Detection model training method, anomaly detection method, and electronic device

Abstract

The embodiment of the application provides a kind of detection model training method, comprising: obtaining the sample data corresponding to sample graph structure, wherein the initial node attribute of each node and the initial edge attribute of each edge are included in sample data.The initial node attribute is input into the encoding unit of detection model, to obtain the first feature vector output by encoding unit, and the initial edge attribute is input into the encoding unit of detection model, to obtain the second feature vector output by encoding unit.According to the first feature vector and the second feature vector, reconstruct the sample graph structure, and determine the reconstruction error corresponding to the reconstructed sample graph structure.According to the first feature vector and the second feature vector, determine the semantic information corresponding to the sample graph structure, and determine the semantic error corresponding to the sample graph structure according to the semantic information.According to reconstruction error and semantic error, update the model parameter of detection model.The technical scheme of the application can effectively improve the anomaly detection effect of detection model.

Description

Technical Field

[0001] This application relates to computer technology, and more particularly to a detection model training method, an anomaly detection method, and an electronic device. Background Technology

[0002] A graph is a data structure consisting of nodes and edges used to represent relational data. Anomaly detection on graphs can effectively identify abnormal objects.

[0003] Currently, graph anomaly detection is usually performed using detection models. However, when training these models, they are typically trained to detect anomalies at nodes based on node information or at edges based on edge information. In other words, only a portion of the graph information is used for anomaly detection.

[0004] However, relying solely on partial graph information for anomaly detection will result in poor anomaly detection performance. Summary of the Invention

[0005] This application provides a detection model training method, an anomaly detection method, and an electronic device to overcome the problem of poor anomaly detection performance.

[0006] In a first aspect, embodiments of this application provide a detection model training method, including:

[0007] Obtain sample data corresponding to the sample graph structure, wherein the sample data includes the initial node attributes of each node in the sample graph structure and the initial edge attributes of each edge in the sample graph structure.

[0008] The initial node attributes are input into the encoding unit of the detection model to obtain the first feature vector output by the encoding unit, and the initial edge attributes are input into the encoding unit of the detection model to obtain the second feature vector output by the encoding unit.

[0009] The sample graph structure is reconstructed based on the first feature vector and the second feature vector, and the reconstruction error corresponding to the reconstructed sample graph structure is determined.

[0010] The semantic information corresponding to the sample graph structure is determined based on the first feature vector and the second feature vector, and the semantic error corresponding to the sample graph structure is determined based on the semantic information.

[0011] The model parameters of the detection model are updated based on the reconstruction error and the semantic error.

[0012] Secondly, embodiments of this application provide an anomaly detection method, including:

[0013] Obtain first data of the first graph structure to be detected, wherein the first data includes the initial node attributes of each node in the first graph structure and the initial edge attributes of each edge in the first graph structure.

[0014] The initial node attributes and the initial edge attributes are input into the detection model to obtain the target error of the first graph structure output by the detection model, wherein the detection model is trained according to the method described in the first aspect above;

[0015] Based on the target error of the first graph structure, the detection result of the first graph structure is determined, and the detection result is used to indicate whether there is an anomaly in the first graph structure.

[0016] Thirdly, embodiments of this application provide a detection model training apparatus, comprising:

[0017] The acquisition module is used to acquire sample data corresponding to the sample graph structure, wherein the sample data includes the initial node attributes of each node in the sample graph structure and the initial edge attributes of each edge in the sample graph structure.

[0018] The encoding module is used to input the initial node attributes into the encoding unit of the detection model to obtain a first feature vector output by the encoding unit, and to input the initial edge attributes into the encoding unit of the detection model to obtain a second feature vector output by the encoding unit.

[0019] The processing module is configured to reconstruct the sample graph structure based on the first feature vector and the second feature vector, and determine the reconstruction error corresponding to the reconstruction of the sample graph structure.

[0020] The processing module is further configured to determine the semantic information corresponding to the sample graph structure based on the first feature vector and the second feature vector, and to determine the semantic error corresponding to the sample graph structure based on the semantic information;

[0021] An update module is used to update the model parameters of the detection model based on the reconstruction error and the semantic error.

[0022] In one possible design, the processing module is specifically used for:

[0023] The third feature vector corresponding to the sample graph structure is obtained by fusing the first feature vector of each node in the sample graph structure and the second feature vector of each edge in the sample graph structure.

[0024] The third feature vector is input into the decoding unit of the detection model, and the decoding unit is used to reconstruct the sample graph structure based on the third feature vector to obtain the reconstructed graph structure;

[0025] Obtain the reconstruction data corresponding to the reconstruction graph structure output by the decoding unit. The reconstruction data includes the reconstruction node attributes of each node in the reconstruction graph structure and the reconstruction adjacency matrix corresponding to the reconstruction graph structure.

[0026] In one possible design, the sample data also includes the initial adjacency matrix corresponding to the sample graph structure;

[0027] The processing module is specifically used for:

[0028] The first error is determined based on the initial node attributes and the reconstructed node attributes;

[0029] The second error is determined based on the initial adjacency matrix and the reconstructed adjacency matrix;

[0030] The reconstruction error is determined based on the first error and the second error.

[0031] In one possible design, the processing module is specifically used for:

[0032] The semantic processing unit in the detection model is used to split the sample graph structure to obtain at least two positive sample subgraph structures.

[0033] Based on the first feature vector and the second feature vector, determine the feature vector corresponding to each of the positive sample subgraph structures;

[0034] Obtain a first node from a preset node set, and replace each node in each positive sample subgraph structure with the first node to obtain a negative sample subgraph structure.

[0035] Based on the second feature vector, determine the feature vector corresponding to each of the negative sample subgraph structures;

[0036] The semantic information corresponding to the sample graph structure includes the feature vectors corresponding to each of the positive sample subgraph structures and the feature vectors corresponding to each of the negative sample subgraph structures.

[0037] In one possible design, the processing module is specifically used for:

[0038] For any of the positive sample subgraph structures, the feature vector corresponding to the positive sample subgraph structure is obtained by fusing the first feature vector of each node in the positive sample subgraph structure and the second feature vector of each edge in the positive sample subgraph structure.

[0039] In one possible design, the processing module is specifically used for:

[0040] For any of the negative sample subgraph structures, obtain the fourth feature vector corresponding to each first node in the negative sample subgraph structure.

[0041] The feature vector corresponding to the negative sample subgraph structure is obtained by fusing the fourth feature vector of each node in the negative sample subgraph structure and the second feature vector of each edge in the negative sample subgraph structure.

[0042] In one possible design, the positive sample subgraph structure includes a first category of positive sample subgraph structure and a second category of positive sample subgraph structure; and the negative sample subgraph structure includes a first category of negative sample subgraph structure and a second category of negative sample subgraph structure.

[0043] The processing module is specifically used for:

[0044] A third error is determined based on the feature vectors of the positive sample subgraph structure of the first category and the feature vectors of the positive sample subgraph structure of the second category. The third error is proportional to the first difference, which is the difference between the feature vectors of the positive sample subgraph structure of the first category and the feature vectors of the positive sample subgraph structure of the second category.

[0045] A fourth error is determined based on the feature vectors of the negative sample subgraph structure of the first category, the feature vectors of the positive sample subgraph structure of the second category, the feature vectors of the negative sample subgraph structure of the second category, and the feature vectors of the positive sample subgraph structure of the first category. The fourth error is inversely proportional to the second difference and the third difference. The second difference is the difference between the feature vectors of the negative sample subgraph structure of the first category and the feature vectors of the positive sample subgraph structure of the second category. The third difference is the difference between the feature vectors of the negative sample subgraph structure of the second category and the feature vectors of the positive sample subgraph structure of the first category.

[0046] Based on the third error and the fourth error, the semantic error corresponding to the sample graph structure is determined.

[0047] In one possible design, the update module is specifically used for:

[0048] Obtain the first weight information corresponding to the reconstruction error and the second weight information corresponding to the semantic error;

[0049] The target error output by the detection model is obtained based on the first weight information, the reconstruction error, the second weight information, and the semantic error.

[0050] The model parameters of the detection model are updated based on the target error.

[0051] In one possible design, the update module is specifically used for:

[0052] Obtain the first weight information and the second weight information output by the automatic weighted loss layer in the detection network.

[0053] Fourthly, embodiments of this application provide an anomaly detection device, comprising:

[0054] The acquisition module is used to acquire the first data of the first graph structure to be detected, wherein the first data includes the initial node attributes of each node in the first graph structure and the initial edge attributes of each edge in the first graph structure.

[0055] The processing module is used to input the initial node attributes and the initial edge attributes into the detection model to obtain the target error of the first graph structure output by the detection model, wherein the detection model is trained according to the method described in the first aspect;

[0056] The determination module is used to determine the detection result of the first graph structure based on the target error of the first graph structure, and the detection result is used to indicate whether there is an anomaly in the first graph structure.

[0057] In one possible design, the determining module is specifically used for:

[0058] If the number of the first graph structures is greater than or equal to a preset number, then the detection results of the preset number of first graph structures that rank highest in the anomaly detection results are determined to be anomalies; or,

[0059] If the number of the first graph structures is less than the preset number, then the detection result of the first graph structure whose target error is greater than or equal to the preset threshold is determined to be abnormal.

[0060] Fifthly, embodiments of this application provide an electronic device, including:

[0061] Memory, used to store programs;

[0062] A processor for executing the program stored in the memory, wherein when the program is executed, the processor is configured to perform the methods described in the first and second aspects above.

[0063] In a sixth aspect, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the methods described in the first and second aspects above.

[0064] In a seventh aspect, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the methods described in the first and second aspects above.

[0065] This application provides a detection model training method. This method reconstructs the sample graph structure by combining the attribute information of nodes and the attribute information of edges, and determines the reconstruction error. It also determines the semantic error of the sample graph structure itself by combining the attribute information of nodes and the attribute information of edges. Then, it updates the model parameters of the detection model based on the reconstruction error and the semantic error. This ensures that the training process of the detection model is based on the multi-faceted information of the graph structure, thus effectively improving the anomaly detection effect of the detection model.

