Trigger node detection method, device, apparatus and storage medium

Abstract

The application discloses a trigger node detection method and device, equipment and a storage medium, and relates to the technical field of graph backdoor detection. The method comprises the following steps: performing node vector learning on graph data through a target graph neural network to obtain a target node vector corresponding to the graph data; performing clustering screening on the target node vector through a target clustering algorithm to determine an abnormal node in the graph data; performing structural disturbance on the abnormal node, calculating a target drift score of the abnormal node after the structural disturbance; generating a discrimination threshold based on the target drift score, and screening a trigger node in the graph data from the abnormal node according to the discrimination threshold. Through the cooperative mechanism of the representation learning to establish the discrimination basis, the clustering screening to narrow the search space, the structural disturbance to expose the stability difference, and the statistical modeling to automatically make decisions, the technical problem that it is difficult to accurately identify the hidden trigger node in the graph data is solved, and the stability and reliability of the detection process are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of graph backdoor detection, and particularly relates to a trigger node detection method and device, equipment and a storage medium. BACKGROUND

[0002] Graph neural networks have been widely used in many fields such as social network analysis and molecular structure prediction, and have become an important tool for processing graph structure data. However, as the application of graph neural networks deepens, the security threats it faces have become increasingly prominent, among which graph backdoor attacks are particularly prominent. In the prior art, the defense against graph backdoor attacks mainly adopts an outlier detection method. This kind of method identifies abnormal nodes that are significantly different from normal node distribution by analyzing the distribution difference of node features. For example, by calculating the statistical features of node embedding, or using clustering algorithm to separate distribution outliers, to detect potential trigger nodes. However, the prior art has a significant drawback: when facing in-distribution trigger attacks, since the trigger nodes are highly similar to normal nodes in feature distribution, traditional outlier detection methods are difficult to effectively distinguish, resulting in a significant decrease in detection accuracy. This kind of in-distribution trigger can perfectly hide in the normal node distribution, making the detection mechanism based on distribution difference ineffective, thereby seriously weakening the practicability of existing defense methods.

[0003] The above content is only used to assist in understanding the technical solutions of the present application and does not represent the acknowledgement of the above content as prior art. SUMMARY

[0004] The main purpose of the present application is to provide a trigger node detection method, device, equipment and storage medium, aiming at solving the technical problem that trigger nodes in graph structure are difficult to detect.

[0005] To achieve the above purpose, the present application provides a trigger node detection method, which comprises:

[0006] learning node vectors of graph data through a target graph neural network to obtain target node vectors corresponding to the graph data;

[0007] filtering the target node vectors through a target clustering algorithm to determine abnormal nodes in the graph data;

[0008] performing structure disturbance on the abnormal nodes, and calculating target drift scores of the abnormal nodes after the structure disturbance;

[0009] generating a discrimination threshold based on the target drift scores, and filtering trigger nodes in the graph data from the abnormal nodes according to the discrimination threshold.

[0010] In an embodiment, the step of performing node vector learning on the graph data by the target graph neural network to obtain the target node vector corresponding to the graph data further comprises:

[0011] learning and optimizing the initial graph neural network through a contrastive learning strategy, inputting the training graph into the initial graph neural network after learning and optimization to generate a first node vector;

[0012] performing clustering on the first node vector through a target clustering algorithm to determine first normal nodes and first abnormal nodes of the training graph;

[0013] performing loss calculation on the first normal nodes through a comprehensive loss function to generate a comprehensive loss value of the first normal nodes, and updating the initial graph neural network after learning and optimization based on the comprehensive loss value until a preset convergence condition is met to obtain a target graph neural network.

[0014] In an embodiment, the step of learning and optimizing the initial graph neural network through a contrastive learning strategy comprises:

[0015] constructing positive sample pairs and negative sample pairs based on initial nodes in the training graph;

[0016] performing contrastive loss calculation on the initial nodes, the positive sample pairs and the negative samples through a contrastive loss function to obtain a contrastive loss of the initial nodes;

[0017] optimizing network parameters of the initial graph neural network through the contrastive loss to obtain an initial graph neural network after learning and optimization.

[0018] In an embodiment, the step of performing loss calculation on the first normal nodes through a comprehensive loss function to generate a comprehensive loss value of the first normal nodes comprises:

[0019] calculating a mean square error between the first normal nodes and cluster center nodes of the first normal nodes to obtain a center loss of the first normal nodes;

[0020] calculating a cosine similarity between the first normal nodes to obtain a consistency loss between the first normal nodes;

[0021] calculating a similarity between the first normal nodes and the first abnormal nodes to obtain a separability loss of the first abnormal nodes;

[0022] performing weighted calculation on the center loss, the consistency loss and the separability loss through a comprehensive loss function to obtain a comprehensive loss value of the first normal nodes.

[0023] In an embodiment, the step of determining the abnormal node in the graph data by clustering the target node vectors through a target clustering algorithm comprises:

[0024] calculating the Euclidean distance between the target node vectors, and constructing a distance matrix based on the Euclidean distance;

[0025] performing density clustering based on the distance matrix to obtain node density corresponding to the target node vectors;

[0026] comparing the node density with a preset density threshold, and if the node density is less than the density threshold, the corresponding target node vector is identified as an abnormal node.

[0027] In an embodiment, the step of performing structural disturbance on the abnormal node and calculating a target drift score of the abnormal node after the structural disturbance comprises:

[0028] obtaining an abnormal node vector of the abnormal node through the target graph neural network;

[0029] deleting a plurality of neighbor edges of the abnormal node to generate a plurality of corresponding disturbance subgraphs;

[0030] inputting a plurality of the disturbance subgraphs into the target graph neural network to obtain disturbance node vectors of the disturbance subgraphs;

[0031] calculating the Euclidean distance between the abnormal node vector and a plurality of the disturbance node vectors respectively to obtain a plurality of single drift scores;

[0032] calculating the mean of a plurality of the single drift scores to obtain the target drift score of the abnormal node.

[0033] In an embodiment, the step of generating a discrimination threshold based on the target drift score and screening a trigger node in the graph data from the abnormal node according to the discrimination threshold comprises:

[0034] determining the discrimination threshold of the abnormal node by fitting the distribution based on the target drift score through a Gaussian mixture model;

[0035] determining the trigger node in the graph data based on the target drift score and the discrimination threshold.

[0036] In addition, to achieve the above-mentioned purposes, the present application also provides a trigger node detection device, which comprises:

[0037] a representation learning module configured to learn node vectors of graph data through a target graph neural network to obtain target node vectors corresponding to the graph data;

[0038] an anomaly determination module configured to determine an abnormal node in the graph data by performing clustering screening on the target node vector through a target clustering algorithm;

[0039] a perturbation drift module configured to perform structural perturbation on the abnormal node, and calculate a target drift score of the abnormal node after the structural perturbation;

[0040] a trigger differentiation module configured to generate a differentiation threshold based on the target drift score, and screen a trigger node in the graph data from the abnormal node according to the differentiation threshold.

[0041] In addition, to achieve the above object, the present application further provides a trigger node detection device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the trigger node detection method as described above.

[0042] In addition, to achieve the above object, the present application further provides a storage medium, which is a computer readable storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the trigger node detection method as described above.

[0043] In addition, to achieve the above object, the present application further provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the steps of the trigger node detection method as described above.

[0044] The one or more technical solutions provided by the present application have at least the following technical effects:

[0045] The embodiments of the present application provide a trigger node detection method, device, equipment and storage medium. The graph data is subjected to node vector learning through a target graph neural network to obtain a target node vector corresponding to the graph data. An abnormal node in the graph data is determined by performing clustering screening on the target node vector through a target clustering algorithm. The abnormal node is subjected to structural perturbation, and a target drift score of the abnormal node after the structural perturbation is calculated. A differentiation threshold is generated based on the target drift score, and a trigger node in the graph data is screened from the abnormal node according to the differentiation threshold. Through the cooperative mechanism of representation learning to establish a differentiation basis, clustering screening to narrow a search space, structural perturbation to expose a poor stability difference, and statistical modeling to automatically make a decision, the technical problem of being difficult to accurately identify a hidden trigger node in the graph data is solved, and the stability and reliability of the detection process are improved. BRIEF DESCRIPTION OF DRAWINGS

[0046] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0047] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 This is a flowchart illustrating the method for detecting trigger nodes in this application, as provided in Embodiment 1.

[0049] Figure 2 A schematic diagram of the training process of a graph neural network is provided for the trigger node detection method of this application;

[0050] Figure 3 This is a simplified flowchart illustrating the trigger node detection method provided in Embodiment 2 of this application;

[0051] Figure 4 This is a schematic diagram of the module structure of the detection device for the trigger node in an embodiment of this application;

[0052] Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the detection method of the trigger node in the embodiments of this application.

[0053] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0054] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0055] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0056] The main solution of this application embodiment is as follows: learn the node vectors of the graph data through a target graph neural network to obtain the target node vectors corresponding to the graph data; perform clustering and filtering of the target node vectors through a target clustering algorithm to determine the abnormal nodes in the graph data; perform structural perturbation on the abnormal nodes and calculate the target drift score of the abnormal nodes after structural perturbation; generate a discrimination threshold based on the target drift score, and filter the trigger nodes in the graph data from the abnormal nodes according to the discrimination threshold.

[0057] In this embodiment, for ease of description, the detection system of the trigger node is taken as the execution subject for illustration.

[0058] Graph neural networks have been widely used in social network analysis, molecular structure prediction and other fields, and have become an important tool for processing graph structured data. However, as the application of graph neural networks deepens, the security threats it faces have become increasingly prominent, among which graph backdoor attacks are particularly prominent. In the prior art, the defense against graph backdoor attacks mainly adopts an outlier detection method. This kind of method identifies abnormal nodes that are significantly different from normal node distribution by analyzing the distribution difference of node features. For example, by calculating the statistical features of node embedding, or using clustering algorithm to separate out-of-distribution samples, to detect potential trigger nodes. However, the prior art has a obvious shortcoming: when facing in-distribution trigger attacks, since the trigger nodes are highly similar to normal nodes in feature distribution, traditional outlier detection methods are difficult to effectively distinguish, resulting in a significant decrease in detection accuracy. This kind of in-distribution trigger can perfectly hide in the normal node distribution, making the detection mechanism based on distribution difference ineffective, thereby seriously weakening the practicability of existing defense methods.

[0059] The present application provides a solution, which establishes a collaborative mechanism of distinguishing basis through representation learning, narrows down the search space through clustering screening, exposes stability difference through structure disturbance, and automatically makes decisions through statistical modeling, solves the technical problem of difficult accurate identification of hidden trigger nodes in graph data, and improves the stability and reliability of the detection process.

[0060] It should be noted that the execution subject of the present embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a trigger node detection system, etc. The following takes the trigger node detection system as an example to illustrate the present embodiment and the following embodiments.

[0061] Based on this, the present application embodiment provides a trigger node detection method, referring to Figure 1 , Figure 1 The flowchart of the first embodiment of the trigger node detection method of the present application.

[0062] In this embodiment, the trigger node detection method comprises steps S11-S14:

[0063] Step S11, learning node vectors of graph data through a target graph neural network to obtain target node vectors corresponding to the graph data.

[0064] It should be noted that the target graph neural network is a graph neural network model with node vector learning capability, and its core function is to extract and represent the features of the nodes in the graph data, and convert the attribute features and adjacency relationships of the nodes into low-dimensional and rich semantic information vectors.

[0065] Additionally, it should be noted that the graph data is structured data containing a node set, an edge set, and node attribute information, and is the input object of node vector learning.

[0066] Additionally, it should be noted that the target node vector is a vector representation in a high-dimensional space obtained by encoding the nodes by the graph neural network, and can reflect the feature information and structure information of the nodes.

[0067] It can be understood that the node vector learning of the graph data by the graph neural network in this step can effectively capture the local structure and feature correlation between the nodes, thereby providing a node representation with strong distinction for subsequent anomaly detection and enhancing the distribution difference between the trigger nodes and normal nodes in the vector space.

[0068] Specifically, the target graph neural network adopts a graph convolutional network or a graph attention network as a basic architecture, aggregates neighbor node information through a multi-layer message passing mechanism, and updates the vector representation of the center node; the node vector learning process can combine node features and adjacency matrices to output the target node vector of each node.

[0069] Illustratively, for social network graph data, the target graph neural network learns the node vector of each user, which contains the social relationship and behavior features of the user.

[0070] Step S12, the target node vector is clustered and screened by a target clustering algorithm to determine the abnormal nodes in the graph data.

[0071] It should be noted that the target clustering algorithm is a density-based clustering method for grouping node vectors, and its function is to distinguish normal nodes and abnormal nodes according to the distribution density of the node vectors; the abnormal nodes refer to nodes that are inconsistent with the distribution of most nodes in the graph data, including poisoned nodes and trigger nodes. In an embodiment of the present application, the target clustering algorithm refers to the HDBSCAN (Hierarchical Density-Based Spatial Clustering of Applications with Noise) clustering algorithm.

[0072] It can be understood that the purpose of this step is to preliminarily screen out an abnormal node set that may contain trigger nodes from all nodes, and the principle is based on the distribution density of the target node vector. Normal nodes usually form a cluster with high density, and abnormal nodes are in a low-density area due to the large difference in characteristics and structure from normal nodes. The role of this step is to reduce the scope of subsequent detection, reduce the amount of calculation, improve the detection efficiency, and avoid resource waste caused by subsequent complex processing of all nodes.

[0073] Specifically, the HDBSCAN algorithm is used to construct a distance matrix by calculating the Euclidean distance between node vectors, identify high-density and low-density areas, and mark the nodes in the low-density area as abnormal nodes.

[0074] Step S13, performing structural disturbance on the abnormal nodes, and calculating the target drift score of the abnormal nodes after the structural disturbance.

[0075] It should be noted that the structural disturbance refers to a random deletion operation on the neighbor edges of the nodes in the graph data to simulate the change of the graph structure.

[0076] In addition, it should be noted that the target drift score refers to a quantitative indicator of the change of the vector before and after the structural disturbance, which is used to measure the stability of the node to the change of the graph structure.

[0077] It can be understood that this step can evaluate the sensitivity of the node to the change of the graph structure through structural disturbance and drift score calculation. The trigger node is distinguished from the poisoned node because of its low drift score due to strong structural dependence.

[0078] Specifically, multiple structural disturbances are performed on each abnormal node, and the node vector is recalculated after each disturbance. The change of the vector before and after the disturbance is calculated by the Euclidean distance, and the average value of the multiple changes is taken as the target drift score.

[0079] Step S14, generating a discrimination threshold based on the target drift score, and screening the trigger nodes in the graph data from the abnormal nodes according to the discrimination threshold.

[0080] It should be noted that the discrimination threshold refers to a probability threshold for distinguishing trigger nodes and poisoned nodes, which is generated by a Gaussian mixture model. The trigger node refers to a node in the graph that is injected with a malicious trigger structure to activate a backdoor attack.

[0081] It can be understood that this step automatically generates a discrimination threshold by fitting the drift score with a Gaussian mixture model, which can accurately identify trigger nodes with low drift scores and improve detection accuracy.

[0082] Specifically, the drift score is fitted as two Gaussian distributions corresponding to the trigger node and the poisoned node respectively using a Gaussian mixture model, and a threshold is determined by probability calculation, and the node whose probability is greater than the threshold is marked as the trigger node.

[0083] The embodiment filters the trigger node from the graph data through the above-mentioned scheme, four steps of node vector learning, cluster screening, structure disturbance drift analysis and threshold distinguishing, solves the problem that the existing method is difficult to detect the hidden trigger, and improves the defense ability of the graph backdoor attack.

[0084] Based on the above implementation scheme, in a feasible implementation, the step of learning the node vector of the graph data through the target graph neural network to obtain the target node vector corresponding to the graph data further includes S21-S23 before the step of learning the node vector of the graph data through the target graph neural network to obtain the target node vector corresponding to the graph data.

[0085] Step S21, learning and optimizing the initial graph neural network through a contrastive learning strategy, inputting the training graph into the learning and optimized initial graph neural network to generate a first node vector.

[0086] It should be noted that the contrastive learning strategy is a learning method for optimizing the model by comparing the similarity between samples, and the core is to strengthen the similarity of similar samples and the difference of different samples.

[0087] In addition, it should be noted that the initial graph neural network is an unoptimized graph neural network, which serves as the basis for model optimization. The training graph is a graph data used for model training, which has similar structure and feature distribution as the subsequent to-be-detected graph data.

[0088] In addition, it should be noted that the first node vector is a vector obtained by encoding the nodes of the training graph after the initial graph neural network is optimized through the contrastive learning.

[0089] It can be understood that the purpose of this step is to preliminarily optimize the parameters of the initial graph neural network and improve its node vector learning ability. Through the contrastive learning strategy, the model learns the essential features of the nodes and strengthens the separation degree of normal nodes and abnormal nodes in the vector space, providing a better initial model for subsequent clustering and model updating, so that the generated first node vector has better distinguishability and creates conditions for accurate division of the first normal node and the first abnormal node.

[0090] Specifically, the positive sample pair and the negative sample pair are constructed based on the initial nodes in the training graph; the contrastive loss of the initial nodes is calculated by comparing the loss function of the initial nodes, the positive sample pair and the negative sample pair; and the network parameters of the initial graph neural network are optimized through the contrastive loss to obtain the learning and optimized initial graph neural network.

[0091] Step S22, clustering the first node vector by a target clustering algorithm to determine first normal nodes and first abnormal nodes of the training graph.

[0092] It should be noted that the first normal node is a node in the training graph that forms a high-density cluster, representing a clean node without abnormalities. The first abnormal node is a node in the training graph that is in a low-density area, including a poisoned node and a trigger node in the training graph.

[0093] It can be understood that the purpose of this step is to divide the first normal nodes and the first abnormal nodes from the training graph. The characteristics and structures of the normal nodes in the training graph are consistent, forming a high-density cluster in the vector space. The abnormal nodes are distributed in a low-density area due to the differences with the normal nodes. The first normal nodes are screened for subsequent model updating, providing accurate training samples for optimizing the model through the comprehensive loss function, and ensuring that the model can better learn the characteristics of the normal nodes.

[0094] Specifically, the HDBSCAN clustering algorithm is selected as the target clustering algorithm (adapted to the density distribution characteristics of the node vector), and basic parameters such as the minimum cluster size are configured. The first node vector set is input, the Euclidean distance between vectors is calculated by the target clustering algorithm, a distance matrix is constructed, and nodes with high density are identified. The nodes in the cluster with high density and strong consistency of characteristics and structure are determined as the first normal nodes (clean nodes), and the nodes in the low-density area that are significantly different from the normal nodes are determined as the first abnormal nodes (including poisoned nodes and trigger nodes). Representative nodes are selected from the first normal node cluster as cluster center nodes.

[0095] Step S23, loss calculation of the first normal node by a comprehensive loss function to generate a comprehensive loss value of the first normal node, and updating the initial graph neural network after learning optimization based on the comprehensive loss value until a preset convergence condition is met to obtain a target graph neural network.

[0096] It should be noted that the comprehensive loss function is a composite loss function that combines multiple loss terms to comprehensively evaluate the representation quality of the first normal node. The comprehensive loss value is the calculation result of the comprehensive loss function, reflecting the representation deviation of the model for the first normal node.

[0097] In addition, it should be noted that the preset convergence condition is a standard for judging whether the model is optimized, such as loss function convergence, iteration number reaching a threshold, or change rate of the first normal node and the first abnormal node reaching a threshold (such as less than 5% for three consecutive rounds), indicating that the model deviation has been reduced to a reasonable range.

[0098] It can be understood that the loss calculation of the first normal node by the comprehensive loss function can further optimize the node representation, enhance the distribution difference between the clean node and the abnormal node, and improve the detection ability of the model to the trigger.

[0099] Specifically, the comprehensive loss function includes center loss, consistency loss and separability loss, and the comprehensive loss value is obtained by weighted summation. Based on the comprehensive loss value, the parameters of the initial graph neural network after learning optimization are adjusted to strengthen the learning of the model to the normal node features and the distinguishing ability of the abnormal node. The preset convergence condition is determined, for example, if the change rate of the first normal node and the first abnormal node in the last 3 rounds of training is less than 5%, or the comprehensive loss value decreases by less than 1 -5 , or the number of iterations reaches the upper limit (such as 50 rounds), the model update is stopped, and the target graph neural network with accurate node representation ability is obtained.

[0100] For better understanding, please refer to Figure 2 , Figure 2 The flowchart for the representation learning of the initial graph neural network is shown in FIG. 1. First, the system learns and optimizes the initial graph neural network through a contrastive learning strategy, and uses positive and negative sample pairs to enhance the distinguishability of node representation. Then, a noisy hierarchical density-based spatial clustering method is used to cluster the generated first node vectors to identify the first normal node and the first abnormal node. Subsequently, based on the clustering results, a comprehensive loss function including center loss, consistency loss and separability loss is constructed to calculate the loss of the first normal node and optimize the model parameters. Finally, whether the preset convergence condition (such as loss convergence, node division stability or maximum iteration number) is reached is determined to decide whether the training is terminated, so as to output the target graph neural network with accurate node representation ability, providing a high-quality vector representation basis for subsequent trigger detection.

[0101] Through the above-mentioned scheme, the node representation ability of the graph neural network is gradually optimized through the three steps of contrastive learning, clustering screening and comprehensive loss optimization, which enhances the distinguishability of the model to the hidden trigger and provides a high-quality node vector basis for subsequent detection.

[0102] Based on the above implementation scheme, in a feasible implementation, the step of learning and optimizing the initial graph neural network through a contrastive learning strategy includes S31-S33.

[0103] Step S31, constructing positive sample pairs and negative sample pairs based on the initial nodes in the training graph.

[0104] It should be noted that the initial node refers to the original node in the training graph that has not been encoded into a vector, which contains node attributes and adjacency relationship information.

[0105] Additionally, it should be noted that the positive sample pair refers to a pair of nodes with similar features or structures in the representation space, which is composed of the same node through different enhanced views or semantically similar neighbor nodes.

[0106] Additionally, it should be noted that the negative sample pair refers to a pair of nodes with large feature or structure differences in the representation space, which is usually composed of nodes with different semantic roles.

[0107] It can be understood that this step enables the model to maximize the similarity of the positive sample pair and minimize the similarity of the negative sample pair through contrastive loss calculation, thereby improving the discriminability of the node representation.

[0108] Specifically, the positive sample pair construction can adopt two ways: generating two views by performing two independent graph enhancements on the same node, or pairing the target node with its high-order neighbor nodes. The negative sample pair construction can adopt three strategies: randomly sampling from other nodes within the same batch, sampling from the global node memory bank, or pairing the target node with nodes of different semantic clusters. For large-scale graph data, neighbor sampling and subgraph batch processing techniques can be used to improve efficiency; for small-scale graphs, the full graph contrast strategy can be used to fully utilize global information.

[0109] Step S32, performing contrastive loss calculation on the initial node, the positive sample pair and the negative sample pair through a contrastive loss function to obtain the contrastive loss of the initial node.

[0110] It should be noted that the contrastive loss function is a function for calculating the similarity difference between the initial node and the positive and negative sample pairs, which is used to quantify the aggregation degree of nodes of the same type and the separation degree of nodes of different types. The role of the contrastive loss function is to bring the positive sample pair closer and push the negative sample pair further apart, thereby optimizing the structure of the node representation space.

[0111] Additionally, it should be noted that the contrastive loss is the output result of the loss function, reflecting the recognition bias of the model on the node difference.

[0112] It can be understood that this step enables the model to explicitly optimize the similarity of the positive sample pair while reducing the similarity of the negative sample pair through contrastive loss calculation, thereby enhancing the discriminability of the node representation and laying a foundation for subsequent clustering analysis.

[0113] Specifically, the contrastive loss function calculates the similarity of the positive and negative sample pairs through cosine similarity. Through contrastive loss function calculation, the calculation formula of the contrastive loss function is:

[0114]

[0115] wherein, is the contrastive loss value; N is the number of first normal nodes; is a node vector of the positive sample, and a cosine similarity of node vectors of node i and node j, is a node vector of the positive sample, is a node vector of the negative sample.

[0116] Step S33, optimizing the network parameters of the initial graph neural network through the contrastive loss to obtain a learning-optimized initial graph neural network.

[0117] It should be noted that the network parameters refer to the learnable weight matrix and bias vector in the graph neural network; the contrastive loss optimization refers to updating the parameters in the direction of the negative gradient of the loss using gradient descent or its variants; and the learning-optimized initial graph neural network is an encoder with adjusted parameters and discriminative ability. This step gradually reduces the positive sample pair distance and increases the negative sample pair distance by propagating the contrastive loss gradient to each layer through backpropagation.

[0118] It can be understood that this step optimizes the network parameters through the contrastive loss, enabling the model to learn more discriminative node representations and providing a basis for subsequent clustering and loss calculation.

[0119] Specifically, the random gradient descent or its variants (such as the Adam optimizer) is used to calculate the gradient based on the contrastive loss and update the network parameters; a learning rate scheduler can be set to dynamically adjust the learning rate. The choice of different optimization algorithms affects the training speed and convergence, while the learning rate scheduling strategy can prevent training oscillation. The synergistic effect of these methods can ensure efficient convergence of the model to a high-quality solution.

[0120] For example, the Adam optimizer is used to calculate the gradient based on the contrastive loss, and the weight matrix of the initial graph neural network is iteratively updated. When the loss change of the last 5 training rounds is less than 1 -4 , the training is stopped, and the learning-optimized initial graph neural network is obtained.

[0121] The above scheme, contrastive learning process, including sample pair construction, loss calculation and parameter optimization, enables the graph neural network to learn highly discriminative node representations, effectively enhancing the model's ability to recognize hidden triggers.

[0122] Based on the above implementation, in a feasible implementation, the step of calculating the comprehensive loss value of the first normal node through the comprehensive loss function includes S41-S44:

[0123] Step S41, calculating the mean square error between the first normal node and the cluster center node of the first normal node to obtain the center loss of the first normal node.

[0124] It should be noted that the cluster center node refers to the center point of the first normal node in the vector space, which is usually obtained by calculating the mean of all first normal node vectors; the center loss refers to the loss value calculated by the mean square error, which is used to measure the distance of the node from the cluster center. The cluster center node is the center of the normal node distribution, which provides a reference benchmark for center loss calculation; the role of the center loss is to constrain the normal nodes to gather around the center, enhancing the intra-class compactness.

[0125] It can be understood that this step can make the first normal node more closely distributed around its cluster center in the embedding space by calculating the center loss, thereby enhancing the cohesion of clean nodes and providing clearer boundaries for subsequent trigger node differentiation.

[0126] Specifically, the cluster center node is calculated by arithmetic mean or moving average, and the mean square error function is used to calculate the mean of the sum of the square of the distance between each first normal node and the cluster center node, to obtain the center loss of the first normal node. The formula for calculating the center loss is:

[0127]

[0128] wherein, is the center loss; is the mean square error calculation formula; is the first normal node; is the cluster center node.

[0129] For example, in a social network graph, there is a set of first normal nodes , and the node vectors are , then the cluster center node vector is , and the center loss is .

[0130] Step S42, calculate the cosine similarity between the first normal nodes to obtain the consistency loss between the first normal nodes.

[0131] It should be noted that the consistency loss refers to the loss value calculated by the cosine similarity, which is used to measure the similarity between the first normal nodes. The role of the consistency loss is to ensure that the first normal nodes maintain consistent semantic direction in the embedding space, enhancing the stability of node representation.

[0132] It can be understood that this step can make the first normal nodes maintain a high degree of consistency in the vector space by calculating the consistency loss, strengthening the semantic association between the normal nodes, thereby improving the sensitivity of the model to abnormal nodes.

[0133] Specifically, the cosine similarity between all pairs of first normal nodes can be calculated, and the average value is taken as the consistency loss; or the contrast similarity can be calculated by constructing positive sample pairs. Full connection calculation can comprehensively capture the relationship between nodes, but the calculation amount is large; sampling calculation can improve efficiency and still maintain good consistency effect. The calculation formula of the consistency loss is:

[0134]

[0135] wherein, refers to the consistency loss; B refers to the number of first normal nodes, B 2 indicates the number of all node pairs; sim() refers to the cosine similarity calculation formula

[0136] Exemplarily, for the first normal node vector , the calculation formula of the cosine similarity is:

[0137]

[0138] The calculation formula of the consistency loss is:

[0139]

[0140] Step S43, calculating the similarity between the first normal node and the first abnormal node to obtain the separability loss of the first abnormal node.

[0141] It should be noted that the separability loss refers to the difference between the first normal node and the first abnormal node calculated by the similarity function; the similarity calculation can use cosine similarity or Euclidean distance conversion. The role of the separability loss is to increase the distance between the normal node and the abnormal node in the embedding space, and to enhance the class separability.

[0142] It can be understood that by calculating the separability loss, the difference between the first normal node and the first abnormal node in the vector space can be effectively expanded, and the ability of the model to distinguish normal and abnormal patterns can be enhanced, providing a more explicit decision boundary for the trigger detection.

[0143] Specifically, the average similarity between each first normal node and all first abnormal nodes can be calculated as the separability loss; or the most representative abnormal node can be selected by negative sampling for calculation. Full abnormal nodes participating in calculation can provide comprehensive separation signal; negative sampling can focus on difficult samples to improve training efficiency.

[0144] Exemplarily, assuming that the first normal node is , and the first abnormal node is , the calculation formula of the separability loss is:

[0145]

[0146] wherein, is a separability loss; is a first normal node; is a first abnormal node.

[0147] Step S44, the center loss, the consistency loss and the separability loss are weighted and calculated by a comprehensive loss function to obtain a comprehensive loss value of the first normal node.

[0148] It should be noted that the comprehensive loss function is a multi-objective optimization function, which is realized by weighted fusion of the three sub-losses; the comprehensive loss value is a scalar, representing the overall loss degree of the first normal node under multiple optimization objectives. The function of the comprehensive loss function is to balance the three optimization objectives of center aggregation, internal consistency and external separation, and realize the overall optimization of node representation.

[0149] It can be understood that the step can synergistically optimize multiple aspects of node representation by weighted fusion of the three sub-losses, while enhancing the cohesion of normal nodes and expanding the difference with abnormal nodes, and comprehensively improving the discrimination ability of node representation.

[0150] Specifically, different weight coefficients can be allocated to the three sub-losses according to specific actual conditions, such as a center loss weight of 0.4, a consistency loss weight of 0.3, and a separability loss weight of 0.3, and the sum of the weights is 1; the specific setting of the weights can be adjusted according to task requirements. Different weight allocation strategies can flexibly adjust the relative importance of each optimization objective to adapt to different detection scenarios.

[0151]

[0152] wherein, is a comprehensive loss value; is a center loss weight, is a center loss; is a consistency loss weight, is a consistency loss; is a separability loss weight, is a separability loss.

[0153] The embodiment realizes the comprehensive optimization of the representation characteristics of the first normal node by the synergistic calculation and weighted fusion of the center loss, the consistency loss and the separability loss, enhances the internal cohesion and consistency of the normal node, expands the external separation from the abnormal node, and significantly improves the discrimination ability of the node representation, thereby laying a solid representation learning foundation for subsequent trigger accurate detection.

[0154] Based on the above embodiments, in a feasible implementation, the step of determining the abnormal nodes in the graph data by clustering the node vectors through a target clustering algorithm includes S51-S53:

[0155] In step S51, the Euclidean distance between the target node vectors is calculated, and a distance matrix is constructed based on the Euclidean distance.

[0156] It should be noted that the Euclidean distance is a mathematical index for measuring the straight-line distance between two node vectors in a high-dimensional vector space, reflecting the relative position relationship of the nodes in the embedding space.

[0157] The calculation formula of the Euclidean distance is:

[0158]

[0159] wherein, and are the representations of nodes and , respectively, represents the Euclidean distance of them in the high-dimensional embedding space, is the Euclidean distance. The clustering result screens out abnormal nodes through density estimation, providing more explicit input for subsequent drift analysis.

[0160] In addition, it should be noted that the distance matrix is a square matrix composed of the Euclidean distances between all pairs of node vectors, and the matrix dimension is m x m (m is the total number of nodes in the graph data), and the matrix element D[i][j] represents the Euclidean distance between the i-th node and the j-th node, which is used to intuitively present the similarity distribution between all nodes.

[0161] It can be understood that this step can accurately capture the distribution relationship of the nodes in the embedding space by calculating the Euclidean distance between the node vectors and constructing the distance matrix, providing reliable input data for density clustering, thereby laying a foundation for abnormal node identification.

[0162] Specifically, the Euclidean distance between the target node vectors is calculated through the Euclidean distance calculation formula, and the distance matrix is calculated by traversing all node pairs. Calculating the distance of all node pairs can provide the most complete structural information, while approximate calculation based on sampling can improve the processing efficiency of large-scale graphs, and both methods can provide effective distance information for density clustering.

[0163] Exemplarily, in a graph containing 3 nodes, the node vectors are z1=[0.1, 0.2], z2=[0.3, 0.4], and z3=[0.8, 0.9], respectively, and the distance matrix is:

[0164]

[0165] Step S52, density clustering is performed based on the distance matrix to obtain node density corresponding to the target node vector.

[0166] It should be noted that density clustering is an unsupervised learning method based on data distribution density; node density refers to the data point density in a certain neighborhood range in the embedding space. Density clustering can automatically discover clusters of arbitrary shape and identify noise points; node density directly reflects the distribution characteristics of the node, which is a key indicator for distinguishing normal nodes and abnormal nodes.

[0167] It can be understood that this step can identify high-density and low-density regions in the embedding space by analyzing node density through density clustering, thereby accurately capturing the distribution pattern of the node and providing a quantitative basis for anomaly node detection.

[0168] Specifically, the HDBSCAN algorithm is used to perform density clustering on the distance matrix, and node density is estimated by constructing a hierarchical clustering tree and extracting stable clusters. The HDBSCAN algorithm can automatically determine the number of clusters and is robust to noise; combined with mutual distance calculation, the density can be more accurately estimated, improving the clustering quality.

[0169] For example, the node density value calculated by the HDBSCAN algorithm can be [0.85, 0.78, 0.15], where nodes 1 and 2 are located in a high-density region, and node 3 is located in a low-density region. The density value ranges from 0 to 1, and the larger the value, the more dense the region where the node is located.

[0170] Step S53, the node density and the preset density threshold are compared, and if the node density is less than the density threshold, the corresponding target node vector is identified as an abnormal node.

[0171] It should be noted that the density threshold is a critical value for distinguishing high-density nodes and low-density nodes; the abnormal node refers to a node with a density lower than the threshold and located in a sparse region, including potential poisoned nodes and trigger nodes. The density threshold as a judgment standard can systematically distinguish normal and abnormal nodes; the identification of abnormal nodes provides a target set for subsequent targeted analysis.

[0172] It can be understood that this step can objectively and consistently identify abnormal nodes with sparse distribution by comparing the density threshold, effectively reducing the detection range and improving the efficiency and accuracy of subsequent drift analysis. Specifically, the density threshold can be automatically calculated by a clustering algorithm, such as taking the median or a specific quantile of all node densities; it can also be manually set according to domain knowledge. The automatic threshold is highly adaptable and suitable for different distribution datasets; the manual threshold can combine prior knowledge to more accurately control the proportion of abnormal nodes.

[0173] For example, if the density threshold b = 0.3 and the node density set is [0.85, 0.25, 0.92, 0.13, 0.88], then the density values 0.25 and 0.13 are less than the threshold, and the corresponding nodes are identified as abnormal nodes.

[0174] The above scheme, through the three steps of Euclidean distance calculation, density clustering analysis and threshold comparison, systematically realizes the accurate identification of abnormal nodes in graph data, fully utilizes the spatial distribution information of node vectors, and realizes objective judgment through density threshold, provides a high-quality candidate node set for subsequent targeted trigger detection, and significantly improves the detection efficiency.

[0175] Based on the above implementation scheme, in a feasible implementation, the step of performing structural disturbance on the abnormal node and calculating a target drift score of the abnormal node after the structural disturbance includes S61-S65:

[0176] Step S61, obtaining an abnormal node vector of the abnormal node through the target graph neural network.

[0177] It should be noted that the abnormal node vector refers to a high-dimensional embedding representation calculated by forward propagation of the abnormal node through the target graph neural network. The target graph neural network serves as an encoder to map graph structure information and node features to an embedding space; the abnormal node vector carries semantic information and structural context of the abnormal node, providing a benchmark representation for subsequent disturbance analysis.

[0178] It can be understood that this step obtains the vector representation of the abnormal node through the target graph neural network, which can provide an accurate benchmark reference for structural disturbance analysis and ensure the reliability of the drift score calculation, thereby laying a foundation for distinguishing trigger nodes and ordinary poisoned nodes.

[0179] Specifically, the abnormal node vector acquisition can adopt a full graph forward calculation mode, input a complete graph containing all nodes into a target graph neural network, and index the vector corresponding to the position of the abnormal node in the output result. This mode has complete information but large memory overhead. The abnormal node vector acquisition can also adopt a subgraph extraction mode, extract only the independent subgraph composed of each abnormal node and its k-order neighbor for forward calculation. This mode is computationally efficient but may lose global context information. The abnormal node vector acquisition can also adopt a hybrid caching strategy, persistently store the abnormal node vector calculated for the first time, and reuse it subsequently to avoid repeated calculation. For large-scale graph data, neighbor sampling or graph partitioning techniques can be used to aggregate only key neighbor information to reduce computational complexity. Different implementations are a trade-off between information integrity and computational efficiency. The full graph mode is suitable for small and medium-sized graphs to ensure representation quality, the subgraph mode is suitable for large-scale graphs to speed up reasoning, and the caching strategy is suitable for iterative analysis that requires multiple reuse of vectors. When combined, the initial vector can be quickly obtained through the subgraph mode, and the nodes with higher suspiciousness can be rechecked and verified using the full graph mode, taking into account efficiency and accuracy.

[0180] In step S62, a number of neighbor edges of the abnormal node are deleted to generate a number of corresponding perturbed subgraphs.

[0181] It should be noted that the neighbor edge refers to the edge directly connected to the abnormal node, representing the first-order neighborhood connection of the node. The perturbed subgraph refers to the modified graph structure generated by randomly deleting part of the neighbor edges of the abnormal node. The neighbor edge deletion simulates the uncertainty change of the graph structure, and the perturbed subgraph provides multiple structure variants for testing the sensitivity of the node representation to structural changes.

[0182] It can be understood that this step generates multiple perturbed subgraphs by randomly deleting the neighbor edges of the abnormal node, which can systematically test the robustness of the node representation to local structural changes and provide multiple observation samples for evaluating the stability of the node.

[0183] Specifically, the neighbor edge deletion can adopt a random deletion strategy, independently perform Bernoulli sampling deletion on each associated edge of the abnormal node with a preset probability p, generate a diversity disturbance; or a systematic deletion strategy can be adopted, a fixed number of edges are deleted according to the node degree ratio (such as deleting 30% of the neighbor with the highest degree), to ensure that the disturbance intensity is controllable; or a targeted deletion strategy can be adopted, the key edges are identified based on the edge betweenness centrality or attention weight and are preferentially deleted, focusing on the structural core. The disturbance subgraph generation can independently build K complete subgraphs, or can use incremental construction to generate a sequence of edges based on the original subgraph. The deletion strength p can be set as a fixed value (such as 0.3), or can be gradually increased from 0.1 to 0.5 for multi-scale disturbance analysis. Different implementations have trade-offs in disturbance diversity and computational efficiency, the random deletion strategy is simple to implement and the disturbance is comprehensive but may produce repeated subgraphs, the systematic deletion strategy is controllable but lacks randomness, and the targeted deletion strategy is accurate but requires pre-computation of edge importance. When combined, the random deletion strategy can be used to generate a preliminary disturbance set, and the suspicious nodes with a medium drift score can be further verified using the targeted deletion strategy to achieve a combination of efficient screening and fine analysis.

[0184] Illustratively, for an abnormal node v_i, its original degree is 25, and it is connected to 25 neighbor edges. Set the disturbance number K = 12 and the deletion probability p = 0.4. For each disturbance k ∈ {1,...,12}, 10 edges are independently and randomly deleted (the expected value is 25 x 0.4), and 15 edges are retained, generating 12 structurally different disturbance subgraphs. Each disturbance operation only modifies the adjacency matrix, and the node features remain unchanged. This process is performed in parallel for all 520 abnormal nodes, generating a total of 520 x 12 = 6240 disturbance subgraphs, which form a structural disturbance dataset. This large-scale disturbance set provides an adequate sample basis for subsequent statistical drift analysis.

[0185] Step S63, inputting a plurality of disturbance subgraphs into the target graph neural network to obtain a disturbance node vector of the disturbance subgraph.

[0186] It should be noted that the disturbance node vector refers to the embedding representation of the abnormal node recalculated by the target graph neural network in each disturbance subgraph. The disturbance node vector reflects the change in the representation of the abnormal node after the local structure changes, and is a key input for calculating the drift score.

[0187] It can be understood that this step can obtain the representation variants of the abnormal node under different structural disturbances by recalculating the node representation by inputting multiple disturbance subgraphs into the target graph neural network, thereby quantifying the sensitivity of the node representation to structural changes.

[0188] Specifically, each perturbed subgraph is input into the target graph neural network respectively, the model parameters remain unchanged, and the output vector of the abnormal node in each perturbed subgraph is extracted. The perturbed subgraph input can adopt an independent forward mode, each subgraph is encoded through the target graph network alone, which is simple but cannot utilize batch acceleration; or a batch forward mode can be adopted, nodes and edges of several perturbed subgraphs are merged into a large graph, and the message passing is ensured not to cross the subgraph boundary through a subgraph ID mask or batch index mechanism, all perturbation vectors can be obtained through a single forward, which significantly improves the calculation efficiency.

[0189] Exemplarily, for the 6240 perturbed subgraphs generated in the foregoing step, the batch forward mode is adopted to obtain the perturbed node vector. 12 perturbed subgraphs for the same abnormal node are merged into a batch graph, and the neighbor aggregation operation of different subgraphs is isolated in the message passing, so as to ensure that the representation calculation of each subgraph is independent of each other. The batch graph is input into the target graph neural network, and a 64-dimensional perturbed node vector sequence of the abnormal node under 12 structural perturbations is obtained through a single forward propagation. The process is repeated for 520 abnormal nodes, and a total of 520 batch forward propagations are performed. Compared with 6240 propagations in the independent forward mode, the calculation efficiency is improved by about 12 times, while the mathematical equivalence of the calculation result is maintained.

[0190] In step S64, the Euclidean distances of the abnormal node vector and the perturbed node vectors are calculated respectively, and a plurality of single drift scores are obtained.

[0191] It should be noted that the single drift score refers to the quantitative value of the vector change of the abnormal node before and after a single structural perturbation, which is calculated by the Euclidean distance. The single drift score directly measures the sensitivity of the node representation to a specific structural perturbation, and is a basic unit for calculating the target drift score.

[0192] It can be understood that this step can quantify the reaction intensity of the abnormal node to each structural perturbation by calculating the vector change distance under each perturbation.

[0193] Specifically, the Euclidean distance calculation formula is:

[0194]

[0195] wherein, the Euclidean distance of the abnormal node is represented by d, the abnormal node vector before the perturbation of the abnormal node is represented by x, and the perturbed node vector after the perturbation of the abnormal node is represented by x'. Calculating the single drift score under all perturbations can comprehensively capture the change of the node representation.

[0196] Step S65, calculate the mean value of several single drift scores to obtain the target drift score of the abnormal node.

[0197] It should be noted that the target drift score refers to the average change degree of the abnormal node under multiple structural disturbances, which is obtained by calculating the arithmetic mean of all single drift scores. The target drift score comprehensively reflects the overall stability of the node representation to structural disturbance, and is a key feature to distinguish trigger nodes from ordinary poisoned nodes.

[0198] Specifically, the mean value calculation can use arithmetic mean, sum all single drift scores with equal weight to reflect the overall expectation; can use weighted average, give higher weight to observation values close to the central region and lower weight to outliers that deviate significantly, to enhance the anti-interference ability to abnormal disturbance; can also use median or truncated mean, directly remove the highest and lowest scores before averaging, to be extremely robust to outliers. K value can be set as a fixed value such as 15, or an adaptive stopping strategy can be used to terminate early when the standard deviation of the single scores calculated continuously is less than a threshold, saving calculation under the premise of ensuring statistical significance. Different implementations differ in robustness and calculation cost, arithmetic mean is simple and efficient but affected by outliers, weighted average suppresses noise but requires a weight function to be designed, median is extremely robust but complex to calculate and loses some information. When combined, arithmetic mean can be used first to quickly obtain the preliminary score, and then weighted average or median can be used to review the boundary nodes whose drift scores are near the valley of the distribution, to achieve a balance between efficient screening and reliable decision-making.

[0199] wherein the calculation formula of the target drift score is:

[0200]

[0201] wherein, represents the abnormal node the target drift score after K disturbances; K represents the number of disturbances of the abnormal node . represents the abnormal node the single drift score obtained after the kth edge deletion disturbance.

[0202] Exemplarily, assuming that the obtained 12 single drift scores are [0.148, 0.134, 0.179, 0.141, 0.110, 0.130, 0.161, 0.118, 0.152, 0.138, 0.158, 0.145], the arithmetic mean Drift_avg = (0.148+0.134+...+0.145) / 12 = 0.143 is calculated. The value is taken as the final target drift score of the abnormal node v_i, reflecting the average response degree of the abnormal node v_i to the structural disturbance.

[0203] The embodiment realizes the quantitative analysis of the structural stability of the abnormal node by the above scheme through the five steps of obtaining the reference representation, generating the structural disturbance, calculating the disturbance representation, quantifying the single change, and comprehensively evaluating the average, can reliably distinguish the ordinary poisoning node sensitive to the structural change and the trigger node with strong structural dependence, and provides a key feature index for the subsequent accurate classification based on the Gaussian mixture model.

[0204] Based on the above implementation scheme, in a feasible implementation, the step of generating a distinguishing threshold based on the target drift score and screening the trigger node in the graph data from the abnormal nodes according to the distinguishing threshold includes S71-S72.

[0205] In step S71, a Gaussian mixture model is used to perform distribution fitting based on the target drift score to determine the distinguishing threshold of the abnormal node.

[0206] It should be noted that the GMM (Gaussian Mixture Model) is a probability generation model, which assumes that the observation data is linearly mixed by multiple Gaussian distributions, and each Gaussian component has independent mean, covariance matrix and mixing coefficient parameters.

[0207] In addition, it should be noted that the distinguishing threshold is an optimal decision boundary value for dividing the abnormal node into a trigger node and a poisoning node, which is usually calculated by finding the intersection of the probability density functions of two Gaussian components or the minimum error rate criterion based on the Bayesian decision theory.

[0208] It can be understood that the principle of fitting the distribution of the target drift score by the Gaussian mixture model and determining the discrimination threshold lies in that the empirical distribution of the drift score usually presents a clear bimodal shape, which meets the statistical hypothesis of mixing of two different latent categories. The Gaussian mixture model can effectively capture this distribution heterogeneity and automatically learn the parameters of the two Gaussian components, thereby revealing the category structure hidden behind the data. The substantial effect of this step is to map discrete drift score observations to continuous probability density functions, automatically determine the optimal classification boundary through statistical modeling, and fundamentally avoid the subjectivity, experience and data dependence of manually setting the threshold.

[0209] Specifically, the Gaussian mixture model sets two Gaussian components, respectively corresponding to the trigger node (low drift score) and the normal poisoning node (high drift score); the expectation maximization algorithm is used to iteratively optimize the mean, variance and weight parameters; the discrimination threshold can be determined by calculating the intersection equation of the two Gaussian distributions or based on the maximum probability principle. Setting two components can accurately match the actual distribution characteristics; the expectation maximization algorithm can ensure the statistical consistency of parameter estimation; different threshold determination methods can adapt to different detection needs.

[0210] More specifically, the distribution fitting can use a standard Gaussian mixture model, assuming that the two components have different means and variances, and the covariance matrix can use a full matrix or only a diagonal matrix to balance the model expressiveness and computational complexity; a Bayesian Gaussian mixture model can also be used, which introduces Dirichlet prior distribution to constrain the mixing coefficients to prevent component weight collapse and introduces Wishart prior distribution to constrain the covariance matrix to prevent overfitting, thereby enhancing robustness in small sample situations; a hierarchical Gaussian mixture model can also be used, which further fits sub-components under each principal component to handle possible multi-peak sub-structures or heterogeneous sub-groups. The threshold determination can take the analytical intersection of the two Gaussian probability density functions as the hard classification boundary, or use Bayesian decision theory to calculate the optimal decision surface that minimizes the total classification error rate (the sum of false positive rate and false negative rate), or set a soft threshold, label the nodes in the intermediate fuzzy area (such as 0.3-0.7) as "uncertain" and trigger manual review or secondary analysis.

[0211] Step S72, determining a trigger node in the graph data based on the target drift score and the discrimination threshold.

[0212] It should be noted that the trigger node refers to a special node in the graph data that is injected with a malicious trigger structure and is used to activate a backdoor attack, which is characterized by strong structural dependence and high stability under structural disturbance, i.e., a low target drift score. Accurate identification of the trigger node is crucial for graph backdoor attack defense, which can effectively block the attacker's poisoning path.

[0213] Understandably, this step, by comparing the target drift score with the discrimination threshold, can systematically filter out trigger nodes with high stability, solve the problem that traditional methods have difficulty detecting hidden triggers, and improve the security of graph learning systems.

[0214] Specifically, the target drift score is compared with the discrimination threshold. Abnormal nodes with a target drift score greater than the discrimination threshold are identified as trigger nodes in the graph data, while abnormal nodes with a target drift score less than or equal to the discrimination threshold are identified as ordinary poisoned nodes in the graph data.

[0215] Furthermore, abnormal nodes The formula for calculating the probability density is:

[0216]

[0217] in, Abnormal node Corresponding target drift score The probability on two Gaussian distributions; Represents the target drift score Gaussian distribution The corresponding probability; Represents the target drift score Gaussian distribution The corresponding probability; This represents the Gaussian distribution corresponding to the trigger node; This represents the Gaussian distribution corresponding to the toxic nodes.

[0218] This embodiment solves the technical problem that traditional anomaly detection methods have difficulty in identifying distributed triggers by fitting the probability distribution of a Gaussian mixture model to the above scheme. It can effectively distinguish between anomaly node types with different stability, providing a reliable technical means for the defense against graph backdoor attacks and significantly improving the security of graph neural networks in practical applications.

[0219] Furthermore, after identifying trigger nodes and poisoned nodes, different backdoor defense strategies can be selected based on the actual environment or needs. In one embodiment of this application, a data-level backdoor defense is adopted, where the defender focuses on cleaning the graph data to block the poisoning path of graph backdoor attacks. The specific steps are as follows: First, trigger nodes are identified in the graph data to obtain a set T of trigger nodes marked as trigger nodes. Then, for each trigger node... Trim the edges associated with it, that is, delete all edges related to it. The connected edges, and the cleaned graph data are as follows:

[0220]

[0221] wherein, is the cleaned graph data; represents the original graph ; represents the cleaned edge set, which is specifically defined as:

[0222]

[0223] wherein, represents the trigger node in the original graph . This is intended to destroy the structural association of the trigger node. Since the trigger mechanism of the graph backdoor attack relies on a specific topology, after removing these key connections, the poisoning path of the activated backdoor is effectively blocked.

[0224] Finally, the graph neural network model is retrained using the cleaned graph data . Since the trigger node has been isolated, the model no longer learns malicious patterns related to the trigger, thereby significantly reducing the success rate of the backdoor attack.

[0225] In another embodiment of the present application, model-level backdoor defense is adopted. Focus on fine-tuning the existing model to correct the model's wrong prediction of the poisoned node. The specific steps are as follows: First, identify the poisoned node of the graph data, detect the graph data, and obtain the poisoned node set H marked as the poisoned node; then based on the identified poisoned node set , fine-tune the training model to reduce the prediction probability of the poisoned node in the model output layer for the target label. Through the above fine-tuning process, the model will gradually "forget" the poisoning path of associating the poisoned node to the target label, thereby effectively defending against backdoor attacks.

[0226] Exemplarily, in order to help understand the implementation process of the trigger node detection method obtained by combining the above embodiment one with the present embodiment, please refer to Figure 3 , Figure 3 a brief flowchart of a trigger node detection method is provided, specifically:

[0227] Firstly, the system starts from the poisoning graph dataset and enters the coarse screening stage. The graph representation learning module inputs the poisoning graph dataset into the graph neural network to learn the high-dimensional embedding representation of the nodes, thereby enhancing the distribution difference between the clean nodes and the abnormal nodes. Subsequently, the target clustering module (based on the HDBSCAN density clustering algorithm) uses the Euclidean distance of the node vectors to construct a distance matrix, identifies the abnormal nodes (including poisoning nodes and trigger nodes) in the low-density area, and completes the preliminary screening. Then, the system enters the fine screening stage. The drift analysis module performs multiple structural perturbations on the abnormal nodes, calculates their target drift scores to quantify the node stability, and finally, the Gaussian mixture model module fits the drift score distribution to automatically generate a distinguishing threshold, accurately identifies the hidden trigger nodes, and thus realizes hierarchical detection from coarse screening to fine screening, effectively solving the detection problem of the in-distribution trigger nodes.

[0228] It should be noted that the above examples are only used for understanding the present application and do not constitute a limitation on the detection method of the trigger nodes of the present application. More forms of simple transformation based on this technical concept are within the protection scope of the present application.

[0229] The present application also provides a trigger node detection device, which is described in detail in the following Figure 4 The trigger node detection device comprises:

[0230] The representation learning module 401 is configured to learn the node vectors of the graph data through a target graph neural network to obtain the target node vectors corresponding to the graph data.

[0231] The abnormality determination module 402 is configured to cluster and screen the target node vectors through a target clustering algorithm to determine the abnormal nodes in the graph data.

[0232] The perturbation drift module 403 is configured to perform structural perturbation on the abnormal nodes and calculate the target drift scores of the abnormal nodes after the structural perturbation.

[0233] The trigger distinguishing module 404 is configured to generate a distinguishing threshold based on the target drift scores and screen the trigger nodes in the graph data from the abnormal nodes according to the distinguishing threshold.

[0234] The trigger node detection device provided by the present application adopts the trigger node detection method in the above embodiments and can solve the technical problem that the trigger nodes in the graph structure are difficult to detect. Compared with the prior art, the trigger node detection device provided by the present application has the same beneficial effects as the trigger node detection method provided by the above embodiments, and the other technical features in the trigger node detection device are the same as the features disclosed in the above embodiments, which will not be repeated here.

[0235] This application provides a trigger node detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, which are executed by the at least one processor to enable the at least one processor to perform the trigger node detection method in the first embodiment described above.

[0236] The following is for reference. Figure 5 The diagram illustrates a structural schematic of a detection device suitable for implementing the trigger node in the embodiments of this application. The detection device for the trigger node in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The detection device for the trigger node shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0237] like Figure 5 As shown, the detection device of the trigger node may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in the read-only memory 1002 or a program loaded from the storage device 1003 into the random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the detection device of the trigger node. The processing unit 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the detection device of the trigger node to communicate wirelessly or wiredly with other devices to exchange data. Although the figures show detection devices for trigger nodes with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0238] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program codes for executing the method shown in the flowchart. In such embodiments, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a read-only memory 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiments disclosed in the present application are executed.

[0239] The trigger node detection device provided by the present application adopts the trigger node detection method in the above-mentioned embodiments, and can solve the technical problem that trigger nodes are difficult to detect in a graph structure. Compared with the prior art, the trigger node detection device provided by the present application has the same beneficial effects as the trigger node detection method provided by the above-mentioned embodiments, and other technical features in the trigger node detection device are the same as the features disclosed in the previous embodiment method, which will not be repeated here.

[0240] It should be understood that parts of the present application can be realized by hardware, software, firmware or a combination thereof. In the description of the above-mentioned embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0241] The above is merely specific implementation of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0242] The present application provides a computer readable storage medium having stored thereon computer readable program instructions (i.e. computer program) for executing the trigger node detection method in the above-mentioned embodiments.

[0243] The computer readable storage medium provided in the application may, for example, be a U disk, but is not limited to an electric, magnetic, optical, electromagnetic, infrared, or semiconductor system or device, or any combination thereof. More specific examples of the computer readable storage medium may include, but are not limited to, an electric connection with one or more conductive wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the embodiment, the computer readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer readable storage medium can be transmitted by any suitable medium, including but not limited to an electric wire, an optical cable, an RF (Radio Frequency), and the like, or any suitable combination thereof.

[0244] The computer readable storage medium described above may be contained in the detection device of the trigger node, or may exist separately without being assembled into the detection device of the trigger node.

[0245] The computer readable storage medium described above carries one or more programs, when the one or more programs are executed by the detection device of the trigger node, the detection device of the trigger node: learns node vectors of graph data through a target graph neural network to obtain target node vectors corresponding to the graph data; filters the target node vectors through a target clustering algorithm to determine abnormal nodes in the graph data; performs structural disturbance on the abnormal nodes, calculates target drift scores of the abnormal nodes after the structural disturbance; generates a discrimination threshold based on the target drift scores, and filters trigger nodes in the graph data from the abnormal nodes according to the discrimination threshold.

[0246] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0247] The flow diagrams and the block diagrams in the drawings are illustrations of architectures, functionalities, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flow diagrams or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may

[0248] The modules involved in the embodiments of the present application can be implemented in the form of software or in the form of hardware. In some cases, the name of the module does not constitute a limitation on the module itself.

[0249] The readable storage medium provided by the present application is a computer readable storage medium, which stores computer readable program instructions (i.e., computer programs) for executing the detection method of the trigger node, and can solve the technical problem that the trigger node is difficult to detect in a graph structure. Compared with the prior art, the computer readable storage medium provided by the present application has the same beneficial effects as the detection method of the trigger node provided by the above-mentioned embodiments, which will not be described here.

[0250] The application further provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the trigger node detection method as described above.

[0251] The computer program product provided by the application can solve the technical problem of difficulty in detecting trigger nodes in a graph structure. Compared with the prior art, the beneficial effects of the computer program product provided by the application are the same as those of the trigger node detection method provided by the above-described embodiments, and are not described here.

[0252] The above only describes some embodiments of the application, and does not limit the patent scope of the application. Any equivalent structural transformation made by using the content of the specification and drawings, or direct / indirect application in other related technical fields under the technical concept of the application is included in the patent protection scope of the application.

Claims

1. A method for detecting trigger nodes, characterized in that, The detection method for the trigger node includes: The target node vectors corresponding to the graph data are obtained by learning node vectors from the graph data through a target graph neural network. The target node vector is clustered and filtered using a target clustering algorithm to identify abnormal nodes in the graph data. The abnormal node is subjected to structural perturbation, and the target drift score of the abnormal node after structural perturbation is calculated. The calculation of the target drift score includes recalculating the abnormal node vector of the abnormal node based on the target graph neural network after each structural perturbation, calculating the change of the abnormal node vector before and after structural perturbation through Euclidean distance, and taking the average of multiple changes as the target drift score. A discrimination threshold is generated based on the target drift score, and trigger nodes in the graph data are filtered from the abnormal nodes according to the discrimination threshold; The step of learning node vectors from graph data using a target graph neural network to obtain the target node vectors corresponding to the graph data further includes the following before: The initial graph neural network is learned and optimized by a contrastive learning strategy. The training graph is input into the learned and optimized initial graph neural network to generate the first node vector. The first node vector is clustered using a target clustering algorithm to determine the first normal node and the first abnormal node in the training graph. Calculate the mean square error between the first normal node and the cluster center node of the first normal node to obtain the center loss of the first normal node; Calculate the cosine similarity between the first normal nodes to obtain the consistency loss between the first normal nodes; Calculate the similarity between the first normal node and the first abnormal node to obtain the separation loss of the first abnormal node; The comprehensive loss value of the first normal node is obtained by weighting the center loss, the consistency loss, and the segregation loss using a comprehensive loss function. The initial graph neural network after learning and optimization is updated based on the comprehensive loss value until the preset convergence condition is met, thereby obtaining the target graph neural network.

2. The method for detecting trigger nodes as described in claim 1, characterized in that, The step of learning and optimizing the initial graph neural network using a contrastive learning strategy includes: Positive and negative sample pairs are constructed based on the initial nodes in the training graph; The contrastive loss of the initial node is obtained by calculating the contrastive loss of the initial node, the positive sample pair, and the negative sample using a contrastive loss function. The network parameters of the initial graph neural network are optimized by the contrastive loss to obtain the optimized initial graph neural network.

3. The method for detecting trigger nodes as described in claim 1, characterized in that, The step of clustering and filtering the target node vectors using a target clustering algorithm to determine abnormal nodes in the graph data includes: Calculate the Euclidean distance between the target node vectors, and construct a distance matrix based on the Euclidean distance; Density clustering is performed based on the distance matrix to obtain the node density corresponding to the target node vector; The node density is compared with a preset density threshold. If the node density is less than the density threshold, the corresponding target node vector is identified as an abnormal node.

4. The method for detecting trigger nodes as described in claim 1, characterized in that, The step of performing structural perturbation on the abnormal node and calculating the target drift score of the abnormal node after structural perturbation includes: The abnormal node vector of the abnormal node is obtained through the target graph neural network; Delete several neighbor edges of the abnormal node to generate several corresponding perturbation subgraphs; The perturbation subgraphs are input into the target graph neural network to obtain the perturbation node vectors of the perturbation subgraphs; Calculate the Euclidean distances between the abnormal node vector and several disturbed node vectors respectively to obtain several single drift scores; The average of several single drift scores is calculated to obtain the target drift score of the abnormal node.

5. The method for detecting trigger nodes as described in claim 1, characterized in that, The step of generating a discrimination threshold based on the target drift score, and filtering trigger nodes from the graph data from the abnormal nodes according to the discrimination threshold, includes: The discrimination threshold of the abnormal node is determined by fitting the distribution based on the target drift score using a Gaussian mixture model. Based on the target drift score and the discrimination threshold, the trigger nodes in the graph data are determined.

6. A detection device for a trigger node, characterized in that, The detection device for the trigger node includes: The representation learning module is used to learn node vectors from graph data through a target graph neural network to obtain the target node vectors corresponding to the graph data. An anomaly determination module is used to cluster and filter the target node vector using a target clustering algorithm to determine abnormal nodes in the graph data; The perturbation and drift module is used to perform structural perturbation on the abnormal node and calculate the target drift score of the abnormal node after the structural perturbation. The calculation of the target drift score includes recalculating the abnormal node vector of the abnormal node based on the target graph neural network after each structural perturbation, calculating the change of the abnormal node vector before and after the structural perturbation through Euclidean distance, and taking the average of multiple changes as the target drift score. The trigger differentiation module is used to generate a differentiation threshold based on the target drift score, and to filter trigger nodes in the graph data from the abnormal nodes according to the differentiation threshold. The trigger node detection device further includes a network determination module, used to: learn and optimize the initial graph neural network through a contrastive learning strategy, input the training graph into the learned and optimized initial graph neural network, and generate a first node vector; The first node vector is clustered using a target clustering algorithm to determine the first normal node and the first abnormal node in the training graph. Calculate the mean square error between the first normal node and the cluster center node of the first normal node to obtain the center loss of the first normal node; Calculate the cosine similarity between the first normal nodes to obtain the consistency loss between the first normal nodes; Calculate the similarity between the first normal node and the first abnormal node to obtain the separation loss of the first abnormal node; The comprehensive loss value of the first normal node is obtained by weighting the center loss, the consistency loss, and the segregation loss using a comprehensive loss function. The initial graph neural network after learning and optimization is updated based on the comprehensive loss value until the preset convergence condition is met, thereby obtaining the target graph neural network.

7. A detection device for trigger nodes, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the method for detecting a trigger node as described in any one of claims 1 to 5.

8. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the trigger node detection method as described in any one of claims 1 to 5.

Images