Network node full-granularity anomaly detection method and system based on attribute-enhanced sampling

Abstract

The present application relates to the technical field of network security analysis, in particular to a network node full-granularity anomaly detection method and system based on attribute-enhanced sampling, which obtains an attribute-enhanced network of an original attribute network based on an attribute-enhanced manner, and generates positive and negative sample pairs of both the original attribute network and the attribute-enhanced network through subgraph sampling of interval random walk; a full-granularity contrast learning network containing nodes and subgraphs, nodes and nodes, subgraphs and subgraphs, and nodes and the whole is constructed by using the positive and negative sample pairs, so as to capture abnormal information of nodes at the subgraph level, the node level and the global level by using the full-granularity contrast learning network; the abnormal value score of each node is calculated based on the full-granularity contrast learning network, and the abnormal nodes in the attribute network are determined according to the abnormal value score, wherein the abnormal value score includes node and subgraph abnormal score, node and node abnormal score, and node and global abnormal score. The present application can improve the accuracy of attribute network anomaly node detection and facilitate deployment and application in actual scenarios.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security analysis, in particular to a network node full-granularity anomaly detection method and system based on attribute-enhanced sampling. BACKGROUND

[0002] There are many types of networks in the real world, which can be represented by networks with nodes attached to attributes, such as social networks, financial networks, transportation networks, etc. Such networks with nodes having attributes are called attributed networks. In recent years, with the development of information technology, attributed networks are increasingly widely used in real society. There are often some abnormal nodes in different types of attributed networks, i.e. nodes that deviate significantly from most nodes. For example, bad information disseminators in social networks, information fraudsters in financial networks, traffic congestion in traffic networks, etc. These abnormal nodes will affect people's normal life, therefore, it is of great practical significance to study the abnormal node discovery technology in attributed networks.

[0003] Early attributed network anomaly node detection techniques can be mainly divided into two categories: community analysis-based methods and residual analysis-based methods. By identifying the attribute differences of different nodes or simulating the residual information of the adjacency matrix to identify abnormal nodes, but it can only detect attribute anomalies or structural anomalies, and cannot detect abnormal nodes that need to consider both attributes and structure, so the accuracy of abnormal node detection needs to be improved.

[0004] Graph neural networks (GNNs) can simultaneously learn the structure and attribute features of attribute networks, exhibiting stronger feature extraction capabilities when processing graph data such as attribute networks. Current methods include applying GNNs to anomaly detection, reconstructing the feature and attribute matrices of the original graph, and identifying nodes with large reconstruction errors as anomalies; utilizing DeepAE embedding models to amplify the differences between normal and anomaly nodes during graph embedding; and applying GAT to attribute network embedding to learn the importance of different neighboring nodes, thereby improving anomaly detection performance. However, these methods, represented by GNNs, suffer from the problem of overly smoothed anomaly nodes due to their neighbor aggregation approach for learning node features; furthermore, their full-graph training mechanism makes them difficult to apply to large-scale graphs. To address the challenges encountered by graph neural network-based methods, researchers have applied contrastive learning to attribute network anomaly detection. For example, CoLA was the first to apply contrastive learning to attribute network anomaly detection by comparing nodes and subgraphs to train a GCN network, fully capturing local feature information of nodes and improving detection accuracy compared to graph neural networks. Another example is CoLA, which adds node-to-node comparison to detect node-level anomalies, further improving anomaly detection accuracy. Yet another approach, building upon node-to-node and node-to-subgraph comparisons, adds subgraph-to-subgraph comparisons, significantly enhancing the mining of local features and structural information within each subgraph. This significantly strengthens the contrast between nodes and subgraphs, improving anomaly detection accuracy. However, these contrastive learning-based anomaly detection methods use positive and negative sample subgraphs for comparison. However, the sampling method for these subgraphs cannot guarantee sufficiently high contrast, leading to inaccurate node features learned by the model and thus affecting the anomaly detection performance. Furthermore, existing contrastive learning methods only capture local anomaly features of nodes, failing to capture global anomaly features and thus failing to detect globally anomalous nodes, thereby limiting the model's ability to detect anomalous nodes. Summary of the Invention

[0005] To address these issues, this invention provides a method and system for full-granularity anomaly detection of network nodes based on attribute-enhanced sampling, which solves the problems of unsatisfactory positive and negative sample contrast, incomplete capture of anomalous features, and reduced detection accuracy in existing contrastive learning methods.

[0006] According to the design scheme provided by the present invention, on the one hand, a method for full-granularity anomaly detection of network nodes based on attribute-enhanced sampling is provided, comprising:

[0007] The attribute augmentation network is obtained based on the attribute augmentation method, and positive and negative sample pairs of the original attribute network and the attribute augmentation network are generated by sampling the subgraph through interval random walks.

[0008] We construct a full-granularity contrastive learning network using positive and negative sample pairs, which includes node-subgraph, node-node, subgraph-subgraph, and node-global comparisons, in order to capture anomalous information of nodes at the subgraph, node, and global levels.

[0009] The anomaly score of each node is calculated based on the full-granularity contrastive learning network, and the abnormal nodes in the attribute network are determined based on the anomaly score. The anomaly score includes the node-subgraph anomaly score, the node-node anomaly score, and the node-global anomaly score.

[0010] As a method for full-granularity anomaly detection of network nodes based on attribute-enhanced sampling according to the present invention, the attribute-enhanced network obtained from the original attribute network based on attribute enhancement includes:

[0011] First, the key attribute features of the original attribute network nodes are extracted using the trained autoencoder to obtain a new attribute feature matrix;

[0012] Then, the similarity between any two nodes is calculated. If the similarity between nodes is greater than the similarity threshold and there is no edge connection between the nodes, an edge is added between the corresponding nodes to obtain a new adjacency matrix and generate the corresponding attribute enhancement network.

