonlinear activation function that maps element values to [0,1 ]]Interval () T For the transpose operation,
for a self-enhancement view learner, the nonlinear activation function sigma applies an ELU function to prevent gradient disappearance, and in a specific implementation process, two common data enhancement modes of feature masking and edge deletion are used for carrying out simple data enhancement on a target view and the self-enhancement view, wherein the feature masking probability is set to 0.7, and the edge deletion probability is set to 0.8;
Modeling target view and self-enhanced view using two weight-shared graph-convolution neural networks, the embedded representation Z of the target view t As shown in equation (26), the embedded representation Z of the self-enhanced view s As shown in formula (27):
wherein,representing an adjacency matrix A for a target view t Performing symmetric normalization operations, "> Representing a symmetric normalization operation performed on the adjacency matrix S of the self-enhanced view,representing the node attribute matrix of the original input diagram, W (0) ，W (1) ，W (2) Is a learnable weight matrix in a graph rolling network encoder, D t Is (A) t +I) degree matrix, D s Is the degree matrix of (S+I), and I is the identity matrix. In the embodiment, a 2-layer GCN model is used as an encoder, a multi-layer perceptron layer is added after the graph rolling neural network model to map the node representation to another potential space, the hidden layer dimension of the graph rolling neural network model is set to 512, the output layer dimension is set to 64, and the random inactivation rate is set to 0.5;
embedded representation Z from a target view t And an embedded representation Z of a self-enhanced view s Constructing a target viewAnd self-enhanced view->Contrast learning loss between as a loss function of the graph contrast learning module +.>As shown in formula (28) -formula (30):
Where N represents the total number of nodes in the original input graph, sim () is a similarity function that calculates the similarity between two node representations, θ represents the temperature factor that controls the concentration level of the distribution.
Step four, designing a target view updating mechanism, wherein the main idea of the target view updating mechanism is to represent Z according to the embedded of the self-enhancement view which is continuously learned s To calculate the probability of links between each pair of nodes to slowly update the target structure instead of maintaining the target viewThe assumption behind the target view update mechanism is that if there is a real link between two nodes, its connectivity pattern can be well re-established, on the contrary, if the probability of there being a link between two nodes is low, it means that there is no link or there is an abnormal link between them; the method comprises the following steps: use of self-enhanced visionThe embedding of the graph represents Z s The probability P that there is a link between each pair of nodes is predicted as shown in equation (31):
the target view is then updated as shown in equation (32):
A t ＝δA t +(1-δ)P (32)
wherein, delta represents the attenuation rate, delta is 0,1]For adjusting the view of the objectThe speed of the update. In the model training process, each time after epsilon iterations, an anchor view is updated, and the embodiment selects the optimal parameter combination as { delta=0.9999, epsilon=0 } aiming at the BlogCatalog data set;
Step five, decoding the embedded representation of the self-enhancement view through a structure reconstruction decoder to obtain a decoding vector, predicting whether a link exists between each pair of nodes according to the decoding vector, generating a reconstructed original input image adjacent matrix, calculating a structure reconstruction error, and decoding the embedded representation of the self-enhancement view through the structure reconstruction decoder to obtain the decoding vector, wherein a specific calculation method is shown in a formula (33):
wherein W is (3) ，W (4) A learnable weight matrix in the decoder is reconstructed for the structure,is to perform a symmetric normalization operation on the original input graph adjacency matrix a, D is the degree matrix of (a + I), I is the identity matrix,
predicting whether a link exists between each pair of nodes according to the decoding vector H to generate a reconstructed original input diagram adjacency matrixAs shown in equation (34):
wherein Sigmoid (.) represents a Sigmoid function, () T For the transpose operation,
adjacent matrix based on reconstructed original input mapCalculating a structural reconstruction error as shown in formula (35):
wherein R is S Representing the reconstruction error of the structure,representing the square of the F-norm of the matrix,
embedded representation Z of self-enhanced view by attribute reconstruction decoder through graph convolution network s Decoding to obtain reconstructed original input graph node attribute matrix As shown in equation (36):
wherein W is (5) ,W (6) ,W (7) Is a learnable weight matrix in the attribute reconstruction decoder,
node attribute matrix according to reconstructed original input diagramCalculating an attribute reconstruction error as shown in equation (37)The illustration is:
wherein R is A Representing the error in the reconstruction of the attribute,representing the square of the F-norm of the matrix.
Step six, combining the structure reconstruction error R S And attribute reconstruction error R A Obtaining a loss function of the network reconstruction moduleAs shown in equation (38):
where alpha is an important control parameter for balancing the effects of structure reconstruction and attribute reconstruction,is the square of the F-norm of the matrix;
identifying an anomaly node in the attribute network from the anomaly score function as node c i For example, as shown in formula (39):
/>
where α is an important control parameter for balancing the effects of structure reconstruction and attribute reconstruction, x i For node v i Is used to determine the original input map attribute vector,for node v i A) reconstructed original input map attribute vector of (a) i The ith row vector of the adjacency matrix A for the original input graph represents the node v i Is the original input of (1)Mapping structure vector, ">Reconstructed original input diagram adjacency matrix +.>I-th row vector of (a) represents node v i Is used for reconstructing the original input diagram structure vector;
loss function of combined graph contrast learning module And loss function of the network reconstruction module>The overall loss function of the unsupervised attribute network anomaly detection model based on view level graph comparison learning can be obtained>As shown in equation (40):
mu is a non-negative tuning parameter used for measuring the importance of the graph contrast learning module and the network reconstruction module; μ=1 represents a training-only graph contrast learning module, and uses random weights to reconstruct network structure and node attributes, μ=0 represents that no contrast learning mechanism is used to mine network intrinsic information, and only a randomly initialized weight matrix is used to encode the full graph representation, in this embodiment, μ values are set to 0.8 for the blogcataog dataset;
training an unsupervised attribute network anomaly detection model based on view level graph comparison learning; the model of this example received 4000 epochs of training and utilized an adaptive moment estimation (Adam) optimizer to minimize model lossThe learning rate is set to be 0.01, and the model weight parameters are updated by adopting a back propagation method, so that the training set and the testing set are not divided for anomaly detection in an unsupervised scene, all nodes and edges in the original input graph are input into the network together for training in the model training process, anomaly scores of all nodes in the original input graph are calculated by using an anomaly score function, and anomaly nodes in the attribute network are identified by sequencing the anomaly scores of all nodes.
Step eight, evaluating the performance of the model on an unsupervised anomaly detection task; based on the seventh step, the experimental result of the unsupervised attribute network anomaly detection model based on the view level graph comparison learning is evaluated by using the BlogCatalog data set, and the unsupervised attribute network anomaly detection method our and the most advanced attribute network anomaly detection method based on the view level graph comparison learning in the embodiment are: the joint modeling method ANOMALOUS for detecting the anomaly of the attribute network, the depth anomaly detection method DOMINANT for the attribute network, the anomaly detection method Deep AE based on the depth map automatic encoder and the two-step deep learning method Deep2NAD for detecting the anomaly of the network are compared, and experimental results are shown in table 1.
Table 1 comparison of experimental results of different algorithms
As can be seen from table 1, the unsupervised attribute network anomaly detection method our based on the view level graph comparison learning provided in this embodiment obtains the results superior to ANOMALOUS, DOMINANT, deepAE and Deep2NAD on the BlogCatalog data set, which is higher than DOMINANT 8.00% on the precision index, is higher than DOMINANT 1.30% on the recall index, is higher than DOMINANT 3.16% on the AUC index, and shows the good unsupervised anomaly detection performance of the detection method.
In addition, in this embodiment, experiments are performed on non-negative tuning parameters μ with different sizes to obtain experimental results as shown in fig. 3, and as can be seen from fig. 3, when the magnitudes of the non-negative tuning parameters μ are different, the performance of the detection method is different, and no optimal result can be obtained when μ=0 or μ=1, that is, no significant performance degradation occurs when only the graph comparison learning module or only the network reconstruction module is trained, which means that the combined training of two complementary modules helps to improve the performance of the unsupervised attribute network anomaly detection method based on graph comparison learning provided in this embodiment.
The embodiments of the invention have been presented for purposes of illustration and description, and are not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiments were chosen and described in order to best explain the principles of the invention and the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated.

