Unsupervised graph anomaly detection model for government affairs, finance and public data governance

Abstract

The invention relates to an unsupervised graph anomaly detection model for government affairs, finance and public data governance. The invention discloses an unsupervised graph anomaly detection model for government affairs, finance and public data governance. The unsupervised graph anomaly detection model comprises a graph sampling module, an attribute graph anomaly detection module and a graph anomaly detection module, the neighborhood subtraction identification module is used for representing positive and negative examples and comprises a GNN encoder sub-module, a neighborhood subtraction sub-module and a low-frequency reconstruction sub-module; and the abnormal value scoring module is used for calculating a final abnormal value score. According to the unsupervised graph anomaly detection model for government affairs, finance and public data governance, high-frequency components are amplified without changing data distribution through neighborhood subtraction operation, and the identifiability of abnormal nodes is further improved; low-frequency information of the graph is effectively reserved through low-frequency reconstruction. And finally, determining an abnormal state of the node by an abnormal scoring mechanism.

Description

Technical Field

[0001] The present invention belongs to the technical field of graph anomaly detection in data governance, and specifically relates to an unsupervised graph anomaly detection model for government affairs, finance, and public data governance. Background Art

[0002] Graph anomaly detection (GAD) aims to identify nodes that deviate significantly from the prevailing node patterns. This technique has been widely used in fields such as spam detection, network intrusion identification, and financial fraud prevention (Kim et al., 2022). However, the complex relationships in real-world graph data make anomaly detection more challenging. In recent years, graph neural networks (GNNs), with their powerful modeling capabilities, have been effectively applied to graph anomaly detection and achieved remarkable results.

[0003] Recent studies have shown that GNNs are not suitable for graph anomaly detection (Xu et al., 2022c, b; Chai et al., 2022). From the perspective of spectral analysis, high-frequency signals are closely related to anomalies (Gao et al., 2023). However, most GNNs use GCN as the backbone, which allows low-frequency information to pass through while filtering out high-frequency anomaly information, that is, the low-pass characteristic of GCN. Due to the low-pass characteristic of GNNs, anomalies are difficult to detect, resulting in the "anomaly disappearance" problem. There are usually two mainstream solutions to solve the anomaly disappearance problem caused by GNNs: (1) Data augmentation: Use data augmentation techniques to enhance anomaly features, such as multi-view methods, to enhance the detectability of anomalies in the latent space by increasing the degree of anomalies in the original data (Xu et al., 2022a; Duan et al., 2023). (2) Deep representation learning: Use complex learning techniques to extract anomaly information of abnormal nodes in the representation space, such as autoencoder-based methods and contrastive learning methods. However, the former follows the encoding-decoding principle, maximizing the use of reconstruction errors of abnormal nodes to detect anomalies, while contrastive learning methods focus on negative sampling, exploring differences in neighborhood patterns hidden in node representations. Although existing efforts have made promising progress, they have not yet directly addressed the challenge of GCNs losing high-frequency information, making anomalies difficult to identify. Therefore, effectively alleviating the disappearance of anomalies caused by the low-pass nature of GCNs while preserving the original data structure is a challenging problem.

[0004] With the deepening of digital transformation in government affairs and finance, massive data resources continue to emerge.

[0005] Traditional anomaly detection methods, such as those based on statistical rules, often struggle with the complex and ever-changing nature of government and financial data. They struggle to capture anomalous patterns within data's multidimensional attributes and complex relationship networks, particularly those that conceal hidden anomalous behaviors formed through complex associations beneath the surface of normal data. While anomaly detection methods based on graph neural networks (GNNs) have made progress, they are limited by the low-pass nature of GNNs and are prone to the "vanishing anomaly" problem, where anomalous information is filtered out. This results in insufficient detection of high-frequency anomalies, making it impossible to accurately identify anomalies such as illegal access patterns in government data and complex fraud networks in financial transactions.

[0006] In view of this, in order to address the above-mentioned anomaly detection difficulties in government and financial data processing, the present invention designs and proposes a new graph anomaly detection model. By relying on neighborhood subtraction operations to amplify high-frequency anomaly signals and combining low-frequency reconstruction to retain normal data features, it can effectively and accurately identify various types of anomalies from complex data relationship networks, providing strong technical support for the security protection, compliance supervision and risk prevention and control of government and financial data. Summary of the Invention

[0007] The purpose of the present invention is to provide an unsupervised graph anomaly detection model for government affairs, finance and public data governance, which cleverly uses neighborhood subtraction to amplify high-frequency signals, thereby enhancing abnormal information in the latent space; at the same time, a low-frequency reconstruction module is introduced to maintain the integrity of low-frequency information, ultimately improving the detection performance of the model.

[0008] In order to achieve the above objectives, the technical solutions adopted are:

[0009] Unsupervised graph anomaly detection models for government, finance, and public data governance, including:

[0010] Graph sampling module: creates positive and negative instance pairs of attribute graphs;

[0011] Neighborhood subtraction identification module: characterizes the positive and negative examples, including: GNN encoder submodule, neighborhood subtraction submodule and low-frequency reconstruction submodule;

[0012] Outlier scoring module: Calculates the final outlier score.

[0013] Furthermore, in the graph sampling module, random walk sampling is performed to generate positive instance pairs of the target node and the subgraph; and negative instance pairs are created by exchanging the subgraphs corresponding to the nodes.