[0013] As a full-granularity anomaly detection method for network nodes based on attribute-enhanced sampling in this invention, further, positive and negative sample pairs of both the original attribute network and the attribute-enhanced network are generated through subgraph sampling using interval random walks, including:

[0014] Starting from the target node, a restarted random walk is used to sample positive sample subgraphs on both the original attribute network and the attribute enhancement network, resulting in positive sample pairs on both networks consisting of the target node and the positive sample subgraphs. Subgraph sampling is then performed on the second node, which is two hops away from the target node, resulting in a subgraph starting from the second node. This subgraph is then used as the negative sample subgraph for the target node, resulting in negative sample pairs on both networks consisting of the target node and the negative sample subgraphs.

[0015] As a method for full-granularity anomaly detection of network nodes based on attribute-enhanced sampling in this invention, a full-granularity contrastive learning network is further constructed using positive and negative sample pairs, including node-to-subgraph, node-to-node, subgraph-to-subgraph, and node-to-global comparisons, comprising:

[0016] First, set up comparative learning losses for nodes and subgraphs, nodes and nodes, subgraphs and subgraphs, and nodes and the global scale at each granularity, and set up a joint training objective function based on the comparative learning losses at each granularity.

[0017] Then, the positive and negative sample pairs of the original attribute network and the attribute enhancement network, as well as the global information of the network, are used as input data for the GCN neural network structure. The GCN neural network is trained based on the joint training objective function, and the trained GCN neural network is used as a full-granularity contrastive learning network.

[0018] As a full-granularity anomaly detection method for network nodes based on attribute-enhanced sampling in this invention, a joint training objective function is further set based on the contrastive learning loss at each granularity, including:

[0019] The target node is masked in the positive and negative sample subgraphs to obtain the hidden layer representation of the subgraph corresponding to the target node; the subgraph feature representation is obtained by aggregating node features; the target node is mapped to the subgraph embedding space and the target node embedding vector representation is obtained.

[0020] The similarity between a node and a subgraph is measured based on the feature representation of the subgraph and the embedding vector representation of the target node, and the contrast loss between the node and the subgraph is obtained based on the similarity between the node and the subgraph.

[0021] The similarity between nodes in positive and negative sample pairs and nodes in the subgraph is measured based on the hidden layer representation and embedding vector representation of target nodes in the subgraph, and the contrast loss between nodes is obtained based on the similarity between nodes.

[0022] The subgraph comparison loss is obtained based on the embedding representation of the positive and negative sample subgraphs corresponding to the target node in the original attribute network and the attribute enhancement network.

[0023] Global information is obtained based on the original attribute network embedding representation. The target node is mapped to an embedding space consistent with the global information to obtain the target node mapping representation. The similarity between the node and the global information is obtained based on the global information and the target mapping representation. The comparison loss between the node and the global information is obtained based on the similarity between the node and the global information.

[0024] The joint training objective function is set based on the comparison loss between nodes and subgraphs, the comparison loss between nodes, the comparison loss between subgraphs, and the comparison loss between nodes and the global graph, and the balance factor and trade-off parameters.

[0025] As a full-granularity anomaly detection method for network nodes based on attribute-enhanced sampling in this invention, the joint training objective function is further expressed as: L=βL NS +(1-β)L NN +γL SS +ηL NG Where β is the balance factor, γ,η are the trade-off parameters, and L NS L is the loss for comparing nodes and subgraphs. NN For node-to-node comparison loss, L SS For subgraph-to-subgraph contrast loss, L NGThe loss is calculated by comparing the node with the global comparison.

[0026] As a full-granularity anomaly detection method for network nodes based on attribute-enhanced sampling in this invention, the anomaly score of each node is calculated based on a full-granularity contrastive learning network, including:

[0027] Based on the similarity between nodes and subgraphs, subgraph-level anomaly scores of nodes on the original attribute network and attribute enhancement network are obtained, and anomaly scores between nodes and subgraphs are obtained based on the subgraph-level anomaly scores.

[0028] Based on the similarity between nodes, the node-level anomaly score of each node in the original attribute network and the attribute enhancement network is obtained, and the anomaly score between nodes is obtained based on the node-level anomaly score.

[0029] The global anomaly score of a node on the original attribute network is obtained based on the similarity between the node and the global network, and the anomaly score between the node and the global network is obtained based on the global anomaly score.

[0030] The final score of the corresponding node is calculated by combining the anomaly scores of each node.

[0031] As a method for full-granularity anomaly detection of network nodes based on attribute-enhanced sampling in this invention, further, node v i The final score S i The calculation formula is expressed as: Where β is the balance factor and η is the compromise parameter. These are the scores for anomalies between nodes and subgraphs, anomalies between nodes, and anomalies between nodes and the global graph.

[0032] As a method for full-granularity anomaly detection of network nodes based on attribute-enhanced sampling according to the present invention, further comprising determining the anomalous nodes in the attribute network based on the scores of the anomaly values, the method further includes:

[0033] Multiple rounds of random sampling are performed on each node, and the average score of the outlier values ​​of each node in multiple rounds is taken as the final outlier value;

[0034] Based on the final outlier size, the nodes are sorted, and the nodes with the highest ranking are identified as outliers according to a preset threshold.

[0035] Furthermore, this invention also provides a network node full-granularity anomaly detection system based on attribute augmentation sampling, comprising: an augmentation sampling module, a contrastive learning module, and an anomaly detection module, wherein...

[0036] The enhanced sampling module is used to obtain the attribute-enhanced network of the original attribute network based on the attribute enhancement method, and to generate positive and negative sample pairs of the original attribute network and the attribute-enhanced network through subgraph sampling by interval random walk;

[0037] The contrastive learning module is used to construct a full-granularity contrastive learning network that includes nodes and subgraphs, nodes and nodes, subgraphs and subgraphs, and nodes and the global context using positive and negative sample pairs. This full-granularity contrastive learning network is used to capture anomalous information of nodes at the subgraph level, node level, and global context.