[0066] Furthermore, this application provides an anomaly detection method. This method obtains the initial node attributes and initial edge attributes of the first graph structure to be detected, and then inputs the initial node attributes and initial edge attributes into a detection model. The detection model is a detection model trained according to the above embodiments. Therefore, the detection model performs comprehensive processing based on the features in the first graph structure. It not only performs encoding and decoding processing to determine the reconstruction error, but also determines the semantic error of the first graph structure. Therefore, it can effectively ensure the accuracy of the target error output by the detection model. Then, based on the target error, it determines whether there is an anomaly in the first graph structure, thereby effectively ensuring the effect and accuracy of anomaly detection. Attached Figure Description

[0067] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0068] Figure 1 A schematic diagram illustrating the implementation of the heterogeneous graph provided in an embodiment of this application;

[0069] Figure 2 A flowchart of the detection model training method provided in the embodiments of this application;

[0070] Figure 3 The process of the detection model training method provided in the embodiments of this application Figure 2 ;

[0071] Figure 4 The process of the detection model training method provided in the embodiments of this application Figure 3 ;

[0072] Figure 5 This is a schematic diagram illustrating the implementation of the split sample graph structure provided in the embodiments of this application;

[0073] Figure 6 This is a schematic diagram illustrating the implementation of determining semantic information provided in an embodiment of this application;

[0074] Figure 7 A model architecture diagram of the detection model provided in the embodiments of this application;

[0075] Figure 8 A flowchart of the anomaly detection method provided in the embodiments of this application;

[0076] Figure 9 A schematic diagram illustrating the processing of the detection model provided in the embodiments of this application;

[0077] Figure 10 This is a schematic diagram of the structure of the detection model training device provided in the embodiments of this application;

[0078] Figure 11 This is a schematic diagram of the anomaly detection device provided in the embodiments of this application;

[0079] Figure 12 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0080] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0081] To better understand the technical solution of this application, the relevant technologies provided in this application will be further described in detail below.

[0082] Graphs, as a general-purpose data structure, are widely used to represent complex structured data. Compared to other data structures, graphs can better store and represent entities and the relationships between them. A graph typically includes multiple nodes and edges between them, where nodes represent entities and edges represent the relationships between entities.

[0083] Furthermore, anomaly detection refers to the process of identifying anomalous objects in data that differ from the majority of objects. The distribution and generation mechanisms of anomalous objects are usually different from other objects. Anomalous objects are typically understood as deviating significantly from most data and not conforming to normal behavior.

[0084] In graph data structures, graph anomaly detection can be performed. Graph anomaly detection can identify anomalous objects within a single graph, such as anomalous nodes, edges, or subgraphs. Alternatively, it can identify anomalous graphs across multiple graphs.

[0085] Graph anomaly detection has numerous applications. For example, in the financial sector, it can identify anomalies in financial data, such as unusual credit card applications or loan fraud. In cybersecurity, it can identify suspicious users and new network intrusion patterns from traffic data. In e-commerce, it can identify abnormal interactions in transaction data, such as malicious order-brushing. In the ecosystem, it can identify abnormal weather conditions. In industry, it can identify defective products. In the medical field, it can identify abnormal lesions, and so on.

[0086] Therefore, it is understandable that graph anomaly detection has a wide range of applications. As long as the data can be constructed into a corresponding graph representation, anomaly detection can be performed accordingly. This embodiment does not limit the specific application scenarios of graph anomaly detection.

[0087] In current related technologies, when performing graph anomaly detection, a detection model is usually trained, and then graph anomaly detection is performed based on the trained detection model.

[0088] Furthermore, training detection models typically involves unsupervised learning. Unsupervised learning refers to solving various pattern recognition problems using unlabeled training samples. In other words, the training data itself has no labels, and the model mines effective features or representations based on this unlabeled training data. Based on the above, it is clear that unsupervised graph anomaly detection plays a crucial role in applications such as financial fraud detection and medical lesion detection.

[0089] However, existing technologies for graph anomaly detection typically rely on partial graph information to detect anomalies in isomorphic graphs. For example, the detection model is trained to detect node anomalies based on node information, or the detection model is trained to detect edge anomalies based on edge information; in other words, anomaly detection is performed using only partial graph information.

[0090] However, this implementation method fails to consider the overall semantic information of the graph, resulting in poor anomaly detection performance. Furthermore, related technologies typically perform anomaly detection on homogeneous graphs, which is not applicable to heterogeneous graphs.

[0091] The following explains isomorphic and heterogeneous graphs. A isomorphic graph is one in number, meaning it contains only one type of node and one type of edge. A heterogeneous graph, on the other hand, contains more than one type of node or edge.

[0092] For example, it can be combined Figure 1 Understanding heterogeneous graphs Figure 1 This is a schematic diagram illustrating the implementation of the heterogeneous graph provided in an embodiment of this application.

[0093] like Figure 1 As shown, the graph structure includes four nodes and three edges. The four nodes are node 101, node 102, node 103 and node 104. The three edges are the edge between node 101 and node 102, the edge between node 103 and node 102, and the edge between node 104 and node 102.

[0094] Among them, nodes 101, 103, and 104 are of the same type, which can be understood as product nodes. Node 102 is of another type, which can be understood as company nodes.

[0095] And, refer to Figure 1 It is certain that each node in the graph structure has its own attribute information. For example, the attribute information of a product node includes the product name and product identifier. For instance, the name of node 101 is pulp, and it has a corresponding identifier. Nodes 103 and 104 are similar. Similarly, the attribute information of a company node includes the company name and the industry to which the company belongs. For instance, the name of node 102 is company C, and its industry is manufacturing.

[0096] as well as Figure 1 The three edges shown represent the relationships between the corresponding nodes, see reference. Figure 1 It can be determined that there are two types of these three edges: buy type and sell type (different line thicknesses are used to distinguish the different edge types).

[0097] For example, if the edge between node 101 and node 102 is of the "buy" type, this edge can indicate that company C has bought pulp.

[0098] The edges between nodes 103 and 102, and between nodes 104 and 102, are of the "sell" type, indicating that company C sold toilet paper and company C sold napkins, respectively.

[0099] Furthermore, each edge also corresponds to its own attribute information, for example, in Figure 1 In the example, the attribute information for each edge can include its corresponding quantity and amount.

[0100] Based on the above introduction, it can be determined that in the existing technology, graph anomaly detection is usually only performed on homogeneous graphs, and anomaly detection is usually performed based on partial graph information. Moreover, the detection is usually based on whether the nodes are abnormal, whether the edges are abnormal, etc. However, this implementation method is not suitable for the detection of heterogeneous graphs. At the same time, the existing technology only uses partial graph information for anomaly detection, which leads to poor anomaly detection results.

[0101] To address the problems in existing technologies, this application proposes the following technical concept: When dealing with heterogeneous graphs that store information in different ways, it is crucial to correctly mine the relationships embedded within the heterogeneous graph and learn its graph-level representation, rather than simply learning node-level or edge-level representations. Therefore, the technical solution of this application can encode and decode based on node and edge attribute information to achieve reconstruction, ensuring the model learns graph-level features. Furthermore, it can determine the semantic information of the graph based on node and edge attribute information to ensure the model learns graph-level semantic relationships. Thus, anomaly detection can be performed based on the overall graph information, thereby improving the effectiveness of anomaly detection.

[0102] The method provided in this application will be described below with reference to specific embodiments. The method provided in this application can be divided into two parts: model training and model application. These two parts will be described separately below. However, it should be noted that the execution subject for both model training and model application can be a data processing device, such as a server, processor, chip, etc. This application does not limit the specific execution subject of the method; it can be selected and set according to actual needs. Any device with data processing capabilities can be used as the execution subject in the various embodiments of this application.

[0103] The following is a combination of... Figure 2 The training methods for the detection model are introduced. Figure 2 A flowchart of the detection model training method provided in the embodiments of this application.

[0104] like Figure 2 As shown, the method includes:

[0105] S201. Obtain the sample data corresponding to the sample graph structure, wherein the sample data includes the initial node attributes of each node in the sample graph structure and the initial edge attributes of each edge in the sample graph structure.

[0106] In this embodiment, the sample graph structure is a graph structure used for model training, and the sample graph structure can be, for example, the heterogeneous graph described above. It should also be noted that the graph structure mentioned in this application is actually the graph described above.

[0107] Furthermore, for each sample graph structure, there are at least two nodes and at least one edge. Accordingly, the sample data corresponding to the sample graph structure may include, for example, the node attributes of each node in the sample graph structure, which are referred to as initial node attributes in this embodiment, and the edge attributes of each edge in the sample graph structure, which are referred to as edge attributes in this embodiment.

[0108] For example, in the above Figure 1 In the example provided, node attributes can include the name and identifier of the node, and edge attributes can include the number and amount of transactions corresponding to the edge.

[0109] Based on the above introduction, it can be determined that structured data in different application scenarios can be represented by graph structures. Therefore, the specific implementation of the sample graph structure can be selected according to actual needs. Consequently, the initial node attributes of nodes and the initial edge attributes of edges in the sample graph structure can have different implementations in different sample graph structures, and this embodiment does not impose any restrictions on this.

[0110] Furthermore, in addition to the initial node and edge attributes mentioned above, the sample data can be set and expanded according to actual needs. For example, the sample data also includes an initial adjacency matrix corresponding to the sample graph structure, which is used to indicate the connection relationships between the nodes in the sample graph structure.

[0111] In actual implementation, any data related to the sample graph structure can be used as sample data in this embodiment. This embodiment does not limit the specific implementation of the sample data.

[0112] S202. Input the initial node attributes into the encoding unit of the detection model to obtain the first feature vector output by the encoding unit, and input the initial edge attributes into the encoding unit of the detection model to obtain the second feature vector output by the encoding unit.

[0113] The detection model in this embodiment includes an encoding model. After obtaining the initial node attributes and initial edge attributes of the nodes and edges in the sample graph structure, the initial node attributes can be input into the encoding model. The encoding model can encode the initial node attributes to obtain the first feature vector corresponding to the node. Similarly, the initial edge attributes can also be input into the encoding model, whereby the encoding model can encode the initial edge attributes to obtain the second feature vector corresponding to the edge.

[0114] Therefore, the encoding unit in this embodiment can, for example, output the first feature vector corresponding to each node in the sample graph structure, and the second feature vector corresponding to each edge in the sample graph structure.

[0115] S203. Reconstruct the sample graph structure based on the first eigenvector and the second eigenvector, and determine the reconstruction error corresponding to the reconstructed sample graph structure.

[0116] After obtaining the first feature vector corresponding to the node and the second feature vector corresponding to the edge, the sample graph structure can be reconstructed based on the first and second feature vectors. The reconstruction of the sample graph structure can also be understood as the process of encoding and then decoding.

[0117] It is understandable that the reconstructed graph structure is obtained by the detection model through decoding and reconstruction based on the first feature vector and the second feature vector. Therefore, there may be some differences between the reconstructed graph structure and the original graph structure. In this embodiment, the reconstruction error corresponding to the reconstructed sample graph structure can be determined. The reconstruction error here can indicate the difference between the original sample graph structure and the reconstructed sample graph structure.

[0118] It is understandable that reconstruction error can indicate anomalies in the sample graph structure. If the reconstruction error is large, it can be understood that the current detection model has not seen this sample graph structure before and therefore cannot reconstruct it well through encoding and decoding. In this case, it can be understood that the sample graph structure is abnormal compared to the samples that the detection model is familiar with.

[0119] S204. Determine the semantic information corresponding to the sample graph structure based on the first feature vector and the second feature vector, and determine the semantic error corresponding to the sample graph structure based on the semantic information.

