Method and device for detecting abnormal nodes in industrial internet

Abstract

The invention relates to the field of data mining, in particular to a method and device for detecting abnormal nodes in the industrial internet, and the method comprises the steps: a given attribute graph is embedded through a multi-layer perceptron to calculate a characteristic matrix of network topology of the industrial internet, and then a comparison positive sample and a comparison negative sample which are composed of nodes and neighbor nodes are constructed; and obtaining a local abnormal difference degree of each node as an attribute abnormal score by using a comparative learning technology. Updating the feature matrix based on a discretization graph diffusion technology, optimizing a new multi-layer perceptron to reconstruct a diffused matrix structure, and using the reconstruction loss as the structure anomaly score of each node; and finally, selecting a node with a relatively high abnormal score as a detected abnormal node. Therefore, the problem that the performance of abnormal node detection is affected due to the fact that only attribute comparison between the target node and the nodes in the local neighborhood of the target node is considered and semantic information of a complex global structure of network topology is ignored in the related technology is solved.

Description

Technical Field

[0001] The present invention relates to the field of data mining, and in particular to a method and device for detecting abnormal nodes in the industrial Internet. Background Art

[0002] In related technologies, in industrial internet scenarios, due to the large scale of networks and the large number of nodes, abnormalities such as node disconnections frequently occur, posing a significant challenge to system stability. Currently, the most commonly used method for detecting abnormal nodes in the industrial internet is based on comparative learning of node feature attributes. This method constructs positive and negative sample pairs using specific methods. The attribute similarities between the target node and its neighboring nodes in the sample pairs are compared, and the local distribution differences between normal and abnormal nodes are learned, indirectly generating an indicator to measure the degree of abnormality of the target node.

[0003] However, related technologies often only consider comparing the attributes of a target node with those of nodes in its local neighborhood. While this approach is simple and easy to implement, it ignores the semantic information of the complex global structure of the Industrial Internet, which affects the performance of abnormal node detection and urgently needs improvement. Summary of the Invention

[0004] The present invention provides a method and device for detecting abnormal nodes in the industrial Internet to solve the problem in related technologies that only the attribute comparison between the target node and the nodes in its local neighborhood is considered, while the semantic information of the complex global structure of the industrial Internet is ignored, thereby affecting the performance of abnormal node detection.

[0005] The first aspect of the present invention provides a method for detecting abnormal nodes in the industrial Internet, comprising the following steps: initializing a first target multi-layer perceptron network, and converting a feature matrix of a network topology input to the industrial Internet into a first embedding representation matrix of a node; calculating a first context-level contrast loss function and a first block-level contrast loss function between the nodes of the network topology to be detected based on the adjacency matrix of the network topology to be detected and the first embedding representation matrix; randomly selecting a plurality of undirected edges from the network topology to be detected for deletion, and randomly selecting a plurality of node pairs from the node pairs where no undirected edges exist to add an undirected edge to generate a new network topology, and obtaining a second context-level contrast loss function and a second block-level contrast loss function of the new network topology; calculating an attribute contrast phase network according to the first context-level contrast loss function, the first block-level contrast loss function, the second context-level contrast loss function and the second block-level contrast loss function. The invention relates to a method for detecting an abnormal network topology of a network by iteratively updating the first target multi-layer perceptron network to calculate the attribute anomaly score of each node of the network topology to be detected after the overall loss function converges; updating the feature matrix of the network topology to be detected a target number of times using a preset discretization graph expansion strategy to obtain a diffused feature matrix; initializing the second target multi-layer perceptron network, and converting the diffused feature matrix into a second embedding representation matrix of the node to obtain a reconstruction matrix of the adjacency matrix; calculating the adjacency matrix reconstruction loss function according to the reconstruction matrix; iteratively updating the second target multi-layer perceptron network based on the adjacency matrix reconstruction loss function to calculate the structural anomaly score of each node after the adjacency matrix reconstruction loss function converges; calculating the final anomaly score of each node according to the attribute anomaly score and the structural anomaly score; and sorting the nodes according to the final anomaly score to filter out abnormal nodes.

[0006] Through the above technical solution, the embodiment of the present invention can initialize the multi-layer perceptron network and convert the feature matrix of the network topology into an embedding representation, combined with the contrast loss function at the context level and the block level, to effectively identify the attribute anomalies of the nodes in the graph. By randomly deleting and adding undirected edges to generate a new network topology, the model's understanding of the graph structure is further enhanced. The feature matrix is ​​updated using the discretized graph expansion strategy to improve the embedding representation quality of the node. Finally, the attribute anomaly score and the structural anomaly score are comprehensively calculated to ensure the accurate identification of abnormal nodes. This method not only improves the performance of abnormal node detection in the industrial Internet, but also overcomes the dependence on local information in traditional methods, enhances the utilization of global structural information, and has broad application value and practicality.

[0007] Optionally, in one embodiment of the present invention, the transformation formula of the first embedding representation matrix is:

[0008] H attr =σ(XW A +b A )

[0009] Where X∈R n×d is the attribute matrix of the node; W A ∈R d×k is the learnable weight parameter matrix; b A ∈R 1×k is the learnable bias parameter matrix; σ is the defined multilayer perceptron network; H attr is the first embedding representation matrix of the node, H attr The vector h of the i-th row i =[(H attr ) i1 ,…,(H attr ) ik ]∈R k For node V i The k embedding representation features.

[0010] Through the above technical solution, the embodiment of the present invention can generate an embedded representation matrix of the node by combining the attribute information of the node with the learnable parameters, which can effectively capture the local characteristics and global structural information of the node and improve the accuracy and efficiency of abnormal node detection.

[0011] Optionally, in one embodiment of the present invention, obtaining the second context-level contrast loss function and the second block-level contrast loss function of the new network topology includes: calculating the second context-level contrast loss function and the second block-level contrast loss function based on the adjacency matrix of the new network topology and the first embedding representation matrix.

[0012] Through the above technical solution, the embodiment of the present invention can calculate the second context-level contrast loss function and the second block-level contrast loss function by calculating the adjacency matrix based on the new network topology and the first embedding representation matrix, so as to more comprehensively capture the relationship and structural information between nodes, thereby improving the accuracy and robustness of abnormal node detection in the industrial Internet.

[0013] Optionally, in one embodiment of the present invention, the calculation formula of the overall loss function is:

[0014]

[0015] Among them, α and β are given equilibrium parameters; is the first context level contrast loss function; is the first block level contrast loss function; is the second context level contrast loss function; is the second block level contrast loss function; is the node V calculated based on the network topology to be detected i The average value of the fully adjacent subgraph features; is the node V calculated based on the network topology to be detected j The average value of the fully adjacent subgraph features; is the node V calculated based on the new network topology i The average value of the fully adjacent subgraph features; is the node V calculated based on the new network topology j The average value of the fully adjacent subgraph features of ; γ is a given supplementary parameter.

[0016] Through the above technical solution, the embodiments of the present invention can comprehensively consider the losses of attribute comparison and structural reconstruction, and adjust the weights of different loss terms through balancing parameters. The overall loss function is composed of context-level and block-level contrast losses, calculated for the original network topology and the adjusted new network topology respectively. In addition, a supplementary term is introduced in the formula, which further enhances the model's sensitivity to inter-node relationships by performing a logarithmic operation on the similarity of node features.

[0017] Optionally, in one embodiment of the present invention, the calculation formula of the adjacency matrix reconstruction loss function is:

[0018]

[0019] Among them, A ij is the element in the i-th row and j-th column of matrix A; is a matrix The element at row i and column j.

[0020] Through the above technical solution, the embodiment of the present invention can effectively measure the reconstruction quality of the graph structure by comparing the difference between the real adjacency matrix and the reconstructed adjacency matrix. It not only considers the situation where there are edges between nodes, but also considers the situation where there are no edges, thereby comprehensively reflecting the structural characteristics of the graph.

[0021] Optionally, in one embodiment of the present invention, the calculation formula of the final anomaly score is:

[0022]

[0023] Among them, q is the balance coefficient between structure and attributes; For node V i Structural abnormality score; For node V i The attribute anomaly score of .

[0024] Through the above technical solution, the embodiments of the present invention can comprehensively consider a node's structural anomaly score and attribute anomaly score, and by introducing a balancing coefficient, achieve a weighted fusion of the two. By standardizing each node's anomaly score and eliminating the influence of different feature dimensions, the formula makes anomaly score calculation more accurate and fair, thereby improving the performance of abnormal node detection in the Industrial Internet and effectively addressing the problem of global structural semantic loss that can be caused by local comparison methods.

[0025] The second aspect of the present invention provides an industrial Internet abnormal node detection device that combines attribute comparison and structure reconstruction, including: a first initialization module, used to initialize a first target multi-layer perceptron network, and convert the feature matrix of the input original network topology into a first embedding representation matrix of the node; a first calculation module, used to calculate the first context-level comparison loss function and the first block-level comparison loss function between the nodes of the network topology to be detected based on the adjacency matrix of the network topology to be detected and the first embedding representation matrix; a generation module, used to randomly select multiple undirected edges from the network topology to be detected for deletion, and randomly select multiple node pairs from the node pairs where no undirected edges exist to add an undirected edge to generate a new network topology, and obtain the second context-level comparison loss function and the second block-level comparison loss function of the new network topology; a second calculation module, used to calculate the overall loss function of the network training in the attribute comparison stage based on the first context-level comparison loss function, the first block-level comparison loss function, the second context-level comparison loss function and the second block-level comparison loss function; a third computing module for iteratively updating the first target multi-layer perceptron network to calculate the attribute anomaly score of each node of the network topology to be detected after the overall loss function converges; a diffusion module for updating the feature matrix of the network topology to be detected a target number of times using a preset discretized graph expansion strategy to obtain a diffused feature matrix; a second initialization module for initializing the second target multi-layer perceptron network and converting the diffused feature matrix into a second embedding representation matrix of the node to obtain a reconstruction matrix of the adjacency matrix; a fourth computing module for calculating the adjacency matrix reconstruction loss function based on the reconstruction matrix; a fifth computing module for iteratively updating the second target multi-layer perceptron network based on the adjacency matrix reconstruction loss function to calculate the structural anomaly score of each node after the adjacency matrix reconstruction loss function converges; a sixth computing module for calculating the final anomaly score of each node based on the attribute anomaly score and the structural anomaly score; a detection module for sorting nodes according to the final anomaly score to screen out abnormal nodes.

[0026] Through the above technical solution, the embodiment of the present invention can initialize the multi-layer perceptron network and convert the feature matrix of the network topology into an embedded representation, combined with the contrast loss function at the context level and the block level, to effectively identify the attribute anomalies of the nodes in the network topology. By randomly deleting and adding undirected edges to generate a new network topology, the model's understanding of the graph structure is further enhanced. The feature matrix is ​​updated using the discretized graph expansion strategy to improve the embedding representation quality of the node. Finally, the attribute anomaly score and the structural anomaly score are comprehensively calculated to ensure the accurate identification of abnormal nodes. This method not only improves the performance of abnormal node detection in the industrial Internet, but also overcomes the dependence on local information in traditional methods, enhances the utilization of global structural information, and has broad application value and practicality.

[0027] Optionally, in one embodiment of the present invention, the first initialization module includes: a transformation formula of the first embedding representation matrix is:

[0028] H attr =σ(XW A +b A )

[0029] Where X∈R n×d is the attribute matrix of the node; W A ∈R d×k is the learnable weight parameter matrix; b A ∈R 1×k is the learnable bias parameter matrix; σ is the defined multilayer perceptron network; H attr is the first embedding representation matrix of the node, H attr The vector h of the i-th row i =[(H attr ) i1 ,…,(H attr ) ik ]∈R k For node V i The k embedding representation features.

[0030] Through the above technical solution, the embodiment of the present invention can generate an embedded representation matrix of the node by combining the attribute information of the node with the learnable parameters, which can effectively capture the local characteristics and global structural information of the node and improve the accuracy and efficiency of abnormal node detection.

[0031] Optionally, in one embodiment of the present invention, the generation module includes: a computing unit for calculating the second context-level contrast loss function and the second block-level contrast loss function based on the adjacency matrix of the new network topology and the first embedding representation matrix.

[0032] Through the above technical solution, the embodiment of the present invention can calculate the second context-level contrast loss function and the second block-level contrast loss function by calculating the adjacency matrix based on the new network topology and the first embedding representation matrix, so as to more comprehensively capture the relationship and structural information between nodes, thereby improving the accuracy and robustness of abnormal node detection in the industrial Internet.

[0033] Optionally, in one embodiment of the present invention, the second calculation module includes: the calculation formula of the overall loss function is:

[0034]

[0035] Among them, α and β are given equilibrium parameters; is the first context level contrast loss function; is the first block level contrast loss function; is the second context level contrast loss function; is the second block level contrast loss function; is the node V calculated based on the network topology to be detected i The average value of the fully adjacent subgraph features; is the node V calculated based on the network topology to be detected j The average value of the fully adjacent subgraph features; is the node V calculated based on the new network topology i The average value of the fully adjacent subgraph features; is the node V calculated based on the new network topology j The average value of the fully adjacent subgraph features of ; γ is a given supplementary parameter.

[0036] Through the above technical solution, the embodiments of the present invention can comprehensively consider the losses of attribute comparison and structural reconstruction, and adjust the weights of different loss terms through balancing parameters. The overall loss function is composed of context-level and block-level contrast losses, calculated for the original network topology and the adjusted new network topology respectively. In addition, a supplementary term is introduced in the formula, which further enhances the model's sensitivity to inter-node relationships by performing a logarithmic operation on the similarity of node features.

[0037] Optionally, in one embodiment of the present invention, the fourth calculation module includes: the calculation formula of the adjacency matrix reconstruction loss function is:

[0038]

[0039] Among them, A ij is the element in the i-th row and j-th column of matrix A; is a matrix The element at row i and column j.

[0040] Through the above technical solution, the embodiment of the present invention can effectively measure the reconstruction quality of the graph structure by comparing the difference between the real adjacency matrix and the reconstructed adjacency matrix. It not only considers the situation where there are edges between nodes, but also considers the situation where there are no edges, thereby comprehensively reflecting the structural characteristics of the graph.

[0041] Optionally, in one embodiment of the present invention, the sixth calculation module includes: the calculation formula of the final anomaly score is:

[0042]

[0043] Among them, q is the balance coefficient between structure and attributes; For node V i Structural abnormality score; For node V i The attribute anomaly score of .

[0044] Through the above technical solution, the present invention comprehensively considers both the structural anomaly score and the attribute anomaly score of a node, and achieves a weighted fusion of the two by introducing a balancing coefficient. This formula standardizes each node's anomaly score, eliminating the influence of different feature dimensions. This makes the calculation of anomaly scores more accurate and fair, thereby improving the performance of detecting abnormal nodes in network topology and effectively addressing the problem of global structural semantic loss that can occur with local comparison methods.

[0045] The third aspect of the present invention provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method for detecting abnormal nodes in the industrial Internet as described in the above embodiment.

[0046] A fourth aspect of the present invention provides a computer-readable storage medium, which stores a computer program. When the program is executed by a processor, it implements the above-mentioned method for detecting abnormal nodes in the industrial Internet.

[0047] A fifth aspect of the present invention provides a computer program product, including a computer program, which is executed to implement the above-mentioned method for detecting abnormal nodes in the industrial Internet.

[0048] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments with reference to the accompanying drawings, in which:

[0050] Figure 1 This is a flow chart of a method for detecting abnormal nodes in the industrial Internet according to an embodiment of the present invention;

[0051] Figure 2 This is a structural diagram of an abnormal node detection device in the industrial Internet provided according to an embodiment of the present invention;

[0052] Figure 3 FIG. 1 is a diagram illustrating a structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The following describes embodiments of the present invention in detail, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and are not to be construed as limiting the present invention.

[0054] The following describes, with reference to the accompanying drawings, a method and apparatus for detecting abnormal nodes in the industrial internet according to an embodiment of the present invention. To address the problem that the related art mentioned in the background art only considers the attribute comparison between the target node and the nodes in its local neighborhood, ignoring the semantic information of the complex global structure of the industrial internet, which can affect the performance of abnormal node detection, the present invention provides a method for detecting abnormal nodes in the industrial internet. This method effectively identifies abnormal attributes of nodes in the network topology by initializing a multilayer perceptron network and converting the feature matrix of the network topology into an embedding representation. This method, combined with context-level and block-level contrastive loss functions, generates a new network topology by randomly deleting and adding undirected edges, further enhancing the model's understanding of the network structure. A discretized graph expansion strategy is used to update the feature matrix, improving the quality of the node embedding representation. Finally, a comprehensive calculation of attribute anomaly scores and structural anomaly scores ensures accurate identification of abnormal nodes. This method not only improves the performance of abnormal node detection in the network topology but also overcomes the reliance on local information in traditional methods, enhancing the utilization of global structural information. It has broad application value and practicality. This solves the problem in related technologies that only considers the attribute comparison between the target node and the nodes in its local neighborhood, ignoring the semantic information of the complex global structure of the graph and network, thereby affecting the performance of abnormal node detection.

[0055] To facilitate understanding and implementation of the present invention by those skilled in the art, the present invention is described in detail below using three real network topology data representing paper citation relationships, online shopping relationships, and movie review relationships in a specific embodiment. The number of nodes, edges, and abnormal nodes contained in the three graphs are shown in Table 1.

[0056] Table 1

[0057] picture Number of nodes Number of sides Number of abnormal nodes Cora 2708 5429 150 Amazon 13752 515042 700 Disney 124 335 6

[0058] Specifically, Figure 1 A flowchart of a method for detecting abnormal nodes in the industrial Internet provided by an embodiment of the present invention.

[0059] like Figure 1 As shown, the abnormal node detection method in the industrial Internet includes the following steps:

[0060] In step S101, a first target multi-layer perceptron network is initialized, and a feature matrix of the network topology of the input original industrial Internet is converted into a first embedding representation matrix of the node.

[0061] Specifically, the network topology to be detected is defined as G = (A, X, V), where V = (V1, V2, ..., V n ) represents the n nodes that make up the graph structure; A∈{0,1} n×n Represents the adjacency matrix of the graph, the element A in the i-th row and j-th column of the matrix A i,j Indicates whether there is an undirected edge between node Vi and node Vj, where A i,j =1 indicates node A i,j =1 and V j There is an undirected edge between them, A i,j =0 means node V i and V j There is no edge between them; X∈R n×d Represents the attribute matrix of the node, and d represents the dimension of the attribute.

[0062] In the actual execution process, a multi-layer perceptron network σ is initialized, and the feature matrix of the input original network topology is converted into the node embedding representation matrix H attr , where the specific calculation of the conversion is:

[0063] H attr =σ(XW A +b A )

[0064] Where X∈R n×d is the attribute matrix of the node; W A ∈R d×k is the learnable weight parameter matrix; bA ∈R 1×k is the learnable bias parameter matrix; σ is the defined multilayer perceptron network; H attr is the first embedding representation matrix of the node, H attr The vector h of the i-th row i =[(H attr ) i1 ,…,(H attr ) ik ]∈R k For node V i The k embedding representation features are preferably 16≤k≤1024 and are positive integers.

[0065] The embodiments of the present invention can effectively convert the attribute information of nodes into low-dimensional embedded features, laying a foundation for subsequent abnormal node detection in network topology.

[0066] In step S102 , a first context-level contrast loss function and a first block-level contrast loss function between nodes of the network topology to be detected are calculated based on the adjacency matrix of the network topology to be detected and the first embedding representation matrix.

[0067] Specifically, according to the adjacency matrix A of graph G and the embedding representation matrix H attr To calculate the context-level contrast loss function between the nodes of graph G Compared with the block level loss function

[0068] First, calculate each node v i The average value e of the fully adjacent subgraph features i , where e i The specific calculation is:

[0069]

[0070] Among them, A ij represents the element in the i-th row and j-th column of matrix A, h j Denotes the embedding representation matrix H attr The vector of the j-th row of .

[0071] Second, for each node v i , randomly select a node v from all remaining nodes i and the corresponding e j (i≠j) to form a set of context-level comparison sample positive examples <h i ,e i >And negative examples <h i ,e j >. At the same time, it constitutes a set of block-level comparison sample positive examples <h i ,ei > and negative examples are <h j ,e j >.

[0072] Furthermore, the loss function of context comparison is calculated The specific calculation is:

[0073]

[0074] Where N represents the number of nodes in the graph to be detected; h i Represents node v i k-dimensional feature representation of e i and e j Represents node v i and node v j The average value of the fully adjacent subgraph features; Dis(h i ,e i ) and Dis(h i ,e j ) represent vector h i and e i and the vector h i and e j The inner product between .

[0075] Finally, calculate the loss function of block level comparison The specific calculation is:

[0076]

[0077] Where N represents the number of nodes in the graph to be detected; h i and h j Represents node v i and node v j k-dimensional feature representation of e i and e j Represents node v i and node v j The average value of the fully adjacent subgraph features; Dis(h i ,e i ) and Dis(h i ,e j ) represent vector h i and e i and vector h i and e j The inner product between .

[0078] The embodiments of the present invention can more comprehensively capture the relationships and feature differences between nodes by combining the contrast loss functions at the context level and the block level; by calculating the average value of the fully adjacent subgraph features of each node, the structural information of the graph is fully utilized, the expressive power of the node features is improved, and the position and correlation of the nodes in the graph are better reflected; by randomly selecting positive and negative samples, the adaptability of the model to different data distributions is enhanced; in the calculation of the loss function, the comparison between feature vectors is simplified by using the inner product, thereby reducing the computational complexity.

[0079] In step S103, multiple undirected edges are randomly selected from the network topology to be detected for deletion, and multiple node pairs are randomly selected from the node pairs where no undirected edges exist to add an undirected edge to generate a new network topology, and the second context level contrast loss function and the second block level contrast loss function of the new network topology are obtained.

[0080] It can be understood that the number of undirected edges contained in the graph G is recorded as m, and a random Delete the edges, then randomly select μm node pairs from the node pairs in the graph G where no undirected edges exist, add an undirected edge between these node pairs, and record the adjusted graph as G2, and the corresponding adjacency matrix as A2, where μ is the specified deletion ratio, preferably 0.01≤μ≤0.2.

[0081] Furthermore, according to the adjacency matrix A2 of the new network topology G2 and the embedding representation matrix H calculated in step S101, attr To calculate the context-level contrastive loss function between nodes in graph G2 Compared with the block level loss function

[0082] The embodiment of the present invention can generate a new network topology by randomly deleting edges and adding node pairs to the network topology to be detected, thereby enhancing the effect of detecting abnormal nodes in the network topology.

[0083] In step S104, the overall loss function of the network training in the attribute comparison phase is calculated according to the first context level contrast loss function, the first block level contrast loss function, the second context level contrast loss function and the second block level contrast loss function.

[0084] Specifically, the overall loss function L attr The calculation formula is:

[0085]

[0086] Wherein, α and β are given equilibrium parameters, preferably, 0.01≤μ≤0.2; is the first context level contrast loss function; is the first block level contrast loss function; is the second context level contrast loss function; is the second block level contrast loss function; is the node V calculated based on the network topology to be detected i The average value of the fully adjacent subgraph features; is the node V calculated based on the network topology to be detected j The average value of the fully adjacent subgraph features; is the node V calculated based on the new network topology i The average value of the fully adjacent subgraph features; is the node V calculated based on the new network topology j The average value of the completely adjacent subgraph features; γ is a given supplementary parameter, preferably, 0≤γ≤1.

[0087] The embodiments of the present invention construct an overall loss function by comprehensively considering the first context-level contrast loss function, the first block-level contrast loss function, the second context-level contrast loss function, and the second block-level contrast loss function, thereby optimizing network training during the attribute comparison phase. This effectively combines contrast information at different levels and uses balancing parameters to adjust the weights of each loss function, enhancing the model's ability to detect abnormal nodes. Furthermore, by introducing supplementary parameters, the model's robustness and adaptability are further improved.

[0088] In step S105 , the first target multi-layer perceptron network is iteratively updated to calculate the attribute anomaly score of each node in the network topology to be detected after the overall loss function converges.

[0089] Optionally, in one embodiment of the present invention, based on the overall loss function L attr , use the gradient descent method to iteratively update the parameters involved in the multilayer perceptron σ, and wait for the overall loss function L attr After convergence, calculate each node v in the graph G i Attribute anomaly score The specific calculation is:

[0090]

[0091] Among them, e i Represents the node v calculated according to the graph G i The average value of the fully adjacent subgraph features; h i Represents the matrix H attr The vector of the i-th row of Dis(h i ,e i ) represents the vector hi and e i The inner product between .

[0092] The present invention uses an iterative update of a multilayer perceptron network, optimizing the overall loss function using gradient descent, to effectively calculate the attribute anomaly score for each node in the network topology to be detected. This method fully leverages the fully adjacency subgraph feature of nodes, improving the accuracy and reliability of anomaly detection. By achieving a convergent overall loss function, the model's stability and effectiveness are ensured, resulting in more accurate identification of anomalous nodes.

[0093] In step S106, a preset discretization graph expansion strategy is used to update the feature matrix of the network topology to be detected a target number of times to obtain a diffused feature matrix.

[0094] Optionally, in one embodiment of the present invention, the feature matrix X of the graph is updated T times using a discretized graph diffusion technique to obtain a diffused feature matrix The specific calculation method is:

[0095]

[0096] Wherein, T represents the number of discrete iterations of the diffusion process, preferably, 1≤T≤100, and is a positive integer; λ represents the coefficient of the given feature diffusion; L represents the Laplace matrix of the original image G.

[0097] The embodiment of the present invention can utilize the discretized graph diffusion technology for updating, and on the basis of retaining the original features, enhance the relationship and similarity between nodes, so that the final diffusion feature matrix is ​​more representative.

[0098] In step S107, the second target multilayer perceptron network is initialized, and the diffused feature matrix is ​​converted into a second embedding representation matrix of the node to obtain a reconstruction matrix of the adjacency matrix.

[0099] Specifically, initialize a multi-layer perceptron network σ′ and transform the diffused feature matrix Transformed into the node embedding representation matrix H str , and according to H str Get the reconstruction matrix of the adjacency matrix A The specific calculation of the conversion is:

[0100]

[0101] in, It represents the feature matrix X after T updates to obtain the diffused feature matrix; W S ∈R d×krepresents the learnable weight parameter matrix; b S ∈R 1×k Represents the learnable bias parameter matrix; σ′ represents the defined multilayer perceptron network; r t (·) represents the inner product function; r t (·) represents the diffusion characteristic matrix through transformation The obtained node embedding representation matrix; Represents the matrix H str The transpose of .

[0102] The embodiments of the present invention can transform the diffused feature matrix into a node embedding representation matrix, effectively reconstructing the adjacency matrix. This not only enhances the expressive power of node features but also improves the model's flexibility and adaptability by introducing learnable weights and bias parameters. By calculating the inner product, the relationships between nodes can be more accurately captured, improving the quality of graph reconstruction and providing richer global information for subsequent detection of abnormal nodes in the network topology.

[0103] In step S108 , an adjacency matrix reconstruction loss function is calculated according to the reconstruction matrix.

[0104] Adjacency matrix reconstruction loss function L A The calculation formula is:

[0105]

[0106] Among them, A ij is the element in the i-th row and j-th column of matrix A; is a matrix The element at row i and column j.

[0107] This embodiment of the present invention effectively measures the difference between the original and reconstructed graph structures through an adjacency matrix reconstruction loss function, thereby optimizing the model's learning process. This loss function utilizes log-likelihood estimation, taking into account both the presence and absence of edges, ensuring that the model accurately captures the graph's global structural information during the reconstruction process.

[0108] In step S109, the second target multilayer perceptron network is iteratively updated based on the adjacency matrix reconstruction loss function to calculate the structural anomaly score of each node after the adjacency matrix reconstruction loss function converges.

[0109] Optionally, in one embodiment of the present invention, based on the reconstruction loss function L A , use the gradient descent method to iteratively update the parameters involved in the multilayer perceptron σ′, and wait for the overall loss function L A After convergence, calculate each node V i Structural Abnormality Score The specific calculation is:

[0110]

[0111] Among them, represents the element in the i-th row and j-th column of matrix A; Representation matrix The element in the i-th row and j-th column; |·| represents the absolute value calculation function.

[0112] By optimizing the reconstruction loss function, the present invention effectively captures the global structural information of the graph, thereby improving the accuracy of calculating the structural anomaly score of a node. Iterative parameter updates using a gradient descent method ensure the convergence and stability of the model, thereby improving the performance of abnormal node detection. By calculating the difference between each node and its reconstructed value, the degree of abnormality of the node can be intuitively reflected, facilitating subsequent anomaly detection and processing.

[0113] In step S110 , a final anomaly score of each node is calculated based on the attribute anomaly score and the structure anomaly score.

[0114] The final anomaly score is calculated as:

[0115]

[0116] Where q is the balance coefficient between structure and properties, preferably, 0≤q≤1; For node V i Structural abnormality score; For node V i The attribute anomaly score of .

[0117] This embodiment of the present invention combines a node's attribute anomaly score and structural anomaly score to calculate a final anomaly score for each node, thereby achieving a more comprehensive and accurate assessment of node abnormal behavior. The balance coefficient allows for flexible adjustment of the impact of attributes and structure to meet the needs of different scenarios.

[0118] In step S111 , the nodes are sorted according to the final anomaly scores to filter out abnormal nodes.

[0119] Specifically, the final anomaly score s calculated in step S110 is i Sort the n nodes in the graph G and select the θn nodes with the highest anomaly scores as the detected anomaly nodes, where θ is the ratio of given anomaly nodes to the total number of nodes. Preferably, 0.01≤θ≤0.05.

[0120] The embodiment of the present invention can ensure that a moderate number of abnormal nodes are screened out by setting a reasonable ratio, avoid excessive or insufficient misjudgments, and improve the accuracy and practicality of detection.

[0121] According to the implementation process of the above steps S101 to S111, the detection performance AUC results corresponding to three real network topologies representing paper citation relationships, online shopping relationships, and movie review relationships in a specific embodiment proposed by the present invention are shown in Table 2.

[0122] Table 2

[0123] picture AUC Cora 97.13 Amazon 95.57 Disney 86.02

[0124] When performing network topology abnormal node detection, the present invention can supplement the global network topology structure information for the local attribute comparison based on contrastive learning, which can effectively improve the problems of global structural semantic loss and suboptimal detection results caused by using only local comparison methods, thereby improving the performance of network topology abnormal node detection.

[0125] According to the embodiment of the present invention, the industrial Internet abnormal node detection combined with attribute comparison and structural reconstruction can effectively identify attribute anomalies of nodes in the network topology by initializing a multi-layer perceptron network and converting the feature matrix of the network topology into an embedding representation. In combination with the contrast loss function at the context level and the block level, it can further enhance the model's understanding of the network topology structure by randomly deleting and adding undirected edges. The feature matrix is ​​updated using the discretized graph expansion strategy to improve the embedding representation quality of the node. Finally, the attribute anomaly score and the structural anomaly score are comprehensively calculated to ensure the accurate identification of abnormal nodes. This method not only improves the performance of abnormal node detection in network topology, but also overcomes the reliance on local information in traditional methods and enhances the utilization of global structural information. It has broad application value and practicality.

[0126] Next, an industrial Internet abnormal node detection device combining attribute comparison and structure reconstruction proposed in accordance with an embodiment of the present invention will be described with reference to the accompanying drawings.

[0127] Figure 2 It is a block diagram of an abnormal node detection device in the industrial Internet according to an embodiment of the present invention.

[0128] like Figure 2 As shown, the abnormal node detection device 10 in the industrial Internet includes: a first initialization module 100, a first calculation module 200, a generation module 300, a second calculation module 400, a third calculation module 500, a diffusion module 600, a second initialization module 700, a fourth calculation module 800, a fifth calculation module 900, a sixth calculation module 1000 and a detection module 1100.

[0129] Specifically, the first initialization module 100 is used to initialize the first target multi-layer perceptron network and convert the feature matrix of the input original network topology into a first embedding representation matrix of the node.

[0130] The first calculation module 200 is used to calculate a first context-level contrast loss function and a first block-level contrast loss function between nodes of the network topology to be detected based on the adjacency matrix of the network topology to be detected and the first embedding representation matrix.

[0131] Generation module 300 is used to randomly select multiple undirected edges from the network topology to be detected for deletion, and randomly select multiple node pairs from the node pairs where no undirected edges exist to add an undirected edge, generate a new network topology, and obtain the second context level contrast loss function and the second block level contrast loss function of the new network topology.

[0132] The second calculation module 400 is used to calculate the overall loss function of the network training in the attribute comparison phase according to the first context level contrast loss function, the first block level contrast loss function, the second context level contrast loss function and the second block level contrast loss function.

[0133] The third calculation module 500 is used to iteratively update the first target multi-layer perceptron network to calculate the attribute anomaly score of each node in the network topology to be detected after the overall loss function converges.

[0134] The diffusion module 600 is used to update the feature matrix of the network topology to be detected a target number of times using a preset discretization graph expansion strategy to obtain a diffused feature matrix.

[0135] The second initialization module 700 is used to initialize the second target multi-layer perceptron network and convert the diffused feature matrix into a second embedding representation matrix of the node to obtain a reconstruction matrix of the adjacency matrix.

[0136] The fourth calculation module 800 is used to calculate the adjacency matrix reconstruction loss function according to the reconstruction matrix.

[0137] The fifth calculation module 900 is used to iteratively update the second target multi-layer perceptron network based on the adjacency matrix reconstruction loss function, so as to calculate the structural anomaly score of each node after the adjacency matrix reconstruction loss function converges.

[0138] The sixth calculation module 1000 is configured to calculate a final anomaly score of each node based on the attribute anomaly score and the structure anomaly score.

[0139] The detection module 1100 is used to sort nodes according to the final anomaly scores to filter out abnormal nodes.

[0140] Optionally, in one embodiment of the present invention, the first initialization module 100 includes: a transformation formula of the first embedding representation matrix is:

[0141] H attr =σ(XW A +b A )

[0142] Where X∈R n×d is the attribute matrix of the node; W A ∈R d×k is the learnable weight parameter matrix; b A ∈R 1×k is the learnable bias parameter matrix; σ is the defined multilayer perceptron network; H attr is the first embedding representation matrix of the node, H attr The vector h of the i-th row i =[(H attr ) i1 ,…,(H attr ) ik ]∈R k For node V i The k embedding representation features.

[0143] Optionally, in one embodiment of the present invention, the generation module 300 includes: a calculation unit, configured to calculate a second context-level contrast loss function and a second block-level contrast loss function based on the adjacency matrix of the new network topology and the first embedding representation matrix.

[0144] Optionally, in one embodiment of the present invention, the second calculation module 400 includes: a calculation formula of the overall loss function is:

[0145]

[0146] Among them, α and β are given equilibrium parameters; is the first context level contrast loss function; is the first block level contrast loss function; is the second context level contrast loss function; is the second block level contrast loss function; is the node V calculated based on the network topology to be detected i The average value of the fully adjacent subgraph features; is the node V calculated based on the network topology to be detected j The average value of the fully adjacent subgraph features; is the node V calculated based on the new network topology i The average value of the fully adjacent subgraph features; is the node V calculated based on the new network topology j The average value of the fully adjacent subgraph features of ; γ is a given supplementary parameter.

[0147] Optionally, in one embodiment of the present invention, the fourth calculation module 800 includes: a calculation formula for the adjacency matrix reconstruction loss function is:

[0148]

[0149] Among them, A ij is the element in the i-th row and j-th column of matrix A; is a matrix The element at row i and column j.

[0150] Optionally, in one embodiment of the present invention, the sixth calculation module 1000 includes: a calculation formula for the final anomaly score is:

[0151]

[0152] Among them, q is the balance coefficient between structure and attributes; For node V i Structural abnormality score; For node V i The attribute anomaly score of .

[0153] It should be noted that the above explanation of the embodiment of the abnormal node detection method in the industrial Internet is also applicable to the abnormal node detection device in the industrial Internet of this embodiment, and will not be repeated here.

[0154] According to the apparatus for detecting abnormal nodes in the industrial Internet proposed in an embodiment of the present invention, the attribute anomalies of nodes in the industrial Internet can be effectively identified by initializing a multi-layer perceptron network and converting the feature matrix of the network topology into an embedding representation, combined with the contrast loss function at the context level and the block level. New network topologies are generated by randomly deleting and adding undirected edges, further enhancing the model's understanding of the network topology structure. The feature matrix is ​​updated using a discretized graph expansion strategy to improve the embedding representation quality of the nodes. Finally, the attribute anomaly score and the structural anomaly score are comprehensively calculated to ensure the accurate identification of abnormal nodes. This method not only improves the performance of abnormal node detection in the industrial Internet, but also overcomes the reliance on local information in traditional methods and enhances the utilization of global structural information. It has broad application value and practicality.

[0155] Figure 3 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. The electronic device may include:

[0156] Memory 301 , processor 302 , and computer programs stored in the memory 301 and executable on the processor 302 .

[0157] When the processor 302 executes the program, the abnormal node detection method in the industrial Internet provided in the above embodiment is implemented.

[0158] Furthermore, the electronic device further includes:

[0159] The communication interface 303 is used for communication between the memory 301 and the processor 302 .

[0160] The memory 301 is used to store computer programs that can be run on the processor 302 .

[0161] The memory 301 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0162] If the memory 301, processor 302, and communication interface 303 are implemented independently, the communication interface 303, memory 301, and processor 302 can be connected to each other via a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0163] Optionally, in a specific implementation, if the memory 301 , the processor 302 and the communication interface 303 are integrated on a chip, the memory 301 , the processor 302 and the communication interface 303 can communicate with each other through an internal interface.

[0164] The processor 302 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention.

[0165] An embodiment of the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned method for detecting abnormal nodes in the industrial Internet.

[0166] An embodiment of the present invention also provides a computer program product, including a computer program, which is executed to implement the above-mentioned method for detecting abnormal nodes in the industrial Internet.

[0167] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

[0168] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Thus, a feature specified as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "N" means at least two, such as two, three, etc., unless otherwise specifically defined.

[0169] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code comprising one or N executable instructions for implementing a custom logical function or step of a process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may be performed out of the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention pertain.

[0170] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or N wires (electronic devices), a portable computer disk cartridge (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program can be obtained electronically by optically scanning the paper or other medium and then editing, interpreting or processing it in other suitable ways as necessary, and then storing it in a computer memory.

[0171] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiment, the N steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. If implemented using hardware, as in another embodiment, it can be implemented using any one or a combination of the following technologies known in the art: a discrete logic circuit having logic gate circuits for implementing logic functions on data signals, an application-specific integrated circuit having suitable combinational logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0172] Those skilled in the art will understand that all or part of the steps in the method of the above embodiment can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiment.

[0173] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing module, or each unit may exist physically separately, or two or more units may be integrated into a single module. The aforementioned integrated modules may be implemented in the form of hardware or in the form of software functional modules. If the integrated modules are implemented in the form of software functional modules and sold or used as independent products, they may also be stored in a computer-readable storage medium.

[0174] The storage medium mentioned above may be a read-only memory, a magnetic disk, or an optical disk, etc. Although the embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and are not to be construed as limiting the present invention. Persons skilled in the art may make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for detecting abnormal nodes in the industrial Internet, characterized in that: The following steps are involved: Initialize the first target multi-layer perceptron network and convert the feature matrix of the input industrial Internet network topology into the first embedding representation matrix of the node; Calculating a first context-level contrast loss function and a first block-level contrast loss function between nodes of the network topology to be detected based on the adjacency matrix of the network topology to be detected and the first embedding representation matrix; Randomly selecting a plurality of undirected edges from the network topology to be detected and deleting them, and randomly selecting a plurality of node pairs from the node pairs where no undirected edges exist to add an undirected edge, generating a new network topology, and obtaining a second context-level contrast loss function and a second block-level contrast loss function of the new network topology; Calculate the overall loss function of the network training in the attribute comparison phase according to the first context-level contrast loss function, the first block-level contrast loss function, the second context-level contrast loss function, and the second block-level contrast loss function; Iteratively updating the first target multi-layer perceptron network to calculate an attribute anomaly score of each node of the network topology to be detected after the overall loss function converges; Using a preset discretization graph expansion strategy, the characteristic matrix of the network topology to be detected is updated a target number of times to obtain a diffused characteristic matrix; Initializing a second target multilayer perceptron network, and converting the diffused feature matrix into a second embedding representation matrix of nodes to obtain a reconstruction matrix of the adjacency matrix; Calculating the adjacency matrix reconstruction loss function according to the reconstruction matrix; Iteratively updating the second target multilayer perceptron network based on the adjacency matrix reconstruction loss function to calculate the structural anomaly score of each node after the adjacency matrix reconstruction loss function converges; Calculating a final anomaly score for each node according to the attribute anomaly score and the structure anomaly score; Nodes are sorted according to the final anomaly scores to filter out abnormal nodes.

2. The method for detecting abnormal nodes in the industrial Internet according to claim 1, characterized in that: The transformation formula of the first embedding representation matrix is: H attr =σ(XW A +b A ) Where X∈R n×d is the attribute matrix of the node; W A ∈R d×k is the learnable weight parameter matrix; b A ∈R 1×k is the learnable bias parameter matrix; σ is the defined multilayer perceptron network; H attr is the first embedding representation matrix of the node, H attr The vector h of the i-th row i =[(H attr ) i1 ,…,(H attr ) ik ]∈R k For node V i The k embedding representation features.

3. The method for detecting abnormal nodes in the industrial Internet according to claim 1, characterized in that: The obtaining of the second context-level contrast loss function and the second block-level contrast loss function of the new network topology includes: The second context-level contrast loss function and the second block-level contrast loss function are calculated according to the adjacency matrix of the new network topology and the first embedding representation matrix.

4. The method for detecting abnormal nodes in the industrial Internet according to claim 1, characterized in that: The calculation formula of the overall loss function is: Among them, α and β are given equilibrium parameters; is the first context level contrast loss function; is the first block level contrast loss function; is the second context level contrast loss function; is the second block level contrast loss function; is the node V calculated based on the network topology to be detected i The average value of the fully adjacent subgraph features; is the node V calculated based on the network topology to be detected j The average value of the fully adjacent subgraph features; is the node V calculated based on the new network topology i The average value of the fully adjacent subgraph features; is the node V calculated based on the new network topology j The average value of the fully adjacent subgraph features of ; γ is a given supplementary parameter.

5. The method for detecting abnormal nodes in the industrial Internet according to claim 1, characterized in that: The calculation formula of the adjacency matrix reconstruction loss function is: Among them, A ij is the element in the i-th row and j-th column of matrix A; is a matrix The element at row i and column j.

6. The method for detecting abnormal nodes in the industrial Internet according to claim 1, characterized in that: The calculation formula of the final anomaly score is: Among them, q is the balance coefficient between structure and attributes; For node V i Structural abnormality score; For node V i The attribute anomaly score of .

7. A method for detecting abnormal nodes in the industrial Internet, characterized in that: include: A first initialization module is used to initialize the first target multi-layer perceptron network and convert the feature matrix of the input original network topology into the first embedding representation matrix of the node; A first calculation module is used to calculate a first context-level contrast loss function and a first block-level contrast loss function between nodes of the network topology to be detected based on the adjacency matrix of the network topology to be detected and the first embedding representation matrix; A generation module is configured to randomly select multiple undirected edges from the network topology to be detected for deletion, and randomly select multiple node pairs from the node pairs where no undirected edges exist to add an undirected edge to generate a new network topology, and obtain a second context-level contrast loss function and a second block-level contrast loss function of the new network topology; A second calculation module is used to calculate the overall loss function of the network training in the attribute comparison phase according to the first context level contrast loss function, the first block level contrast loss function, the second context level contrast loss function and the second block level contrast loss function; a third computing module, configured to iteratively update the first target multi-layer perceptron network, so as to calculate an attribute anomaly score of each node of the network topology to be detected after the overall loss function converges; A diffusion module is used to update the characteristic matrix of the network topology to be detected a target number of times using a preset discretization graph expansion strategy to obtain a diffused characteristic matrix; A second initialization module is used to initialize a second target multi-layer perceptron network and convert the diffused feature matrix into a second embedding representation matrix of nodes to obtain a reconstruction matrix of the adjacency matrix; A fourth calculation module, configured to calculate the adjacency matrix reconstruction loss function according to the reconstruction matrix; a fifth computing module, configured to iteratively update the second target multilayer perceptron network based on the adjacency matrix reconstruction loss function, so as to calculate the structural anomaly score of each node after the adjacency matrix reconstruction loss function converges; a sixth calculation module, configured to calculate a final anomaly score of each node according to the attribute anomaly score and the structure anomaly score; The detection module is configured to sort the nodes according to the final anomaly scores to filter out abnormal nodes.

8. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method for detecting abnormal nodes in the industrial Internet as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the abnormal node detection method in the industrial Internet as described in any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that The computer program is executed to implement the abnormal node detection method in the industrial Internet as described in any one of claims 1 to 6.

Images