[0038] The anomaly detection module is used to calculate the anomaly score of each node based on the full-granularity contrastive learning network, and to determine the abnormal nodes in the attribute network based on the anomaly score. The anomaly score includes the node-subgraph anomaly score, the node-node anomaly score, and the node-global anomaly score.

[0039] The beneficial effects of this invention are:

[0040] This invention refers to the original network as the original view. Based on the original view, edges are added between nodes with similar attributes but no direct connection, and direct edges between node pairs with low attribute similarity are removed to construct an attribute-enhanced view. This view ensures that nodes with similar attributes are connected while preserving as much of the original graph's structural information as possible. Sampling is performed through interval random walks, resulting in sufficiently high contrast between positive and negative samples in terms of structure and attributes. This allows contrastive learning to more accurately identify node features and improve the accuracy of anomaly node detection in the attribute network. Next, a contrastive learning network is constructed that simultaneously includes node-subgraph, node-node, subgraph-subgraph, and node-global comparisons. Building upon node-node and node-subgraph comparisons, this network adds a node-global comparison, capturing full-granularity anomaly features of each node at the node, subgraph, and global levels. Through this full-granularity contrastive learning network, the learned node features are more comprehensive, enabling the detection of full-granularity anomalies and improving the accuracy of anomaly node detection. Finally, anomaly scores for each node are calculated by comprehensively considering anomaly information at various granularities to comprehensively and accurately detect full-granularity anomalies in the attribute network. Furthermore, experimental data demonstrates that the proposed solution, through attribute-enhanced view sampling and the introduction of global graph information, can improve the accuracy of the attribute network anomaly node detection algorithm. Compared with the latest methods, the algorithm's AUC values ​​are improved by 1.75%, 1.33%, 3.17%, and 1.61%, respectively. It is applicable to the detection of anomaly nodes such as malicious information dissemination nodes in social networks, information fraud nodes in financial networks, and traffic congestion nodes in transportation networks. Attached image description:

[0041] Figure 1 This is a schematic diagram of the full-granularity anomaly detection process for network nodes based on attribute-enhanced sampling in the embodiment.

[0042] Figure 2 This is a schematic diagram of the full-granularity anomaly detection model architecture in the embodiment;

[0043] Figure 3This is a schematic diagram of the attribute enhancement strategy process in the embodiment;

[0044] Figure 4 This is a schematic diagram comparing the AUC values ​​of the proposed algorithm FGAnomAES with those of the benchmark method in this embodiment;

[0045] Figure 5 This example illustrates the effect of different parameters on the AUC value.

[0046] Figure 6 The figure below illustrates the enhanced ablation analysis in the example. Detailed implementation method:

[0047] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0048] The attribute network is defined as G = (V, A, X), where V = {v1, v2, v3, ..., v...}. n}(|V|=n) represents a node in the attribute network; Represents the adjacency matrix of an attribute network, when A ij When = 0, it indicates node v i and node v j There are no edges connecting them, A ij =1 indicates that there is an edge connecting the two; The attribute matrix representing the network, the vector in the i-th row. Represents the i-th node v in the attribute network i Attribute information.

[0049] Given an attribute network G = (V, A, X), learn a function f to calculate anomaly scores based on the adjacency matrix A and the attribute matrix X, for each node v in the network. i Each node can be scored as an anomaly score S based on its degree of anomaly. i ; This results in nodes with higher anomaly scores (S) i The larger the score, the higher the node is considered an anomaly. Nodes are sorted according to their anomaly scores, with higher-ranked nodes being identified as anomalous. The symbols are explained in the table below.

[0050]

[0051]

[0052] Early attribute network anomaly detection primarily relied on analyzing the features of the attribute network itself. In recent years, deep learning has developed rapidly, and its powerful feature extraction capabilities are highly effective for graph anomaly detection, leading to its application in this field. Early deep learning-based methods considered attributes and structure separately, ignoring their interactions and failing to detect anomalies that require combining both attribute and structural features. Graph Neural Networks (GCNs) acquire embedded representations of attribute networks by aggregating neighborhood information, enabling them to learn both node structure and attribute features simultaneously. Therefore, they can identify not only nodes with structural or attribute anomalies but also those requiring a combination of attribute and structural features. For example, in the DOMINANT model, a graph neural network is used to construct an autoencoder, and the reconstruction error is calculated through compression-reconstruction; nodes with larger reconstruction errors are considered more anomalous. However, GCNs do not consider the contribution of different nodes and suffer from oversmoothing. Graph Attribution-Altering (GAT) focuses on extracting important information from neighboring nodes. Using GAT in the autoencoder architecture allows it to learn important information between neighboring nodes, enabling the detection of node-level anomalies using the structural information and attribute similarity of graph data. The ultimate goal of the autoencoder architecture is to identify anomalous nodes based on reconstruction errors. However, reconstruction errors are susceptible to potential noise and suffer from overfitting issues with both normal and anomalous data. Furthermore, the high time complexity of the full-graph training mechanism prevents its scaling to large-scale attribute graphs.

[0053] To address the problems encountered by graph neural networks in anomaly detection of attribute networks, contrastive learning has been applied to anomaly detection in attribute networks. However, existing contrastive learning-based methods suffer from issues such as insufficient contrast between positive and negative samples and incomplete capture of anomalous features. Therefore, this invention provides an embodiment, see [link to embodiment]. Figure 1 As shown, a method for full-granularity anomaly detection of network nodes based on attribute augmentation sampling is provided, comprising:

[0054] S101. Obtain the attribute enhancement network of the original attribute network based on the attribute enhancement method, and generate positive and negative sample pairs of the original attribute network and the attribute enhancement network by sampling the subgraph through interval random walk.