Claims (10)

1. The method for detecting the unsupervised attribute network anomaly detection model based on view level graph comparison learning is characterized by comprising the following steps of:
S1, preprocessing effective data, and manually injecting attribute abnormality and structural abnormality into a clean attribute network to obtain a real-world attribute network with an abnormality mode, and integrating the real-world attribute network into an original input diagram data set;
s2, constructing a target view through an original input diagram adjacent matrix, an original input diagram node attribute matrix and an edge attribute matrix of the original input diagram in the original input diagram data set obtained in the step S1; modeling an original input image in the original input image data set obtained in the step S1 through a self-enhancement view learner to generate a fully-connected self-enhancement view adjacency matrix, selecting the first k nodes which are semantically similar to the fully-connected self-enhancement view adjacency matrix for each node based on the fully-connected self-enhancement view adjacency matrix, and constructing a sparse self-enhancement view adjacency matrix by taking the k nodes as neighborhood nodes of each node;
s3, normalizing the target view and the self-enhancement view obtained in the step S2, ensuring that adjacent matrixes in the target view and the self-enhancement view are symmetrical and each element in the adjacent matrixes is non-negative, modeling the normalized target view and self-enhancement view by using a graph convolution neural network with two weights to generate an embedded representation of the target view and an embedded representation of the self-enhancement view, and constructing a contrast learning loss between the target view and the self-enhancement view according to the embedded representation of the target view and the embedded representation of the self-enhancement view, wherein the contrast learning loss between the target view and the self-enhancement view is used as a loss function of a graph contrast learning module;
S4, decoding the embedded representation of the self-enhancement view obtained in the step S3 through a structure reconstruction decoder to obtain a decoding vector, predicting whether a link exists between each pair of nodes according to the decoding vector, generating a reconstructed original input diagram adjacent matrix and calculating a structure reconstruction error; decoding the embedded representation of the self-enhancement view obtained in the step S3 through an attribute reconstruction decoder to obtain a reconstructed original input graph node attribute matrix and calculating an attribute reconstruction error;
s5, obtaining a reconstructed original input diagram structure vector and a reconstructed original input diagram attribute vector through the reconstructed original input diagram adjacency matrix and the reconstructed original input diagram node attribute matrix obtained in the step S4, constructing an anomaly score function, calculating the anomaly score of each node, and sorting the nodes according to the anomaly score of each node to identify the anomaly node; constructing a loss function of a network reconstruction module through the structure reconstruction error and the attribute reconstruction error obtained in the step S4, combining the loss function of the graph comparison learning module and the loss function of the network reconstruction module to obtain a total loss function of an unsupervised attribute network anomaly detection model based on view level graph comparison learning, and obtaining the unsupervised attribute network anomaly detection model based on view level graph comparison learning through joint training;
S6, inputting the attribute network to be detected into the unsupervised attribute network anomaly detection model based on view level graph comparison learning obtained in the step S5 through joint training, and obtaining a detection result.
2. The method for detecting the network anomaly of the unsupervised attribute based on the view level graph contrast learning according to claim 1, wherein in the step S2, the constructing the target view includes the steps of reading the data of the original input graph to construct the adjacent matrix of the original input graph and the node feature matrix of the original input graph, and calculating the edge attribute of each edge in the original input graph by using the similarity index of two connected nodes in the original input graph to obtain the edge attribute matrix of the original input graph;
constructing an edge attribute matrix of the original input graph and calculating an original input graph adjacency matrix A with edge attributes t As shown in formula (1):
wherein lambda is EA Is the edge attribute matrix of the original input graph calculated from the similarity index of the two connected nodes,representing Hadamard product, ->Representing an adjacency matrix of the original input graph, wherein n is the number of nodes;
using the original input graph adjacency matrix A with edge attributes t Constructing a target view with the node attribute matrix X of the original input diagramWherein (1)>Node attribute matrix representing original input graph, wherein n is node number and d is nodeIs a feature dimension of (2);
the self-enhancement view learner adopts a full-view parameterization method to directly model each element of the adjacency matrix of the original input view through an independent parameter to generate the fully-connected self-enhancement view adjacency matrixAs shown in formula (2):
wherein,the node attribute matrix of the original input diagram is represented, wherein n is the number of nodes, d is the characteristic dimension of the nodes, ω=w represents the parameter matrix, and σ is a nonlinear activation function;
