A graph anomaly detection method and system based on ensemble learning and active learning

Abstract

A graph anomaly detection method and system based on active learning and ensemble learning includes: collecting and preprocessing data, selecting different graph anomaly detection models, and training each model to calculate the anomaly score and embedding vector for each node in the graph data; using an active learning strategy, selecting samples from the unlabeled data based on data characteristics, labeling them, and adding them to the training set of the ensemble model; and using the training set obtained through active learning to train the ensemble model. The input of the ensemble model is the node embedding and node anomaly score of the node in multiple graph anomaly detection models. The ensemble model includes a weight prediction module that generates an ensemble weight for each graph anomaly detection model. This weight is ultimately multiplied by the anomaly score output by the corresponding graph anomaly detection model, and the sum is then calculated to obtain the final score for each node as the final score of the ensemble model. This method can improve the accuracy of anomaly detection using a small amount of labeled data.

Description

Technical field:

[0001] The present invention relates to a graph anomaly detection method and system based on ensemble learning and active learning, and belongs to the field of computer artificial intelligence. Background technology:

[0002] Graph anomaly detection is a widely used technique in graph analysis. It aims to identify outliers in a graph by analyzing the characteristics of nodes and edges. Compared to traditional anomaly detection methods, graph-based anomaly detection can better address various challenges such as complex network structures.

[0003] In real life, graph anomaly detection has broad application prospects. Take e-commerce fraud detection as an example. While there are a large number of sellers on e-commerce platforms, a certain number of them are fraudulent sellers who use various means to defraud consumers. To address this problem, graph-based anomaly detection algorithms can analyze the attributes and connections of sellers to identify those engaging in fraudulent behavior. Graph anomaly detection technology is also widely used in social network identification, financial risk management, medical diagnosis, and other fields.

[0004] Although numerous graph anomaly detection methods have been developed over the past few decades, existing methods still have several limitations. For example, many methods require large amounts of labeled data to train the model, which increases both labor and time costs. Many methods also require manual feature selection or parameter adjustment, which limits the generalization performance of the algorithm. Furthermore, existing graph anomaly detection methods often perform significantly differently across different datasets. For some datasets, existing graph anomaly detection algorithms may perform well, but poorly on others. This can limit the algorithm's scope of application and require significant time and effort to fine-tune the algorithm and select parameters. Summary of the invention:

[0005] In response to the above problems and difficulties in the prior art, the present invention proposes a graph anomaly detection method and system based on ensemble learning and active learning.

[0006] This paper proposes a graph anomaly detection method based on ensemble learning and active learning. This method uses ensemble learning and active learning to learn a mapping, integrating several graph anomaly detection models to achieve good results on different datasets. This method can better handle data from different domains, scales, and structures, thereby improving the algorithm's generalization and robustness.

[0007] A graph anomaly detection method based on ensemble learning and active learning includes the following steps:

[0008] S1: Collect and preprocess data

[0009] S1-1: Determine the scope and category of the dataset: First, you need to determine the scope and category of the required dataset, such as what types of graph data need to be collected, how much data needs to be collected, etc.

[0010] S1-2: Data acquisition: When acquiring data, various data interfaces can be used to acquire data.

[0011] S1-3: Data Cleaning: The raw data you obtain may contain missing, duplicate, or erroneous information. Therefore, you need to clean and process the raw data, such as filling in missing values, removing duplicate data, and deleting erroneous data. For graph data, you also need to check and correct errors in node and structural information.

[0012] S1-4: Feature Extraction: Before graph data can be used in machine learning or deep learning models, it needs to be converted into feature vectors. The feature extraction method should be determined according to the specific task, such as feature embedding.

[0013] S2: Select several different graph anomaly detection models and train each model to calculate the anomaly score and embedding vector of each node on the graph data;

[0014] S3: Using active learning strategies, select some samples from the unlabeled data, label them, and add them to the training set;

[0015] S4: Use the training set to train the ensemble model. The ensemble model uses the node's anomaly score and the node's embedding vector to calculate the final anomaly score for each node.

[0016] S5: Repeat steps S3 to S4 until a preset number of iterations is reached;

[0017] S6: Output the anomaly score of the final node.

[0018] Preferably, the optimization objective of the integrated model can be formalized as formula (1):

[0019]

[0020]

[0021] Among them, θ in the formula * are the model parameters of the integrated model to be solved; the function f(·) represents the integrated model to be solved θ is its parameter; [Z1,Z2...Z K ] represents a K different graph anomaly detection model; k is the number of each different model; X i and Yi Represents node v i Attributes and tags of D l Refers to the part of the training data set that has been queried and has a label. The nodes used in training are all from D l ; The loss function used in the formula is the cross entropy loss function; and the loss function is each graph anomaly detection algorithm Z k Each defines its own self-supervised loss function, which will be trained according to its own algorithm process, where A represents the graph structure and X represents the node attributes.

[0022] The function f of the integrated model is specifically represented by formula (2):

[0023]

[0024] Among them, E k (X i ) represents each graph anomaly detection model [Z1,Z2...Z K ] for node X i The node embedding vector of g(·) is the weight prediction function with parameter θ, which uses the node embedding vector E k (X i ) calculates a weight; S k (X i ) is the graph anomaly detection model Z k For node X i The anomaly score of the node is multiplied by the corresponding weight. The sum of the products of the K weights and the anomaly score is then used as the final anomaly score for the current node.

[0025] Preferably, the data used in S1 is a real collected data set or a ready-made data set.

[0026] Preferably, several different graph anomaly detection models based on graph autoencoders are selected in S2, specifically:

[0027] The DOMINANT model is a deep learning-based attribute graph anomaly detection algorithm. It consists of a shared graph convolutional encoder, a structure reconstruction decoder, and an attribute reconstruction decoder. It can simultaneously utilize the structure and attribute information of the graph to identify abnormal nodes.

[0028] The AnomalyDAE model is a dual-autoencoder attribute graph anomaly detection algorithm consisting of a structural autoencoder and an attribute autoencoder. It can simultaneously learn node embeddings and attribute embeddings and perform anomaly detection in the latent space. The structural autoencoder uses a graph attention layer to capture the graph's topological information, while the attribute autoencoder uses two nonlinear feature transformations to compress and reconstruct node attribute information.

[0029] The CONAD model is a contrastive attribute network anomaly detection algorithm consisting of a shared graph convolutional encoder, a structure reconstruction decoder, and an attribute reconstruction decoder. It can simultaneously learn the structural and attribute features of nodes and perform contrastive learning in the latent space to distinguish normal nodes from abnormal nodes.

[0030] Preferably, the active learning strategy adopted in S3 includes a node centrality strategy, specifically:

[0031] Node centrality is a metric used to measure the importance of nodes in a network. It measures a node's ability to control and influence the network based on its position and role within the network structure. Node centrality has a wide range of applications in social networks, information networks, transportation networks, and other practical applications.

[0032] Commonly used node centrality indicators include:

[0033] 1. Degree Centrality: Degree centrality refers to the degree of a node, that is, the number of edges connected to the node. Nodes with higher degree centrality have greater influence in the network.

[0034] 2. Closeness Centrality: Closeness centrality is the inverse of the average distance between a node and other nodes. Nodes with higher closeness centrality have greater influence in the network and are able to spread information faster.

[0035] 3. Betweenness Centrality: Betweenness centrality refers to the frequency with which a node appears on all shortest paths. Nodes with high betweenness centrality play an important intermediary role in the network, connecting different communities and clusters.

[0036] 4. Eigenvector centrality: Eigenvector centrality refers to the number of nodes with high centrality among their neighbors in the network. Nodes with high eigenvector centrality have greater influence in the network.

[0037] 5. PageRank Centrality: This is a centrality metric proposed by Google founders Larry Page and Sergey Brin to measure the importance of a webpage in search engine rankings. PageRank centrality is calculated based on the links between nodes, assuming that the importance of a webpage depends on the number and quality of other pages linking to it.

[0038] Commonly used node centrality metrics can be used in the proposed method, and the appropriate node centrality metric can be selected based on the characteristics of the dataset. The node centrality of all nodes is calculated, and the node with the largest node centrality value is selected for each query. Because the most central nodes on a graph are often more representative of the overall graph, querying the actual labels of these nodes can often significantly improve the final model performance.

[0039] The active learning strategy used in S3 includes an uncertainty strategy, specifically:

[0040] According to the anomaly scores obtained by each node in various graph anomaly detection algorithms, those nodes with high overall uncertainty in multiple graph anomaly detection algorithms are selected for annotation. The overall uncertainty calculation of each node is shown in formula (3):

[0041]

[0042] Among them, φ UC (v i ) represents node v i Uncertainty of p k (v i ) is the k-th graph anomaly detection algorithm Z k Given about node v i The probability of being abnormal, here p k (v i )=S k (X i ). In this way, we can calculate the overall performance of all graph anomaly detection algorithms at node v i The uncertainty on can reflect the degree of uncertainty of the graph anomaly detection algorithm about whether the current node is an anomaly. The uncertainty of each node is calculated using formula (3), and the node with the largest uncertainty among the unlabeled nodes is selected for each query. This is because querying the actual labels of nodes with higher uncertainty often brings a significant improvement to the final performance of the model.

[0043] The active learning strategy used in S3 includes a node propagation suspicion strategy, specifically:

[0044] The propagation suspicion score of a node is shown in formula (4):

[0045] φ SU (v i )=DE P (v i )-R P (v i ) (4)

[0046] Among them, R P (v i ) is the node's propagation credibility, which is determined by the node's initial credibility R 0 (v) propagates on the graph, for all nodes v∈D whose labels have been queried l Define the initial credibility as 1, all nodes v∈D that have not been queried for labels u The initial credibility is set to 0. The process of label propagation for a total of P rounds of node credibility on the graph structure is shown in formula (5):

[0047] R P (v) = A P R 0 (v) (5)

[0048] DE P (v i ) is the node’s propagation controversy score, which is composed of the node’s initial controversy score DE 0 (v) Perform attentive propagation on the graph. For each node, define their initial controversy score as: DE 0 (v i )=max(S(v i ))-min(S(v i )). S(v in the formula i )=[S 1 (X i ),S 2 (X i )...S K (X i )] is each graph anomaly detection model [Z1,Z2...Z K ]For the current node v i The difference between the max and min values ​​in these scores can reflect the degree of controversy of the current node judgment by different graph anomaly detection algorithms, and is therefore defined as the initial controversy score of the node. Then, the controversy of the node is propagated on the graph structure. The propagation process uses the attention mechanism and propagates for a total of P rounds. The specific formula (6) is as follows:

[0049]

[0050] where α ij is node v i and neighbor node v j The attention score between is as follows:

[0051]

[0052] in, E k (X i ) and E k (X j ) is the node v i and v j The node embedding vectors given by the k-th graph anomaly detection algorithm are obtained by calculating the cosine similarity between them to obtain the correlation coefficient e ij .

[0053] In this way, the final credibility R of each node is obtained P (v) and controversy degree DE P (v) Define the difference between the two as the node's propagation suspicion, and select the unmarked node D in each query. u The nodes with the largest suspicion scores are propagated in the query, because querying the actual labels of the most suspicious nodes can often bring a significant improvement to the final effect of the model.

[0054] The active learning strategy used in S3 includes a node discrimination strategy, specifically:

[0055] According to the embedding features of the node, the node farthest from the remaining nodes is selected. The discrimination of each node is shown in formula (8):

[0056]

[0057] Among them, φ DI (v i ; t) represents node v i In the current round t, the discrimination degree; and d(E k (X i ),E k (X j )) represents node v i and nodes v j is the Euclidean distance between node embedding vectors in the k-th graph anomaly detection algorithm; D l Represents the set of nodes that have obtained labels in the current round t. Calculate each node v by formula (8) i ∈D u With D lThe overall discrimination of the nodes in the dataset is calculated, and the node with the highest discrimination is selected. Because using a fixed strategy to query nodes over and over again will make the queried nodes tend to be homogenized, resulting in information redundancy, it is necessary to query more different nodes to obtain more information, thereby improving model performance.

[0058] Preferably, in each round t, S3 will select a query node to query through each of the above active learning strategies, and then add it to the node set D that has obtained the query. l middle.

[0059] Preferably, ensemble learning is used in S4 as a method to fuse multiple basic models to obtain a final prediction result that is more accurate and stable than the basic graph anomaly detection model. The specific process of ensemble learning is as follows:

[0060] Using labeled graph data obtained through active learning as a training set, we train an ensemble model, enabling it to achieve superior anomaly detection results on unseen data. The ensemble model consists of multiple basic graph anomaly detection models, each focusing on different types of anomalies on the graph. By fusing the outputs of these basic models, the ensemble model utilizes the node embeddings and anomaly scores of each node to produce the final prediction.

[0061] Preferably, the commonly used solutions for the integrated model in S4 include simple averaging, weighted averaging, voting, stacking, etc. In this patent, the use of a learnable integrated model can better obtain the relationship between the characteristics of the data nodes and the anomaly scores. By assigning corresponding weights to each basic model, and these weights can be automatically learned by the integrated model, the integrated model can use the information between different basic models more efficiently and will not be affected by the subjectivity and limitations brought about by manual adjustment of weights. Specifically, the optimization objective formula (1) of the integrated model can be written as follows based on formula (2):

[0062]

[0063] Among them, g(E k (X i );θ) is a module for predicting the importance weight of the graph anomaly detection model. The input of this weight prediction module is the embedding of the node by the graph neural network model, and the output is the weight of the anomaly score obtained by the training of the corresponding graph anomaly detection model in the final integrated model. The parameter θ of the weight prediction module is the cross entropy loss function between the node anomaly score finally given by the model and the actual label of the node. Therefore, the training goal of the ensemble model is to find an optimal parameter θ that can effectively predict model weights using the node embeddings provided by different graph anomaly detection models. This weight is then used to perform a weighted sum of the node anomaly scores provided by the different graph anomaly detection models, resulting in a result that outperforms all graph anomaly detection models. For example, for the three models selected in S2, three node embeddings are obtained respectively. These three embeddings are collectively used as input to the weight prediction module. The weight prediction module uses the three node embeddings to calculate three weights, which are then multiplied by the anomaly scores provided by the corresponding graph anomaly detection models and then summed to obtain the final node anomaly score.

[0064] The present invention also relates to a graph anomaly detection system based on ensemble learning and active learning, comprising:

[0065] Data acquisition and preprocessing module, used to collect and preprocess data;

[0066] The node anomaly score and embedding vector calculation module selects different graph anomaly detection models and trains each graph anomaly detection model to calculate the anomaly score and embedding vector of each node on the graph data;

[0067] The data labeling module uses an active learning strategy to select some samples from the unlabeled data, label them, and add them to the training set;

[0068] The node final anomaly score calculation module uses the training set to train the integrated model. The integrated model uses the node anomaly score and the node embedding vector to calculate the final anomaly score of each node;

[0069] An iteration module repeats steps S3 to S4 until a preset number of iterations is reached;

[0070] The result output module is used to output the anomaly score of the final node.

[0071] The present invention also relates to a computer-readable storage medium having a program stored thereon, which implements the method of the present invention when the program is executed by a processor.

[0072] The present invention has the following advantages:

[0073] (1) Through active learning, a small amount of labeled data can be effectively used to improve the accuracy of anomaly detection;

[0074] (2) Through ensemble learning, different types of graph anomaly detection models can be effectively integrated, thereby leveraging their respective advantages to capture various complex information in graph data;

[0075] (3) The method proposed in this invention can achieve good anomaly detection effects on graph data of different fields, different scales, and different structures, thereby improving the generalization and robustness of the algorithm. Description of the drawings:

[0076] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0077] Figure 1 It is an overall flow chart of the method of the present invention.

[0078] Figure 2 It is a structural diagram of the system of the present invention. Specific implementation:

[0079] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. The technical solutions in the embodiments of the present disclosure will be clearly and completely described below. Obviously, the described embodiments are only a portion of the embodiments of the present disclosure, not all of them. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present disclosure fall within the scope of protection of the present disclosure.

[0080] Example 1

[0081] A graph anomaly detection method based on ensemble learning and active learning includes the following steps:

[0082] S1: Select dataset

[0083] This example uses a ready-made dataset provided by the open-source Torch_Geometric library, which contains attribute graph data from multiple different fields, different scales, and different structures. For example, one of the datasets is the Cora dataset, which is a citation network where each node represents a paper and each edge represents a citation relationship between two papers. Each node has a 1433-dimensional feature vector, representing the words that appear in the paper. Each node also has a category label, indicating the field to which the paper belongs. Specifically:

[0084] Planetoid database, which contains three Citation network datasets: Cora, CiteSeer, and PubMed. These datasets are built based on citation networks and are used for node classification tasks. Each node represents a document and has a feature vector and label of the document. The edge represents the citation relationship, that is, one document cites another document.

[0085] Weibo dataset, Weibo dataset is a dataset containing data about the Chinese social media platform Weibo. The dataset contains Weibo articles, users, relationships, and tags from 2012 to 2016. It can be used for research in areas such as social network analysis, sentiment analysis, and user behavior analysis.

[0086] The Reddit dataset is a dataset containing public content published by the Reddit community, including articles, comments, users, and community information. This dataset can be used for research in areas such as text analysis, social network analysis, sentiment analysis, and topic modeling.

[0087] The Disney dataset is a dataset containing information about Disney movies, including movies, TV shows, characters, and voice actors. This dataset can be used to analyze the characteristics, audience groups, and marketing strategies of Disney movies.

[0088] The Books dataset is a dataset that contains information about various types of books, including title, author, publication date, ISBN, etc. This dataset can be used for research in areas such as recommendation systems, book classification, and sales analysis.

[0089] The DGraph dataset is a dataset that contains the graph database DGraph, which includes different types of data such as social networks, food nutrition, phrase learning, etc. This dataset can be used to study issues such as performance, storage, and query of graph databases.

[0090] S1-1: Insert abnormal node

[0091] Since the selected dataset does not contain outlier nodes, we need to insert outlier nodes into the graph. We use the gen_contextual_outliers and gen_structural_outliers methods implemented in the open source Python library PYGOD to insert outlier nodes.

[0092] Among them, gen_contextual_outliers is a method for generating contextual anomalies. It randomly selects some nodes in the attribute graph data and then modifies their attribute features to make them significantly different from the attribute features of other nodes, thereby forming contextual anomalies. For example, for the dataset Cora used in the example, 70 nodes are first randomly selected as attribute perturbation candidate nodes. For each selected node v i, randomly select another 10 nodes from the data set, and select the nodes whose attributes are similar to node v by maximizing the node Euclidean distance i The node with the largest deviation v j Then, the node v i The property x i Change to x j , thus obtaining 70 abnormal nodes.

[0093] gen_structural_outliers is a method for generating structural outliers. It randomly selects nodes in the graph and increases the edge connections between them to form a fully connected cluster, thus generating structural outliers. For example, for the Cora dataset used in this example, 10 nodes are first randomly selected from the network, these nodes are fully connected, and all 10 nodes in the cluster are considered outliers. This process is then iteratively repeated until a certain number of clusters of 7 are generated, resulting in a total of 70 structural outliers.

[0094] S2: Select several different attribute graph anomaly detection algorithms and train them

[0095] Select several different property graph anomaly detection algorithms, such as the DOMINANT model, AnomalyDAE model, and CONAD model implemented in the open-source Python library PYGOD. Initialize and train each model, calculate the anomaly score for each node on the property graph data, and obtain the embedding vector for each node for each model.

[0096] S3: Calculate active learning score

[0097] Using active learning strategies, based on the anomaly scores calculated in the previous step and the embedding vectors for each node, we calculate the scores of four active learning strategies for each node in this round: node centrality, uncertainty, propagation suspicion, and node discrimination. We select one sample from the unlabeled data using each active learning strategy, obtain their labels, and add them to the training set to improve the performance of the ensemble model.

[0098] S4: Training the Neural Network

[0099] Using the training set obtained through active learning, an ensemble model is trained. The input of the ensemble model is the node embeddings and node anomaly scores of each node in the training set from multiple attribute graph anomaly detection algorithms. The output of the ensemble model is the final anomaly score for each node.

[0100] S5: Iteration

[0101] Repeat steps S3 to S4 until a preset number of iterations is reached or a stop condition is met.

[0102] S6: Output results

[0103] Output the final anomaly score of the node obtained by the graph deep learning model.

[0104] Example 2

[0105] This embodiment relates to an e-commerce fraud detection method using a graph anomaly detection method based on ensemble learning and active learning according to the present invention, comprising the following steps:

[0106] S1: collect data and preprocess the data;

[0107] Specifically, in an e-commerce platform application scenario, taking credit card transactions as an example, the task of graph anomaly detection is to detect fraudulent transactions in user transaction records, which is a node classification task. Each trading platform obtains relevant data on each user and each transaction through various methods. The users are extracted as the node set V, the transaction relationships between users as the edge set E, and various user information as features X. This constructs a graph network G(V, E, X).

[0108] S2: Select several different graph anomaly detection models and train each model to calculate the anomaly score and embedding vector of each node on the graph data;

[0109] S3: Using active learning strategies, we select some suspicious samples from unlabeled users, label them, and add them to the training set.

[0110] The selected active learning strategies specifically include the following four: node centrality, node uncertainty, propagation suspicion, and node discrimination.

[0111] Among them, node centrality can adopt different node centrality indicators to adapt to different graph structure types, such as degree centrality, closeness centrality, betweenness centrality, eigenvector centrality, and PageRank centrality.

[0112] Among them, the node uncertainty formula (3) is:

[0113]

[0114] p k (v i ) is the k-th graph anomaly detection algorithm Z k Given about node v i The probability of being abnormal has the same meaning as node v iThe anomaly scores are the same, so here p k (v i ) is the node v i In the kth graph anomaly detection algorithm Z k The anomaly score S in k (X i ).

[0115] Among them, the node propagation suspicion formula (4) is:

[0116] φ SU (v i )=DE P (v i )-R P (v i ) (4)

[0117] R P (v) is the credibility of the node and DE P (v) is the node’s controversy level. The node credibility formula is:

[0118] R P (v) = A P R 0 (v) (5)

[0119] For all nodes v∈D whose labels have been queried l Define the initial credibility R 0 (v) is 1, all nodes v∈D whose labels have not been queried u The initial credibility R 0 (v) is set to 0. A is the adjacency matrix of the graph structure. The node dispute degree formula is:

[0120]

[0121] α ij is node v i and neighbor node v j Attention score between: E k (X i ) and E k (X j ) is the node v i and v j The node embedding vectors given by the k-th graph anomaly detection algorithm are used to obtain the correlation coefficient e between them by calculating the cosine similarity between them. ij The initial dispute score of the node is: DE 0 (v i )=max(S(v i ))-min(S(vi )). Where max(S(v i )) and min(S(v i )) is each graph anomaly detection model [Z1,Z2...Z K ]For the current node v i Abnormal score S(v i )=[S 1 (X i ),S 2 (X i )...S K (X i )] in the maximum and minimum values.

[0122] Among them, the node discrimination formula (8) is:

[0123]

[0124] d(E k (X j ),E k (X j )) represents node v i and node v j In the k-th graph anomaly detection algorithm, the Euclidean distance between node embedding vectors is calculated, and each unqueried node is only compared with the set of nodes D whose labels have been queried. l Calculate the Euclidean distance between the nodes in .

[0125] For each of the four active learning strategies mentioned above, the nodes selected by each active learning strategy are added to the query list. Multiple rounds of queries are repeated to build the training set for ensemble learning.

[0126] S4: Use the training set to train the ensemble model. The ensemble model uses the node's anomaly score and the node's embedding vector to calculate the final anomaly score for each node.

[0127] Specifically, the input of the integrated model is the embedding of each node in the training set obtained in the previous step S2 in multiple graph anomaly detection models and the anomaly score of the node. The output of the integrated model is the anomaly score of the node.

[0128] S5: Repeat steps S3 to S4 until a preset number of iterations is reached;

[0129] S6: Output the anomaly score of the final node to achieve e-commerce fraud detection;

[0130] A node assigned a higher anomaly score by the model often means that the credit card user represented by the node is more likely to be a credit card fraud user, and his credit card usage behavior should be further investigated.

[0131] Example 3

[0132] Reference Figure 2 This embodiment of the present invention also relates to a graph anomaly detection system based on ensemble learning and active learning, including:

[0133] Data acquisition and preprocessing module, used to collect and preprocess data;

[0134] The node anomaly score and embedding vector calculation module selects different graph anomaly detection models and trains each graph anomaly detection model to calculate the anomaly score and embedding vector of each node on the graph data;

[0135] The data labeling module uses active learning strategies to select some samples from unlabeled data, label them, and add them to the training set;

[0136] The node final anomaly score calculation module uses the training set to train the integrated model. The integrated model uses the node anomaly score and the node embedding vector to calculate the final anomaly score of each node;

[0137] An iteration module repeats steps S3 to S4 until a preset number of iterations is reached;

[0138] The result output module is used to output the anomaly score of the final node.

[0139] Example 4

[0140] The present invention also relates to a computer-readable storage medium having a program stored thereon, which implements the method of embodiment 1 when the program is executed by a processor.

Claims

1. A graph anomaly detection method based on ensemble learning and active learning, characterized in that: The following steps are involved: S1: collect data and preprocess the data; S2: Select different graph anomaly detection models and train each model to calculate the anomaly score and embedding vector of each node in the graph data; S3: Using active learning strategies, select some samples from the unlabeled data, label them, and add them to the training set; Using an active learning strategy, based on the anomaly score and embedding vector of each node obtained in step S2, we calculate the scores of four active learning strategies for each node: node centrality strategy, node uncertainty strategy, propagation suspicion strategy, and node discrimination strategy. Based on each active learning strategy, we select a sample from the unlabeled data, obtain a label for each sample, and add the sample to the training set to improve the performance of the ensemble model. S4: Use the training set to train the ensemble model. The ensemble model uses the node's anomaly score and the node's embedding vector to calculate the final anomaly score for each node. Ensemble learning is used as a method to fuse multiple basic models. The specific process of ensemble learning is as follows: The ensemble model is trained using labeled graph data obtained through active learning, enabling it to detect anomalies on unseen data. The ensemble model consists of multiple basic graph anomaly detection models, each of which focuses on different types of anomalies on the graph. By fusing the outputs of these basic graph anomaly detection models, the ensemble model uses the node embedding and anomaly score of each node to obtain the final prediction result; S5: Repeat steps S3 to S4 until a preset number of iterations is reached; S6: Output the anomaly score of the final node.

2. The graph anomaly detection method based on ensemble learning and active learning according to claim 1 is characterized by: The optimization objective of the integrated model described in step S4 can be formalized as formula (1): Among them, θ in the formula * are the model parameters of the integrated model to be solved; the function f(·) represents the integrated model to be solved θ is its parameter; [Z1, Z2…Z K ] represents a K different graph anomaly detection model; k is the number of each different model; X i and Y i Represents node v i Attributes and tags of D l Refers to the part of the training data set that has been queried and has a label. The nodes used in training are all from D l ; The loss function used in the formula is the cross entropy loss function; and the loss function is each graph anomaly detection algorithm Z k Each defines its own self-supervised loss function, which is trained according to its own algorithm process, where A represents the graph structure and X represents the node attributes; The function f of the integrated model is specifically represented by formula (2): Among them, E k (X i ) represents each graph anomaly detection model [Z1, Z2…Z K ] for node X i The node embedding vector of g(·) is the weight prediction function with parameter θ, which uses the node embedding vector E k (X i ) calculates a weight; S k (X i ) is the graph anomaly detection model Z k For node X i The abnormality score of the node is multiplied by the corresponding weight; then the sum of the products of the K weights and the abnormality score will be used as the final abnormality score of the current node.

3. The graph anomaly detection method based on ensemble learning and active learning according to claim 1 is characterized by: In step S2, by training the selected graph anomaly detection model, not only the anomaly score of each node is obtained, but also the node embedding of each node is obtained for the next step.

4. The graph anomaly detection method based on ensemble learning and active learning according to claim 1, characterized in that: The node centrality described uses different node centrality indicators to adapt to different graph structure types, such as degree centrality, closeness centrality, betweenness centrality, eigenvector centrality, and PageRank centrality.

5. The graph anomaly detection method based on ensemble learning and active learning according to claim 1, characterized in that: The node uncertainty formula (3) is: where p k (v i ) is the k-th graph anomaly detection algorithm Z k Given about node v i The probability of being abnormal has the same meaning as node v i The anomaly scores are the same, so here p k (v i ) is the node v i In the kth graph anomaly detection algorithm Z k The anomaly score S in k (X i ); The node propagation suspicion formula (4) is: φ SU (v i )=DE P (v i )-R P (v i ) (4) where R P (v i ) is the credibility of the node and DE P (v i ) is the dispute degree of the node; The node credibility formula is: R P (v)=A P R 0 (v) (5) Among them, for all nodes v∈D whose labels have been queried l Define the initial credibility R 0 (v) is 1, all nodes v∈D whose labels have not been queried u The initial credibility R 0 (v) is set to 0; and A is the adjacency matrix of the graph structure; The node dispute degree formula is: where α ij is node v i and neighbor node v j Attention score between: in, E k (X i ) and E k (X j ) is the node v i and v j The node embedding vectors given by the k-th graph anomaly detection algorithm are used to obtain the correlation coefficient e between them by calculating the cosine similarity between them. ij ; The initial dispute score of the node is: DE 0 (v i )=max(S(v i ))-min(S(v i )); where max(S(v i )) and min(S(v i )) is each graph anomaly detection model [Z1, Z2…Z K ]For the current node v i Abnormal score S(v i )=[S 1 (X i ),S 2 (X i )…S K (X i )]; The node discrimination formula (8) is: Where d(E k (X i ),E k (X j )) represents node v i and node v j In the k-th graph anomaly detection algorithm, the Euclidean distance between node embedding vectors is calculated, and each unqueried node is only compared with the set of nodes D whose labels have been queried. l Calculate the Euclidean distance between the nodes in .

6. The graph anomaly detection method based on ensemble learning and active learning according to claim 1, characterized in that: In step S3, each node selected by each active learning strategy used is added to the query list.

7. The graph anomaly detection method based on ensemble learning and active learning according to claim 1, characterized in that: The input of the integrated model in step S4 is the embedding of each node in the training set obtained in the previous step S2 in multiple graph anomaly detection models and the anomaly score of the node. The output of the integrated model is the anomaly score of the node.

8. A graph anomaly detection system based on ensemble learning and active learning, characterized in that: include: Data acquisition and preprocessing module, used to collect and preprocess data; The node anomaly score and embedding vector calculation module selects different graph anomaly detection models and trains each graph anomaly detection model to calculate the anomaly score and embedding vector of each node on the graph data; The data labeling module uses an active learning strategy to select some samples from the unlabeled data, label them, and add them to the training set; Using active learning strategies, we calculate the scores of four active learning strategies for each node based on the anomaly score and embedding vector of each node. These strategies are: node centrality strategy, node uncertainty strategy, propagation suspicion strategy, and node discrimination strategy. Based on each active learning strategy, we select a sample from the unlabeled data, obtain a label for each sample, and add the sample to the training set to improve the performance of the ensemble model. The node final anomaly score calculation module uses the training set to train the ensemble model. The ensemble model uses the node anomaly score and the node embedding vector to calculate the final anomaly score of each node. Ensemble learning is used as a method to fuse multiple basic models. The specific process of ensemble learning is as follows: Using labeled graph data obtained through active learning as a training set, we train an ensemble model, enabling it to detect anomalies on unseen data. The ensemble model consists of multiple basic graph anomaly detection models, each of which focuses on different types of anomalies on the graph. By fusing the outputs of these basic graph anomaly detection models, the ensemble model utilizes the node embedding and anomaly score of each node to produce the final prediction result. Iteration module, which repeatedly executes the data labeling module and the node final anomaly score calculation module until the preset number of iterations is reached; The result output module is used to output the anomaly score of the final node.

9. A computer-readable storage medium, characterized in that A program is stored thereon, and when the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images