[0055] In contrastive self-supervised learning, constructing augmented views can help the model uncover deeper semantic information in graphs. Currently, the method of constructing augmented views through edge perturbation is widely used. This method randomly adds and removes edges to generate augmented views, but it cannot guarantee sufficient contrast between positive and negative samples. Furthermore, since nodes that are structurally far apart may have similar attributes, existing sampling methods cannot ensure a sufficiently large difference in attributes between positive and negative sample subgraphs, leading to insufficient contrast and inaccurate node features learned by the model. Therefore, this embodiment [see example]. Figure 2 In the overall model architecture shown, an enhanced view is created using attribute enhancement. In the enhanced view, nodes with directly connected edges have similar attributes. When sampling the subgraph, as long as the initial nodes of positive and negative samples are a certain distance apart, the contrast between the positive and negative samples can be ensured.

[0056] The enhanced view G′ is obtained through attribute enhancement; subgraph sampling is performed on both the original view and the enhanced view. Each node v is obtained by sampling on the original view. i The positive sample subgraph of (i = 1, 2, 3, ..., n) is denoted as G. i and negative sample subgraphs Each node v i The positive sample pair formed by the positive sample subgraph and the positive sample subgraph is denoted as (v i G i ), and the negative sample subgraph constitutes a negative sample pair. Similarly, the positive and negative sample pairs obtained on the augmented view are denoted as (v i G i ′),

[0057] Specifically, the attribute enhancement network obtained from the original attribute network using attribute enhancement methods can be designed to include the following:

[0058] First, the key attribute features of the original attribute network nodes are extracted using the trained autoencoder to obtain a new attribute feature matrix;

[0059] Then, the similarity between any two nodes is calculated. If the similarity between nodes is greater than the similarity threshold and there is no edge connection between the nodes, an edge is added between the corresponding nodes to obtain a new adjacency matrix and generate the corresponding attribute enhancement network.

[0060] like Figure 3 As shown, given an original attribute network G, which contains a node attribute feature matrix X, it consists of two parts: a trained autoencoder and a generated augmented view G′. The specific process of generating the augmented view can be described as follows: First, the trained autoencoder is used to extract important node attribute features to obtain a new attribute feature matrix X′; then, X′ is calculated.T To obtain the similarity between any two nodes, let v be the similarity between any two nodes. i v j The similarity value is t i,j Finally, the enhanced view G' is obtained based on the similarity between nodes. If t i,j >T (T is the set similarity threshold) and A ij =0 then at node v i v j Adding edges means letting A ij =1. This allows the generation of an attribute-enhanced view G′, which, while preserving as much of the original graph's structural information as possible, ensures that nodes with similar attributes are connected by edges.

[0061] The positive and negative sample pairs generated by subgraph sampling through interval random walks for both the original attribute network and the attribute enhancement network can be designed to include:

[0062] Starting from the target node, a restarted random walk is used to sample positive sample subgraphs on both the original attribute network and the attribute enhancement network, resulting in positive sample pairs on both networks consisting of the target node and the positive sample subgraphs. Subgraph sampling is then performed on the second node, which is two hops away from the target node, resulting in a subgraph starting from the second node. This subgraph is then used as the negative sample subgraph for the target node, resulting in negative sample pairs on both networks consisting of the target node and the negative sample subgraphs.

[0063] Existing mainstream subgraph sampling methods employ a restarted random walk approach. At each step, the algorithm either chooses to continue moving towards adjacent nodes with a certain probability, or returns to the starting point to restart the walk with a smaller probability, thus effectively capturing the neighborhood features of nodes. Therefore, in this embodiment, a restarted random walk approach can be used for sampling.

[0064] Subgraph sampling is performed simultaneously in both the original view G and the enhanced view G′. The specific process of original view sampling can be described as follows: First, with the target node v i Starting from a point, sampling is performed using a restarted random walk to obtain the positive sample subgraph G. i Target node v i And positive sample subgraph G i Form positive sample pairs (v) i G i ); at a distance v from the target node i Node v outside of two hops j Perform subgraph sampling to obtain v j The subgraph starting from the target node v is the subgraph that is the target node. i negative sample sub-image target node v iForm negative sample pairs with negative sample subgraphs Similarly, the sign of the augmented view can be obtained as: (v i G i ′),

[0065] Since nodes that are structurally far apart may have similar attributes, sampling only on the original view G cannot guarantee that the positive and negative sample pairs are sufficiently different in attributes. However, in the enhanced view, nodes with similar attributes must be connected by edges, as long as the sampling ensures that the nodes in the negative samples are connected to the target node v. i The absence of direct edges ensures sufficient contrast between positive and negative sample pairs. The positive and negative sample pairs on the two views complement each other, allowing the contrastive learning network to accurately learn node features.

[0066] S102. Construct a full-granularity contrastive learning network using positive and negative sample pairs, which includes node-subgraph, node-node, subgraph-subgraph, and node-global comparisons, in order to capture anomalous information of nodes at the subgraph, node, and global levels.

[0067] To capture subgraph-level, node-level, and global anomaly information in the attribute network, this embodiment utilizes a full-granularity contrastive learning network. This contrastive network mainly comprises four parts: node-subgraph, node-node, subgraph-subgraph, and node-global contrast. Node-subgraph and node-node contrasts are performed separately in the original and enhanced views, and through joint training, accurately capture the local structural and attribute features of nodes. This ensures that node-subgraph contrasts fully capture subgraph-level anomalies, and node-node contrasts fully capture node-level anomalies. Subgraph-subgraph contrasts are based on positive and negative sample subgraphs in both views to directly optimize the subgraph embeddings of the two views, thus improving node-subgraph and node-node contrasts. Node-global contrasts are performed only in the original view to capture global anomalies.