[0120] After obtaining the first feature vector corresponding to the node and the second feature vector corresponding to the edge, this embodiment can, for example, process the first and second feature vectors to obtain the semantic information corresponding to the sample graph structure. This semantic information can reflect the semantic meaning of the sample graph structure to a certain extent. It is understandable that when the sample graph structure is abnormal, its corresponding semantic meaning will also be abnormal. For example, taking the scenario of a company buying and selling, if the graph structure reflects that the company only bought 1 kilogram of pulp but sold 10 tons of napkins, then this graph is definitely abnormal.

[0121] Therefore, in this embodiment, after determining the semantic information corresponding to the sample graph structure, the semantic error corresponding to the sample graph structure can be determined based on the semantic information. For example, the semantic error can indicate the semantic anomaly of the current sample graph structure. If the semantic error is larger, it means that the sample graph structure is more abnormal.

[0122] S205. Update the model parameters of the detection model based on the reconstruction error and semantic error.

[0123] Based on the above introduction, it can be determined that reconstruction error and semantic error reflect the anomalies in the sample graph structure from different perspectives. Moreover, the training process of the graph anomaly detection model is unsupervised, so the sample graph structures are usually positive samples, meaning that the sample graph structures are usually normal graph structures.

[0124] Understandably, larger reconstruction and semantic errors indicate a more abnormal graph structure. Conversely, smaller reconstruction and semantic errors indicate a more normal graph structure. Since the detection model in this embodiment processes normal sample graph structures, we aim for the reconstruction and semantic errors output by the detection model to be as small as possible to ensure accurate anomaly detection.

[0125] Therefore, after obtaining the reconstruction error and semantic error, the model parameters of the detection model can be updated according to the reconstruction error and semantic error, so that the detection model can continuously learn in the direction of decreasing reconstruction error and semantic error, thereby ensuring that the detection model can be effectively trained.

[0126] Meanwhile, in this embodiment, when training the detection model, the attribute information of nodes and edges is integrated. Furthermore, based on the attribute information of nodes and edges, not only is the reconstruction error of the reconstructed sample graph structure determined, but also the semantic error of the sample graph structure itself is determined. Therefore, it can effectively ensure that the detection model is trained based on various aspects of information in the graph structure, so as to ensure that the detection model can effectively improve its detection performance.

[0127] The detection model training method provided in this application includes: acquiring sample data corresponding to a sample graph structure, wherein the sample data includes initial node attributes of each node in the sample graph structure and initial edge attributes of each edge in the sample graph structure. The initial node attributes and initial edge attributes are input into the encoding unit of the detection model to obtain a first feature vector of the node and a second feature vector of the edge output by the encoding unit. The sample graph structure is reconstructed based on the first and second feature vectors, and the reconstruction error corresponding to the reconstructed sample graph structure is determined. Semantic information corresponding to the sample graph structure is determined based on the first and second feature vectors, and the semantic error corresponding to the sample graph structure is determined based on the semantic information. The model parameters of the detection model are updated based on the reconstruction error and the semantic error. By reconstructing the sample graph structure by combining the attribute information of the nodes and the attribute information of the edges, and determining the reconstruction error, and also by combining the attribute information of the nodes and the attribute information of the edges to determine the semantic error of the sample graph structure itself, and then updating the model parameters of the detection model based on the reconstruction error and the semantic error, it can be ensured that the training process of the detection model is based on multiple aspects of the graph structure information, thus effectively improving the anomaly detection performance of the detection model.

[0128] Based on the above embodiments, it can be understood that the processing of the detection model may include two parts: reconstructing the sample graph structure and determining the reconstruction error, and determining the semantic error of the sample graph structure. The following will describe these two parts respectively.

[0129] The following is a combination of... Figure 3 The implementation process for determining the reconstruction error in the detection model training method provided in this application will be described in further detail. Figure 3 The process of the detection model training method provided in the embodiments of this application Figure 2 .

[0130] like Figure 3 As shown, the method includes:

[0131] S301. The first feature vector of each node in the sample graph structure and the second feature vector of each edge in the sample graph structure are fused to obtain the third feature vector corresponding to the sample graph structure.

[0132] In this embodiment, the first feature vector of each node in the sample graph structure and the second feature vector of each edge in the sample graph structure can be fused to obtain the third feature vector corresponding to the sample graph structure, wherein the third feature vector is a feature vector used to characterize the overall features of the sample graph structure.

[0133] The first eigenvector can be understood as a node-level eigenvector, the second eigenvector as an edge-level eigenvector, and the third eigenvector as a graph-level eigenvector.

[0134] In one possible implementation, when performing fusion processing based on the first feature vector and the second feature vector, it can be achieved, for example, through a message passing mechanism. The message passing mechanism is a mechanism for transmitting, aggregating, and updating information in a graph. The specific implementation of the message passing mechanism can be found in the implementation and description in related technologies, and will not be elaborated on in this embodiment.

[0135] S302. The third feature vector is input into the decoding unit of the detection model. The decoding unit is used to reconstruct the sample graph structure based on the third feature vector to obtain the reconstructed graph structure.

[0136] In this embodiment, the detection model further includes a decoding unit, which is used to decode the encoded feature vector. Corresponding to this embodiment, after obtaining the graph-level third feature vector, the third feature vector can be input into the decoding unit of the detection model. The decoding unit is used to reconstruct the sample graph structure based on the third feature vector. In this embodiment, the sample graph structure reconstructed by the decoding unit is called the reconstructed graph structure.

[0137] S303. Obtain the reconstruction data corresponding to the reconstruction graph structure output by the decoding unit. The reconstruction data includes the reconstruction node attributes of each node in the reconstruction graph structure and the reconstruction adjacency matrix corresponding to the reconstruction graph structure.

[0138] In one possible implementation, the output of the decoding unit may be, for example, the reconstruction data corresponding to the reconstructed graph structure, wherein the reconstruction data includes the reconstruction node attributes of each node in the reconstructed graph structure. It can be understood that the reconstruction node attributes are the node attributes restored by the decoding unit based on the third feature vector.

[0139] The reconstructed data also includes the reconstructed adjacency matrix corresponding to the reconstructed graph structure. This matrix indicates the connection relationships between nodes in the reconstructed graph, thus indicating the existence of edges between any two nodes. Essentially, the reconstructed adjacency matrix is ​​the adjacency matrix restored by the decoding unit based on the third eigenvector; in other words, the decoding unit has reconstructed the connection relationships between nodes.

[0140] S304. Determine the first error based on the initial node attributes and the reconstructed node attributes.

[0141] Based on the above description, it can be determined that after processing by the encoding and decoding units, the detection model first encodes the features of the sample graph structure, and then reconstructs the sample graph structure using the encoded features. If the difference between the reconstructed sample graph structure and the original sample graph structure is small, it means that the detection model is familiar with the relevant features and distributions of this sample graph structure, and therefore it can be considered that the sample graph structure is not significantly different from normal data. If the difference between the reconstructed sample graph structure and the original sample graph structure is large, it means that the detection model is unfamiliar with the relevant features and distributions of this sample graph structure, and therefore it can be considered that the sample graph structure is significantly different from normal data. Therefore, this embodiment needs to determine the difference between the sample graph structure and the reconstructed graph structure.

[0142] The decoding unit in this embodiment can output the reconstructed node attributes of each node in the reconstructed graph structure, as well as the reconstructed adjacency matrix corresponding to the reconstructed graph structure. Therefore, for example, the error can be determined based on these two aspects.

[0143] In one possible implementation, for example, the first error can be determined by the initial node attributes of each node in the sample graph structure and the reconstructed node attributes of the corresponding nodes in the reconstructed graph structure. In this embodiment, the first error is used to indicate the difference between the initial node attributes and the reconstructed node attributes.

[0144] S305. Determine the second error based on the initial adjacency matrix and the reconstructed adjacency matrix.

[0145] In another possible implementation, for example, a second error can be determined based on the initial adjacency matrix and the reconstructed adjacency matrix, where the second error is used to indicate the difference between the initial adjacency matrix and the reconstructed adjacency matrix.

[0146] S306. Determine the reconstruction error based on the first error and the second error.

[0147] After determining the first error corresponding to the node attributes and the second error corresponding to the adjacency matrix, the reconstruction error can be determined based on the first and second errors, where the reconstruction error is used to indicate the difference between the reconstructed graph structure and the sample graph structure.

[0148] For example, the sum of the first error and the second error can be determined as the reconstruction error, or the weighted sum of the first error and the second error can be determined as the reconstruction error. This embodiment does not limit the implementation method of determining the first error and the second error, or the implementation method of determining the reconstruction error based on the first error and the second error, as long as the various errors described above can achieve the corresponding indication meaning.

[0149] In one possible implementation, the reconstruction error can be determined by, for example, satisfying the following formula:

[0150] Formula 1

[0151] in, To reconstruct node attributes, As the initial node attributes, then This can be understood as the first error described above, and This is the weighting coefficient corresponding to the first error. To reconstruct the adjacency matrix, Given the initial adjacency matrix, then This can be understood as the second error described above, and This is the weighting coefficient corresponding to the second error. This indicates a reconstruction error.

[0152] It is understandable that, in actual implementation, the specific method for determining the reconstruction error is not limited to Formula 1 described above. For example, adding corresponding coefficients to Formula 1 or modifying Formula 1 can all determine the reconstruction error. Therefore, the specific method for determining the reconstruction error can be selected according to actual needs, as long as it meets the determination method described above and can achieve the corresponding indication.

[0153] The detection model training method provided in this application fuses the first feature vector corresponding to a node and the second feature vector corresponding to an edge to obtain a graph-level third feature vector corresponding to the sample graph structure. This third feature vector is obtained by fusing the attribute information of nodes and edges in the graph structure, thus effectively ensuring that the third feature vector can completely represent the graph-level features. The third feature vector is then processed by the decoding unit in the detection model to reconstruct the sample graph structure. The decoding unit can output the reconstructed node attributes and the reconstructed adjacency matrix of the reconstructed graph structure. A first error is then determined based on the reconstructed node attributes and the initial node attributes, and a second error is determined based on the reconstructed adjacency matrix and the initial adjacency matrix. Finally, a reconstruction error is determined based on the first and second errors. This ensures that the reconstruction error measures information from different perspectives of the graph structure before and after reconstruction. Therefore, the reconstruction error can effectively reflect the overall error between the reconstructed graph structure and the sample graph structure, improving the accuracy and effectiveness of the reconstruction error.

[0154] Based on the above introduction, the following will further combine... Figures 4 to 6 The implementation process of determining the semantic error of the sample graph structure in the detection model training method provided in this application will be further described in detail. Figure 4The process of the detection model training method provided in the embodiments of this application Figure 3 , Figure 5 This is a schematic diagram illustrating the implementation of the split sample graph structure provided in an embodiment of this application. Figure 6 This is a schematic diagram illustrating the implementation of determining semantic information in an embodiment of this application.

[0155] like Figure 4 As shown, the method includes:

[0156] S401. By detecting the semantic processing unit in the model, the sample graph structure is split to obtain at least two positive sample subgraph structures.