[0014] Furthermore, the GNN encoder submodule encodes the instance pairs to obtain node representations in the positive and negative instance pairs, and the formula is:

[0015] in, X i 、A i and H i Represent subgraphs G respectively i The feature matrix, adjacency matrix and embedding matrix of , W is a trainable parameter, and σ(·) represents the activation function.

[0016] Furthermore, the neighborhood subtraction submodule amplifies the high-frequency signal of the sub-graph by neighborhood subtraction, and the process is as follows:

[0017] (1) Use a readout module to extract neighborhood embeddings, as follows:

[0018]

[0019] in, represents a readout function that varies according to the specific data set;

[0020] (2) By embedding the neighborhood into or From the embedding h of the target node i Subtract it from the target node v i The new embedding of is:

[0021] Among them, α is a balancing factor;

[0022] (3) Use a multilayer perceptron to obtain the predicted output, the formula is:

[0023]

[0024] Furthermore, the low-frequency reconstruction submodule adopts a decoder with low-pass filtering as the core to reconstruct the features of the negative instance pairs. The formula is:

[0025]

[0026] Among them, H i represents the embedding matrix corresponding to all nodes in the subgraph, Representing and reconstructing subgraphs The related reconstructed features, φ, is a linear mapping function that projects the embedding from the latent space to the same dimension as the original features.

[0027] Furthermore, in the outlier scoring module, a multi-round anomaly scoring function is used, and the formula is:

[0028]

[0029] Where T represents the number of test iterations;

[0030] Node vi Construct a comprehensive anomaly scoring function, the formula is: f(v i )=f sub (v i )+γf rec (v i ).

[0031] Furthermore, in the outlier scoring module, the final optimization goal is the formula L=L sub +γL rec ;

[0032] Among them, γ is a hyperparameter;

[0033] In the positive instance pair y i = 1, in the negative instance pair y i =0;

[0034]

[0035] An unsupervised attribute graph anomaly detection method based on neighborhood subtraction adopts the above-mentioned unsupervised attribute graph anomaly detection model.

[0036] A computer device includes a processor and a memory, wherein the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the above-mentioned unsupervised attribute graph anomaly detection model.

[0037] A computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to implement the operation of the above-mentioned unsupervised attribute graph anomaly detection model.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] In order to solve the problem of disappearance of abnormal data due to the low-pass characteristics of GCN, the present invention proposes a solution, which is an unsupervised attribute graph anomaly detection model based on neighborhood subtraction, which involves designing a GCN model that can amplify high-frequency signals while maintaining the original data distribution. Taking into account the different neighborhood patterns between normal nodes and abnormal nodes, the present invention proposes an unsupervised graph anomaly detection (NSGAD) framework based on neighborhood subtraction, the core idea of ​​which is to amplify the high-frequency information of abnormal attribute graphs through neighborhood subtraction, thereby enhancing the anomaly detection capability. The technical solution of the present invention, through the neighborhood subtraction operation, amplifies the high-frequency components without changing the data distribution, thereby further improving the identifiability of abnormal nodes. In addition, in the neighborhood subtraction process, low-frequency reconstruction is introduced to effectively retain the low-frequency information of the graph. Finally, the anomaly scoring mechanism determines the abnormal state of the node.

[0040] The main innovative points of the technical solution of the present invention are summarized as follows:

[0041] (1) Based on the nature of anomalies, this paper proposes an NSGAD framework based on a neighborhood subtraction method, which amplifies the difference between anomaly and normal nodes and alleviates the anomaly disappearance caused by the low-pass characteristic of GCN.

[0042] (2) This paper deeply explores graph anomaly detection from a spectral perspective and theoretically proves the amplification effect of neighborhood subtraction on high-frequency information. In addition, we adopt a low-frequency reconstruction module to efficiently preserve low-frequency information.

[0043] (3) Experiments on eight commonly used anomaly detection datasets show that the framework of the present invention outperforms current mainstream methods and is 65% faster than the best baseline method. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is the NSGAD model framework diagram;

[0045] Figure 2 is the change of the image signal before and after neighborhood subtraction;

[0046] Figure 3 This is a parameter sensitivity analysis. DETAILED DESCRIPTION

[0047] In order to further illustrate the unsupervised graph anomaly detection model for government affairs, finance and public data governance of the present invention and achieve the intended purpose of the invention, the specific implementation method, structure, characteristics and efficacy of the unsupervised graph anomaly detection model for government affairs, finance and public data governance proposed in accordance with the present invention are described in detail below in combination with the preferred embodiments. In the following description, different "one embodiment" or "embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0048] Before elaborating on the unsupervised graph anomaly detection model of the present invention for government affairs, finance and public data governance, it is necessary to further explain the related work mentioned in the present invention to achieve better results.

[0049] 1. Spectral Graph Neural Network

[0050] Spectral GNN (Shuman et al., 2013) performs learnable graph convolution operations in the Fourier domain. In recent years, spectral analysis has attracted widespread attention due to its explanatory power and expressive capabilities for graph neural networks. Balcillar et al. demonstrated that most graph neural networks with GCN as their backbone are low-pass filters and verified the necessity of high-pass filters (Balcilar et al., 2021). To address the problem of GCN filtering out high-frequency signals, FAGCN proposed using adaptive multi-band convolution kernels to learn low- and high-frequency node representations (Bo et al., 2021). BWGNN uses beta wavelets to generate bandpass filters (Tang et al., 2022). Although these spectral methods effectively utilize existing high-frequency information by designing various filter functions, they are still limited by the feature extraction capabilities of the GCN graph neural network encoder. In contrast, this study is the first to attempt to enhance the high-frequency information in the mixed frequency pattern anomaly attribute graph to effectively handle anomalies.