[0068] Specifically, a full-granularity contrastive learning network, constructed using positive and negative sample pairs and encompassing node-subgraph, node-node, subgraph-subgraph, and node-global comparisons, can be designed to include the following:

[0069] First, set up comparative learning losses for nodes and subgraphs, nodes and nodes, subgraphs and subgraphs, and nodes and the global scale at each granularity, and set up a joint training objective function based on the comparative learning losses at each granularity.

[0070] Then, the positive and negative sample pairs of the original attribute network and the attribute enhancement network, as well as the global information of the network, are used as input data for the GCN neural network structure. The GCN neural network is trained based on the joint training objective function, and the trained GCN neural network is used as a full-granularity contrastive learning network.

[0071] Specifically, the joint training objective function, based on the contrastive learning loss at each granularity, can be designed to include:

[0072] The target node is masked in the positive and negative sample subgraphs to obtain the hidden layer representation of the subgraph corresponding to the target node; the subgraph feature representation is obtained by aggregating node features; the target node is mapped to the subgraph embedding space and the target node embedding vector representation is obtained.

[0073] The similarity between a node and a subgraph is measured based on the feature representation of the subgraph and the embedding vector representation of the target node, and the contrast loss between the node and the subgraph is obtained based on the similarity between the node and the subgraph.

[0074] The similarity between nodes in positive and negative sample pairs and nodes in the subgraph is measured based on the hidden layer representation and embedding vector representation of target nodes in the subgraph, and the contrast loss between nodes is obtained based on the similarity between nodes.

[0075] The subgraph comparison loss is obtained based on the embedding representation of the positive and negative sample subgraphs corresponding to the target node in the original attribute network and the attribute enhancement network.

[0076] Global information is obtained based on the original attribute network embedding representation. The target node is mapped to an embedding space consistent with the global information to obtain the target node mapping representation. The similarity between the node and the global information is obtained based on the global information and the target mapping representation. The comparison loss between the node and the global information is obtained based on the similarity between the node and the global information.

[0077] The joint training objective function is set based on the comparison loss between nodes and subgraphs, the comparison loss between nodes, the comparison loss between subgraphs, and the comparison loss between nodes and the global graph, and the balance factor and trade-off parameters.

[0078] Among them, node-subgraph comparison is to compare the target node v in the sample pair. i The comparison with the positive and negative sample subplots can be described as follows:

[0079] Step 1: Mask the target node to obtain the hidden layer representation of the subgraph corresponding to the target node. First, mask the target node in the positive and negative sample subgraphs, that is, set the attribute of the target node to 0 in the positive and negative sample subgraphs. Then, learn the hidden layer representation of the positive and negative sample subgraphs:

[0080]

[0081] In formula (1), and Representing the target node v i The hidden representations of the corresponding subgraphs at levels l+1 and l are as follows: It is a normalized adjacency matrix, W l This represents the parameters of the graph neural network.

[0082] Step 2: Obtain the final representation z of the subgraph i The final representation of the subgraph z i This can be obtained using the Readout function. In this article, the average Readout function is used to obtain the subgraph representation:

[0083]

[0084] Among them, Z i It is the final embedding matrix of the subgraph.

[0085] Step 3: Obtain the final representation e of the target node i The parameters of GCN can be used to map the target node to the same embedding space as the subgraph. The hidden layer representation of the target node is as follows:

[0086]

[0087] In formula (3) W l These are shared parameters of GCN, and the final target node embedding vector is represented by e. i express.

[0088] Step 4 calculates node-subgraph similarity. In each view, the anomaly of the target node is closely related to the subgraph. A bilinear model can be used here to measure node-subgraph similarity. Figure Two The relationship between the parties:

[0089]

[0090] in, This represents the similarity between the target node and its subgraph embedding in the original view. In positive sample pairs, the target node and its subgraph are similar. The value is close to 1, while in negative sample pairs... Close to 0.

[0091] Step 5: Loss Function Design. Use cross-entropy loss to train the contrastive loss:

[0092]

[0093] Among them, y i =1 indicates that the sample is a positive sample pair, y i =0 indicates that the samples are negative sample pairs. Similarity can be defined in the augmented view in the same way. and loss These two views share parameters; therefore, the final node-subgraph contrast loss can be expressed as:

[0094]

[0095] Here, α∈(0,1) is a weighting coefficient used to balance the importance of the two views.

[0096] Node-to-node comparison is to compare the target node v in a sample pair. i The comparison with the target node in the subgraph can be described as follows:

[0097] Step 1: Mask the target node to obtain the hidden layer representation of the subgraph corresponding to the target node. First, mask the target node in the subgraph, and then learn the hidden layer representation of the subgraph, as shown in formula (7):

[0098]

[0099] Among them, W′ l It is a parameter matrix, and the parameter matrix W is compared with the node-subgraph. l It's not the same matrix; it's used to train a new GCN.

[0100] Step 2: Obtain the representation of the target node in the subgraph. The v of the target node in the subgraph... i The representation at layer l+1 is: This yields the final representation of the target node in the subgraph: u i .

[0101] Step 3: Obtain the final representation of the target node through node-to-node comparison. GCN parameters can be used to target node v i The mapping is applied to the same embedding space as the subgraph. The hidden layer representation of the target node is as follows:

[0102]

[0103] Among them, W′ l It is the parameter matrix in formula (7), which ultimately embeds the target node into the sub-node. Figure One Such a low-dimensional space is denoted as:

[0104] Step 4: Design the loss function. Similar to the node-subgraph comparison loss, the loss function is calculated using a bilinear model. and u i similarity between Similar to formula (5), the loss function for node-to-node contrastive learning can be expressed as:

[0105]

[0106] Similarly, the similarity on the augmented view can be calculated. With loss The total loss function for node-to-node comparisons is:

[0107]

[0108] Node-to-node comparison view balance parameters and formula (6) Node-to-subgraph comparison sharing.

[0109] Subgraph-to-subgraph comparison is performed between the original view and the enhanced view. For the target node v i The positive and negative samples of the subgraph come from the original view and the enhanced view. A subgraph G is generated in the original view, starting from itself. i Similarly, G is obtained in the enhanced view. i ′, and transfer these two subgraphs G i G i ′ is defined as a positive sample. It will be used with another node v j Two subgraphs generated from the starting point Let this be denoted as a negative sample. The loss function can be expressed as:

[0110]

[0111] In this formula, z i and z′ i Represents the target node v i Corresponding positive sample subgraph G i G i Low-dimensional embedding in two views and It is node v i Corresponding negative sample subgraph The negative sample low-dimensional embedding.

[0112] Node-global comparison is to compare the target node v i By comparing the information with that of the entire graph, global graph information can be obtained by maximizing mutual information using DGI. The specific comparison process can be described as follows:

[0113] Step 1: Obtain the embedded representation of the original view.

[0114]

[0115] In formula (12), H l+1 and H l These represent the hidden representations of the original graph at layer (l+1) and layer l, respectively. It is a normalized adjacency matrix, W″ l This represents the parameters of the graph neural network.

[0116] Step 2: Obtain the global information of the original view. The global representation of the entire graph is obtained using the Readout function, and this global information is denoted as g.

[0117]

[0118] Step 3: Calculate node-global similarity. During training, the target node needs to be mapped to the same embedding space as the global information. In the node-global comparison network, formula (3) is used to map the target node to the same embedding space as the global information. The final mapping of the target node is expressed as: e i For all target nodes v i A bilinear model is used to calculate similarity, and the similarity between the target node and global information is represented by the symbol. express:

[0119]

[0120] During the comparison, e i This represents the embedded representation of the target node. This represents the similarity score between the node and the global information; the higher the similarity between the target node and the global information, the better.

[0121] Step 4: The loss function can be expressed as:

[0122]

[0123] In formula (15), Let represent the similarity score between the node and the global information. During optimization, all nodes should be as close as possible to the global information, so the loss function of formula (15) is adopted.

[0124] The loss function is crucial for training the model. The entire model is trained using contrastive learning. In this embodiment, full-granularity comparisons are employed: node-subgraph, node-node, subgraph-subgraph, and node-global comparisons are performed. Each granularity has its own loss function. To comprehensively consider the full-granularity loss, the loss of each granularity is calculated together, and its mathematical expression can be represented as:

[0125] L=βL NS +(1-β)L NN +γL SS +ηL NG (16)

[0126] β∈(0,1) is used to balance the outlier information at the subgraph level and the node level, and γ,η∈(0,1) are trade-off parameters used to control the impact of subgraph-subgraph and node-global loss on the entire training process.

[0127] S103. Calculate the outlier score of each node based on the full-granularity contrastive learning network, and determine the outlier nodes in the attribute network based on the outlier score. The outlier score includes the node-subgraph outlier score, the node-node outlier score, and the node-global outlier score.

[0128] After the model training is complete, the trained model is used to calculate v for each node. i The anomaly is worth dividing S. i The anomaly score consists of three parts: subgraph level, node level, and global level.

[0129] Specifically, the outlier score for each node, calculated using a full-granularity contrastive learning network, can be designed to include the following:

[0130] Based on the similarity between nodes and subgraphs, subgraph-level anomaly scores of nodes on the original attribute network and attribute enhancement network are obtained, and anomaly scores between nodes and subgraphs are obtained based on the subgraph-level anomaly scores.

[0131] Based on the similarity between nodes, the node-level anomaly score of each node in the original attribute network and the attribute enhancement network is obtained, and the anomaly score between nodes is obtained based on the node-level anomaly score.

[0132] The global anomaly score of a node on the original attribute network is obtained based on the similarity between the node and the global network, and the anomaly score between the node and the global network is obtained based on the global anomaly score.

[0133] The final score of the corresponding node is calculated by combining the anomaly scores of each node.

[0134] It can perform multiple rounds of random sampling on each node, and take the average score of the outlier values ​​of each node as the final outlier value; according to the size of the final outlier value, the nodes are sorted, and the nodes with the highest ranking are judged as outlier nodes according to the preset threshold.

[0135] The outlier scores at the subgraph level are calculated based on positive and negative samples, and the calculation formula is shown in (17):

[0136]

[0137] In formula (17), It is the similarity between nodes and negative samples in the subgraph. This represents the similarity between nodes and positive samples in the subgraph. i k Represents node v i The anomaly scores on the initial view or enhanced view are calculated, where k=1 represents the initial view and k=2 represents the enhanced view. Node v is calculated according to formula (17). i In the anomaly score of the two views, denote node v. i The anomaly score on the original view is Anomalies in the enhanced view are categorized into Then, by combining the scores of the original view and the enhanced view, the subgraph-level anomaly score is calculated, as shown in formula (18):

[0138]

[0139] The calculation of anomaly scores at the node level is similar to that at the subgraph level. First, the node v is calculated based on formula (17) and node-to-node similarity. i Anomalies in the original view and the enhanced view are scored. Then, by combining the scores of the original view and the enhanced view, the node-level anomaly score is calculated, as shown in formula (19):

[0140]

[0141] The global anomaly score is calculated by comparing the node with global information, which is obtained from the original view. Therefore, the global anomaly score only needs to calculate the similarity between the node and the original view, and the negative of the similarity is used as the global anomaly score, as shown in formula (20).

[0142]

[0143] Next, by combining the outlier scores from the three granularities, the final score for each node is calculated, as shown in formula (21):

[0144]

[0145] In this context, α and formula (6), and β, η and formula (16) share parameters.

[0146] Because random walks have a certain degree of uncertainty, multiple rounds of random sampling can be performed on each node, and the average score of each node across multiple rounds can be used as the final outlier score.

[0147]

[0148] Where R is the number of random samples performed for each target node.

[0149] Furthermore, based on the above methods, this embodiment of the invention also provides a network node full-granularity anomaly detection system based on attribute augmentation sampling, comprising: an augmentation sampling module, a contrastive learning module, and an anomaly detection module, wherein,

[0150] The enhanced sampling module is used to obtain the attribute-enhanced network of the original attribute network based on the attribute enhancement method, and to generate positive and negative sample pairs of the original attribute network and the attribute-enhanced network through subgraph sampling by interval random walk;

[0151] The contrastive learning module is used to construct a full-granularity contrastive learning network that includes nodes and subgraphs, nodes and nodes, subgraphs and subgraphs, and nodes and the global context using positive and negative sample pairs. This full-granularity contrastive learning network is used to capture anomalous information of nodes at the subgraph level, node level, and global context.

[0152] The anomaly detection module is used to calculate the anomaly score of each node based on the full-granularity contrastive learning network, and to determine the abnormal nodes in the attribute network based on the anomaly score. The anomaly score includes the node-subgraph anomaly score, the node-node anomaly score, and the node-global anomaly score.

[0153] To verify the effectiveness of this solution, the following explanation is based on experimental data:

[0154] Experimental data: Experiments were conducted on four widely used attribute network anomaly detection benchmark datasets, including two social network datasets (BlogCatalog and Flickr) and two citation network datasets (Cora and ACM).

[0155] Social Network Datasets: BlogCatalog and Flickr are two typical social network datasets derived from the blog-sharing website BlogCatalog and the image hosting website Flickr. In these datasets, nodes represent website users, and links represent the following relationships between users. Node attributes consist of personalized content from the user, such as tags for blog posts, shared images, and custom tags.

[0156] Citation Network Datasets: Cora and ACM are two available citation network datasets. In these datasets, nodes represent published papers, while edges represent citation relationships between papers. Node attributes consist of information such as the article's field and keywords.

[0157] The statistical information for the four datasets is shown in Table 1: The table shows the number of nodes, the number of edges, the size of the attribute dimensions, and the number of injected abnormal nodes for each dataset.

[0158] Table 1 Statistical Analysis of Attribute Network Information

[0159] BlogCatalog Cora Flickr ACM Node 5196 2708 7575 16484 Edges 171743 5429 239738 71980 Attributes 8189 1433 12047 8337 Anomalics 300 100 400 800

[0160] The node attributes of the above four datasets are all vectorized using the bag-of-words model. Each node's attribute is represented by a vector, and the size of the vector dimension is determined by the size of the dictionary in the bag-of-words model.

[0161] Since the four datasets mentioned above do not have labeled anomalous nodes, and there is currently no unified standard for labeling anomalous nodes, the widely used structural perturbation and attribute perturbation anomaly injection methods are adopted in practice.

[0162] This method injects structurally anomalous nodes by perturbing the network topology. The underlying principle is that in many real-world scenarios, few nodes in a subgraph have fully connected connections, thus fully connected structures are considered anomalous. First, m subgraphs are randomly selected from the network, each with n nodes. Then, the n nodes in these m subgraphs are fully connected, forming a fully connected structure. These fully connected nodes in the subgraphs are considered structurally anomalous nodes.

[0163] Attribute anomalous nodes are generated by perturbing node attributes. The attributes of the target node are perturbed using the node with the largest Euclidean distance from it in the network. First, m×n nodes are randomly selected from the network as candidate attribute anomalous nodes. Then, for each target node among the candidate nodes, k nodes are randomly selected from the data excluding the candidate nodes. The Euclidean distance between the target node and the k nodes is calculated, and the node j with the largest Euclidean distance from the target node is found. Next, the attribute of the target node is replaced with the attribute of node j. Finally, these m×n nodes are used to generate attribute anomalous nodes.

[0164] Based on the injection method described above and according to the network size, approximately 5% of the network size of anomalous nodes were injected into each dataset. The resulting perturbed network is shown in the last row of Table 1, with the total number of anomalies listed therein. In this experiment, all class labels were removed; anomalous labels are only visible during the inference phase.

[0165] Experimental setup: The proposed scheme FGAnomAES (e.g.) Figure 2 This is compared with the seven mainstream attribute network anomaly detection methods shown below:

[0166] LOF: An attribute-based anomaly detection method. It determines whether a node is an anomaly by observing the attribute values ​​of nodes within the same community. It only considers the attribute information of the nodes and ignores structural anomalies in the attribute network.

[0167] ANOMALOUS is a residual analysis-based anomaly detection method. It's a joint learning framework that performs anomaly detection holistically based on CUR decomposition and residual analysis. However, it only considers structural anomalies and ignores attribute-related anomalies.

[0168] DOMINANT: An anomaly detection architecture based on graph neural networks. It utilizes graph convolution and autoencoders to jointly reconstruct the adjacency matrix and attribute matrix. The anomaly level of each node is evaluated by calculating the reconstruction error. However, this method suffers from oversmoothing; when GCN aggregates neighbor information, it smooths out anomaly information.

[0169] CoLA: An anomaly detection architecture based on contrastive learning. It constructs a node-subgraph comparison through instance sampling; trains a GCN network to fully capture local feature information of nodes, improving detection accuracy compared to graph neural networks. This method does not consider node-level or global-level anomalies.