the first k nodes with the highest connection value are reserved for each node to serve as neighborhood nodes of each node, and the sparse self-enhancement view adjacency matrix S is constructed; constructing a self-enhanced view through a sparse self-enhanced view adjacency matrix S using a k-nearest neighbor algorithm as shown in equation (3):
wherein,representing row vector +.>Is set of the first k maxima, +.>Self-enhanced vision representing full connectivityPicture adjacency matrix->The value of the ith row and jth column of S ij Values representing the ith row and jth column of a sparse self-enhanced view adjacency matrix S, constructing a self-enhanced view +. >
3. The method for detecting the network anomaly based on the unsupervised attribute of view level graph contrast learning according to claim 2, wherein in the step S3: normalizing the target viewAnd said self-enhanced view->Ensuring adjacency matrix A of target view t And the adjacency matrix S of the self-enhanced view is symmetrical and each element in the adjacency matrix is non-negative as shown in equation (4) and equation (5):
where sym (-) is a symmetric function, nor (-) is a normalized function, σ is a nonlinear activation function that maps element values to [0,1 ]]Interval () T Is a transposition operation;
the embedded representation Z of the target view t The embedded representation Z of the self-enhanced view, as shown in equation (6) s As shown in formula (7):
wherein,representing an adjacency matrix A for said target view t Performing symmetric normalization operations, ">Representing a symmetric normalization operation performed on the adjacency matrix S of the self-enhanced view,representing the node attribute matrix of the original input diagram, W (0) ，W (1) ，W (2) Is a learnable weight matrix in a graph rolling network encoder, D t Is (A) t +I) degree matrix, D s Is the degree matrix of (S+I), and I is the identity matrix.
4. The method for unsupervised attribute network anomaly detection based on view level graph comparison learning according to claim 3, wherein in step S3, the graph comparison learning module loses function The calculation is shown in the formula (8) -formula (10):
where N represents the total number of nodes in the original input graph, sim () is a similarity function that calculates the similarity between two node representations, θ represents the temperature factor that controls the concentration level of the distribution.
5. The method for unsupervised attribute network anomaly detection based on view level graph comparison learning of claim 4, wherein in step S4, the structure reconstruction decoder embeds the self-enhanced view representation Z through a graph convolution network s Decoding is carried out to obtain a decoding vector H, as shown in a formula (11):
wherein W is (3) ，W (4) A learnable weight matrix in the decoder is reconstructed for the structure,is to perform a symmetric normalization operation on the original input graph adjacency matrix a, D is the degree matrix of (a + I), I is the identity matrix,
predicting whether a link exists between each pair of nodes according to the decoding vector H, and generating the reconstructed original input diagram adjacency matrixAs shown in formula (12):
wherein Sigmoid (.) represents a Sigmoid function, (. S.) T For the transpose operation,
an adjacency matrix based on the reconstructed original input mapCalculating a structural reconstruction error as shown in formula (13):
wherein R is S Representing the reconstruction error of the structure,representing the square of the F-norm of the matrix,
The attribute reconstruction decoder embeds a representation Z for a self-enhanced view over a graph convolution network s Decoding to obtain the reconstructed original input graph node attribute matrixAs shown in equation (14):
wherein W is (5) ，W (6) ，W (7) Is a learnable weight matrix in the attribute reconstruction decoder,
node attribute matrix according to the reconstructed original input diagramCalculating an attribute reconstruction error as shown in formula (15):
wherein R is A Representing the error in the reconstruction of the attribute,representing the square of the F-norm of the matrix.
6. The method for detecting an unsupervised attribute network anomaly based on view level graph comparison learning according to claim 5, wherein in step S5, the anomaly score function is as shown in formula (16):
wherein v is i Representing nodes, alpha is an important control parameter for balancing the reconstruction of a structure and the reconstruction of an attribute, and x i For node v i Is used to determine the original input map attribute vector,for node v i A) reconstructed original input map attribute vector of (a) i The ith row vector of the adjacency matrix A for the original input graph represents the node v i Is the original input diagram structure vector, ">Reconstructed original input diagram adjacency matrix +.>I-th row vector of (a) represents node v i Is used to reconstruct the original input map structure vector.
7. The method for unsupervised attribute network anomaly detection based on view level graph comparison learning according to claim 6, wherein in step S5, the error R is reconstructed by the structure S And the attribute reconstruction error R A Obtaining the network reconstruction moduleIs a loss function of (2)As shown in formula (17):
where alpha is an important control parameter for balancing the effects of structure reconstruction and attribute reconstruction,representing the square of the F-norm of the matrix;
the overall loss function of the unsupervised attribute network anomaly detection model based on view level graph comparison learningAs shown in equation (18):
μ is a non-negative tuning parameter for measuring importance of the graph to the learning module and the network reconstruction module;
the joint training includes minimizing an overall loss function with an adaptive moment estimation optimizerAnd updating weight parameters of a graph comparison learning module and a network reconstruction module in the model by adopting a back propagation method to obtain an unsupervised attribute network anomaly detection model based on view level graph comparison learning.