[0051] 2. Graph Anomaly Detection

[0052] Anomaly detection is a key research area that has evolved from traditional statistical methods to advanced deep learning techniques. Early methods (Peng et al., 2018; Perozzi and Akoglu, 2016; Li et al., 2017) primarily rely on shallow mechanisms to identify anomalous patterns. While these methods can be effective for simple or low-dimensional attributed network data, they encounter limitations when processing complex or high-dimensional attributed network data. In recent years, the rise of neural networks has enhanced the ability of models to extract high-dimensional information. New methods such as DOMINANT (Ding et al., 2019a) and SpecAE (Li et al., 2019) have emerged, relying on the representational power and encoder reconstruction mechanisms of graph neural networks for anomaly detection. CoLA (Liu et al., 2021) introduced a self-supervised learning approach and pioneered the contrastive learning paradigm (Yang et al., 2022) for detecting node anomalies in graphs, allowing for more flexible utilization of structural and attribute information. CoLA was further improved in SL-GAD (Zheng et al., 2021) and GRADATE (Duan et al., 2023), employing a multi-perspective approach to improve the ability of graph neural networks to extract anomaly information. Although these algorithms have achieved impressive results, they do not directly address the anomaly vanishing problem caused by GCNs, and their performance is still limited by GCNs' limited anomaly recognition capabilities. In contrast, the present invention uses neighborhood subtraction to enhance anomaly information, alleviating the anomaly vanishing problem and improving the ability of graph neural networks to detect graph anomalies.

[0053] After understanding the related work mentioned in this invention, the following will further introduce the unsupervised graph anomaly detection model of the present invention for government affairs, finance and public data governance in combination with specific embodiments:

[0054] Graph anomaly detection is an important task in multimedia security and data mining. With the emergence of graph neural networks (GNNs), graph anomaly detection has made significant progress. However, GNNs, as low-pass filters, often filter out high-frequency signals that are critical for anomaly detection, resulting in the disappearance of anomalies. To address this problem, this paper proposes an unsupervised attributed graph anomaly detection model based on neighborhood subtraction, which is an unsupervised graph anomaly detection (NSGAD) framework based on neighborhood subtraction. The framework cleverly utilizes neighborhood subtraction to amplify high-frequency signals, thereby enhancing anomaly information in the latent space. In addition, a low-frequency reconstruction module is introduced to maintain the integrity of low-frequency information. Experimental results on synthetic anomaly and real anomaly datasets show that NSGAD outperforms the sota method in terms of both AUC and time consumption.

[0055] Example 1.

[0056] The specific steps are as follows:

[0057] AProblem Definition

[0058] 1. Symbolic marking

[0059] Table 1 summarizes the important concepts mentioned in this embodiment and their corresponding symbols.

[0060] Table 1

[0061]

[0062] 2. Unsupervised Graph Anomaly Detection

[0063] Consider an attributed graph represented as G = (V, A, X). In this structure, Represents the adjacency matrix. The node set V includes {v1, v2, ..., v n}, the total number is N. Matrix The feature is defined, where d represents the feature dimension. In addition, this embodiment uses To describe the node v i Characteristics of Y i It is a score used to quantify the abnormality level of the node. The unsupervised graph anomaly detection framework can be described as finding an optimal function F:

[0064]

[0065] 3. Spectral Theory

[0066] The graph filtering mechanism is rooted in the principle of Graph Fourier Transform (GFT). The symmetric normalized Laplacian operator is expressed as Where I is the identity matrix and D is the degree matrix. When the Laplace operator L undergoes eigendecomposition, it can be expressed as L = U∧U T Here, ∧=diag[λ1,…,λ n ] represents a diagonal matrix filled with eigenvalues, the matrix U=[u1,u2,...,u N ]U=[u1,u2,…,u N ,] contains the eigenvectors corresponding to these specific eigenvalues.

[0067] Given a graph-based signal x∈R N , and its graph Fourier transform is defined as Corresponding to λ k The energy of the signal x in the spectrum domain can be expressed as:

[0068] This is often used to assess the strength of a signal.

[0069] The signal x is filtered by the filter g and is expressed as:

[0070] in, Represents a filtering operation.

[0071] Method B

[0072] In this example, the key components of the NSGAD framework are introduced in detail. Figure 1 As shown in the figure, the framework consists of three main modules: graph sampling module, neighborhood subtraction identification module and outlier scoring module. In the graph sampling process, random walk sampling is first performed to generate "target node and subgraph" instance pairs, and negative instance pairs are created by exchanging the subgraphs corresponding to the nodes. In the neighborhood subtraction discrimination module, the mainstream GNN encoder (with GCN as the skeleton) is used to encode the instance pairs to obtain the node representations in the instance pairs. In order to solve the problem of outlier disappearance caused by the low-pass characteristics of GCN, the present invention introduces two submodules after the encoder: neighborhood subtraction and low-frequency reconstruction. (1) The high-frequency signal of the subgraph is first amplified by neighborhood subtraction, thereby amplifying the abnormal information. After neighborhood subtraction of the subgraph, the difference between the abnormal node and its neighborhood is significantly enhanced. (2) Considering the important role of low-frequency information in anomaly detection, the present invention applies a decoder with low-pass filtering as the core to ensure that the model amplifies the high-frequency information while retaining the low-frequency information in the original data. The decoder effectively utilizes a large amount of low-frequency information in the attribute graph, enabling the model to identify true abnormal patterns. Finally, based on the optimization objectives of the two sub-modules, the present invention designs an outlier scoring module to calculate the final outlier score of each node.

[0073] The details of the key modules in the model of the present invention are:

[0074] 1. Graph Sampling

[0075] Let an attribute graph be G = (V, A, X), where is the adjacency matrix, V is the node set, including v1, v2, ..., v n , a total of N nodes. Matrix represents the feature, where d represents the feature dimension. In addition, this embodiment uses To describe the node v i characteristics.

[0076] The present invention uses random walk algorithm to sample the subgraph of nodes. Specifically, the target node v i As the center, sample a self-subgraph of fixed size K Represents a positive instance pair. Similarly, by perturbing the subgraph (recombining with the subgraph of another node), we get node v i Negative samples Expressed as represents a negative instance pair.

[0077] 2. Neighborhood Subtraction Discrimination

[0078] (1) GNN Encoder

[0079] This embodiment uses the widely used GNN graph neural network as an encoder in graph machine learning to obtain rich representations of instance pairs.

[0080]

[0081] in, X i 、A i and H i Represent subgraphs G respectively i The feature matrix, adjacency matrix and embedding matrix of . In particular, for the embedding of positive instance pairs, it is called For the embedding of negative instance pairs, it is called W is a trainable parameter and σ(·) represents the activation function.

[0082] (2) Neighborhood Subtraction

[0083] To alleviate the problem of outlier nodes disappearing due to the low-pass nature of GCN, we conducted a large number of experiments. We observed significant differences between outlier nodes and background nodes, and summarized the following theoretical and empirical findings:

[0084] Conclusion 1: Neighborhood subtraction will lead to an increase in high-frequency energy, which in turn increases the degree of abnormality in the graph. According to the probabilistic abnormality model, given a graph G = (V, A) and its corresponding Laplace matrix L. The vector x is an n-dimensional vector that obeys a Gaussian distribution, and the expression is: x~N(μe N ,σ 2 I N ),in, Indicates the degree of abnormality.

[0085] Apply the Laplace transform to x. Due to the invariance of the Gaussian distribution, the Fourier transform of It also conforms to the Gaussian distribution of the probability anomaly model. In other words, the result follows a Gaussian distribution consistent with the probabilistic anomaly model, i.e. in, there will be:

[0086] For a set of frequencies (λ1,λ2,...,λ N ), in this embodiment, the first k frequencies are defined as low frequencies, and the sum of their corresponding signal energies is expressed as:

[0087] The ratio of the sum of high-frequency energy and low-frequency energy in the figure can be calculated as follows:

[0088]

[0089] set up So:

[0090]

[0091] set up So

[0092] Since w ≥ 0, we have therefore That is, the high-frequency energy in the graph is proportional to the degree of data anomaly.

[0093] This embodiment will It is defined as the vector after the neighborhood subtraction operation:

[0094]

[0095] Among them, N i Represents node v i The neighbor set of It is inversely proportional to μ. Therefore, the present invention can conclude that neighborhood subtraction will lead to an increase in high-frequency energy, which in turn causes the abnormality of the graph to increase.

[0096] The present invention proposes a specific neighborhood subtraction method based on Conclusion 1. The function of neighborhood subtraction is to amplify high-frequency signals in the abnormal attribute graph, thereby amplifying abnormal values.

[0097] After the GNN encoder, this example first uses a readout module to extract neighborhood embeddings using the formula: Here, φ represents a readout function that varies according to the specific data set, such as Min, Max, and Avg.

[0098] By embedding the neighborhood or From the embedding h of the target node i Subtract it from the target node v i The new embedding of is: where α is a balancing factor.

[0099] From a spectral perspective, anomalies are often associated with high-frequency signals. Through the neighborhood subtraction operation, we amplify the high-frequency components without changing the data distribution, further enhancing the ability to distinguish abnormal nodes. In other words, if v i is an abnormal node, h′ i The transitions will become more unusual and thus easier to identify.

[0100] Then, this embodiment uses a multilayer perceptron to obtain the prediction output, the formula is:

[0101]

[0102] In positive pairs, nodes are usually similar to their neighbors, while in negative pairs they are different. This example uses BCE_loss as the optimization objective, and the formula is:

[0103]

[0104] Among them, in the positive instance pair y i = 1, in the negative instance pair y i =0.

[0105] (3) Low-frequency Reconstruction

[0106] As is well known, most nodes in an anomaly attribute graph are normal nodes. Therefore, the large amount of low-frequency information in the graph is crucial for anomaly detection. To mitigate the potential loss of low-frequency information caused by the neighbor subtraction module, the present invention employs a reconstruction module using a low-pass filter decoder.

[0107]

[0108] Among them, H i represents the embedding matrix corresponding to all nodes in the subgraph, Representing and reconstructing subgraphs Related reconstructed features. φ is a linear mapping function that projects the embedding from the latent space to the same dimension as the original features.

[0109] For a given node v i , this embodiment uses Euclidean distance to determine the original feature X i and their reconstruction features The difference between the two is:

[0110] 3. Anomaly Scoring

[0111] Finally, the neighbor subtraction module and the low-frequency reconstruction module are linked to obtain the final optimization target, which is: L = L sub +γL rec . where γ is a hyperparameter that tends to assign higher weights to modules that are considered more critical for anomaly detection.

[0112] Considering that a single random walk may not be able to fully obtain the neighbor information of a node, this embodiment adopts a multi-round anomaly scoring function, the formula is:

[0113]

[0114] Where T represents the number of test iterations. In order to adjust the value range of the anomaly score to [0, 1], this embodiment uses two separate scalars: δ1 and δ2.

[0115] By combining the two aforementioned scoring functions, we can get i Construct a comprehensive anomaly scoring function, the formula is: f(v i )=f sub (v i )+γf rec (v i ).

[0116] C experiment

[0117] In this section, we conduct a series of experiments on eight widely used anomaly detection benchmark datasets, comparing NSGAD with existing anomaly detection methods to demonstrate the superiority of our model. It is important to emphasize that to maintain experimental fairness, we use the best configurations presented by the benchmark models in their respective papers. The experiments in this example aim to answer the following four questions:

[0118] RQ1: How does the model compare to state-of-the-art baselines on real-world anomaly detection tasks?

[0119] RQ2: Can subtractive amplification amplify high-frequency signals?

[0120] RQ3: How do the various parts of the model affect the performance of the framework?

[0121] RQ4: How do key hyperparameters affect the performance of the model?

[0122] 1. Experimental Setup

[0123] (1) Datasets. This example uses eight datasets widely used in the field of anomaly detection to evaluate the proposed NSGAD model, including six typical graph datasets: Cora, Citeseer, Pubmed, ACM (Sen et al., 2008; Tang et al., 2008), Flickr, and BlogCatalog (Tang and Liu, 2009), as well as two real anomaly datasets: Reddit (Kumar et al., 2019) and Weibo (Zhao et al., 2020).

[0124] (2) Anomaly injection. Since there are no ground-truth anomalies in the first six graph datasets, this embodiment adopts the anomaly injection method mentioned in the literature Kim, H., Lee, B.S., Shin, W.Y., Lim, S., 2022. Graph anomaly detection with graph neural networks: Current status and challenges. IEEE Access, which is also the mainstream method for generating anomalies in the field of graph anomaly detection.

[0125] (3) Baseline Models. For the GAD task, our method is compared with eight well-known baseline methods. SL-GAD, GRADATE, and GADNR are state-of-the-art methods for graph anomaly detection based on contrastive learning. The first column of Table 1 lists these methods. The first three are shallow methods, and the rest are based on deep learning techniques.

[0126] (4) Metrics. Kim, H., Lee, B.S., Shin, W.Y., Lim, S., 2022. Graph anomaly detection with graph neural networks: Current status and challenges. IEEE Access uses the widely used AUC-ROC metric and running time to evaluate the performance of the model.

[0127] Table 1 shows the AUC performance of the six datasets, where bold indicates the best results and underlined indicates the suboptimal results.

[0128] Table 1

[0129] Methods Cora Citeseer Pubmed ACM Flickr BlogCatalog Weibo Reddit AMEN 0.6266 0.6154 0.7713 0.5626 0.6573 0.6392 - - Radar 0.6587 0.6709 0.6233 0.7247 0.7399 0.7401 0.9493 0.537 ANOMALOUS 0.577 0.6307 0.7316 0.7038 0.7434 0.7237 0.9494 0.4066 DOMINANT 0.8155 0.8251 0.8081 0.7601 0.7442 0.7468 0.8892 0.5621 CoLA 0.8779 0.8968 0.9512 0.8237 0.7513 0.7854 0.2056 0.4928 SL-GAD 0.913 0.9136 0.9654 0.8538 0.7988 0.816 0.5277 0.5608 GRADATE 0.9237 0.8273 0.8695 0.8434 0.7121 0.5824 0.3411 0.5603 GADNR 0.7535 0.7345 0.6684 0.5398 0.5487 0.7024 0.3318 0.5552 NSGAD 0.9322 0.9213 0.9832 0.9028 0.8159 0.8263 0.9268 0.6274

[0130] 2. Evaluation (RQ1)

[0131] (1) Performance

[0132] This example compares the AUC of NSGAD with eight baseline methods, as shown in Table 1.

[0133] The corresponding AUC curve is Figure 2 The observations are summarized as follows:

[0134] ① The NSGAD method in this example outperforms all baseline methods on synthetic datasets and also achieves competitive results on real anomaly datasets. This is because NSGAD enhances high-frequency information through neighborhood subtraction, thereby alleviating the anomaly disappearance problem caused by the inherent low-pass filtering characteristics of GCN.

[0135] ②Except for ANOMALOUS, all deep learning methods encountered bottlenecks when processing real anomalies, which shows that real-world anomalies are more complex than synthetic anomalies.

[0136] ③ Among deep learning methods, contrastive learning-based methods significantly outperform other methods on most datasets. This shows that contrastive learning methods can more effectively utilize node context to mine abnormal information.

[0137] (2) Efficiency

[0138] The time consumption is compared with the state-of-the-art models. The results are shown in Table 2. On all datasets, NSGAD reduces the execution time by about 65.29% compared to the current leading models.

[0139] Table 2 Running time of different models (seconds)

[0140] Methods Cora Citeseer Pubmed ACM Flickr BlogCatalog Weibo Reddit SL-GAD 672 1410 5467 3467 2159 1421 1532 3372 GRADATE 823 942 5556 2969 1314 878 1021 1956 NSGAD 160 465 1685 1813 626 559 468 917

[0141] This significant reduction is due to the neighborhood subtraction operation, which utilizes background information and thus significantly simplifies the network structure. In addition, the neighborhood subtraction operation can alleviate the problem that causes anomalies to disappear, thereby accelerating model convergence.

[0142] 3. Visualization (RQ2)

[0143] According to Conclusion 1, the high-frequency components can be amplified through the neighborhood subtraction operation to enhance the ability to identify outliers.

[0144] To prove this conclusion, this example performs spectral visualization analysis on node embeddings in all six synthetic anomaly datasets. Figure 2 As shown in Figure 3, after neighborhood subtraction, the high-frequency components in the feature space are significantly increased. In other words, the neighborhood subtraction method significantly amplifies the high-frequency signals, thereby alleviating the problem of outlier disappearance caused by GNNs.

[0145] 4. Ablation study (RQ3)

[0146] Table 3 Ablation study results of NSGAD

[0147]

[0148] To study the impact of neighborhood subtraction in the model, this example designed two variants of NSGAD. NSGAD-BIL and NSGAD-MLP replace neighborhood subtraction with bilinear layers and multilayer perceptrons, respectively. NSGAD-NR removes the low-frequency reconstruction module. The results are shown in Table 3, and the observed results are as follows:

[0149] ①NSGAD-BIL and NSGAD-MLP perform competitively on all datasets because they both utilize neighborhood information to some extent. However, due to the high-frequency information loss problem caused by GNNs, they cannot achieve the best anomaly detection results.

[0150] ②NSGAD-NR has a large performance gap compared to the complete model. This is because low-frequency information accounts for the majority in the anomaly attribute graph. Neighborhood subtraction strengthens high-frequency signals while destroying low-frequency signals in the data, resulting in the model being unable to capture the correct anomaly pattern.

[0151] ③ Comprehensive NSGAD achieves the best results on all datasets. This is because the neighborhood subtraction method strengthens the high-frequency components, enhances the anomaly detection performance, and fundamentally alleviates the anomaly disappearance problem caused by GNNs.

[0152] 5. Parameter sensitivity (RQ4)

[0153] In this section, this example conducts a series of experiments to test the effectiveness of various hyperparameters within the NSGAD paradigm, including the subgraph size K, the balance factor α, and the joint optimization factor γ. The results are shown in Figure 3 .

[0154] Subgraph size K: In this experiment, this embodiment modified the value of K to study its impact on AUC. Specifically, this embodiment ran GADNS on six datasets with K = {2, 4, 6, 8, 10} and tested the anomaly detection performance. The results are shown in Figure 2. Figure 3 As shown in the figure, AUC increases with K. After reaching the optimal value, AUC decreases with increasing K. The optimal value of K varies for different datasets. When K is too large, it not only increases computational overhead but also affects performance by including too much neighborhood information, dominating the small amount of abnormal information contained therein.

[0155] Balance factor α: In this example, alpha is adjusted separately in [0.1, 1.0] on six data sets and the AUC changes are observed. The results are as follows: Figure 3 As shown in the figure, AUC increases steadily with increasing alpha. Except for Citeseer, all algorithms achieve optimal values ​​when alpha = 1.0. This reflects that as the high-frequency components of a subgraph increase, the degree of anomalies also increases, making them easier for the model to capture. The neighborhood subtraction strategy effectively mines the contextual information of nodes. Therefore, an appropriate scale is crucial for anomaly detection.

[0156] Joint optimization factor γ: In this experiment, the relationship between the optimization objectives of the two modules was studied by setting different values ​​of γ in [0.1, 1.0]. The results are as follows: Figure 3 It can be observed that except for the ACM dataset, other datasets all achieve the optimal value when γ = 0.6. This is because the ACM dataset has higher features than other citation network datasets.

[0157] dimensionality, it is difficult to reconstruct the original features in the feature space, so the value of γ is small. The relative stability on other datasets is because the model can adaptively fuse the outputs of the neighborhood subtraction module and the low-frequency reconstruction module to generate anomaly scores, thereby improving the stability of the model.

[0158] In conjunction with Example 1, it can be seen that in order to solve the problem of disappearing outliers caused by GNNs, the present invention proposes an unsupervised attribute graph anomaly detection model based on neighborhood subtraction, which is a new unsupervised graph anomaly detection model and method called NSGAD. This model and method are based on neighborhood subtraction. On the one hand, the present invention uses the neighborhood subtraction module to amplify high-frequency anomaly information, thereby facilitating subsequent anomaly identification. At the same time, the present invention effectively utilizes the low-frequency information within the subgraph through the low-frequency reconstruction module. The present invention has conducted a large number of experiments, and the results show the superiority of this method.

[0159] Example 2.

[0160] A. Background

[0161] Currently, the following methods and technologies are used to detect abnormal user behavior on the Internet:

[0162] 1. Rule-based approach: This traditional detection method uses a set of predefined rules to identify anomalous behavior. For example, in financial transactions, if an account frequently conducts large transactions within a short period of time, or logs in from an unfamiliar location, these rules will be triggered and considered anomalous. However, this approach is limited in that the rules need to be constantly updated to address new anomaly patterns and struggle to cope with complex and changing network environments.

[0163] 2. Machine Learning-Based Methods: With the development of big data and artificial intelligence technologies, machine learning methods have been widely used in abnormal behavior detection. These methods train models to learn patterns of normal behavior and then identify deviations from these patterns as anomalies. Common machine learning algorithms include supervised learning (such as logistic regression and decision trees) and unsupervised learning (such as clustering and principal component analysis). For example, in the field of cybersecurity, supervised learning algorithms can be used to train historical data to identify possible cyberattacks.

[0164] 3. Graph Neural Network-Based Methods: Graph Neural Networks (GNNs) are particularly well-suited for processing data with complex relationships, such as those in social networks and communication networks. By constructing user behavior graphs, GNNs can capture the complex interactions between users, enabling more accurate detection of anomalous behavior. For example, in social networks, GNNs can identify anomalous information dissemination paths and promptly detect potential dissemination of false information or malicious marketing activities.

[0165] 4. Deep learning-based methods: Deep learning models (such as recurrent neural networks and long short-term memory networks) excel at processing time series data and are therefore often used to detect abnormal behaviors with temporal characteristics. For example, in network traffic monitoring, analyzing time series data can identify abnormal traffic patterns, such as DDoS attacks.

[0166] Although existing methods have achieved certain results in detecting abnormal user behavior on the Internet, they still face some difficulties and challenges:

[0167] 1. Data diversity and complexity: Internet user behavior data is diverse, complex, and high-dimensional, posing significant challenges to anomalous behavior detection. Different users may exhibit distinct behavioral patterns, and these patterns can vary over time, in different scenarios, and other factors. Effectively extracting features and modeling these complex data is a pressing issue.

[0168] 2. Model Generalization: In practical applications, abnormal behavior detection models must possess good generalization capabilities and be able to maintain stable performance across diverse datasets and scenarios. However, many existing models perform well on specific datasets, but performance may degrade significantly when used in new datasets or scenarios. Improving the model's generalization capabilities to adapt to diverse network environments and user behavior patterns is an important research direction.

[0169] 3. Real-time and efficiency: In practical applications, abnormal behavior detection systems need to be able to process large amounts of data in a short period of time and detect abnormal behavior promptly. However, some complex models (such as deep learning models) typically require high computing resources and long training times, making it difficult to meet real-time requirements. Therefore, improving the system's real-time performance and efficiency while ensuring detection accuracy is a key issue that needs to be addressed.

[0170] 4. Model explainability: For most anomaly detection models based on machine learning and deep learning, their decision-making process is often a "black box," making it difficult to explain why the model identifies a particular behavior as abnormal. This is a significant limitation in applications requiring detailed explanations of detection results, such as financial risk control and judicial processes. Improving model explainability, enabling people to understand the underlying rationale behind the model's decisions, is a key research direction in the field of anomaly detection.

[0171] To address the problem of vanishing outliers caused by the use of GNNs when identifying abnormal behavior in government and financial data, this paper proposes an unsupervised attribute graph anomaly detection model based on neighborhood subtraction. This novel unsupervised graph anomaly detection model and method, named NSGAD, is based on neighborhood subtraction. On the one hand, the present invention utilizes a neighborhood subtraction module to amplify high-frequency anomaly information, thereby facilitating subsequent anomaly identification. Simultaneously, the present invention effectively utilizes low-frequency information within the subgraph through a low-frequency reconstruction module. Extensive experiments have been conducted, and the results demonstrate the superiority of this method.

[0172] BApplication Cases and Usage Process

[0173] Based on the technical solution of "Method B" in Example 1, the application case and usage process include:

[0174] 1. Identification of abnormal behavior in government data

[0175] (1) Monitoring of abnormalities in data sharing between departments: In the cross-departmental sharing process of government data, by constructing an attribute graph of data interaction between departments, the model uses department nodes, their shared data characteristics, interaction frequency, etc. as attributes. The graph sampling module is used to create positive instances of normal sharing processes and negative instance pairs generated by disturbances such as simulated malicious data requests. The neighborhood subtraction identification module processes the node embeddings and amplifies the high-frequency signal characteristics corresponding to abnormal data sharing request behaviors between each department node and the nodes of surrounding collaborative departments, such as a department suddenly having a large-scale data request operation that far exceeds daily needs. The low-frequency reconstruction module retains the normal data feature patterns of routine sharing services of each department, such as the regular synchronization of daily office data. Based on this, the outlier scoring module accurately locates those department nodes with potential illegal data sharing intentions, promptly discovers and prevents possible data leakage risks, and ensures the compliance and security of government data sharing between departments.

[0176] (2) Identification of abnormalities in government approval processes: A graph is constructed based on government approval process data. Nodes represent approval links, handling personnel, and projects to be approved, and edges reflect their relationships, such as when a project is transferred to a certain approval personnel. When sampling the graph, the model samples the normal approval process path as a positive instance, and artificially constructs negative instances that include abnormal processes such as approval personnel failing to review in the prescribed order, timed out approvals, or skipping key review nodes without reason. The neighborhood subtraction operation can highlight high-frequency abnormal features such as inconsistent operation timing and approval duration between the approval personnel node in the abnormal process and the normal approval link nodes before and after. This helps regulatory authorities quickly identify approval processes and personnel suspected of illegal operations, ensure the fairness, transparency, and efficiency of government approval, and prevent approval chaos caused by human intervention or illegal operations.

[0177] 2. Identification of abnormal financial data transactions and risk associations

[0178] (1) Fraud detection in financial transaction networks: In the transaction network graph composed of massive transaction data from banks and other financial institutions, customer accounts are nodes and transaction records are edges, which contain attributes such as transaction amount, time, and location. The model samples normal transaction sequences through random walks to form positive instances and exchanges some transaction nodes to construct negative instances. The neighborhood subtraction submodule focuses on amplifying high-frequency abnormal transaction signals in the transaction network that are significantly different from the surrounding normal transaction patterns, such as a certain account suddenly having frequent large-amount and fast transfer transactions with accounts in high-risk areas, while the low-frequency reconstruction module maintains the characteristic patterns of customers' normal daily small-amount and stable transactions. Ultimately, the model can accurately mark abnormal transaction account nodes involving fraud risks, assist financial institutions in freezing related accounts in a timely manner, blocking fraudulent capital chains, reducing the incidence of financial fraud cases, and protecting customers' funds.

[0179] (2) Mining of credit risk-related customers: A correlation graph is constructed based on the credit customer data of financial institutions, with the nodes being customers and the edges being established based on the customer's guarantee relationship, capital transaction relationship, and competition relationship with the same industry. When sampling the model, historical customer groups with good credit and no risk association are selected as positive examples, and negative examples with risk associations such as fictitious guarantee relationships and hidden capital borrowing are constructed. After neighborhood subtraction processing, the high-frequency risk association characteristics corresponding to customer nodes that have hidden and complex associations with defaulted or high-risk customers but appear to be making normal repayments can be highlighted, assisting financial institutions in identifying potential credit risk-related groups in advance, optimizing credit approval strategies and risk warning mechanisms, improving the quality of financial credit assets, and avoiding systemic financial risks caused by the spread of hidden association risks between customers.

[0180] The above is merely a preferred embodiment of the present invention and does not constitute any form of limitation to the embodiments of the present invention. Any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the embodiments of the present invention are still within the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An unsupervised graph anomaly detection model for government affairs, finance, and public data governance, characterized by: include: Graph sampling module: creates positive and negative instance pairs of attribute graphs; Neighborhood subtraction identification module: characterizes the positive and negative examples, including: GNN encoder submodule, neighborhood subtraction submodule and low-frequency reconstruction submodule; Outlier scoring module: Calculates the final outlier score.

2. The unsupervised attribute graph anomaly detection model according to claim 1, characterized in that In the graph sampling module, random walk sampling is performed to generate positive instance pairs of target nodes and subgraphs; negative instance pairs are created by exchanging the subgraphs corresponding to the nodes.

3. The unsupervised attribute graph anomaly detection model according to claim 1, characterized in that The GNN encoder submodule encodes the instance pairs to obtain the node representations in the positive and negative instance pairs. The formula is: in, X i 、A i and H i Represent subgraphs G respectively i The feature matrix, adjacency matrix and embedding matrix of , W is a trainable parameter, and σ(·) represents the activation function.

4. The unsupervised attribute graph anomaly detection model according to claim 1, characterized in that The neighborhood subtraction submodule amplifies the high-frequency signal of the sub-graph through neighborhood subtraction, and the process is as follows: (1) Use a readout module to extract neighborhood embeddings, as follows: in, represents a readout function that varies according to the specific data set; (2) By embedding the neighborhood into or From the embedding h of the target node i Subtract it from the target node v i The new embedding of is: Among them, α is a balancing factor; (3) Use a multilayer perceptron to obtain the predicted output, the formula is:

5. The unsupervised attribute graph anomaly detection model according to claim 1, characterized in that The low-frequency reconstruction submodule uses a decoder with low-pass filtering as the core to reconstruct the features of the negative instance pairs. The formula is: Among them, H i represents the embedding matrix corresponding to all nodes in the subgraph, Representing and reconstructing subgraphs The related reconstructed features, φ, is a linear mapping function that projects the embedding from the latent space to the same dimension as the original features.

6. The unsupervised attribute graph anomaly detection model according to claim 1, characterized in that In the outlier scoring module, a multi-round anomaly scoring function is used, and the formula is: Where T represents the number of test iterations; Node v i Construct a comprehensive anomaly scoring function, the formula is: f(v i )=f sub (v i )+γf rec (v i ).

7. The unsupervised attribute graph anomaly detection model according to claim 1, characterized in that In the outlier scoring module, the final optimization goal is the formula L=L sub +γL rec ; Among them, γ is a hyperparameter; In the positive instance pair y i = 1, in the negative instance pair y i =0; 8. Unsupervised graph anomaly detection method for government affairs, finance and public data governance, characterized by: The unsupervised attribute graph anomaly detection method adopts the unsupervised attribute graph anomaly detection model described in any one of claims 1-7.

9. A computer device, characterized in that: It includes a processor and a memory, the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the operation of the unsupervised attribute graph anomaly detection model according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are called and executed by the processor, the computer-executable instructions prompt the processor to implement the operation of the unsupervised attribute graph anomaly detection model described in any one of claims 1-7.

Images