A graph anomaly detection method and device based on multi-frequency reconstruction
By constructing multiple filters and combining low-frequency reconstruction and contrastive learning methods, the problem of abnormal node information loss in existing graph anomaly detection technologies is solved, achieving more efficient anomaly detection results.
Patent Information
- Application Number
- CN202310972139.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-08-03
- Publication Date
- 2025-10-24
- Estimated Expiration
- 2043-08-03
AI Technical Summary
Existing graph anomaly detection methods suffer from the problem of losing abnormal node information when processing complex graph data, especially in attribute networks, resulting in poor detection performance.
A multi-frequency reconstruction-based method is adopted to capture high-frequency and low-frequency signal patterns and realize anomaly detection by constructing multiple filters and combining low-frequency reconstruction and contrastive learning.
The detection performance and generalization ability of graph anomaly detection are improved, which is better than existing methods, especially for graph data with high-dimensional node features.
Smart Images
Figure CN117151160B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application belongs to the field of graph processing, and particularly relates to a graph anomaly detection method and device based on multi-frequency reconstruction. BACKGROUND
[0002] Graph data has attracted strong attention due to its strong modeling ability and scalability, especially graph anomaly detection, which plays an important role in spam detection, financial fraud, and social network analysis. The purpose of graph anomaly detection is to identify patterns (nodes, subgraphs, edges, etc.) that are significantly different from most patterns in the graph. In real-world data sets, anomalies are often hidden in structural space, attribute space, or a mixture of the two. Due to complex node relationships and node characteristics, graph anomaly detection is a very challenging task.
[0003] Due to the rapid development of GNN, some scholars have begun to use GNN to perform the graph anomaly detection task. The general paradigm of GNN-based anomaly detection is to input the attribute and structure information of the graph data into the GNN, and to distinguish the anomaly by learning the difference between the representations of normal and abnormal nodes. GNN is a low-pass filter that amplifies low-frequency signals and suppresses high-frequency signals (signals that change more dramatically) during encoding. The current mainstream contrast learning method is to use GCN to extract node features of positive and negative examples for anomaly detection. However, in a network containing anomalies, abnormal nodes often have different features from their neighbors, and using GCN to extract information will cause the loss of node anomaly information, thereby leading to suboptimal device performance.
[0004] Therefore, the application provides a novel graph anomaly detection method and device based on multi-frequency information reconstruction, which can better implement graph anomaly detection. SUMMARY
[0005] The application aims to provide a graph anomaly detection method based on multi-frequency reconstruction, which constructs a multi-filter based on a target node and uses low-frequency reconstruction and contrast learning for anomaly detection, thereby having the ability to detect anomalies on high-dimensional node feature graph data, and having stronger detection performance and generalization ability.
[0006] In order to achieve the above-mentioned purpose, the technical scheme adopted is:
[0007] A graph anomaly detection method based on multi-frequency reconstruction, comprising the following steps:
[0008] (1) sampling the graph to obtain positive samples and negative samples;
[0009] (2) performing multi-frequency filtering processing on the positive samples and the negative samples;
[0010] (3) The method of contrast learning is used to process the anomaly in the structure space, and the method of low-frequency reconstruction is used to process the anomaly in the attribute space, and then the anomaly detection is realized.
[0011] Further, in step (1), the random walk algorithm is used to obtain positive samples, and negative samples of the corresponding nodes are obtained by disturbing background information.
[0012] Further, in the multi-frequency filtering processing of step (2), an adaptive beta walvelet is used as an encoder to capture and fuse information of multiple frequencies, and then an MLP layer is used to adaptively fuse the features extracted by each filter.
[0013] Further, the information of multiple frequencies is captured and fused by using the following formula:
[0014] B={W0,W1,…},H i =W i x=Ug i (Λ)U T x;
[0015] Wherein, W i represents the i-th filter, H i represents the feature after the i-th filter.
[0016] Further, the features extracted by each filter are fused by using the following formula:
[0017] H=σ(cat(H0,H1,H2,…));
[0018] Wherein, H∈R N×h represents the final feature, sigma represents a nonlinear activation function, and cat represents a full connection layer.
[0019] Further, in step (3), the method of contrast learning is used to process the anomaly in the structure space, and the formula is as follows:
[0020]
[0021] Wherein, t is a node, represents the positive sample score of node t, represents the negative sample score of node t.
[0022] Further, in step (3), the method of low-frequency reconstruction is used to process the anomaly in the attribute space, and the method is as follows: whether the anomaly can be reconstructed by a low-frequency signal is judged.
[0023] Further, a low-frequency GCN is used as a decoding filter to obtain a reconstruction error, and the formula is as follows:
[0024]
[0025] Further, in the step (3), the process of abnormality detection is realized, and the sampling formula is: L=L cmp + alpha L rec ;
[0026] Wherein, alpha is a hyperparameter for balancing loss, and the value range is [0, 1].
[0027] Another purpose of the application is to provide a graph anomaly detection device based on multi-frequency reconstruction (MFAD device), which comprises a multi-frequency filter module, a comparison module and a reconstruction module, and can more accurately detect anomalies.
[0028] In order to achieve the above purpose, the technical scheme adopted is:
[0029] A graph anomaly detection device based on multi-frequency reconstruction comprises a graph sampling module, a multi-frequency filter module, a comparison module, a reconstruction module and a decision module.
[0030] The graph sampling module samples the graph to obtain positive sampling and negative sampling.
[0031] The multi-frequency filter module performs multi-frequency filtering processing on the positive sampling and the negative sampling.
[0032] The comparison module uses a contrast learning method to process the anomaly in the structure space.
[0033] The reconstruction module uses a low-frequency reconstruction method to process the anomaly in the attribute space.
[0034] The decision module realizes anomaly detection.
[0035] Compared with the prior art, the application has the following advantages:
[0036] The technical scheme of the application first uses a multi-frequency wavelet filter to adaptively fuse high-frequency signals and low-frequency signals to obtain more rich node representations, and then mines abnormal information through two special strategies, one is to reconstruct the original features by using a low-pass filter to obtain the anomaly in the feature space, and the other is to use the context information on the nodes to mine the structure space anomaly by using the framework of contrast learning. Therefore, the technical scheme of the application has the following advantages:
[0037] (1) The concept of low-frequency reconstruction is first introduced into anomaly detection, which is more suitable for the frequency spectrum characteristics of abnormal network than the prior art.
[0038] (2) A framework for anomaly detection based on contrastive learning and spectral graph reconstruction is proposed, which combines the advantages of spectral generative learning and contrastive learning.
[0039] (3) The device of the present application is tested on six public datasets, and the device of the present application is superior to the optimal graph anomaly detection device, with an improvement of about 2.6% on each dataset. BRIEF DESCRIPTION OF DRAWINGS
[0040] Figure 1 A framework diagram for MFAD;
[0041] Figure 2 AUC values on four datasets vary with alpha. DETAILED DESCRIPTION
[0042] In order to further illustrate the method and device for detecting graph anomalies based on multi-frequency reconstruction according to the present application, and achieve the intended purpose of the present application, the specific implementation, structure, features and functions of the method and device for detecting graph anomalies based on multi-frequency reconstruction according to the present application will be described in detail below in conjunction with preferred embodiments. In the following description, different "an embodiment" or "embodiments" do not necessarily refer to the same embodiment. In addition, the specific features, structures or characteristics in one or more embodiments can be combined in any suitable form.
[0043] Before describing the method and device for detecting graph anomalies based on multi-frequency reconstruction according to the present application in detail, it is necessary to further explain the related background mentioned in the present application in order to achieve better results.
[0044] 1. Attribute graph anomaly detection
[0045] Recently, with the superior graph modeling ability of GNN, various methods using GNN have been proposed to solve the problem of attribute graph anomaly detection. Perozzi and Akoglu proposed an AMEN method for anomaly detection, which defines normality as a measure. Li et al. proposed Radar, Peng et al. proposed ANOMALOUS, which uses matrix regression method, and nodes with larger residual error are regarded as anomalies. Recently, some deep methods have also been applied to anomaly detection graphs such as DOMINANT, DGI, etc. These methods usually use graph auto-encoder to embed nodes into latent space, and then reconstruct graph information, and the reconstruction error is used for anomaly detection. Recently, Liu et al. proposed a self-supervised method of CoLA, which is an anomaly detection method based on contrastive self-supervised learning. It captures anomaly patterns by evaluating the consistency between each node and its adjacent subgraph using a GNN-based encoder device.
[0046] 2. Spectral graph convolutional network
[0047] GNN is an effective graph representation learning method inspired by spectral graph theory. In recent years, spectral graph theory has been effectively combined with anomaly detection, proving that most GNNs are low-pass filters and demonstrating the necessity of high-pass and band-pass filters. However, the above methods do not consider the unique properties of abnormal networks, and we are the first to study how to adaptively integrate different signals in abnormal networks with mixed frequency patterns.
[0048] After understanding the relevant background mentioned in the present application, the following will be combined with specific embodiments to further introduce the graph anomaly detection method and device based on multi-frequency reconstruction in the present application in detail:
[0049] Graph anomaly detection is of great interest due to its practical significance in many critical applications such as network security, finance, and social networks. The current mainstream attribute graph anomaly detection method is a graph neural network based on contrastive learning, which only considers homogeneous low-frequency signals. However, normal nodes and abnormal nodes in attribute networks have different frequency signal patterns, which prompts the present application to propose an anomaly detection method and device based on multi-frequency reconstruction to capture normal-abnormal signal patterns. Specifically, the technical scheme of the present application constructs multiple filters based on target nodes, and adopts a low-frequency reconstruction and a contrastive learning module for anomaly detection; the generative low-frequency reconstruction module captures anomalies in the high-frequency attribute space, while the contrastive learning module can utilize more abundant structural information in multiple subgraphs to capture structural space and mixed space anomalies. The present application conducts extensive experiments on five public datasets, and the results show that our method is much better than the most advanced method.
[0050] The technical scheme adopted by the present application is:
[0051] A graph anomaly detection method based on multi-frequency reconstruction, comprising the following steps:
[0052] (1) sampling the graph to obtain positive samples and negative samples;
[0053] (2) performing multi-frequency filtering processing on the positive samples and negative samples;
[0054] (3) processing the anomalies on the structure space by the contrastive learning method, processing the anomalies on the attribute space by the low-frequency reconstruction method, and combining to realize anomaly detection.
[0055] Preferably, in step (1), the sampling random walk algorithm is used to obtain positive samples, and the negative samples corresponding to the nodes are obtained by disturbing the background information.
[0056] Preferably, in the multi-frequency filtering processing of step (2), an adaptive betawalvelet is used as an encoder to capture and fuse information of multiple frequencies, and then the features extracted by each filter are adaptively fused through an MLP layer.
[0057] Further preferably, the capturing and fusing of information of multiple frequencies is performed according to the following formula:
[0058] B = {W0, W1, …}, H i = W i x = Ug i (Λ)U T x;
[0059] wherein W i represents the i-th filter, H i represents the feature after passing through the i-th filter.
[0060] Further preferably, the fusing of features extracted by each filter is performed according to the following formula:
[0061] H = σ (cat (H0, H1, H2, …)) ;
[0062] wherein H ∈ R N×h represents the final feature, σ represents a nonlinear activation function, and cat represents a full connection layer.
[0063] Preferably, in step (3), a contrast learning method is used to process the anomaly in the structure space, and the formula is as follows:
[0064]
[0065] wherein t is a node, represents the positive sampling score of node t, represents the negative sampling score of node t.
[0066] Preferably, in step (3), the method for processing the anomaly in the attribute space is a low-frequency reconstruction method, which determines whether the anomaly can be reconstructed by a low-frequency signal.
[0067] Preferably, a low-frequency GCN is used as a decoding filter to obtain a reconstruction error, and the formula is as follows:
[0068]
[0069] Further preferably, in step (3), the process of anomaly detection is performed according to the formula: L = L cmp + αL rec ;
[0070] Among them, α is a hyperparameter used to balance the loss, and its value range is [0,1].
[0071] Example 1.
[0072] In this embodiment, the self-supervised anomaly detection algorithm used and the overview of the MFAD node-level anomaly detection framework proposed in the present invention will be described in detail.
[0073] Ⅰ) Problem Definition:
[0074] Anomaly detection: Given a graph G = (V, A, X), where V = {v1, v2, ..., v n} represents a node set, A∈R N×N is the adjacency matrix, N is the number of nodes, X∈R N×d is the feature matrix, d is the feature dimension. In particular, we use X i ∈R D To represent the node V i The anomaly detection framework can be described as: finding an ideal function F
[0075] F:G(A,X)→y,y∈R N
[0076] Where Y is the node V i A label indicating whether the node is abnormal.
[0077] II) Spectral graph convolution: Defines the graph filtering operation based on the graph Fourier transform. Let L be the symmetric normalized Laplacian operator with eigendecomposition L = UΛU T , where Λ=diag[λ1,...,λ n ] is the diagonal matrix of eigenvalues, the signal x∈Rn, and the filter g on the graph is g * x=Ug(Λ)U T x.
[0078] Method A:
[0079] The specific processing steps are:
[0080] Device framework: Figure 1 As shown, the apparatus framework of this embodiment includes five parts, from left to right: graph sampling module, multi-frequency filter module, comparison module, reconstruction module and decision module. The graph anomaly detection method of this embodiment is:
[0081] First, a target node and its original features are selected and sampled. Positive sampling is obtained through the random walk algorithm, and negative sampling of the corresponding node is obtained by disturbing the background information.
[0082] Secondly, in order to make full use of the graph information of multiple frequencies, an adaptive multi-frequency filter is designed, which can adaptively fuse the outputs of each filter from low frequency to high frequency to obtain a more complete graph representation.
[0083] Finally, a contrast learning module is used to solve the anomaly in the structure space, and a low-frequency reconstruction module is used to process the anomaly in the attribute space, and the two are combined to achieve the final training goal.
[0084] (1) Multi-frequency filter
[0085] In order to enhance the ability of GNN to capture anomalies, an adaptive betawalvelet is used as the encoder. It can adaptively capture and fuse information of multiple frequencies. The formula is described as:
[0086] B={W0,W1,…},H i = W i x=Ug i (Λ)U T x;
[0087] Where W i represents the i-th filter, H i represents the feature after the i-th filter.
[0088] Then pass through an MLP layer to adaptively fuse the features extracted by each filter.
[0089] H=σ(cat(H0,H1,H2,…)), where H∈R N×h represents the final feature, σ represents the nonlinear activation function, and cat represents the full connection layer.
[0090] (2) Contrast learning
[0091] In order to better utilize the background information of nodes to solve the anomaly in the structure space, a contrast learning module is designed. Through the previous node sampling and multi-frequency encoding module, the positive sampling P t + ={h t ,S t} and the negative sampling of node t can be obtained, where h t represents the embeding of node t, S t represents the positive neighborhood feature of node t, represents the negative neighborhood feature of node.
[0092] This embodiment uses a bilinear discriminator to compare the similarity of h t and positive and negative neighborhoods, so as to obtain the anomaly score of node t.
[0093]
[0094] (3)Reconstruction Learning
[0095] In the attribute network containing anomalies, high-frequency signals correspond to abnormal nodes, while low-frequency signals correspond to normal nodes. Abnormal high-frequency signals are difficult to reconstruct through normal low-frequency information. Therefore, the embodiment can determine whether it is abnormal by whether it can be reconstructed by low-frequency signals.
[0096]
[0097] A low-frequency GCN or other methods can be used as a decoder. In actual operation, the embodiment selects a GCN as a decoding filter
[0098]
[0099] To balance low-frequency reconstruction and contrastive learning, the embodiment designs a hyperparameter to control the proportion of loss function fusion. The optimization goal is:
[0100] L = L cmp + αL rec (1);
[0101] Wherein, α is a hyperparameter for balancing loss, and its value range is [0, 1].
[0102] B Experiment and result analysis
[0103] (1) Experimental setup
[0104] ① Dataset: The embodiment selects five public and widely used real data sets for anomaly detection, including Cora, CiteSeer, PubMed, Flickr, ACM, and BlogCatalog. Each data set is composed of a graph.
[0105] Citation network: Cora, CiteSeer, and Pubmed are three public citation graph data sets. They come from three different databases. In these graphs, each node is a paper, and each edge represents the citation relationship between two papers. The text content of each paper is considered as its node feature.
[0106] Social networks: Blogcatalog and Flickr are two social network datasets, which are collected from the blog website Blogcatalog and the image sharing website Flickr, respectively. In these social network datasets, each node represents a user of the website, and each link represents the relationship between two users. The personalized content of the user (e.g., publishing a blog or sharing a photo with a tagged description) is extracted as the node feature.
[0107] ②Since there is no original anomaly included in the dataset, this embodiment will inject attribute anomaly and structure anomaly in the form of synthetic anomaly.
[0108] Baseline selection In order to verify the effect of the framework on the anomaly detection task, this embodiment compares it with many node classification baselines of the most advanced GNNs: (1) traditional methods AMEN, Radar and ANOMALOUS; (2) deep learning methods DOMINANT, DGI; (3) contrastive learning method CoLA.
[0109] AMEN detects anomalies through self-network analysis. It evaluates the correlation of attributes between different nodes in the self-network to distinguish abnormal information.
[0110] Radar uses residual analysis to identify anomalies in the graph. It considers the residual of attribute information and the consistency information with the graph to detect anomalies.
[0111] ANOMALOUS learns anomaly patterns by considering CUR decomposition and residual analysis. A joint learning framework is used to select information attributes to detect anomalies.
[0112] DOMINANT is a deep learning-based graph anomaly detection method. It uses a graph autoencoder to simultaneously reconstruct the adjacency matrix and the feature matrix to learn the normal pattern of the graph. Then, the anomaly of each node is measured by the reconstruction error of the node.
[0113] DGI is a representative unsupervised contrast-based self-supervised learning method. It learns node representations by maximizing the embedding consistency between each node and the whole graph. For this method, we use the bilinear discriminator trained by it to score the node anomaly.
[0114] CoLA is an anomaly detection method based on contrastive self-supervised learning. It captures anomaly patterns by evaluating the consistency between each node and its adjacent subgraph using a GNN-based encoder device.
[0115] (2) Evaluation scheme: This embodiment uses accuracy (ACC) as the evaluation index.
[0116] (3) Experimental results and analysis
[0117] a: Performance of MFAD in unsupervised anomaly detection task:
[0118] The performance of MFAD in anomaly detection task is shown in Table 1. It can be observed that MFAD outperforms all the traditional methods in the unlabeled scenario, which proves that the way of multi-frequency compression and decoding effectively improves the representation ability and anomaly capturing ability of the encoder. On the three citation network datasets, the device of the embodiment all achieved the level of sota.
[0119] The method MFAD proposed in this embodiment is superior to the benchmark method on all benchmark datasets, which proves its ability to detect anomalies on high-dimensional node features of graph data. The reason behind this is that SL-GAD captures anomaly patterns by combining frequency information with background information.
[0120] The shallow method (AMEN, Radar and ANOMALOUS) did not show competitive anomaly detection performance in the experiment of the embodiment. This is because these mechanisms have limited ability to distinguish anomalies from high-dimensional features and complex structure of graph data, resulting in relatively poor performance.
[0121] Compared with other deep methods, MFAD has stronger detection performance and generalization ability. The reason is that these baselines only adopt one learning strategy (for example, DOMINANT only uses the reconstruction strategy, and CoLA only considers the contrast strategy), which leads to a suboptimal solution for anomaly detection. On the contrary, MFAD jointly uses two learning strategies through spectral decomposition, achieving higher performance.
[0122] On the social network (BlogCatalog and Flickr) dataset, the method of the embodiment does not improve much compared to sota. One possible reason is that the social network is a relatively dense graph, which may cause information loss when sampling a fixed-size subgraph view.
[0123] Table 1: Results of anomaly detection experiment under unsupervised learning
[0124] Dataset Cora CiteSeer PubMed Flickr BlogCatalog AMEN 0.6266 0.7712 0.7713 0.6573 0.6392 Radar 0.6587 0.6233 0.6633 0.7399 0.7401 ANOMALOUS 0.577 0.7316 0,7316 0.7434 0.7237 DOMINANT 0.8155 0.6962 0.8081 0.7442 0.7468 DGI 0.7511 0.8512 0.6962 0.6237 0.5827 CoLA 0.8779 0.8868 0,9512 0.7513 0.7854 ours 0.8939 0.8924 0.9773 0.7915 0.8133
[0125] b: The role played by each module of the device:
[0126] In order to explore the role played by each module in the anomaly detection process, the embodiment designs two variants of MFAD. Among them, MFAD-Sin only uses a low-pass filter as the encoding method, and MFAD-Com only considers the unique means of contrast learning anomaly detection. The results are shown in Table 2, and the following conclusions are drawn for the table:
[0127] The full MFAD achieves optimal performance, validating the effectiveness of combining multi-frequency reconstruction with a contrastive learning framework for anomaly detection. This demonstrates that the low-frequency reconstruction strategy and contrastive learning module in this embodiment can interact with each other to more effectively identify anomalies.
[0128] In all five datasets, MFAD-Com is always better than MFAD-Sin. The contrastive learning method still plays a dominant role in the anomaly detection task. The low-frequency reconstruction method can effectively constrain the contrastive learning strategy, thereby improving the effect.
[0129] On the social network datasets Flickr and BlogCatalog, the full MFAD algorithm achieves significantly greater improvements than the two MFAD variants on the citation network. One reason for this is that social networks are more complex and have higher average node degrees, which suggests that MFAD has a greater advantage in handling complex graph data.
[0130] Table 2 Impact of various components of the anomaly detection device on device performance
[0131] cora citeseer pubmed Flickr BlogCatalog MFAD-Sin 0.8644 0.8564 0.9451 0.7674 0.7421 MFAD-Com 0.8713 0.8642 0.9465 0.7702 0.7569 MFAD 0.8939 0.8924 0.9773 0.7915 0.8133
[0132] Parameter sensitivity analysis:
[0133] In this experiment, the influence of the balance factor α in formula (1) is discussed. In this embodiment, the factor α is adjusted in the range of [0,1] with a step of 0.05. The results are as follows Figure 2 shown.
[0134] This example was validated on the Cora, Citeseer, Flickr, and BlogCatalog datasets. The results show that the AUC value increases with increasing α, with multiple peaks and troughs. The AUC value for the citation network fluctuates significantly, but stabilizes within a large range after reaching its maximum. The social network fluctuates less, but a stable range is difficult to achieve. This observation suggests that the reconstruction ratio varies for each dataset. For example, BlogCatalog requires a larger reconstruction ratio (0.9), while Cora requires a smaller reconstruction ratio (0.2). Generally speaking, the more complex the graph structure and the higher the feature dimensionality, the larger the reconstruction ratio required.
[0135] Summary: Most existing GNNs only consider graph signals with a single frequency, and do not fully exploit the frequency characteristics of anomalous networks, where abnormal and normal nodes tend to different frequency bands. Therefore, the present application proposes a new graph anomaly detection method and device based on multi-frequency reconstruction. The present application adopts three key techniques for experiments, namely multi-frequency coding, low-frequency reconstruction and background contrast learning. The experimental results show that the technical solution of the present application has made significant progress compared with several most advanced baseline methods.
[0136] The above is only the preferred embodiment of the present application, and does not limit the present application in any form. Any simple modification, equivalent change and modification of the above embodiment according to the technical essence of the present application still belongs to the scope of the technical solution of the present application.
Claims
1. A method for graph anomaly detection based on multi-frequency reconstruction, characterized in that, The method comprises the following steps: (1) sampling the graph to obtain positive samples and negative samples; (2) performing multi-frequency filtering processing on the positive samples and the negative samples; (3) processing the anomaly in the structure space by using a contrast learning method and processing the anomaly in the attribute space by using a low-frequency reconstruction method, so as to realize the graph anomaly detection task; In the step (3), the anomaly in the structure space is processed by using the contrast learning method, and the formula is as follows: where t is a node, denotes a positive sampling score for node t, denotes a negative sampling score for node t; A low-frequency GCN is used as a decoding filter to obtain a reconstruction error, and the formula is as follows: The process of anomaly detection is implemented, and the sampling formula is: L = L cmp + aL rec ; Wherein, α is a hyperparameter for balancing the loss, and the value range is [0, 1].
2. The graph anomaly detection method according to claim 1, wherein In the step (1), the positive samples are obtained by using a random walk algorithm, and the negative samples corresponding to the nodes are obtained by disturbing the background information.
3. The graph anomaly detection method according to claim 1, wherein In the multi-frequency filtering processing of the step (2), an adaptive betawalvelet is used as an encoder to capture and fuse information of multiple frequencies, and then an MLP layer is used to adaptively fuse the features extracted by the filters.
4. The graph anomaly detection method according to claim 3, wherein The information of multiple frequencies is captured and fused by using the following formula: B = {W0, W1,...}, H i = W i x = Ug i (Λ)U T x; where W i represents the i-th filter, H i represents the feature after the i-th filter.
5. The graph anomaly detection method according to claim 3, wherein The features extracted by the filters are fused by using the following formula: H = σ (cat (H0, H1, H2, …)) ; where H ∈ R N×h denotes the final features, σ denotes a non-linear activation function, and cat denotes a fully connected layer.
6. The graph anomaly detection method according to claim 1, wherein In the step (3), the method for processing the anomaly in the attribute space by using the low-frequency reconstruction method is that whether the anomaly can be reconstructed by a low-frequency signal is judged.
7. A device for detecting anomalies in an image based on multi-frequency reconstruction, characterized in that: The graph anomaly detection device is used to realize the graph anomaly detection method according to any one of claims 1-6, and comprises a graph sampling module, a multi-frequency filter module, a comparison module, a reconstruction module and a decision module. The graph sampling module samples the graph to obtain positive samples and negative samples; The multi-frequency filter module performs multi-frequency filtering processing on the positive samples and the negative samples; The comparison module processes the anomaly in the structure space by using a contrast learning method; The reconstruction module processes the anomaly in the attribute space by using a low-frequency reconstruction method; The decision module realizes anomaly detection.