8. The method for unsupervised attribute network anomaly detection based on view level graph comparison learning of claim 7, further comprising a target view update mechanism according to continuous learning An embedded representation Z of the self-enhanced view as learned s Calculating the probability of existence of links between each pair of nodes, and updating the target structure of the target view, so as to continuously correct the abnormal mode existing in the target view, alleviate the structural abnormality in the target view, and enable the self-enhancement view to be more towards the normal mode, specifically:
embedded representation Z using the self-enhanced view s Predicting the probability P that there is a link between each pair of nodes as shown in equation (19):
updating the target view as shown in equation (20):
A t ＝δA t (1-delta) P (20) wherein delta represents the decay rate, delta ε [0,1 ]]For adjusting the target viewThe speed of the update.
9. An unsupervised attribute network anomaly detection system based on view level graph contrast learning, which is characterized by comprising:
the data preprocessing module is used for preprocessing effective data, and acquiring a real world attribute network with an abnormal mode by manually injecting attribute abnormality and structural abnormality into a clean attribute network, and integrating the real world attribute network into an original input diagram data set;
the graph contrast learning module comprises
The target view generation component is used for constructing a target view through the adjacent matrix of the original input diagram, the node attribute matrix in the original input diagram and the edge attribute matrix of the original input diagram;
a self-enhanced view learning component for modeling the original input graph by a self-enhanced view learner to generate a fully connected self-enhanced view adjacency matrix; selecting the first k nodes which are semantically similar to each node based on the fully connected self-enhancement view adjacency matrix, taking the k nodes as neighborhood nodes of each node, constructing a sparse self-enhancement view adjacency matrix, and constructing a self-enhancement view through the sparse self-enhancement view adjacency matrix;
a contrast learning component for normalizing the target view and the self-enhanced view and ensuring that adjacency matrices in the target view and the self-enhanced view are symmetrical and each element in the adjacency matrices is non-negative; modeling the normalized target view and the self-enhancement view by using a graph convolution neural network with two weights sharing to generate an embedded representation of the target view and an embedded representation of the self-enhancement view; constructing a contrast learning loss between the target view and the self-enhancement view according to the embedded representation of the target view and the embedded representation of the self-enhancement view, and taking the contrast learning loss between the target view and the self-enhancement view as a loss function of a graph contrast learning module;
A network reconfiguration module comprising
The structure reconstruction component is used for decoding the embedded representation of the self-enhancement view through a structure reconstruction decoder to obtain a decoding vector, predicting whether a link exists between each pair of nodes according to the decoding vector, generating a reconstructed original input diagram adjacent matrix and calculating a structure reconstruction error;
the attribute reconstruction component is used for decoding the embedded representation of the self-enhancement view through an attribute reconstruction decoder to obtain a reconstructed original input graph node attribute matrix and calculating an attribute reconstruction error;
the abnormal node detection component is used for obtaining a reconstructed original input diagram structure vector and a reconstructed original input diagram attribute vector through the obtained reconstructed original input diagram adjacency matrix and the reconstructed original input diagram node attribute matrix, constructing an abnormal score function, calculating the abnormal score of each node, and sorting the nodes according to the abnormal score of each node to identify the abnormal node; and constructing a loss function of a network reconstruction module through the structure reconstruction error and the attribute reconstruction error, combining the loss function of the graph comparison learning module and the loss function of the network reconstruction module to obtain a total loss function of an unsupervised attribute network anomaly detection model based on view level graph comparison learning, and obtaining the unsupervised attribute network anomaly detection model based on view level graph comparison learning through joint training.
10. The system for unsupervised attribute network anomaly detection based on view level graph contrast learning of claim 9, further comprising a target view update mechanism module for updating a target structure of the target view according to a continuously learned probability of self-enhanced view embedded representation calculating links between each pair of nodes, thereby continuously correcting an anomaly pattern existing in the target view, relieving structural anomalies in the target view, and making the self-enhanced view more prone to a normal pattern.
CN202311162248.3A 2023-09-11 2023-09-11 Unsupervised attribute network anomaly detection method and system based on view level graph comparison learning Pending CN117201122A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202311162248.3A CN117201122A (en) 2023-09-11 2023-09-11 Unsupervised attribute network anomaly detection method and system based on view level graph comparison learning

