A deep anomaly detection method for unlabeled table data and electronic equipment

Abstract

The application discloses a kind of deep anomaly detection method and electronic equipment for unlabeled table data, comprising the following steps: constructing the abnormal data sample of table, and the normal data sample of table is merged as training set with the abnormal data sample of construction;Table structure data is converted into graph structure data, and corresponding adjacency matrix is obtained;Adjacency matrix is used as training data to train deep graph autoencoder, and the trained deep graph autoencoder is obtained;The data sample of target table is detected using the trained deep graph autoencoder, and the deep anomaly detection of unlabeled table data is realized.The application has the advantages of high applicability, high recognition accuracy and full use of data information for different data sets.The application solves the problem that the adaptability of traditional anomaly detection method to different data sets is poor, reduces human error caused by manually setting threshold and other parameters in actual use, and reduces workload and overhead.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information technology, and in particular to a deep anomaly detection method for unlabeled table data and an electronic device. BACKGROUND

[0002] Anomaly detection is an important sub-branch of data mining. In the era of big data, the speed and efficiency of manual data processing far cannot catch up with machines. Finding a faster method to detect anomalies in data is an important research direction. Anomaly detection has important applications in many fields, including network security, complex system management, medical diagnosis, etc. Although anomaly detection has made great progress in the past few years, anomaly detection on multi-dimensional or high-dimensional data is still a challenging research task.

[0003] Anomaly detection technology research is attracting more and more attention. So far, there have been a large number of solutions. Typical strategies include establishing a cluster point model and learning parameters from positive sample training data; setting a discrimination rule for the cluster point to identify and remove outliers according to the rule; using the geometric distribution characteristics of outliers to separate samples, mainly KNN and LOF. The method of using geometric distribution characteristics for anomaly detection has the following problems:

[0004] 1. It does not make use of unlabeled data in the sample, and there are often a large number of unlabeled data in the actual industry. If only positive sample training data is used, it may cause overfitting problem of the model to the data;

[0005] 2. Lack of parameters that can be trained, need to set threshold value manually, which leads to dependence on human experience or skill in these modes, which may bring human error, and threshold value as a hyperparameter cannot adapt to different data sets, which needs to be adjusted for different data sets, increasing workload and cost;

[0006] 3. When dealing with high-dimensional data, all feature vectors of the data are treated equally, which is easy to cause errors and affect the accuracy of the algorithm. SUMMARY

[0007] In view of the above problems in the prior art, the present application provides a deep anomaly detection method for unlabeled table data and an electronic device, which solves the problem of low detection accuracy of the prior art.

[0008] In order to achieve the above application purpose, the technical scheme adopted by the present application is:

[0009] A deep anomaly detection method for unlabeled table data is provided, which comprises the following steps:

[0010] S1, construct an abnormal data sample of a table, and merge the constructed abnormal data sample with a normal data sample of the table into a training set;

[0011] S2, convert the table structure data into graph structure data by searching for Euclidean distances between data samples in each training set in a feature space, and obtain a corresponding adjacency matrix;

[0012] S3, train a deep graph autoencoder using the adjacency matrix as training data, and obtain a trained deep graph autoencoder;

[0013] S4, detect data samples of a target table using the trained deep graph autoencoder to realize deep anomaly detection of unlabeled table data.

[0014] Further, the specific method for constructing an abnormal data sample of a table in step S1 is as follows:

[0015] A small perturbation is applied to a feature subspace and a feature subspace is uniformly distributed to construct an abnormal data sample of a table.

[0016] Further, the specific method for applying a small perturbation to a feature subspace is as follows:

[0017] Obtain a normal data sample set X, and according to the formula:

[0018]

[0019] Normalize the sample x in the normal data sample set X to obtain the normalized sample x' and the normalized sample set X'; wherein x min is the minimum value in the normal data sample set X; x max is the maximum value in the normal data sample set X;

[0020] According to the formula:

[0021] X negative = X' + M·εZ

[0022] Perturb the normalized sample set X' to obtain an abnormal data sample set X negative ; wherein M is a d-dimensional vector composed of 0 and 1, when the element in M takes the value 0 in a certain dimension, it means that no perturbation is applied, and when the value is 1, it means that perturbation is applied; Z is Gaussian white noise with a probability density obeying a standard normal distribution; ε is a constant.

[0023] Further, the specific method of step S2 includes the following sub-steps:

[0024] S2-1, each data sample in the training set is regarded as a node on a graph, and the Euclidean distance between each node is searched;

[0025] S2-2, the k data samples closest to each node are taken as neighbors of the node;

[0026] S2-3, a graph structure data in the form of an adjacency matrix is established using the nodes and neighbors and the corresponding Euclidean distances; wherein the data samples are nodes in the graph structure data, and each node is connected to its k neighbors through k edges;

[0027] S2-4, according to the formula:

[0028]

[0029] The adjacency matrix E of the graph structure data is obtained; wherein e ij represents the edge feature corresponding to the node x i ; x j is a neighbor of the data sample x i ; N i is the neighbor set of the data sample x i ; dist(x i , x j ) represents the Euclidean distance between x i and x j .

[0030] Further, the specific method of step S3 is:

[0031] A deep graph autoencoder is constructed, a loss function is defined, and the Adam optimizer is used for optimization with the goal of minimizing the loss function, the learning rate of the Adam optimizer is set to 0.001, the weight decay is set to 0.1, the graph structure data is used as training data to train the deep graph autoencoder, and the trained deep graph autoencoder is obtained.

[0032] Further, the deep graph autoencoder in step S3 includes a message passing module, an aggregation module, an update module, an attribute decoder, and a label decoder, wherein:

[0033] The message passing module is used to pass the edge feature e ij as information from the source node x j to the node x i along the edge (j, x);

[0034] The aggregation module is used to generate an aggregation function with learning adaptability on the data set through a deep neural network, and the specific process is:

[0035] According to the formula:

[0036] e (i) = [e 1,i , e 2,i..., e j,i ..., e k,i ]

[0037] The neighbors of node x i are concatenated together to form a k-dimensional input vector e i ; e (i) is the information passed from the neighbors of node x j,i to node x i ; e j is the information passed from neighbor x i to node x ij ;

[0038] According to the formula:

[0039]

[0040] The low-dimensional embedding representation of node x i is obtained, which is denoted as h , where Θ represents the weight parameters of the deep neural network F; the output expression of the l-th layer neuron of the deep neural network F is: a l = σ (h l ) = σ (W l a l-1 + b l ), a l is the output of the l-th layer neuron, a l-1 is the output of the (l-1)-th layer neuron, a 1 = e (i) ; h l is the linear representation of the l-th layer neuron; σ (·) is the activation function of the l-th layer neuron; W l is the coefficient matrix from the (l-1)-th layer neuron to the l-th layer neuron; b l is the bias matrix of the l-th layer neuron;

[0041] An updating module is configured to update the representation of the current node with the output of the aggregation module, and the expression is:

[0042]

[0043] where H is the output of the updating module; is the low-dimensional embedding representation of node x N ; v is the dimension of the low-dimensional embedding representation; h Nv represents the v-th dimensional data in h ;

[0044] An attribute decoder is configured to reconstruct the adjacency matrix according to the output of the updating module, and the decoding expression is:

[0045]

[0046] wherein is the reconstructed adjacency matrix; T denotes the transpose of a matrix;

[0047] a label decoder for reconstructing the original node labels, whose decoding expression is:

[0048]

[0049] wherein is the label decoding result; W is a coefficient matrix; b is a bias matrix; σ * is an activation function.

[0050] Further, the expression of the loss function is:

[0051]

[0052] wherein Loss is the loss value of the depth map autoencoder, a is a weighting coefficient; ||·||2 is the matrix two-norm, denotes the attribute reconstruction error; BCELoss(·) is a binary cross-entropy calculation function, denotes the label reconstruction error calculated by the binary cross-entropy; l * is the true label vector.

[0053] Further, the specific method of step S4 includes the following sub-steps:

[0054] S4-1, using the same method as steps S1 and S2 to obtain the adjacency matrix E(m) corresponding to the data sample m of the target table;

[0055] S4-2, taking the adjacency matrix E(m) corresponding to the data sample m of the target table as the input of the trained depth map autoencoder, to obtain the reconstructed adjacency matrix and the label decoding result

[0056] S4-3, according to the formula:

[0057]

[0058] obtain the anomaly score Score of the data sample m of the target table m , complete the depth anomaly detection of the unlabeled table data; wherein β is a weighting coefficient; the higher the anomaly score Score m indicates the greater the probability of the abnormality of the data sample m of the target table.

[0059] An electronic device is provided, comprising:

[0060] a memory storing executable instructions; and

[0061] The processor is configured to execute the executable instructions in the memory to implement a deep anomaly detection method for label-free table data.

[0062] The beneficial effects of the present application are:

[0063] 1. The present application has high recognition accuracy. By converting table data into a network data model, the data anomalies in the table can be better identified.

[0064] 2. The method of applying a small perturbation to the feature subspace to generate anomalies can make it easier for the unsupervised deep learning model to determine the boundary between normal and abnormal. Uniformly distributing abnormal samples in the feature subspace can make the artificially generated anomalies diffuse in the feature space, making the method have better anomaly detection performance.

[0065] 3. The present application realizes anomaly detection and evaluation for label-free table data by artificially constructing abnormal data.

[0066] 4. The present application uses a deep graph autoencoder to calculate the anomaly score of the data sample by weighting the reconstruction of the two sets of decoders, improving the detection accuracy.

[0067] 5. The present application uses the Euclidean distance between data nodes as the input of the network, which has better generalization ability than directly inputting the feature vector of the data. BRIEF DESCRIPTION OF DRAWINGS

[0068] Figure 1 is a flowchart of the present method;

[0069] Figure 2 is a schematic diagram of the node embedding encoder used in the present application;

[0070] Figure 3 is a schematic diagram of the anomaly detection basic framework of the present application;

[0071] Figure 4 is a loss function curve graph of the training iteration of the deep graph autoencoder model of the present application on the data set SPEECH;

[0072] Figure 5 is a loss function curve graph of the training iteration of the deep graph autoencoder model of the present application on the data set ANNTHYROID;

[0073] Figure 6 is a loss function curve graph of the training iteration of the deep graph autoencoder model of the present application on the data set ARRHYTHMIA. DETAILED DESCRIPTION

[0074] The specific embodiments of the present application are described below to facilitate the understanding of the present application for those skilled in the art, but it should be clear that the present application is not limited to the scope of the specific embodiments, and for those skilled in the art, it is obvious that various changes are within the spirit and scope of the present application defined and determined by the appended claims, and all the inventions utilizing the concept of the present application are within the scope of protection.

[0075] As shown in the figure, the deep anomaly detection method for label-free table data comprises the following steps: Figure 1

[0076] S1, constructing abnormal data samples of the table, and merging the constructed abnormal data samples and normal data samples of the table into a training set;

[0077] S2, converting the table structure data into graph structure data by searching the Euclidean distance between data samples in each training set in the feature space, and obtaining the corresponding adjacency matrix;

[0078] S3, training the adjacency matrix as training data for the deep graph autoencoder to obtain the trained deep graph autoencoder;

[0079] S4, detecting the data samples of the target table by using the trained deep graph autoencoder to realize deep anomaly detection of label-free table data.

[0080] The specific method for constructing abnormal data samples of the table in step S1 is to construct abnormal data samples of the table by applying a small perturbation in the feature subspace and uniformly distributing the feature subspace.

[0081] The specific method for applying a small perturbation in the feature subspace is to obtain a normal data sample set X, and according to the formula:

[0082]

[0083] Normalizing the sample x in the normal data sample set X to obtain the normalized sample x' and the normalized sample set X'; wherein x min is the minimum value in the normal data sample set X; x max is the maximum value in the normal data sample set X;

[0084] According to the formula:

[0085] X negative = X' + M·εZ

[0086] Perturbing the normalized sample set X' to obtain an abnormal data sample set X negative ​; wherein M is a d-dimensional vector composed of 0 and 1, when the element in M takes the value of 0 in a certain dimension, it means that no disturbance is applied, and when it takes the value of 1, it means that disturbance is applied; Z is Gaussian white noise with probability density obeying standard normal distribution; ε is a constant, which can take the value of 0.1. The element in M can be generated with a probability of 0.3 to take the value of 1.

[0087] The specific method for constructing abnormal data samples of the table through uniform distribution of feature subspaces is as follows:

[0088] According to the formula:

[0089] X negative ~ μ(-ε, 1+ε)

[0090] Sampling from uniform distribution to generate abnormal data sample set X negative ; wherein μ(·) represents uniform distribution.

[0091] The specific method of step S2 includes the following sub-steps:

[0092] S2-1, regarding each data sample in the training set as a node on the graph, retrieve the Euclidean distance between the nodes;

[0093] S2-2, the k data samples closest to each node are regarded as the neighbors of the node;

[0094] S2-3, use the nodes and neighbors and the corresponding Euclidean distance to establish a graph structure data in the form of adjacency matrix; wherein the data sample is a node in the graph structure data, and each node is connected to its k neighbors through k edges;

[0095] S2-4, according to the formula:

[0096]

[0097] Obtain the adjacency matrix E of the graph structure data; wherein e ij represents the edge feature corresponding to the data sample x i as a node; x j is the neighbor of the data sample x i ; N i is the neighbor set of the data sample x i ; dist(x i ,x j ) represents the Euclidean distance between x i and x j .

[0098] The specific method of step S3 is as follows: construct a depth map autoencoder, define a loss function, optimize it using the Adam optimizer with the goal of minimizing the loss function, set the learning rate of the Adam optimizer to 0.001 and the weight decay to 0.1, use the graph structure data as training data to train the depth map autoencoder, and obtain the trained depth map autoencoder.

[0099] The depth map autoencoder in step S3 includes a message passing module, an aggregation module, an update module, an attribute decoder, and a label decoder, wherein:

[0100] The message passing module is used to pass edge features e ij As the source node x j Propagate along edge (j, x) to node x i Information;

[0101] The aggregation module is used to generate aggregation functions with learning and adaptability on the dataset through deep neural networks. The specific process is as follows:

[0102] According to the formula:

[0103] e (i) =[e 1,i ,e 2,i ,...,e j,i ,...,e k,i ]

[0104] Node x i The neighbor passes it to node x i The information is concatenated together to form a k-dimensional input vector e (i) ;e j,i For node x i Neighbor x j Passed to node x i Information, namely e ij ;

[0105] According to the formula:

[0106]

[0107] Get node x i Corresponding low-dimensional embedding representation Where Θ represents the weight parameters of the deep neural network F; the output expression of the l-th layer neuron of the deep neural network F is: a l =σ(h) l )=σ(W l a l-1 +b l ), a l a is the output of the l-th layer neuron. l-1 a is the output of the (l-1)th layer neuron.1 =e(i);h l Let be the linear representation of the neurons in the l-th layer; σ(·) is the activation function of the neurons in the l-th layer; W l b is the coefficient matrix from neurons in layer (l-1) to neurons in layer l; l Here is the bias matrix for the neurons in layer l; the encoder used for low-dimensional embedding is as follows: Figure 2 As shown;

[0108] The update module is used to update the representation of the current node with the output of the aggregation module. The expression is:

[0109]

[0110] Where H is the output of the update module; For node x N The corresponding low-dimensional embedding representation; v is the dimension of the low-dimensional embedding representation; h Nv express The v-th dimension of the data;

[0111] The attribute decoder is used to reconstruct the adjacency matrix based on the output of the update module. Its decoding expression is:

[0112]

[0113] in Let be the reconstructed adjacency matrix; (·) T Represents the transpose of a matrix;

[0114] The label decoder is used to reconstruct the original node labels, and its decoding expression is:

[0115]

[0116] in The result is the tag decoding result; W is the coefficient matrix; b is the bias matrix; σ * (·) is the activation function, and its expression is:

[0117] The expression for the loss function is:

[0118]

[0119] Where Loss is the loss value of the depth map autoencoder, α is the weighting coefficient; ||·||2 is the matrix L2 norm, This represents the attribute reconstruction error; BCELoss(·) is the function for calculating the cross-entropy of binary classification. This represents the label reconstruction error calculated using binary cross-entropy; * This is the actual label vector.

[0120] The deep neural network construction step in the aggregation operation is as follows:

[0121] Define the input space

[0122] Define the input space

[0123] Define the neural network model: neural network: Phi (x; w): x-> F;

[0124] Define the neural network model weight w = {W 1 ,..., W L}, L is the number of hidden layers, which can be 4 in the embodiment;

[0125] The number of nodes of the output layer is.

[0126] The specific method of step S4 includes the following sub-steps:

[0127] S4-1, the same method as steps S1 and S2 is used to obtain the adjacency matrix E(m) corresponding to the data sample m of the target table;

[0128] S4-2, the adjacency matrix E(m) corresponding to the data sample m of the target table is taken as the input of the trained deep graph autoencoder, and the reconstructed adjacency matrix and the label decoding result

[0129] S4-3, according to the formula:

[0130]

[0131] Obtain the anomaly score Score m of the data sample m of the target table, complete the deep anomaly detection of the unlabeled table data; wherein β is a weighting coefficient; the higher the anomaly score Score m , the greater the probability of the abnormality of the data sample m of the target table. The whole anomaly detection process (basic framework) is shown in Figure 3 .

[0132] The application also provides an electronic device, which comprises:

[0133] A memory storing executable instructions; and

[0134] A processor configured to execute the executable instructions in the memory to implement a deep anomaly detection method for unlabeled table data.

[0135] In an embodiment of the present application, the commonly used Outlier Detection DataSets (ODDS) website (stonybrook.edu) is used to collect the data sets, and the size, data dimension and abnormality proportion of each data set are shown in Table 1.

[0136] Table 1: Basic information of data sets

[0137]

[0138] The training data in these data sets are normalized by maximum and minimum, and the above two methods are used to generate abnormal data, and some abnormal data are randomly extracted and merged with the original abnormal data in the training set. The original thyroid disease (ANNTHYROID) data set from the UCI machine learning library is a classification data set, which has 3772 training instances and 3428 test instances, and after the above processing, part of the sample data is shown in Table 2.

[0139] Table 2: Part of sample data instances

[0140] realattr1 realattr2 realattr3 realattr4 realattr5 realattr6 label 0.73 0.0006 0.015 0.12 0.082 0.146 0 0.24 0.00025 0.03 0.143 0.133 0.108 0 0.47 0.0019 0.024 0.102 0.131 0.078 0 0.64 0.0009 0.017 0.077 0.09 0.085 0 0.23 0.00025 0.026 0.139 0.09 0.153 0 0.69 0.00025 0.016 0.086 0.07 0.123 0 0.85 0.00025 0.023 0.128 0.104 0.121 0 0.48 0.00208 0.02 0.086 0.078 0.11 0 0.67 0.0013 0.024 0.087 0.109 0.08 0 0.76 0.0001 0.029 0.124 0.128 0.097 0 0.62 0.011 0.008 0.073 0.074 0.098 1 0.18 0.0001 0.023 0.098 0.085 0.115 0 0.59 0.0008 0.023 0.094 0.099 0.09475 0 0.49 0.0006 0.023 0.113 0.102 0.111 0 0.53 0.0023 0.02 0.063 0.095 0.066 0 0.39 0.0001 0.018 0.09 0.071 0.126 0 0.39 0.0006 0.02 0.114 0.1 0.114 0 0.65 0.0016 0.018 0.078 0.092 0.085 0 0.64 0.032 0.014 0.085 0.116 0.071 0 0.5 0.061 0.0096 0.013 0.116 0.011 1 0.76 0.0001 0.0208 0.098 0.101 0.097 0

[0141] In Table 2, realattr represents attribute, and label represents label, that is, the first six columns are attributes for describing the degree of thyroid function decline of patients, and the last column is the label of abnormal data, 1 represents abnormal data, and 0 represents normal data. In this embodiment, for each data set used, the hyperparameter k is set to 2, 10, 50, 100, 150 and 200, and by setting different hyperparameters, the robustness of the method to different neighbor numbers is measured.

[0142] For the data set ANNT HYROID, the neural network built uses the tanh function as the activation function of the middle hidden layer, the number of hidden layer nodes in each layer is 256, and the sigmoid function is used as the activation function of the output layer, and the number of nodes of the output layer is v. The loss function curve of the deep graph autoencoder of the present application in the training iteration on different data sets in this embodiment is shown in Figure 4 、 Figure 5 and Figure 6

[0143] By constructing the test set (having normal data and abnormal data) and obtaining the abnormal score of each data sample in the test set, the false positive rate and the true positive rate are calculated. The false positive rate and the true positive rate are used to draw the ROC curve, and the area under the curve is calculated to obtain the AUC score, which can be used to measure the accuracy of the trained deep graph autoencoder for the real data set.​

[0144] For the three data sets selected in the embodiment, the two traditional anomaly detection algorithms KNN, LOF, an anomaly detection method combined with deep learning (LUNAR) and the anomaly detection method of the application (DGAE) are compared, and the AUC scores corresponding to different methods of each data set are obtained as shown in Tables 3, 4 and 5.

[0145] Table 3: AUC scores of different algorithms for data set SPEECH

[0146]

[0147] Table 4: AUC scores of different algorithms for data set ANNT HYROID

[0148]

[0149] Table 5: AUC scores of different algorithms for data set ARRH YTHMIA

[0150]

[0151] From the above tables, it can be found that for most of the selected three data sets, the accuracy of the anomaly detection method of the application is higher. For the data set ANNT HYROID, the accuracy is improved by about 6% compared with the traditional anomaly detection algorithm, and the accuracy is improved by about 2% compared with the new anomaly detection method combined with deep learning LUNAR, and the improvement is obvious.

[0152] In summary, the anomaly detection method based on deep graph autoencoder of the application has high recognition accuracy for different data sets, and can accurately identify data anomalies in the table. The application has the advantages of high applicability, high recognition accuracy and full use of data information for different data sets. The application solves the problem of poor adaptability of traditional anomaly detection methods to different data sets, reduces human errors caused by manually setting threshold parameters and the like in actual use, and reduces the workload and cost.

Claims

1. A deep anomaly detection method for unlabeled tabular data, characterized in that, The method comprises the following steps: S1, constructing an abnormal data sample of a table, and merging the constructed abnormal data sample and a normal data sample of the table into a training set; S2, converting the table structure data into graph structure data by searching for the Euclidean distance between data samples in each training set in a feature space, and obtaining a corresponding adjacency matrix; S3, training a deep graph autoencoder by taking the adjacency matrix as training data, to obtain a trained deep graph autoencoder; S4, detecting data samples of a target table by using the trained deep graph autoencoder, to realize deep anomaly detection of unlabeled table data; The specific method for constructing the abnormal data sample of the table in step S1 is: The abnormal data sample of the table is constructed by applying a slight perturbation in the feature subspace and uniformly distributing the feature subspace; The specific method for applying a slight perturbation in the feature subspace is: Obtain a normal data sample set X, and according to the formula: Normalizing a sample x in the normal data sample set X to obtain a normalized sample x' and a normalized sample set X'; wherein x min is a minimum value in the normal data sample set X; x max is a maximum value in the normal data sample set X. According to the formula: X negative = X' + M · εZ The normalized sample set X' is disturbed to obtain an abnormal data sample set X negative ; wherein M is a d-dimensional vector composed of 0 and 1, when the element in M takes the value 0 in a certain dimension, it means that no disturbance is applied, and when it takes the value 1, it means that disturbance is applied; Z is Gaussian white noise with a standard normal distribution probability density; and ε is a constant. 2.The deep anomaly detection method for label-free table data according to claim 1, wherein, The specific method of step S2 includes the following sub-steps: S2-1, regarding each data sample in the training set as a node on a graph, and searching for the Euclidean distance between each node; S2-2, taking the k data samples closest to each node as the neighbors of the node; S2-3, establishing graph structure data in the form of an adjacency matrix by using the nodes, the neighbors, and the corresponding Euclidean distances; wherein the data samples are nodes in the graph structure data, and each node is connected to its k neighbors through k edges; S2-4, according to the formula: Obtain the adjacency matrix E of the graph structure data; where e ij Represents data sample x i The edge feature corresponding to the node; x j For data sample x i Neighbors; N i For data sample x i The neighbor set; dist(x) i ,x j ) represents x i and x j The Euclidean distance between them. 3.The deep anomaly detection method for label-free table data according to claim 2, wherein, The specific method of step S3 is: A deep graph autoencoder is constructed, a loss function is defined, the Adam optimizer is used for optimization with the goal of minimizing the loss function, the learning rate of the Adam optimizer is set to 0.001, the weight decay is set to 0.1, the graph structure data is taken as training data to train the deep graph autoencoder, and a trained deep graph autoencoder is obtained. 4.The deep anomaly detection method for label-free table data according to claim 3, wherein, The deep graph autoencoder in step S3 includes a message passing module, an aggregation module, an update module, an attribute decoder, and a label decoder, wherein: a message passing module for passing edge features e ij from source node x j to node x i along edge (j, x) The aggregation module is used to generate an aggregation function with learning adaptability on the data set through a deep neural network, and the specific process is: According to the formula: e (i) = [e 1,i , e 2,i ,..., e j,i ,..., e k,i ] The information passed by the neighbors of node x i to node x i is concatenated to form a k-dimensional input vector e (i) ; e j,i is the information passed by the neighbors x j of node x i to node x i , i.e. e ij ; According to the formula: Acquiring node x i Corresponding low-dimensional embedding representation where Θ represents the weight parameters of the deep neural network F; the output expression of the l-th layer neuron of the deep neural network F is: l = σ(h l ) = σ(W l a l-1 + b l ), a l is the output of the l-th layer neuron, a l-1 is the output of the (l-1)-th layer neuron, a 1 = e(i); h l is the linear representation of the l-th layer neuron; σ(·) is the activation function of the l-th layer neuron; W l is the coefficient matrix of the (l-1)-th layer neuron to the l-th layer neuron; b l is the bias matrix of the l-th layer neuron; The update module is used to update the representation of the current node with the output of the aggregation module, and the expression is: where H is the output of the update module; for node x N corresponding low-dimensional embedding representation; v is the dimension of the low-dimensional embedding representation; h Nv denotes the v-th data in The attribute decoder is used to reconstruct the adjacency matrix according to the output of the update module, and the decoding expression is: wherein is the reconstructed adjacency matrix; (·) T denotes the transpose of a matrix; The label decoder is used to reconstruct the original node label, and the decoding expression is: wherein is the label decoding result; W is the coefficient matrix; b is the bias matrix; σ * (·) is an activation function. 5.The deep anomaly detection method for label-free table data according to claim 4, characterized in that, The expression of the loss function is: wherein Loss is the loss value of the depth map autoencoder, a is a weighting coefficient; ||·||2 is the matrix two-norm, denotes the attribute reconstruction error; BCELoss(·) is a binary cross-entropy calculation function, denotes the label reconstruction error calculated by the binary cross-entropy; l * is the real label vector. 6.The deep anomaly detection method for label-free table data according to claim 5, wherein, The specific method of step S4 includes the following sub-steps: S4-1, obtaining the adjacency matrix E(m) corresponding to the data sample m of the target table by using the same method as steps S1 and S2; S4-2, taking the adjacency matrix E(m) corresponding to the data sample m of the target table as the input of the trained deep map self-encoder, to obtain the reconstructed adjacency matrix corresponding to the data sample m of the target table and the tag decoding result S4-3, according to the formula: Anomaly score Score of the data sample m of the target table is acquired m , the deep anomaly detection of the unlabeled table data is completed; wherein β is a weighting coefficient; the anomaly score Score m The higher the anomaly score Score is, the greater the probability of the data sample m of the target table being abnormal is.

7. An electronic device, comprising: It comprises: A memory storing executable instructions; And A processor configured to execute the executable instructions in the memory to implement the deep anomaly detection method for unlabeled table data in any one of claims 1-6.

Images