[0157] In this embodiment, the detection model also includes a semantic processing unit, which is used to determine the semantic information corresponding to the sample graph structure and determine the semantic error corresponding to the sample graph structure based on the semantic information. Therefore, the steps in this embodiment can be understood as being performed by the semantic processing unit in the detection model.

[0158] The semantic processing unit can decompose the sample graph structure into at least two subgraph structures. In this embodiment, the subgraph structure obtained by directly decomposing the sample graph structure is called the positive sample subgraph structure. It should also be noted that the subgraph structure mentioned in this application can also be directly referred to as a subgraph; these are the same concept.

[0159] In one possible implementation, the semantic processing unit can, for example, split the sample graph structure based on prior knowledge, where prior knowledge can be understood as preset subgraph splitting rules, which can be selected and set according to actual needs.

[0160] For example, it can be combined Figure 5 To understand, in Figure 5 The diagram illustrates a sample graph structure, which includes four nodes, such as product nodes 1, 2, and 3, and company node c. The sample graph structure also includes three edges: the edge between node 2 and node c indicates that the company corresponding to node c bought the product corresponding to node 2; the edge between node 1 and node c indicates that the company corresponding to node c sold the product corresponding to node 1; and the edge between node 3 and node c indicates that the company corresponding to node c sold the product corresponding to node 3.

[0161] Therefore, it is understandable that... Figure 5 There are two types of edges: buy and sell. For example, we can use prior knowledge to... Figure 5 The sample graph structure shown in the diagram is divided into "buy" subgraphs and "sell" subgraphs, which can be understood as the subgraphs being split according to the type of edges.

[0162] For example in Figure 5 In one possible implementation of the example, the sample graph structure can be split into... Figure 5 Part (a) shows two subgraph structures, 501 and 502. Subgraph structure 501 includes nodes c, 1, and 3, as well as the edges between nodes c and 1, and between nodes c and 3. Subgraph structure 502 includes nodes c and 2, as well as the edges between nodes c and 2.

[0163] In another possible implementation, the sample graph structure can be split into... Figure 5 Part (b) shows two subgraph structures, 503 and 504. Subgraph structure 503 includes only node 2 and does not include edges. Subgraph structure 504 includes node c, node 1, and node 3, as well as the edges between node c and node 1, and between node c and node 3.

[0164] In another possible implementation, the sample graph structure can be split into... Figure 5 Part (c) shows two subgraph structures, 505 and 506. Subgraph structure 505 includes only nodes 1 and 3, and does not include edges. Graph structure 506 includes nodes c and 2, as well as the edge between nodes c and 2.

[0165] In another possible implementation, the sample graph structure can be split into... Figure 5 The four subgraph structures 507, 508, 509 and 510 shown in part (d) are as follows: subgraph structure 507 is similar to subgraph structure 505 described above, subgraph structure 508 is similar to subgraph structure 506 described above, subgraph structure 509 is similar to subgraph structure 503 described above, and subgraph structure 510 is similar to subgraph structure 504 described above. They will not be described again here.

[0166] It is understandable that for a given classification rule, there can be multiple different classification methods, but in the above... Figure 5 In the examples, regardless of the partitioning method, the principle is to place the node corresponding to the buy in one subgraph and the node corresponding to the sell in another subgraph. Therefore, based on the partitioning rules corresponding to prior knowledge, the specific partitioning method can be selected according to actual needs.

[0167] One possible implementation is to partition the graph using multiple methods, and then select one subgraph structure from the resulting subgraph structures for further processing. Alternatively, a partitioning method can be pre-selected, and only subgraph structures obtained using this method can be processed.

[0168] It should be noted that the above description describes the division rules for sample graph structures into buyer subgraph structures and seller subgraph structures based on the type of edges. In actual implementation, depending on the application scenario, the specific division rules can be selected and set accordingly, and this embodiment does not impose any restrictions on this.

[0169] S402. For any positive sample subgraph structure, perform fusion processing based on the first feature vector of each node in the positive sample subgraph structure and the second feature vector of each edge in the positive sample subgraph structure to obtain the feature vector corresponding to the positive sample subgraph structure.

[0170] In this embodiment, the subgraph structure obtained by directly dividing the sample graph structure is called the positive sample subgraph structure. It can be understood that dividing the sample graph structure can yield at least two positive sample subgraph structures. The processing method for each positive sample subgraph structure is similar. Therefore, the following explanation will take any positive sample subgraph structure as an example.

[0171] In this embodiment, after determining the positive sample subgraph structure, for example, the feature vector corresponding to the positive sample subgraph structure can be determined. The feature vector here is the subgraph-level feature vector for this positive sample subgraph structure.

[0172] Furthermore, the positive sample subgraph structure can include at least one node or at least one edge. Therefore, in one possible implementation, for example, the feature vector corresponding to the positive sample subgraph structure can be obtained by fusing the first feature vector of each node and the second feature vector of each edge in the positive sample subgraph structure. Similar to the embodiments described above, processing can be performed through a message passing mechanism, which will not be elaborated here.

[0173] For example, it can be combined Figure 6 To understand this, let's assume that among various possible subgraph partitioning methods, we can choose... Figure 6 The subgraph partitioning method shown is used for processing; that is, the currently determined positive sample subgraph structure includes... Figure 6 As shown in 601 and 602, when determining the feature vector for subgraph structure 601, the feature vectors corresponding to the first feature vectors of node c, node 1, and node 3 can be fused together to obtain the feature vectors corresponding to subgraph structure 601. Among them, the feature vectors It is a vector used to characterize the overall features of the subgraph structure 601, and the subscript sub indicates the subgraph.

[0174] For example, when determining the feature vector for subgraph structure 602, the first feature vector corresponding to node c, the first feature vector corresponding to node 2, and the second feature vector corresponding to the edge between node c and node 2 can be fused to obtain the feature vector corresponding to subgraph structure 602. Among them, the feature vectors It is a vector used to characterize the overall features of the subgraph structure 602.

[0175] S403. Obtain the first node from the preset node set, and replace each node in the positive sample subgraph structure with the first node to obtain the negative sample subgraph structure.

[0176] The positive sample subgraph structure described above is a subgraph obtained by directly dividing the sample graph structure. However, the sample graph structures in this embodiment are all normal, so the positive sample subgraph structure usually does not have many abnormal situations.

[0177] However, in order to enable the detection model to learn as much knowledge as possible, the structure of the positive sample subgraph can be modified in this embodiment to obtain the structure of the negative sample subgraph.

[0178] In one possible implementation, for example, a first node can be obtained from a preset set of nodes. Then, this first node can be used to replace each node in the positive sample subgraph structure, that is, to replace the original nodes in the positive sample subgraph structure, thereby obtaining the negative sample subgraph structure. For example, a first node with the same number of nodes as in the positive sample subgraph structure can be selected, and then the first node can be used to replace each node in the positive sample subgraph structure.

[0179] For example, continuing with the example introduced above, Figure 5 In the sample graph structure given, node c corresponds to company c, node 2 corresponds to the product pulp, node 1 corresponds to the product toilet paper, and node 3 corresponds to the product napkins. Figure 5 The sample diagram structure in the image represents Company C buying pulp, then manufacturing toilet paper and napkins for sale.

[0180] In one possible implementation, the preset node set in the current example could be a set of product category nodes, such as all product nodes in the preset node set, where each node corresponds to attribute information, such as the product name, identifier, etc.

[0181] In the current example, there are a total of 3 nodes in the positive sample subgraph structure. For example, we can randomly select 3 product nodes from the preset node set, such as metal jewelry, clothing and cups.

[0182] Then, these three product nodes are used to replace the product nodes in the two positive sample subgraph structures respectively. For example, refer to... Figure 6 To understand this, suppose node 1 corresponds to toilet paper, which is replaced by node 5, and node 5 corresponds to metal jewelry. Also suppose node 3 corresponds to napkins, which is replaced by node 6, and node 6 corresponds to clothing. Finally, suppose node 2 corresponds to pulp, which is replaced by node 9, and node 9 corresponds to a cup.

[0183] After the replacement is completed, the positive sample subgraph structure 601 is changed to the negative sample subgraph structure 63, and the positive sample subgraph structure 602 is changed to the negative sample subgraph structure 604.

[0184] The meaning represented by negative sample subgraph structure 603 is that company C sold metal ornaments and clothing, and the meaning represented by negative sample subgraph structure 604 is that company C bought cups.

[0185] In actual implementation, the specific implementation method of the preset node set can be selected and set according to different application scenarios. Furthermore, in actual implementation, the specific node in the sample graph structure replaced by each first node selected from the preset node set can be, for example, randomly replaced. This embodiment does not impose any restrictions on this, and the corresponding node replacement method can also be extended according to actual needs.

[0186] The above describes a method for constructing a negative sample subgraph structure by replacing nodes in the positive sample subgraph structure. Alternatively, the initial edge attributes of the edges in the positive sample subgraph structure can be randomly changed, for example, changing the quantity on a certain edge from 1000kg to 1kg. This can also construct a negative sample subgraph structure. The method of changing the initial edge attributes can be selected and set according to actual needs, and this embodiment does not impose any restrictions on it.

[0187] Alternatively, in the actual implementation process, node replacement and edge attribute changes can be performed simultaneously to construct a negative sample subgraph structure. The implementation method can be selected and set according to actual needs, as long as the negative sample subgraph structure is obtained by changing the positive sample subgraph structure.

[0188] S404. For any negative sample subgraph structure, obtain the fourth feature vector corresponding to each first node in the negative sample subgraph structure.

[0189] After constructing the negative sample subgraph structure, since there are multiple positive sample subgraph structures in this embodiment, there are also multiple negative sample subgraph structures. The processing method for each negative sample subgraph structure is similar, so the following explanation uses any one negative sample subgraph structure as an example.

[0190] In this embodiment, the nodes in the negative sample subgraph structure are the first nodes after replacement. Therefore, the vectors of each node in the negative sample subgraph structure are still uncertain. For example, we can first obtain the fourth feature vector corresponding to each first node in the negative sample subgraph structure. It can be understood that the fourth feature vector is actually a node-level vector.

[0191] In one possible implementation, for example, the attribute information of the nodes in the negative sample subgraph structure can be processed by the encoding unit described above, thereby obtaining the fourth feature vector corresponding to each node in the negative sample subgraph structure.

[0192] S405. Based on the fourth feature vector of each node in the negative sample subgraph structure and the second feature vector of each edge in the negative sample subgraph structure, perform fusion processing to obtain the feature vector corresponding to the negative sample subgraph structure.

[0193] In this embodiment, the feature vector corresponding to the negative sample subgraph structure can also be determined. The feature vector here is the subgraph-level feature vector for this negative sample subgraph structure.

[0194] Similar to the positive sample subgraph structure described above, the feature vectors corresponding to the negative sample subgraph structure can be obtained by fusing the fourth feature vector of each node and the second feature vector of each edge in the negative sample subgraph structure. As described in the above embodiments, this can also be processed through a message passing mechanism, which will not be elaborated here.

[0195] For example, it can be combined Figure 6 To understand this, assume the currently determined negative sample subgraph structure includes... Figure 6 As shown in figures 603 and 604. When determining the feature vector for subgraph structure 603, the feature vectors can be obtained by fusing the first feature vector corresponding to node c, the fourth feature vector corresponding to node 5, the fourth feature vector corresponding to node 6, the second feature vector corresponding to the edge between node c and node 5, and the second feature vector corresponding to the edge between node c and node 6. Among them, the feature vectors It is a vector used to characterize the overall features of the subgraph structure 603.

[0196] For example, when determining the feature vector for subgraph structure 604, the first feature vector corresponding to node c, the fourth feature vector corresponding to node 9, and the second feature vector corresponding to the edge between node c and node 9 can be fused to obtain the feature vector corresponding to subgraph structure 604. Among them, the feature vectors It is a vector used to characterize the overall features of the subgraph structure 604.

[0197] In this embodiment, the semantic information corresponding to the sample graph structure actually includes the feature vectors corresponding to each of the positive sample subgraph structures and the feature vectors corresponding to each of the negative sample subgraph structures.

[0198] S406. Based on the feature vectors of the positive sample subgraph structure of the first category and the feature vectors of the positive sample subgraph structure of the second category, determine the third error. The third error is proportional to the first difference, which is the difference between the feature vectors of the positive sample subgraph structure of the first category and the feature vectors of the positive sample subgraph structure of the second category.

[0199] After determining the feature vectors corresponding to each positive sample subgraph structure and each negative sample subgraph structure, the semantic error can be determined based on each feature vector.

[0200] It should first be noted that the multiple positive sample subgraph structures in this embodiment may include a first category of positive sample subgraph structures and a second category of positive sample subgraph structures.

[0201] In the example described above, when dividing the sample graph structure into positive sample subgraph structures, the sample graph structure is divided into buyer subgraphs and seller subgraphs according to the edge type. Therefore, the buyer subgraph can be a subgraph of one category, while the seller subgraph can be a subgraph of another category.

[0202] In other words, the category of each positive sample subgraph structure can be determined according to different semantic meanings. Alternatively, it can be understood as dividing the sample graph structure into a first category and a second category of positive sample subgraph structures according to the partitioning rules corresponding to prior knowledge. The specific implementation of the first and second categories, as well as the number of positive sample subgraph structures under each category, can be adaptively determined according to the actual partitioning rules.

[0203] For example, it can be combined with the above introduction. Figure 5 To gain a deeper understanding, for example Figure 5 In the two positive sample subgraph structures corresponding to (a) in the diagram, 501 can be understood as the subgraph structure of the first category (selling category), while 502 can be understood as the subgraph structure of the second category (buying category).

[0204] For example Figure 5 In the four positive sample subgraph structures corresponding to (a) in the diagram, 507 and 510 can be understood as the subgraph structures of the first category (selling category), while 508 and 509 can be understood as the subgraph structures of the second category (buying category).

[0205] In this embodiment, nodes in the positive sample subgraph structure are replaced to obtain the corresponding negative sample subgraph structure. Therefore, the corresponding negative sample subgraph structure includes the first category of negative sample subgraph structure and the second category of negative sample subgraph structure.

[0206] It is understandable that the category of the negative sample subgraph structure is the same as the category of its corresponding positive sample subgraph structure. That is, replacing nodes in the positive sample subgraph structure of the first category will result in the corresponding negative sample subgraph structure of the first category. Similarly, replacing nodes in the positive sample subgraph structure of the second category will result in the corresponding negative sample subgraph structure of the second category.

[0207] The following describes the implementation method for determining semantic error. The feature vectors of each positive sample subgraph structure have been determined above, and the positive sample subgraph structures in this embodiment include the first category of positive sample subgraph structures and the second category of positive sample subgraph structures.

[0208] In one possible implementation, for example, a third error can be determined first based on the feature vectors of the first category of positive sample subgraph structures and the feature vectors of the second category of positive sample subgraph structures. The third error is used to indicate the difference between the feature vectors of the first category of positive sample subgraph structures and the feature vectors of the second category of positive sample subgraph structures.

[0209] The third error is proportional to the first difference, which is the difference between the feature vector of the positive sample subgraph structure of the first category and the feature vector of the positive sample subgraph structure of the second category.

[0210] In other words, the greater the difference between the feature vectors of the positive sample subgraph structure of the first category and the positive sample subgraph structure of the second category, the larger the value of the third error. Conversely, the smaller the difference between the feature vectors of the positive sample subgraph structure of the first category and the positive sample subgraph structure of the second category, the smaller the value of the third error.

[0211] In one possible implementation, the third error can, for example, satisfy Equation 2:

[0212] Formula 2

[0213] in, The feature vectors of the positive sample subgraph structure of the first category are: The feature vectors of the positive sample subgraph structure of the second category, and The weighting coefficients corresponding to the third error. This represents the third error.

[0214] Referring to Formula 2, we can determine the feature vector of the positive sample subgraph structure of the first category. Feature vectors of the positive sample subgraph structure of the second category The more similar they are, the more appropriate the first difference will be. The smaller the first difference, the smaller the third error; therefore, the third error is directly proportional to the first difference.

[0215] It is understandable that, since the sample graph structures in this embodiment are all normal samples, and the sample graph structures in this embodiment are divided based on prior knowledge of trade relations, the characteristics of the positive sample subgraph structures of the first category and the positive sample subgraph structures of the second category are actually quite similar.

[0216] For example, combining Figure 6 To understand this, let's assume the subgraph structure of the positive samples in the first category is 601, and the subgraph structure of the positive samples in the second category is 602. Let node 1 and node 3 in subgraph structure 601 represent toilet paper and napkins respectively, and node 2 in subgraph structure 602 represent pulp. Then, the features between nodes 1, 3, and 2 must be quite similar.

[0217] Furthermore, the edges in subgraph structures 601 and 602 also represent the quantity and amount of goods bought and sold, so the features of the edges must be quite similar. Consequently, the feature vectors of subgraph structures 601 and 602 must also be quite similar. The overall meaning of the two subgraphs is that Company C bought a certain amount of pulp and then sold a certain amount of toilet paper and napkins. The semantics of such graph structures are normal.

[0218] Based on the above analysis, it can be determined that the difference between the feature vectors of the positive sample subgraph structure of the first category and the positive sample subgraph structure of the second category is relatively small, and the third error is also relatively small. This is in line with the training direction of minimizing the error of the final output of the detection model.

[0219] S407. Determine the fourth error based on the feature vectors of the negative sample subgraph structure of the first category, the feature vectors of the positive sample subgraph structure of the second category, the feature vectors of the negative sample subgraph structure of the second category, and the feature vectors of the positive sample subgraph structure of the first category.

[0220] In this embodiment, a fourth error can be determined based on the feature vectors of the negative sample subgraph structure of the first category and the positive sample subgraph structure of the second category, as well as the feature vectors of the negative sample subgraph structure of the second category and the positive sample subgraph structure of the first category. The fourth error is used to indicate the difference between the feature vectors of the negative sample subgraph structure of the first category and the feature vectors of the positive sample subgraph structure of the second category, and also to indicate the difference between the feature vectors of the negative sample subgraph structure of the second category and the feature vectors of the positive sample subgraph structure of the first category.

[0221] The fourth error is inversely proportional to the second and third differences. The second difference is the difference between the feature vectors of the negative sample subgraph structure of the first category and the feature vectors of the positive sample subgraph structure of the second category. The third difference is the difference between the feature vectors of the negative sample subgraph structure of the second category and the feature vectors of the positive sample subgraph structure of the first category.

[0222] In other words, the greater the difference between the feature vectors of the negative sample subgraph structure of the first category and the positive sample subgraph structure of the second category, the smaller the value of the fourth error. Conversely, the smaller the difference between the feature vectors of the negative sample subgraph structure of the first category and the positive sample subgraph structure of the second category, the larger the value of the fourth error.

[0223] Furthermore, the greater the difference between the feature vectors of the negative sample subgraph structure of the second category and the positive sample subgraph structure of the first category, the smaller the value of the fourth error. Conversely, the smaller the difference between the feature vectors of the negative sample subgraph structure of the second category and the positive sample subgraph structure of the first category, the larger the value of the fourth error.

[0224] Understandably, because this embodiment replaces nodes in the positive sample subgraph structure to obtain the negative sample subgraph structure, the features of the first category of negative sample subgraph structures and the second category of positive sample subgraph structures are already quite different, exhibiting significant differences. Similarly, the features of the second category of negative sample subgraph structures and the first category of positive sample subgraph structures are already quite different, exhibiting significant differences.

[0225] For example, combining Figure 6 To understand this, let's assume the subgraph structure for the negative samples of the first category is 603, and the subgraph structure for the positive samples of the second category is 602. In subgraph structure 603, nodes 5 and 6 represent metal jewelry and clothing, respectively, and node 2 in subgraph structure 602 represents pulp. Since these three product nodes are unrelated, the features between nodes 5, 6, and 2 must be significantly different.

[0226] Correspondingly, the feature vectors of subgraph structure 603 and subgraph structure 602 must also be quite different. The overall meaning of the two subgraphs is that company C bought a certain amount of pulp and then sold a certain amount of metal ornaments and clothing. The semantics of such a graph structure must be abnormal.

[0227] In this embodiment, the fourth error is set to be inversely proportional to the second difference. Based on the above analysis, it can be determined that the difference between the feature vector of the negative sample subgraph structure of the first category and the positive sample subgraph structure of the second category is relatively large. Therefore, the corresponding fourth error is relatively small, which is in line with the training direction of minimizing the error of the final output of the detection model.

[0228] For example, combining Figure 6 It is understandable that we assume the subgraph structure for the negative samples of the second category is 604, and the subgraph structure for the positive samples of the first category is 601. In subgraph structure 601, nodes 1 and 3 represent toilet paper and napkins respectively, and node 9 in subgraph structure 604 represents a cup. Because these three product nodes are unrelated, the features between nodes 1, 3, and 9 must be significantly different.

[0229] Therefore, the feature vectors of subgraph structure 601 and subgraph structure 604 must also be quite different. The overall meaning of the two subgraphs is that company C bought a certain number of cups and then sold a certain number of toilet paper and napkins. The semantics of such a graph structure must be abnormal.

[0230] In this embodiment, the fourth error is set to be inversely proportional to the third difference. Based on the above analysis, it can be determined that the difference between the feature vector of the negative sample subgraph structure of the second category and the positive sample subgraph structure of the first category is relatively large. Therefore, the corresponding fourth error is relatively small, which is in line with the training direction of minimizing the error of the final output of the detection model.

[0231] In one possible implementation, the fourth error described above can, for example, satisfy Equation 3:

[0232] Formula 3

[0233] in, The feature vectors of the positive sample subgraph structure of the first category are: The feature vectors of the negative sample subgraph structure of the second category. This is used to characterize the third difference described above. And The feature vectors of the negative sample subgraph structure of the first category are... The feature vectors of the positive sample subgraph structure of the second category are: This is used to characterize the second difference described above. And These are the weighting coefficients corresponding to the fourth and fifth errors. This represents the fourth error.

[0234] Referring to Formula 3, we can determine the feature vector of the positive sample subgraph structure of the first category. Feature vectors of the negative sample subgraph structure of the second category The greater the difference, the more... The larger the value, the smaller the fourth error; therefore, the fourth error is proportional to the second difference. Also, the feature vector of the negative sample subgraph structure of the first category... Feature vectors of the positive sample subgraph structure of the second category The greater the difference, the more... The larger the error, the smaller the fourth error; therefore, the fourth error is directly proportional to the third difference.

[0235] Based on the current analysis, it can be determined that during the model training process, the model is actually optimized by maximizing the semantic errors of negative correlations and minimizing the semantic errors of positive correlations. Therefore, it can be guaranteed that the trained detection model can effectively identify semantic anomalies in heterogeneous graphs.

[0236] S408. Based on the third and fourth errors, determine the semantic error corresponding to the sample graph structure.

[0237] After determining the third and fourth errors described above, the semantic error corresponding to the sample structure can be determined based on the third and fourth errors. For example, referring to Formula 4, the sum of the third and fourth errors can be used to determine the semantic error corresponding to the sample graph structure.

[0238] Formula 4

[0239] in, This indicates the semantic error corresponding to the sample graph structure.

[0240] In actual implementation, the method for determining semantic error can be selected and set according to actual needs. For example, the third error and the fourth error can be weighted and summed, or the semantic error can be obtained by performing certain operations on the third error and the fourth error. This embodiment does not limit the specific implementation method for determining semantic error, as long as the semantic error is determined based on the third error and the fourth error.

[0241] It is understandable that the goal of training the detection model in this embodiment is to minimize the error of the final model output. Correspondingly, in the calculation of semantic error, the purpose of model training is to minimize the first difference between the first type of positive sample subgraph structure and the second type of positive sample subgraph structure, maximize the second difference between the first type of negative sample subgraph structure and the second type of positive sample subgraph structure, and maximize the third difference between the first type of positive sample subgraph structure and the second type of negative sample subgraph structure. Based on the above analysis, it can be determined that such an error is consistent with the actual semantic situation.

[0242] Therefore, in this embodiment, the feature vectors corresponding to the positive sample subgraph structure and the feature vectors corresponding to the negative sample subgraph structure are determined. Then, the third error and the fourth error are determined according to the above-described method using the feature vectors of the two types of positive sample subgraph structures and the two types of negative sample subgraph structures. Then, the semantic error of the sample graph structure is determined based on the third error and the fourth error. Under the premise that the training objective is to minimize the semantic error, the semantic processing unit can be effectively trained to correctly analyze the semantic anomalies in the graph structure.

[0243] The two embodiments described above illustrate the implementation methods for determining reconstruction error and semantic error, respectively. Based on the above introduction, the following will further combine... Figure 7 The complete execution flow of the detection model training method provided in the embodiments of this application is described. Figure 7 This is a model architecture diagram of the detection model provided in the embodiments of this application.

[0244] like Figure 7 As shown, the detection unit includes an encoding unit, a decoding unit, a semantic processing unit, and an automatically weighted loss layer. And as shown... Figure 7 As shown, during the model training process, the input to the detection model is a batch of heterogeneous graphs. The detection model processes each heterogeneous graph in a similar way, and the detection model will eventually output the target error corresponding to each of these heterogeneous graphs.

[0245] The model training process in this embodiment may include the following four stages: data construction, data preprocessing, encoding-decoding, and semantic mining. These four stages will be described in detail below.

[0246] During the data construction process, for example, a training set can be built for training the detection model, and a test set can be built for evaluating the detection model.

[0247] For example, in the example of a company buying and selling goods mentioned above, it is possible to obtain multiple abnormal company nodes and multiple normal company nodes.

[0248] Then, for example, 90% of the company nodes can be selected from multiple normal company nodes, and the heterogeneous graph corresponding to their operating status within a preset time period can be used as the training set.

[0249] Additionally, the heterogeneous graph corresponding to the operating conditions of all abnormal company nodes and the remaining 10% of company nodes within a preset time period can be used as a test set.

[0250] It is understood that the above-described methods for determining the training and test sets are merely illustrative examples for one application scenario. In actual implementation, the specific construction of the training and test sets can be selected and set according to actual needs, as long as the graph structure in the training set is as normal as possible. This ensures that the detection model can effectively learn the graph features of normal heterogeneous graphs, and thus effectively detect abnormal heterogeneous graphs in subsequent applications.

[0251] After the data is constructed, a series of preprocessing steps are required to improve the efficiency and effectiveness of subsequent model training.

[0252] Data preprocessing may include, for example, the following:

[0253] Exception handling is used to remove data that significantly exceeds the normal range and to fill in NULL (empty) values ​​with 0.

[0254] Data quantification is used to convert non-numerical data into numerical data to facilitate model processing. This quantification can include data type conversion, such as quantifying character-based data like industry codes, or one-hot encoding (one-bit encoding), for example, one-hot encoding can be used to quantify product nodes in a graph.

[0255] Z-score (zero-mean) standardization is used to standardize the attribute features of each node and edge in each heterogeneous graph, so that the data falls into a uniform range, which facilitates dimensionless analysis.

[0256] In actual implementation, the specific implementation method of data preprocessing can be selected and expanded according to actual needs. This embodiment does not impose any special restrictions on the specific implementation of data preprocessing.

[0257] Next, the encoding and decoding processes will be explained. (Refer to...) Figure 7The detection model in this embodiment includes an encoding unit and a decoding unit.

[0258] The encoding unit can process the node attributes of a node to obtain the first feature vector of the node, and the encoding unit can also process the edge attributes of an edge to obtain the second feature vector of the edge.

[0259] Reference Figure 7 To understand this, for example, the node attributes of nodes c, 1, 2, and 3, as well as the edges between nodes c and 2, c and 1, and c and 3, can be input into the encoding unit. Then, the network layers in the encoding unit (such as linear convolutional layers) can embed the node attributes and edge attributes into a vector of the same dimension, thus obtaining the feature vectors corresponding to each node and each edge. Here, "vector of the same dimension" means that the feature vectors of each node and each edge are of the same dimension.

[0260] In one possible implementation, nodes of the same type can be processed using the same network layer. Similarly, edges of the same type can also be processed using the same network layer.

[0261] For example, refer to Figure 7 The node attributes of node c can be processed through network layers to obtain the first feature vector H1 corresponding to node c. Since nodes 1, 2, and 3 are of the same type, their node attributes can be processed through the same network layer to obtain the first feature vector H2 for node 1, the first feature vector H3 for node 2, and the first feature vector H4 for node 3.

[0262] At the same time, refer to Figure 7 The edge attributes of the edge between node c and node 2 can be processed through a network layer to obtain the second feature vector H5 corresponding to the edge between node c and node 2. Furthermore, since the edge between node c and node 1 and the edge between node c and node 3 are of the same node type, the edge attributes of these edges can be processed through the same network layer to obtain the second feature vector H6 corresponding to the edge between node c and node 1, and the second feature vector H7 corresponding to the edge between node c and node 3.

[0263] After obtaining the feature vectors corresponding to each node and each edge, the encoding unit can further fuse the feature vectors of each node and each edge to obtain the graph-level third feature vector corresponding to the heterogeneous graph, that is... Figure 7 The meaning shown .

[0264] Therefore, the encoding unit in this embodiment can extract useful information from the attribute information of nodes and edges and the topological information of the graph, thereby obtaining a graph-level embedding representation, which is the third feature vector introduced above.

[0265] The third feature vector of the graph level obtained from the encoding unit can then be input into the decoding unit. In the decoding unit, the third feature vector can be processed by network layers to reconstruct the graph-level representation, thus reconstructing the node and graph topological information. This yields... Figure 7 The reconstructed node attributes and reconstructed adjacency matrix are shown.

[0266] Then, based on the initial node attributes and initial adjacency matrix of the sample graph structure, as well as the reconstructed node attributes and reconstructed adjacency matrix output by the decoding unit, the reconstruction error can be determined. The specific implementation of determining the reconstruction error can be referred to the description of the above embodiments, and will not be repeated here.

[0267] The implementation of semantic mining will be explained below, referring to... Figure 7 The semantic processing unit in the detection model can perform semantic mining. In order to obtain the ideal semantic vector, positive sampling and negative sampling methods can be used to generate the semantic vector.

[0268] like Figure 7 As shown, the semantic processing unit can divide the sample graph structure of the input detection model into multiple positive sample subgraph structures, which are then used as positive samples. Subsequently, nodes in the positive sample subgraph structures can be replaced to obtain corresponding negative sample structures, which are then used as negative samples. Next, graph-level feature vectors are determined for both the positive and negative sample subgraph structures. Based on these feature vectors, the semantic error can be determined. The method for determining the semantic error can be referred to the description in the above embodiment.

[0269] The determined reconstruction error and the reconstruction error can then be fed together into the automatic weighted loss layer (autoloss). The automatic weighted loss layer is used to determine the weight parameters corresponding to each error, which is the method described in the above embodiment. , and It is learned by the automatically weighted loss layer. Compared with the implementation method of manually setting weight parameters, the model automatically learns the weight parameters, which can effectively improve the accuracy of the target error output by the final detection model and save the cost of adjusting parameters.

[0270] Then the automatic weighted loss layer can update the model parameters of the detection model based on the determined weight parameters, reconstruction error, and semantic error.

[0271] In one possible implementation, for example, the first weight information corresponding to the reconstruction error and the second weight information corresponding to the semantic error can be obtained through an automatically weighted loss layer. Then, based on the first weight information, the reconstruction error, the second weight information, and the semantic error, the target error output by the detection model is obtained. Then, backpropagation is performed based on the target error to update the model parameters of the detection model, thereby effectively optimizing the detection model so that it optimizes in the direction of minimizing the target error. This ensures that the trained detection model can effectively detect anomalies in heterogeneous graphs.

[0272] The target error, for example, can satisfy Formula 5:

[0273]

[0274] in, For reconstruction error, For semantic error, and To reconstruct the first weight information corresponding to the error, and This is the second weight information corresponding to the semantic error. This represents the target error.

[0275] The method of determining the target error is not limited to Formula 5 mentioned above. For example, the target error can be determined by modifying Formula 5 or by adding relevant parameters, as long as the target error is determined based on the reconstruction error, semantic error, first weight information and second weight information.

[0276] In summary, the detection model training method provided in this application offers an unsupervised, end-to-end heterogeneous graph-level anomaly detection algorithm. The detection model includes a semantic processing unit that generates a relatively ideal graph-level semantic representation. Compared to simply training the detection model for encoding and decoding, simultaneously integrating the graph-level semantic representation effectively improves the effectiveness and accuracy of anomaly detection. It is understood that the detection model in this embodiment considers various aspects of information in the heterogeneous graph during processing, including node attributes, edge attributes, graph topology, and graph semantic information. It then integrates this information to output the target error corresponding to the heterogeneous graph, thus effectively ensuring the accuracy of the target error output by the detection model.

[0277] It should also be noted that the model structure in this embodiment is relatively simple, with fewer network layers, thus ensuring a lightweight detection model. Compared to some large-scale detection models, which have a huge number of parameters and high storage and computation costs, making them difficult to apply to large-scale graph computation scenarios, the lightweight detection model provided in this application can effectively achieve anomaly detection in large-scale heterogeneous graphs. Furthermore, compared to related technologies that only implement node-level and edge-level anomaly detection, the detection model in this application achieves graph-level anomaly detection.

[0278] It should also be noted that related technologies typically perform edge-level anomaly detection based solely on the existence of edges. However, the detection model in this embodiment integrates edge attribute information for anomaly detection, thus effectively improving the detection results.

[0279] The above embodiments describe the training process of the detection model. The following will combine... Figure 8 and Figure 9 The application of the detection model will be explained. Figure 8 This is a flowchart of the anomaly detection method provided in the embodiments of this application. Figure 9 This is a schematic diagram illustrating the processing of the detection model provided in the embodiments of this application.

[0280] like Figure 8 As shown, the method includes:

[0281] S801. Obtain the first data of the first graph structure to be detected, wherein the first data includes the initial node attributes of each node in the first graph structure and the initial edge attributes of each edge in the first graph structure.

[0282] In this embodiment, the graph structure for which anomaly detection is required is referred to as the first graph structure. Similar to the sample graph structure described above, the first graph structure corresponds to first data, which includes the initial node attributes of each node in the first graph structure and the initial edge attributes of each edge in the first graph structure. The implementation of the initial node attributes and initial edge attributes is similar to that described above and will not be repeated here.

[0283] The specific implementation of the first diagram structure can also be selected and set according to actual needs, as can the number of first diagram structures to be detected.

[0284] For example, when anomaly detection is required for multiple graph structures, the first information of multiple first graph structures can be input into the detection model in batches, so that the detection model can output the target error corresponding to each first graph structure in batches.

[0285] Alternatively, if anomaly detection is only required for a single first graph structure, then only the first information of this first graph structure can be input into the detection model so that the detection model outputs the target error of this first graph structure.

[0286] S802. Input the initial node attributes and initial edge attributes into the detection model to obtain the target error of the first graph structure output by the detection model.

[0287] Reference Figure 9 , Figure 9 The diagram illustrates a first graph structure to be detected. After obtaining the initial node attributes and initial edge attributes of the first graph structure, these attributes can be input into the detection model, such as... Figure 9 As shown, after processing, the detection model can output the target error of the first image structure. The detection model in this embodiment is trained according to the detection model training method described in the above embodiment.

[0288] In the detection model, the processing of initial node attributes and initial edge attributes to obtain the target error is similar to that described in the above-described embodiment of training the detection model. This includes reconstructing the first graph structure using an encoding / decoding model to determine the reconstruction error, and determining the semantic information of the first graph structure using a semantic processing unit to determine the semantic error.

[0289] It is understandable that if the reconstruction error is relatively large, it means that the detection model cannot reconstruct the first graph structure well based on the relevant features of the first graph structure. This means that the data features, distribution, etc. of the first graph structure are not familiar to the detection model. Since the detection model is trained based on normal samples, the graph structure that the detection model cannot encode and decode well to reconstruct can be considered to have an abnormal graph structure.

[0290] Furthermore, if the semantic error is relatively large, it indicates that there are some semantic anomalies in the first graph structure. For example, as described in the above embodiment, if a graph means that a company bought a certain number of cups and then sold a certain number of napkins and toilet paper, then the semantics of this graph are definitely abnormal. Similarly, if a graph means that a company bought 10 yuan worth of pulp but sold 10 million yuan worth of napkins and toilet paper, then the semantics of such a graph are also definitely abnormal. The semantic processing unit in this embodiment can output the semantic error, thereby effectively reflecting such semantic errors.

[0291] The detection model then determines the target error of the first image structure based on the reconstruction error and semantic error, thereby ensuring the accuracy of the target error output by the detection model.

[0292] S803. Based on the target error of the first diagram structure, determine the detection result of the first diagram structure. The detection result is used to indicate whether there is an anomaly in the first diagram structure.

[0293] After the detection model outputs the target error of the first image structure, the detection result of the first image structure can be determined based on the target error of the first image structure. The detection result can indicate whether there is an anomaly in the first image structure.

[0294] In one possible implementation, when the number of first graph structures is greater than or equal to a preset number, for example, the target errors of each first graph structure can be sorted, and then the top preset number of first graph structures in the sorting can be identified as graph structures with anomalies. For example, the preset number can be k, meaning that the first graph structures corresponding to the top-k target errors are identified, and the detection results of the top K first graph structures in the sorting are identified as having anomalies. The specific implementation of the preset number K can be selected and set according to actual needs.

[0295] In another possible implementation, when the number of first graph structures is less than a preset number, the target error of the first graph structure can be compared with a preset threshold. Then, the first graph structure with a target error greater than or equal to the preset threshold is determined to be an abnormal graph structure. In other words, the detection result of the first graph structure with a target error greater than or equal to the preset threshold can be determined to be abnormal.

[0296] In actual implementation, when the number of first image structures is greater than or equal to the preset number, the target error can be compared with the preset threshold, and then the detection result of the first image structure with the target error greater than or equal to the preset threshold is determined to be abnormal.

[0297] Understandably, after determining the target error of the first graph structure, the method for determining the detection result based on the target error can be selected and set according to actual needs, as long as the overall principle is to determine the graph structure with a larger target error as the graph structure with anomalies.

[0298] The anomaly detection method provided in this application obtains the initial node attributes and initial edge attributes of the first graph structure to be detected, and then inputs the initial node attributes and initial edge attributes into the detection model. The detection model is a detection model trained according to the above embodiments. Therefore, the detection model performs comprehensive processing based on the features in the first graph structure. It not only performs encoding and decoding processing to determine the reconstruction error, but also determines the semantic error of the first graph structure. Therefore, it can effectively ensure the accuracy of the target error output by the detection model. Then, it determines whether there is an anomaly in the first graph structure based on the target error, thereby effectively ensuring the effect and accuracy of anomaly detection.

[0299] In addition to the content described in the above embodiments, it should also be noted that although the technical solution of this application emphasizes anomaly detection for heterogeneous graphs, if the sample graph structure used in the implementation of the training detection model is a homogeneous graph, the technical solution provided by this application can also achieve anomaly detection for homogeneous graphs. The implementation method is similar to that described above, and only the training set and test set need to be adjusted accordingly.

[0300] Figure 10 This is a schematic diagram of the structure of the detection model training device provided in an embodiment of this application. Figure 10 As shown, the device 100 includes: an acquisition module 1001, an encoding module 1002, a processing module 1003, and an update module 1004.

[0301] The acquisition module 1001 is used to acquire sample data corresponding to the sample graph structure, wherein the sample data includes the initial node attributes of each node in the sample graph structure and the initial edge attributes of each edge in the sample graph structure.

[0302] The encoding module 1002 is used to input the initial node attributes into the encoding unit of the detection model to obtain the first feature vector output by the encoding unit, and to input the initial edge attributes into the encoding unit of the detection model to obtain the second feature vector output by the encoding unit.

[0303] The processing module 1003 is used to reconstruct the sample graph structure based on the first feature vector and the second feature vector, and to determine the reconstruction error corresponding to the reconstruction of the sample graph structure.

[0304] The processing module 1003 is further configured to determine the semantic information corresponding to the sample graph structure based on the first feature vector and the second feature vector, and to determine the semantic error corresponding to the sample graph structure based on the semantic information;

[0305] The update module 1004 is used to update the model parameters of the detection model based on the reconstruction error and the semantic error.

[0306] In one possible design, the processing module 1003 is specifically used for:

[0307] The third feature vector corresponding to the sample graph structure is obtained by fusing the first feature vector of each node in the sample graph structure and the second feature vector of each edge in the sample graph structure.

[0308] The third feature vector is input into the decoding unit of the detection model, and the decoding unit is used to reconstruct the sample graph structure based on the third feature vector to obtain the reconstructed graph structure;

[0309] Obtain the reconstruction data corresponding to the reconstruction graph structure output by the decoding unit. The reconstruction data includes the reconstruction node attributes of each node in the reconstruction graph structure and the reconstruction adjacency matrix corresponding to the reconstruction graph structure.

[0310] In one possible design, the sample data also includes the initial adjacency matrix corresponding to the sample graph structure;

[0311] The processing module 1003 is specifically used for:

[0312] The first error is determined based on the initial node attributes and the reconstructed node attributes;

[0313] The second error is determined based on the initial adjacency matrix and the reconstructed adjacency matrix;

[0314] The reconstruction error is determined based on the first error and the second error.

[0315] In one possible design, the processing module 1003 is specifically used for:

[0316] The semantic processing unit in the detection model is used to split the sample graph structure to obtain at least two positive sample subgraph structures.

[0317] Based on the first feature vector and the second feature vector, determine the feature vector corresponding to each of the positive sample subgraph structures;

[0318] Obtain a first node from a preset node set, and replace each node in each positive sample subgraph structure with the first node to obtain a negative sample subgraph structure.

[0319] Based on the second feature vector, determine the feature vector corresponding to each of the negative sample subgraph structures;

[0320] The semantic information corresponding to the sample graph structure includes the feature vectors corresponding to each of the positive sample subgraph structures and the feature vectors corresponding to each of the negative sample subgraph structures.

[0321] In one possible design, the processing module 1003 is specifically used for:

[0322] For any of the positive sample subgraph structures, the feature vector corresponding to the positive sample subgraph structure is obtained by fusing the first feature vector of each node in the positive sample subgraph structure and the second feature vector of each edge in the positive sample subgraph structure.

[0323] In one possible design, the processing module 1003 is specifically used for:

[0324] For any of the negative sample subgraph structures, obtain the fourth feature vector corresponding to each first node in the negative sample subgraph structure.

[0325] The feature vector corresponding to the negative sample subgraph structure is obtained by fusing the fourth feature vector of each node in the negative sample subgraph structure and the second feature vector of each edge in the negative sample subgraph structure.

[0326] In one possible design, the positive sample subgraph structure includes a first category of positive sample subgraph structure and a second category of positive sample subgraph structure; and the negative sample subgraph structure includes a first category of negative sample subgraph structure and a second category of negative sample subgraph structure.

[0327] The processing module 1003 is specifically used for:

[0328] A third error is determined based on the feature vectors of the positive sample subgraph structure of the first category and the feature vectors of the positive sample subgraph structure of the second category. The third error is proportional to the first difference, which is the difference between the feature vectors of the positive sample subgraph structure of the first category and the feature vectors of the positive sample subgraph structure of the second category.

[0329] A fourth error is determined based on the feature vectors of the negative sample subgraph structure of the first category, the feature vectors of the positive sample subgraph structure of the second category, the feature vectors of the negative sample subgraph structure of the second category, and the feature vectors of the positive sample subgraph structure of the first category. The fourth error is inversely proportional to the second difference and the third difference. The second difference is the difference between the feature vectors of the negative sample subgraph structure of the first category and the feature vectors of the positive sample subgraph structure of the second category. The third difference is the difference between the feature vectors of the negative sample subgraph structure of the second category and the feature vectors of the positive sample subgraph structure of the first category.

[0330] Based on the third error and the fourth error, the semantic error corresponding to the sample graph structure is determined.

[0331] In one possible design, the update module 1004 is specifically used for:

[0332] Obtain the first weight information corresponding to the reconstruction error and the second weight information corresponding to the semantic error;

[0333] The target error output by the detection model is obtained based on the first weight information, the reconstruction error, the second weight information, and the semantic error.

[0334] The model parameters of the detection model are updated based on the target error.

[0335] In one possible design, the update module 1004 is specifically used for:

[0336] Obtain the first weight information and the second weight information output by the automatic weighted loss layer in the detection network.

[0337] The apparatus provided in this embodiment can be used to execute the technical solutions of the above method embodiments. Its implementation principle and technical effects are similar, and will not be described again here.

[0338] Figure 11 This is a schematic diagram of the anomaly detection device provided in an embodiment of this application. Figure 11 As shown, the device 110 includes: an acquisition module 1101, a processing module 1102, and a determination module 1103.

[0339] The acquisition module 1101 is used to acquire the first data of the first graph structure to be detected, wherein the first data includes the initial node attributes of each node in the first graph structure and the initial edge attributes of each edge in the first graph structure.

[0340] Processing module 1102 is used to input the initial node attributes and the initial edge attributes into the detection model to obtain the target error of the first graph structure output by the detection model, wherein the detection model is trained according to the method described in the above embodiments;

[0341] The determining module 1103 is used to determine the detection result of the first graph structure based on the target error of the first graph structure, and the detection result is used to indicate whether there is an anomaly in the first graph structure.

[0342] In one possible design, the determining module 1103 is specifically used for:

[0343] If the number of the first graph structures is greater than or equal to a preset number, then the detection results of the preset number of first graph structures that rank highest in the anomaly detection results are determined to be anomalies; or,

[0344] If the number of the first graph structures is less than the preset number, then the detection result of the first graph structure whose target error is greater than or equal to the preset threshold is determined to be abnormal.

[0345] Figure 12 A schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application, such as... Figure 12 As shown, the electronic device 120 of this embodiment includes: a processor 1201 and a memory 1202; wherein

[0346] Memory 1202 is used to store computer-executed instructions;

[0347] The processor 1201 is used to execute computer execution instructions stored in the memory to implement the various steps of the detection model training method and the anomaly detection method in the above embodiments. For details, please refer to the relevant descriptions in the foregoing method embodiments.

[0348] Alternatively, the memory 1202 can be either standalone or integrated with the processor 1201.

[0349] When the memory 1202 is set up independently, the electronic device also includes a bus 1203 for connecting the memory 1202 and the processor 1201.

[0350] This application also provides a computer-readable storage medium storing computer-executable instructions. When a processor executes the computer-executable instructions, it implements the detection model training method and the anomaly detection method executed by the above-mentioned electronic device.

[0351] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0352] The integrated modules implemented as software functional modules described above can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of this application.

[0353] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0354] The memory may include high-speed RAM, and may also include non-volatile storage (NVM), such as at least one disk storage device, and may also be a USB flash drive, external hard drive, read-only memory, disk or optical disc, etc.

[0355] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0356] The aforementioned storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0357] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0358] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for training a detection model, characterized in that, include: Obtain sample data corresponding to the sample graph structure, wherein the sample data includes the initial node attributes of each node in the sample graph structure and the initial edge attributes of each edge in the sample graph structure, the nodes are used to indicate at least one of the following objects: goods, companies, the edges are used to indicate the relationship between nodes, and the type corresponding to the edges is any one of the following: buy type and sell type; The initial node attributes are input into the encoding unit of the detection model to obtain the first feature vector output by the encoding unit, and the initial edge attributes are input into the encoding unit of the detection model to obtain the second feature vector output by the encoding unit. The sample graph structure is reconstructed based on the first feature vector and the second feature vector, and the reconstruction error corresponding to the reconstructed sample graph structure is determined. The semantic information corresponding to the sample graph structure is determined based on the first feature vector and the second feature vector, and the semantic error corresponding to the sample graph structure is determined based on the semantic information. The model parameters of the detection model are updated based on the reconstruction error and the semantic error. The step of determining the semantic information corresponding to the sample graph structure based on the first feature vector and the second feature vector includes: The semantic processing unit in the detection model is used to split the sample graph structure to obtain at least two positive sample subgraph structures. Based on the first feature vector and the second feature vector, determine the feature vector corresponding to each of the positive sample subgraph structures; Obtain a first node from a preset node set, and replace each node in each positive sample subgraph structure with the first node to obtain a negative sample subgraph structure. Based on the second feature vector, determine the feature vector corresponding to each of the negative sample subgraph structures; The semantic information corresponding to the sample graph structure includes the feature vectors corresponding to each of the positive sample subgraph structures and the feature vectors corresponding to each of the negative sample subgraph structures.

2. The method according to claim 1, characterized in that, The step of reconstructing the sample graph structure based on the first feature vector and the second feature vector includes: The third feature vector corresponding to the sample graph structure is obtained by fusing the first feature vector of each node in the sample graph structure and the second feature vector of each edge in the sample graph structure. The third feature vector is input into the decoding unit of the detection model, and the decoding unit is used to reconstruct the sample graph structure based on the third feature vector to obtain the reconstructed graph structure; Obtain the reconstruction data corresponding to the reconstruction graph structure output by the decoding unit. The reconstruction data includes the reconstruction node attributes of each node in the reconstruction graph structure and the reconstruction adjacency matrix corresponding to the reconstruction graph structure.

3. The method according to claim 2, characterized in that, The sample data also includes the initial adjacency matrix corresponding to the sample graph structure; The determination of the reconstruction error corresponding to the reconstruction of the sample graph structure includes: The first error is determined based on the initial node attributes and the reconstructed node attributes; The second error is determined based on the initial adjacency matrix and the reconstructed adjacency matrix; The reconstruction error is determined based on the first error and the second error.

4. The method according to any one of claims 1-3, characterized in that, The step of determining the feature vector corresponding to each of the positive sample subgraph structures based on the first feature vector and the second feature vector includes: For any of the positive sample subgraph structures, the feature vector corresponding to the positive sample subgraph structure is obtained by fusing the first feature vector of each node in the positive sample subgraph structure and the second feature vector of each edge in the positive sample subgraph structure.

5. The method according to claim 4, characterized in that, The step of determining the feature vector corresponding to each of the negative sample subgraph structures based on the second feature vector includes: For any of the negative sample subgraph structures, obtain the fourth feature vector corresponding to each first node in the negative sample subgraph structure. The feature vector corresponding to the negative sample subgraph structure is obtained by fusing the fourth feature vector of each node in the negative sample subgraph structure and the second feature vector of each edge in the negative sample subgraph structure.

6. The method according to claim 5, characterized in that, The positive sample subgraph structure includes a first category of positive sample subgraph structure and a second category of positive sample subgraph structure; and the negative sample subgraph structure includes a first category of negative sample subgraph structure and a second category of negative sample subgraph structure. Determining the semantic error corresponding to the sample graph structure based on the semantic information includes: A third error is determined based on the feature vectors of the positive sample subgraph structure of the first category and the feature vectors of the positive sample subgraph structure of the second category. The third error is proportional to the first difference, which is the difference between the feature vectors of the positive sample subgraph structure of the first category and the feature vectors of the positive sample subgraph structure of the second category. A fourth error is determined based on the feature vectors of the negative sample subgraph structure of the first category, the feature vectors of the positive sample subgraph structure of the second category, the feature vectors of the negative sample subgraph structure of the second category, and the feature vectors of the positive sample subgraph structure of the first category. The fourth error is inversely proportional to the second difference and the third difference. The second difference is the difference between the feature vectors of the negative sample subgraph structure of the first category and the feature vectors of the positive sample subgraph structure of the second category. The third difference is the difference between the feature vectors of the negative sample subgraph structure of the second category and the feature vectors of the positive sample subgraph structure of the first category. Based on the third error and the fourth error, the semantic error corresponding to the sample graph structure is determined.

7. The method according to any one of claims 1-3, characterized in that, The step of updating the model parameters of the detection model based on the reconstruction error and the semantic error includes: Obtain the first weight information corresponding to the reconstruction error and the second weight information corresponding to the semantic error; The target error output by the detection model is obtained based on the first weight information, the reconstruction error, the second weight information, and the semantic error. The model parameters of the detection model are updated based on the target error.

8. The method according to claim 7, characterized in that, The step of obtaining the first weight information corresponding to the reconstruction error and the second weight information corresponding to the semantic error includes: Obtain the first weight information and the second weight information output by the automatic weighted loss layer in the detection model.

9. An anomaly detection method, characterized in that, include: Obtain first data of the first graph structure to be detected, wherein the first data includes the initial node attributes of each node in the first graph structure and the initial edge attributes of each edge in the first graph structure, wherein the node is used to indicate at least one of the following objects: goods, company, and the edge is used to indicate the relationship between the nodes, and the type corresponding to the edge is any one of the following: buy type and sell type. The initial node attributes and the initial edge attributes are input into the detection model to obtain the target error of the first graph structure output by the detection model, wherein the detection model is trained by the method according to any one of claims 1-8; Based on the target error of the first graph structure, the detection result of the first graph structure is determined, and the detection result is used to indicate whether there is an anomaly in the first graph structure.

10. The method according to claim 9, characterized in that, The step of determining the detection result of the first graph structure based on the target error of the first graph structure, wherein the detection result is used to indicate whether there is an anomaly in the first graph structure, includes: If the number of the first graph structures is greater than or equal to a preset number, then the detection results of the preset number of first graph structures that rank highest in the anomaly detection results are determined to be anomalies; or, If the number of the first graph structures is less than the preset number, then the detection result of the first graph structure whose target error is greater than or equal to the preset threshold is determined to be abnormal.

11. An electronic device, characterized in that, include: Memory, used to store programs; A processor for executing the program stored in the memory, wherein when the program is executed, the processor is configured to perform the method as described in any one of claims 1 to 8 or 9 to 10.

12. A computer-readable storage medium, characterized in that, Includes instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1 to 8 or 9 to 10.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 8 or 9 to 10.

Images