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202311162248.3A CN117201122A (en) 2023-09-11 2023-09-11 Unsupervised attribute network anomaly detection method and system based on view level graph comparison learning

Publications (1)

Publication Number Publication Date
CN117201122A true CN117201122A (en) 2023-12-08

Family

ID=89003046

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202311162248.3A Pending CN117201122A (en) 2023-09-11 2023-09-11 Unsupervised attribute network anomaly detection method and system based on view level graph comparison learning

Country Status (1)

Country Link
CN (1) CN117201122A (en)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117407697A (en) * 2023-12-14 2024-01-16 南昌科晨电力试验研究有限公司 Graph anomaly detection method and system based on automatic encoder and attention mechanism
CN117665224A (en) * 2024-01-31 2024-03-08 深圳海关食品检验检疫技术中心 Intelligent laboratory management method for food detection
CN117828513A (en) * 2024-03-04 2024-04-05 北京邮电大学 Thesis subject irrelevant citation checking method and device

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117407697A (en) * 2023-12-14 2024-01-16 南昌科晨电力试验研究有限公司 Graph anomaly detection method and system based on automatic encoder and attention mechanism
CN117407697B (en) * 2023-12-14 2024-04-02 南昌科晨电力试验研究有限公司 Graph anomaly detection method and system based on automatic encoder and attention mechanism
CN117665224A (en) * 2024-01-31 2024-03-08 深圳海关食品检验检疫技术中心 Intelligent laboratory management method for food detection
CN117828513A (en) * 2024-03-04 2024-04-05 北京邮电大学 Thesis subject irrelevant citation checking method and device

Similar Documents

Publication Publication Date Title
CN117201122A (en) Unsupervised attribute network anomaly detection method and system based on view level graph comparison learning
CN110048827B (en) Class template attack method based on deep learning convolutional neural network
CN111414461B (en) Intelligent question-answering method and system fusing knowledge base and user modeling
Pal Soft computing for feature analysis
CN108062572A (en) A kind of Fault Diagnosis Method of Hydro-generating Unit and system based on DdAE deep learning models
CN110110318B (en) Text steganography detection method and system based on cyclic neural network
Ma et al. Learn to forget: Machine unlearning via neuron masking
CN112906770A (en) Cross-modal fusion-based deep clustering method and system
CN112464004A (en) Multi-view depth generation image clustering method
CN113177132A (en) Image retrieval method based on depth cross-modal hash of joint semantic matrix
CN110941734A (en) Depth unsupervised image retrieval method based on sparse graph structure
CN113190688A (en) Complex network link prediction method and system based on logical reasoning and graph convolution
CN114417427A (en) Deep learning-oriented data sensitivity attribute desensitization system and method
CN111598252B (en) University computer basic knowledge problem solving method based on deep learning
CN113128600A (en) Structured depth incomplete multi-view clustering method
CN114513337B (en) Privacy protection link prediction method and system based on mail data
CN113807214B (en) Small target face recognition method based on deit affiliated network knowledge distillation
Ahmed et al. An investigation on disparity responds of machine learning algorithms to data normalization method
Yang et al. Hierarchical overlapping belief estimation by structured matrix factorization
CN112329918A (en) Anti-regularization network embedding method based on attention mechanism
CN116861923A (en) Multi-view unsupervised graph contrast learning model construction method, system, computer, storage medium and application
CN116935128A (en) Zero sample abnormal image detection method based on learning prompt
CN117272195A (en) Block chain abnormal node detection method and system based on graph convolution attention network
CN117036760A (en) Multi-view clustering model implementation method based on graph comparison learning
CN115580547A (en) Website fingerprint identification method and system based on time-space correlation between network data streams

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination