Network outlier detection method based on hyperbolic space

Abstract

This invention provides a network outlier detection method based on hyperbolic space. This method uses a hyperbolic graph neural network to learn node representations of an attribute network. A generative adversarial network is then trained to detect outliers in the input network embedding. The method primarily involves: constructing an attribute network; estimating the hyperbolic geometric curvature parameters of the input attribute network; mapping the input attribute network into a low-dimensional vector representation in hyperbolic space as the output of the hyperbolic graph neural network via a hyperbolic graph neural network; training the entire neural network using backpropagation, and ultimately implementing outlier identification using a discriminator module. This method uses a hyperbolic graph neural network to aggregate and extend the node features of a graph neural network into hyperbolic space, effectively integrating node features and hierarchical structure to obtain a high-level node representation of the graph. This method utilizes the rich hierarchical information in hyperbolic space for outlier detection. This method significantly improves detection accuracy and shortens anomaly detection time.

Description

Technical Field

[0001] The present invention belongs to the field of network analysis, and in particular relates to a network anomaly detection method. Background Art

[0002] An attribute network is a network structure where nodes or edges have one or more attributes and labels. For example, in a social network, users may have different ages, interests, places of residence, work backgrounds, educational backgrounds, etc., and edge relationships may have different time, types, frequencies, etc.

[0003] Before the new progress of deep learning, traditional non-deep learning techniques have been widely used in many real networks to identify abnormal individuals [1]. A key idea of ​​these methods is to transform graph anomaly detection into a traditional anomaly detection problem. Because network data with rich structural information cannot be directly processed by traditional detection techniques, many works have tried to use node-related statistical features, such as in-degree and out-degree, to detect abnormal nodes [1].

[0004] In order to obtain more valuable information from the network structure for anomaly detection, network representation techniques have been widely used. These techniques encode the structure of the network into an embedded vector space and identify abnormal nodes through further analysis. So far, many network representation methods, such as Deepwalk, Node2Vec, and LINE, have shown their effectiveness in generating node representations and have been used in anomaly detection tasks [3].

[0005] In addition to structural information, real-world networks also contain rich attribute information associated with nodes. These attributes, together with the network structure, provide information about real objects, so more anomalies can now be detected. Graph Convolutional Neural Networks (GCNs) [4] have achieved good success in many graph data mining tasks (such as link prediction, node classification, and anomaly detection) because they can capture comprehensive information from graph structure and node attributes.

[0006] The existing technology has the following problems: Existing anomaly detection techniques based on network representation typically embed the network in Euclidean space. However, many types of complex data exhibit highly non-Euclidean characteristics[5]. In this case, Euclidean space does not provide the most powerful or meaningful geometric representation. Moreover, classifiers in Euclidean space cannot accurately identify outliers because they cannot use the hierarchical structure of the data[6].

[0007] [References]

[0008] [1]G.Pang,C.Shen,L.Cao,and A.V.D.Hengel,“Deep learning for anomalydetection,”ACM Comput.Surv.,vol.54,no.2,p.1–38,2021.

[0009] [2]Chalapathy R,Chawla S.Deep Learning for Anomaly Detection:A Survey[J].CoRR,2019,abs / 1901.03407.

[0010] [3]Akoglu L,McGlohon M,Faloutsos C.oddball:Spotting Anomalies inWeighted Graphs[C].In Advances in Knowledge Discovery and Data Mining,14thPacific-Asia Conference,PAKDD 2010,Hyderabad,India,June 21-24,2010.Proceed-ings.Part II,2010:410–421.

[0011] [4]Wu F,Jr AH S,Zhang T,et al.Simplifying Graph ConvolutionalNetworks[C].In Proceedings of the 36th International Conference on MachineLearning,ICML 2019,9-15June 2019,Long Beach,California,USA,2019:6861–6871.

[0012] [5]Gromov M.Hyperbolic groups,Essays in group theory[J].MathematicalSciences Research Institute Publications,1987,8.

[0013] [6]Liu Q,Nickel M,Kiela D.Hyperbolic Graph Neural Networks[J].CoRR,2019,abs / 1910.12892 Summary of the Invention

[0014] In response to the above-mentioned prior art, a network anomaly detection method based on hyperbolic space is provided to solve the problem that the current network anomaly detection method cannot use the hierarchical structure information of the data and has low accuracy. The method of the present invention mainly uses a hyperbolic graph neural network to learn the node representation of the attribute network; trains a generative adversarial network to detect abnormal nodes in the input network embedding. In the generative adversarial network, the purpose of the generator G is to generate potential abnormal node representations, and the discriminator D attempts to learn a decision boundary to separate potential abnormal data from normal data; and uses the trained generative adversarial network to detect anomalies in the input network embedding. The present invention is an inductive method and has a strong anomaly detection capability for newly added nodes. The specific steps are as follows:

[0015] Step 1: Construct an attribute network: The attribute network is a static unweighted undirected graph. The nodes in the attribute network have attribute features in the form of vectors. The attribute network is defined as follows:

[0016] G s =(V s , E s , H s ) (1)

[0017] In formula (1), V s is the node set, E s is the set of edges, H s is a set of node attributes, H(v) represents the attribute vector of node v;

[0018] Step 2: Estimate the hyperbolic geometric curvature parameter δ of the input attribute network. The hyperbolic geometric curvature parameter δ is defined as taking four points x, y, u, v∈Vs, if:

[0019]

[0020] In formula (2), is the shortest path distance between two points x and y, then:

[0021]

[0022] Define three intermediate variables, denoted as S1, S2 and S3:

[0023]

[0024]

[0025]

[0026] Sort S1, S2, and S3, and take 1 / 2 of the absolute value of the difference between the two largest values ​​as the local hyperbolic geometric curvature parameter. Sampling the entire attribute network 1000 to 10000 times, and taking the maximum value of the local hyperbolic geometric curvature parameter as the hyperbolic geometric curvature parameter δ;

[0027] Step 3: Based on the hyperbolic geometric curvature parameter δ estimated in step 2, the input attribute network is mapped into a low-dimensional vector representation in the hyperbolic space as the output of the hyperbolic graph neural network (HGNN), including:

[0028] 3-1) transforming the node attribute vectors of the attribute network existing in the Euclidean space into the hyperbolic space through exponential mapping;

[0029] 3-2) extracting features from the hyperbolic space attribute vector obtained in step 3-1) through hyperbolic transformation;

[0030] 3-3) performing a hyperbolic neighborhood aggregation operation on the features of the hyperbolic space attribute vector obtained in step 3-2) and the topological structure of the input attribute network;

[0031] 3-4) The result of the aggregation operation in step 3-3) is used as the hyperbolic space attribute vector of the attribute network, and the hyperbolic neighborhood aggregation operation is repeated according to steps 3-2) and 3-3). The final aggregation operation is the low-dimensional representation of the network in the hyperbolic space;

[0032] Step 4: training the autoencoder using the hyperbolic graph neural network as the encoder part of the autoencoder to update the parameters of the hyperbolic graph neural network;

[0033] Step 5: Based on the hyperbolic geometric curvature parameter δ estimated in step 2, the input attribute network is mapped into a low-dimensional vector representation in the hyperbolic space by the hyperbolic graph neural network (HGNN) trained in step 4, which is used as the output of the trained hyperbolic graph neural network;

[0034] Step 6: Use the low-dimensional representation of the network in the hyperbolic space obtained in step 5 to train a generative adversarial network.

[0035] In step 7, the low-dimensional vector representation in the hyperbolic space obtained in step 5 is input into the discriminator D of the generative adversarial network trained in step 6. The anomaly scores of all nodes are calculated based on the output of the discriminator D, and the abnormal nodes in the network are detected accordingly.

[0036] Furthermore, the network outlier detection method based on hyperbolic space described in the present invention includes:

[0037] In step 3-1), the node attribute vector of the attribute network in the Euclidean space is Mapped into the node attribute vector of the attribute network in the hyperbolic space The process is: first, add a one-dimensional zero element to the first dimension of the original node attribute vector to satisfy the following constraints in the tangent space:

[0038]

[0039] Then, the input node attribute vector is transformed into the hyperbolic space through the exponential mapping: And define the input node attribute vector h k，E Exists at the origin of hyperbolic space In the tangent space of

[0040] The specific process of step 3-2) is: first, the node attribute vector in the hyperbolic space is mapped to the corresponding hyperbolic tangent space through log transformation, the formula is: Then, the neural network linear layer mapping M is completed in the tangent space: Finally, the transformed features are mapped back to the hyperbolic space through exponential mapping; the above process is expressed as:

[0041]

[0042] In formula (5), In hyperbolic space, the matrix The size of is (m+1)×(n+1) to satisfy the constraints of the conditions in the tangent space described in formula (4).

[0043] The specific process of step 3-3) is: according to the distance between the nodes of the input attribute network in the hyperbolic space, the attribute information of the neighbors of each node is aggregated to the central node to obtain new node feature information; for node feature The node's neighborhood node set is N(i), and for each node j in N(i), there is an aggregation weight W based on the hyperbolic distance. ij Corresponding to this node, the aggregation result is c d，β , obtained by the following formula:

[0044]

[0045] The square of the distance between two points in hyperbolic space is defined as:

[0046]

[0047] For a central node i and a neighbor node j, there is an aggregation weight W ij , using the self-attention mechanism to learn the aggregation weight Wij ; For two node features μ ij The attention coefficient representing the importance of node i to node j is expressed as:

[0048]

[0049] In formula (8), ATT(·) represents the function of calculating the attention coefficient. The similarity between nodes i and j is positively correlated with the attention coefficient. Based on the square of the hyperbolic space distance, ATT(·) is defined as

[0050]

[0051] For node i and all its neighbors N(i), the Softmax function is used for normalization to calculate the aggregate weight w ij :

[0052]

[0053] The specific process of step 4 is as follows: First, the attribute network G s =(V s , E s , H s ) as the input of the graph convolutional autoencoder, and use the encoder to learn the latent representation Z:

[0054] Z (l+1) =f(Z (l) ,E|W (l) ) (11)

[0055] In formula (11), Z (l) is the input of the convolution, Z (l+1) is the output after convolution; n nodes and m-dimensional feature vector; W (l) is the matrix of parameters learned in the neural network; the decoder is then used to reconstruct the attribute network G from the latent representation Z s ;Decoder reconstructs attribute network G s The graph structure E s , the decoder predicts the probability of connection between two adjacent nodes i, j Where Zi, Zj are the potential representations of nodes i, j, sigmoid is a nonlinear activation function,

[0056]

[0057]

[0058] The predicted probability Compared with the probability of the actual connection, a decoder is trained; the autoencoder is trained using a loss function to update the parameters of the hyperbolic graph neural network. The loss function is expressed as follows:

[0059]

[0060] The process of step 6 is as follows: a generative adversarial network is trained using the low-dimensional vector representation in the hyperbolic space obtained in step 5, wherein the generative adversarial network consists of a generator G and a discriminator D; noise sampled from the prior normal distribution pz is used as the input of the generator G to generate potential anomalies in information; the output of the generator G and the low-dimensional vector representation in the hyperbolic space are used as the input of the discriminator D, and the output of the discriminator D is the anomaly score of each input node.

[0061] In step 6, the generative adversarial network is trained by minimizing the overall loss:

[0062]

[0063] In formula (15), D represents the discriminator and G represents the generator. The training is performed alternately according to the following process. First, the parameters in the generator G are fixed, and the parameters θ in the discriminator D are updated according to formula (16): D :

[0064]

[0065] Then, fix the parameters in the discriminator D and update the parameters θ in the generator G according to formula (17) G :

[0066]

[0067] In step 7, the abnormality score of node i is calculated using formula (18) according to the output of the discriminator D.

[0068] scpre(x′ i )=1-D(z′ i ) (18)

[0069] Compared with the prior art, the present invention has the following beneficial effects:

[0070] The network anomaly detection method based on hyperbolic space described in the present invention uses a hyperbolic graph neural network (HGNN) to aggregate and extend the node features of the graph neural network into the hyperbolic space, and performs node embedding through the hyperbolic graph neural network. It learns the node hierarchical structure information and global structure information that are difficult for traditional graph neural networks to obtain, effectively integrates the node features and hierarchical structure, obtains a high-level node representation of the graph, and uses the rich hierarchical information in the hyperbolic space for anomaly detection. A generative adversarial network in the hyperbolic space is used to distinguish between positive and negative samples to complete the anomaly detection task. In the present invention, the nodes in the network are embedded in the hyperbolic space, retaining the hierarchical structure information of the network, so that two points that are far apart in the topological network are still far apart in the embedded space, thereby solving the embedding distortion problem in the Euclidean space. The present invention significantly improves the detection accuracy and shortens the anomaly detection time. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 is a block diagram of a network outlier detection method based on hyperbolic space according to the present invention;

[0072] Figure 2 It is a flowchart of training a generative adversarial network in the method of the present invention. DETAILED DESCRIPTION

[0073] The design idea of ​​the network outlier detection method based on hyperbolic space proposed in the present invention is to learn the node representation of the attribute network through a hyperbolic graph neural network; train a generative adversarial network to detect abnormal nodes in the input network embedding. In the generative adversarial network, the generator G is used to generate potential abnormal node representations, and the discriminator D is used to separate potential abnormal data from normal data.

[0074] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, but the following embodiments are by no means intended to limit the present invention in any way.

[0075] Step 1: Construct an attribute network: The attribute network is a static unweighted undirected graph. The Cora dataset used in this example is an unweighted undirected graph. Figure 1 As shown in the input network in , the nodes in the attribute network have attribute features in the form of vectors. The attribute network is defined as follows:

[0076] G s =(V s , E s , H s ) (1)

[0077] In formula (1), V s is the node set, E s is the set of edges, H sis a set of node attributes, and H(v) represents the attribute vector of node v.

[0078] Step 2: Estimate the hyperbolic curvature parameter δ of the input attribute network: The hyperbolic curvature parameter δ, namely Gromov δ-hyperbolicity, is defined as follows: Take four points x, y, u, v∈Vs, if:

[0079]

[0080] Among them, the definition is the shortest path distance between two points x and y, then:

[0081]

[0082] Define three intermediate variables, denoted as S1, S2 and S3:

[0083]

[0084]

[0085]

[0086] Sort S1, S2, and S3, and take 1 / 2 of the absolute value of the difference between the two largest values ​​as the local hyperbolic geometric curvature parameter. Sampling the entire attribute network 1000 to 10000 times. In this example, sampling the entire network 5000 times, and taking the maximum value of the local hyperbolic geometric curvature parameter is the hyperbolic geometric curvature parameter δ.

[0087] In step 3, based on the hyperbolic geometric curvature parameter δ estimated in step 2, the input attribute network is mapped into a low-dimensional vector representation in the hyperbolic space through the Hyperbolic Graph Convolutional Neural Networks (HGNN), and used as the output of the HGNN. The specific steps are as follows:

[0088] 1) The node attribute vector originally existing in the Euclidean space is converted to the hyperbolic space through exponential mapping.

[0089] In this example, the input feature is the node attribute vector of the attribute network (The symbol means that the input vector is k-dimensional and exists in Euclidean space.) It needs to be mapped to a vector in hyperbolic space (The symbol means that the vector is k-dimensional and exists in a hyperbolic space with curvature β.) First, add a one-dimensional zero element to the first dimension of the original node attribute vector to satisfy the tangent space.

[0090]

[0091] The constraints of the conditions are then transformed into the hyperbolic space through the exponential mapping:

[0092]

[0093] And define the input node attribute vector h k，E Exists at the origin of hyperbolic space In the tangent space of

[0094] 2) For the hyperbolic space attribute vector obtained in step 1), extract its features through hyperbolic transformation.

[0095] The hyperbolic transformation process in this example is as follows: first, the node attribute vector in the hyperbolic space is mapped to the corresponding hyperbolic tangent space through log transformation, based on the formula:

[0096]

[0097] Then complete the neural network linear layer mapping M in the tangent space: After that, the transformed features are mapped back to the hyperbolic space through the exponential mapping. The whole process can be described as:

[0098]

[0099] In formula (5), In hyperbolic space, the matrix The size of is (m+1)×(n+1) to satisfy the constraints of the conditions in the tangent space described in formula (4).

[0100] 3) Based on the features of the hyperbolic space attribute vector obtained in step 2) and the topological structure of the input attribute network, a hyperbolic neighborhood aggregation operation is used to obtain the hyperbolic space embedding of the node.

[0101] The hyperbolic neighborhood aggregation process in this example is: based on the distance between the nodes of the input attribute network in the hyperbolic space, the attribute information of each point's neighbors is aggregated to the central node to obtain new node attribute information. Its neighborhood node set is N(i), and for each node j in N(i), there is an aggregation weight W based on hyperbolic distance ij Correspondingly, the result of the aggregation is c d，β , obtained by the following formula:

[0102]

[0103] The square of the distance between two points in hyperbolic space is defined as:

[0104]

[0105] For a central node i and a neighbor node j, there is an aggregation weight W ij , which represents the importance of the neighborhood to the central node. In this paper, a self-attention mechanism is proposed to learn the aggregation weight W ij For two node features μ ij The attention coefficient representing the importance of node i to node j can be expressed as:

[0106]

[0107] Among them, ATT(·) represents the function of calculating the attention coefficient. The similarity between nodes i and j is positively correlated with the attention coefficient. When the attention coefficient is larger, it means that the similarity between nodes i and j is higher. Based on the square of the hyperbolic space distance, ATT(·) is defined as

[0108]

[0109] For all neighbors N(i) of node i (including the node itself), they are normalized using the Softmax function to calculate the aggregate weight w ij :

[0110]

[0111] 4) The result of the aggregation operation in step 3) is used as the hyperbolic space attribute vector of the attribute network. The hyperbolic neighborhood aggregation operation is repeated according to steps 2) and 3). The final aggregation operation is the final low-dimensional representation of the network in the hyperbolic space.

[0112] Step 4: Using the hyperbolic graph neural network as the encoder part of the autoencoder to train the autoencoder to update the parameters of the hyperbolic graph neural network; the process is as follows:

[0113] First, the attribute network G s =(V s , E s , H s ) as the input of the graph convolutional autoencoder. The autoencoder part uses the encoder to learn the potential representation Z:

[0114] Z (l+1) =f(Z (l) ,E|W (l) ) (11)

[0115] In formula (11), Z (l)is the input of the convolution, Z (l+1) is the output after convolution; n nodes and m-dimensional feature vector; W (l) is the matrix of parameters learned in the neural network;

[0116] Then, the decoder is used to reconstruct the attribute network G from the latent representation Z s ;Decoder reconstructs attribute network G s The graph structure E s , the decoder predicts the probability of connection between two adjacent nodes i, j Where Zi, Zj are the potential representations of nodes i, j, sigmoid is a nonlinear activation function,

[0117]

[0118]

[0119] The predicted probability Compared with the probability of the actual connection, a decoder is trained; the autoencoder is trained using a loss function to update the parameters of the hyperbolic graph neural network. The loss function is expressed as follows:

[0120]

[0121] The autoencoder in the present invention is as follows Figure 1 The encoder, latent representation, and decoder are shown in Figure 2.

[0122] Step 5. Based on the hyperbolic geometric curvature parameter δ estimated in step 2, the input attribute network is mapped into a low-dimensional vector representation in the hyperbolic space through the hyperbolic graph neural network (HGNN) trained in step 4, which serves as the output of the trained hyperbolic graph neural network. The process of this step is basically the same as that of step 3, with the only difference being that the original hyperbolic graph neural network is replaced by the hyperbolic graph neural network trained in step 4.

[0123] Step 6: Use the low-dimensional representation of the network in the hyperbolic space obtained in step 5 to train a generative adversarial network; the generative adversarial network consists of a generator G and a discriminator D; the prior normal distribution p z The noise sampled in the image is used as the input of the generator G to generate potential anomalies in information; the output of the generator G and the low-dimensional vector representation in the hyperbolic space are used as the input of the discriminator D, and the output of the discriminator D is the anomaly score of each input node.

[0124] The generative adversarial network is trained by minimizing the overall loss:

[0125]

[0126] In formula (15), D represents the discriminator and G represents the generator. The two parts are trained alternately. First, the parameters in the generator G are fixed, and the parameters θ in the discriminator D are updated according to formula (16). D :

[0127]

[0128] Then, fix the parameters in the discriminator D and update the parameters θ in the generator G according to formula (17) G :

[0129]

[0130] The above-mentioned generative adversarial network is as follows Figure 1 As shown in the generator and discriminator in, the training steps are as follows Figure 2 shown.

[0131] Step 7: After the training phase, the low-dimensional vector representation in the hyperbolic space obtained in step 5 is input into the discriminator D of the generative adversarial network trained in step 6. Based on the output of the discriminator D and using formula (18), the abnormal scores of all nodes are calculated, and the abnormal nodes in the network are detected accordingly.

[0132] score(x′ i )=1-D(z′ i ) (18)

[0133] In addition, the present invention can process data outside the training set without retraining the model. In order to obtain the anomaly scores of these nodes, the parameters of the previously trained model can be retained and the new (sub) network G′=(A′, X′) can be directly input into it. The present invention will learn the embedding representation of each newly added node in a feedforward manner. Similarly, the anomaly score of node i can be calculated based on the output of the discriminator D, and the anomaly node can be detected accordingly. Figure 1 The discriminator and anomaly score in are shown in the table.

[0134] Although the present invention has been described above in conjunction with the accompanying drawings, the present invention is not limited to the above-mentioned specific embodiments. The above-mentioned specific embodiments are merely illustrative and not restrictive. Under the guidance of the present invention, ordinary technicians in this field can make many variations without departing from the purpose of the present invention, and these are all protected by the present invention.

Claims

1. A network outlier detection method based on hyperbolic space, characterized in that: A hyperbolic graph neural network is used to learn the node representation of the attribute network. A generative adversarial network is trained to detect abnormal nodes in the input network embedding. In the generative adversarial network, the generator G is used to generate potential abnormal node representations, and the discriminator D is used to separate potential abnormal data from normal data. The specific steps are as follows: Step 1: Build an attribute network The attribute network is a static unweighted undirected graph. The nodes in the attribute network have attribute features in the form of vectors. The attribute network is defined as follows: G s =(V s ,E s ,H s ) (1) In formula (1), V s is the node set, E s is the set of edges, H s is a collection of node attributes; Step 2: Estimate the hyperbolic curvature parameter δ of the input attribute network The hyperbolic geometric curvature parameter δ is defined as taking four points x, y, u, v∈Vs, if: In formula (2), is the shortest path distance between two points x and y, then: Define three intermediate variables, denoted as S1, S2 and S3: Sort S1, S2, and S3, and take 1 / 2 of the absolute value of the difference between the two largest values ​​as the local hyperbolic geometric curvature parameter. Sampling the entire attribute network 1000 to 10000 times, and taking the maximum value of the local hyperbolic geometric curvature parameter as the hyperbolic geometric curvature parameter δ; Step 3: Based on the hyperbolic geometric curvature parameter δ estimated in step 2, the input attribute network is mapped into a low-dimensional vector representation in the hyperbolic space as the output of the hyperbolic graph neural network (HGNN), including: 3-1) transforming the node attribute vectors of the attribute network existing in the Euclidean space into the hyperbolic space through exponential mapping; 3-2) extracting features from the hyperbolic space attribute vector obtained in step 3-1) through hyperbolic transformation; 3-3) performing a hyperbolic neighborhood aggregation operation on the features of the hyperbolic space attribute vector obtained in step 3-2) and the topological structure of the input attribute network; 3-4) The result of the aggregation operation in step 3-3) is used as the hyperbolic space attribute vector of the attribute network, and the hyperbolic neighborhood aggregation operation is repeated according to steps 3-2) and 3-3). The final aggregation operation is the low-dimensional representation of the network in the hyperbolic space; Step 4: training the autoencoder using the hyperbolic graph neural network as the encoder part of the autoencoder to update the parameters of the hyperbolic graph neural network; Step 5: Based on the hyperbolic geometric curvature parameter δ estimated in step 2, the input attribute network is mapped into a low-dimensional vector representation in the hyperbolic space by the hyperbolic graph neural network (HGNN) trained in step 4, which is used as the output of the trained hyperbolic graph neural network; Step 6: Use the low-dimensional representation of the network in the hyperbolic space obtained in step 5 to train a generative adversarial network. In step 7, the low-dimensional vector representation in the hyperbolic space obtained in step 5 is input into the discriminator D of the generative adversarial network trained in step 6. The anomaly scores of all nodes are calculated based on the output of the discriminator D, and the abnormal nodes in the network are detected accordingly.

2. The method for detecting network outliers based on hyperbolic space according to claim 1, characterized in that: In step 3-1), the node attribute vector of the attribute network in the Euclidean space is Mapped into the node attribute vector of the attribute network in the hyperbolic space The process is: First, add a one-dimensional zero element to the first dimension of the original node attribute vector to satisfy the following constraints in the tangent space: Then, the input node attribute vector is transformed into the hyperbolic space through the exponential mapping: And define the input node attribute vector h k,E Exists at the origin of hyperbolic space In the tangent space of 3. The method for detecting network outliers based on hyperbolic space according to claim 2, characterized in that: The specific process of step 3-2) is: First, the node attribute vector in the hyperbolic space is mapped to the corresponding hyperbolic tangent space through log transformation. The formula is: Then, the linear layer mapping of the neural network is completed in the tangent space Finally, the transformed features are mapped back to the hyperbolic space through exponential mapping; the above process is expressed as: In formula (5), In hyperbolic space, the matrix The size of is (m+1)×(n+1) to satisfy the constraints of the conditions in the tangent space described in formula (4).

4. The method for detecting network outliers based on hyperbolic space according to claim 3, characterized in that: The specific process of step 3-3) is: According to the distance between the nodes of the input attribute network in the hyperbolic space, the attribute information of each node's neighbors is aggregated to the central node to obtain new node feature information; Node Features The node's neighborhood node set is N(i), and for each node j in N(i), there is an aggregation weight W based on the hyperbolic distance. ij Corresponding to this node, the aggregation result is c d,β , obtained by the following formula: The square of the distance between two points in hyperbolic space is defined as: For a central node i and a neighbor node j, there is an aggregation weight W ij , using the self-attention mechanism to learn the aggregation weight W ij ; For two node features μ ij The attention coefficient representing the importance of node i to node j is expressed as: In formula (8), ATT(·) represents the function of calculating the attention coefficient. The similarity between nodes i and j is positively correlated with the attention coefficient. Based on the square of the hyperbolic space distance, ATT(·) is defined as For node i and all its neighbors N(i), the Softmax function is used for normalization to calculate the aggregate weight w ij :

5. The method for detecting network outliers based on hyperbolic space according to claim 1, characterized in that: The specific process of step 4 is as follows: First, the attribute network G s =(V s ,E s ,H s ) as the input of the graph convolutional autoencoder, and use the encoder to learn the latent representation Z: WITH (l+1) =f(Z (l) ,E∣W (l) ) (11) In formula (11), Z (l) is the input of the convolution, Z (l+1) is the output after convolution; n nodes and m-dimensional feature vector; W (l) is the matrix of parameters learned in the neural network; Then, the decoder is used to reconstruct the attribute network G from the latent representation Z s ;Decoder reconstructs attribute network G s The graph structure E s , the decoder predicts the probability of connection between two adjacent nodes i, j Where Zi, Zj are the potential representations of nodes i, j, sigmoid is a nonlinear activation function, The predicted probability Compared with the probability of the actual connection, a decoder is trained; the autoencoder is trained using a loss function to update the parameters of the hyperbolic graph neural network. The loss function is expressed as follows:

6. The method for detecting network outliers based on hyperbolic space according to claim 1, characterized in that: The process for step 6 is as follows: Using the low-dimensional vector representation in the hyperbolic space obtained in step 5, a generative adversarial network is trained, wherein the generative adversarial network consists of a generator G and a discriminator D; From the prior normal distribution p z The noise sampled in is used as the input of the generator G to generate potential anomalies in information; The output of the generator G and the low-dimensional vector representation in the hyperbolic space are used as the input of the discriminator D, and the output of the discriminator D is the abnormality score of each input node.

7. The method for detecting network outliers based on hyperbolic space according to claim 6, characterized in that: In step 6, the generative adversarial network is trained by minimizing the overall loss: In formula (15), D represents the discriminator and G represents the generator, which are trained alternately according to the following process: First, fix the parameters in the generator G and update the parameters θ in the discriminator D according to formula (16) D : Then, fix the parameters in the discriminator D and update the parameters θ in the generator G according to formula (17) G :

8. The method for detecting network outliers based on hyperbolic space according to claim 7, characterized in that: In step 7, the abnormality score of node i is calculated using formula (18) according to the output of the discriminator D. score(x′ i )=1-D(z′ i ) (18)。

Images