[0170] ANEMONE: An anomaly detection architecture based on contrastive learning. Building upon CoLA, it introduces node-to-node contrast to capture anomalies at multiple scales. However, it does not fully utilize information from subgraphs and does not consider global anomalies.

[0171] Sub-CR: An anomaly detection architecture based on contrastive learning. It detects anomalies by using contrastive learning and network reconstruction, enabling it to capture global anomalies. However, this method neglects the utilization of subgraph information during anomaly detection.

[0172] GRADATE: An anomaly detection architecture based on contrastive learning. It performs node-to-node and node-to-subgraph comparisons within a view; and subgraph-to-subgraph comparisons between views; calculating the anomaly score for each node based on the comparison information. However, this method fails to ensure sufficient contrast between positive and negative samples during sampling and does not detect global anomalies.

[0173] To measure the performance of our proposed method and benchmark methods, we used the Area Under the Curve (AUC), a widely used metric for evaluating anomaly detection performance. AUC is a common indicator for evaluating the performance of binary classification models; it represents the area under the ROC curve. Physically, it represents the probability that, given random positive and negative examples, the model is more likely to predict a positive example as positive than it is likely to predict a negative example as positive. Therefore, a higher AUC value indicates better model performance, meaning the model is more accurate in distinguishing between positive and negative examples.

[0174] The attribute similarity threshold T was set to the top 60% of similarity, and the sampled subgraph size was set to 4. In the graph neural network contrastive learning model, the number of layers was set to 1. The embedding dimension was fixed at 64. During training, the batch size for each dataset was set to 300. The Adam optimization algorithm was used to train the model. The number of training epochs was set to 300. Anomaly scores were calculated over 256 epochs, and the average score over these 256 epochs was used as the final anomaly score for the target node.

[0175] I. Performance Comparison Test

[0176] The experimental results of the FGAnomAES model and seven other baseline models in this study are shown in Table 2, along with the AUC results of each model. Figure 4 The AUC values ​​shown are for comparison purposes.

[0177] Table 2 Comparison of AUC Performance

[0178]

[0179] From Table 2 and Figure 4 The following conclusions can be drawn:

[0180] (1) The FGAnomAES model proposed in this case outperforms other comparative models on four datasets. Specifically, the FGAnomAES model proposed in this case achieves certain improvements on BlogCatalog, Cora, Flicker, and ACM, with AUC values ​​increased by 1.75%, 1.32%, 3.17%, and 1.61% respectively compared to the best comparative model. This indicates that the FGAnomAES model proposed in this case generates enhanced views through attribute augmentation, ensuring sufficient contrast between positive and negative samples during the sampling process. Furthermore, the FGAnomAES model proposed in this case also incorporates global information into anomaly node detection, improving detection accuracy.

[0181] (2) Shallow methods such as LOF and ANOMALOUS are not as effective as deep learning in detecting abnormal nodes. This indicates that layered mechanisms cannot capture the attributes and structure of high-dimensional nodes, and their ability to process network structures is limited.

[0182] (3) Among deep learning methods, the overall performance of contrastive learning-based methods such as CoLA, ANEMONE, Sub-CR, and GRADATE is better. Experimental results show that the contrastive learning-based training mode can fully consider the structure of the attribute graph and attribute information to better detect abnormal nodes. By adding global contrast and attribute augmentation view sampling, AnomAESG achieves the best performance in detecting abnormal nodes in attribute networks.

[0183] II. Model Parameter Analysis Experiment

[0184] This study investigates the impact of three key parameters—attribute similarity threshold T, subgraph size, and embedding dimension—on the performance of the FGAnomAES algorithm in this case.

[0185] The attribute similarity threshold determines the number of augmented view edges, and augmented views have a significant impact on model performance. In the experiments, the attribute similarity thresholds were set to: top 10%, 20%, 30%, 40%, 50%, 60%, 70%, 80%, and 90%. The experimental results are as follows: Figure 5As shown in (a) of the diagram. The experimental results show that as the attribute similarity threshold increases, the AUC value of the algorithm gradually increases. When the similarity threshold exceeds 60% of the attribute similarity, the model's AUC value remains essentially unchanged or decreases, with only a slight increase on the ACM dataset. Therefore, the attribute similarity threshold for the model is set to the top 60%.

[0186] The number of nodes in a subgraph, i.e., the subgraph size, is a key parameter affecting model performance during subgraph sampling. This paper sets the subgraph size sequentially from 1 to 9. Experimental results are as follows: Figure 5 As shown in (b) of the diagram, the model performs poorly when the subgraph is too small. As the subgraph size increases, the model's performance gradually improves. However, when the subgraph size reaches 4, increasing the subgraph size no longer improves the algorithm's performance.

[0187] The embedding dimension is the size of the representation vector for each node. It's a key factor affecting model performance; we observe its impact on model performance by continuously changing the embedding dimension. The model's AUC value changes as follows: Figure 5 As shown in (c) above, the AUC value increases with the embedding dimension for each dataset. Anomaly detection performance steadily improves as the embedding dimension increases from 1 to 32; however, the performance improvement slows down with further increases in the embedding dimension. For most datasets, 64 dimensions are sufficient to provide enough information for downstream anomaly detection. Therefore, the algorithm in this case sets the embedding dimension to 64.

[0188] III. Ablation Analysis

[0189] To verify the effectiveness of attribute augmentation sampling, four other methods for generating augmented views were used to replace the attribute augmentation method in this case, resulting in new models that were then compared with the model in this case. The four methods for generating augmented views are described below:

[0190] Gaussian Noise Feature (GNF): The original features of nodes are perturbed by random Gaussian noise, and the perturbed view serves as an enhanced view. Feature Mask (FM): Randomly masks certain features of nodes. Graph Diffusion (GD): Generates a graph diffusion matrix using a diffusion model. Edge Modification (EM): Deletes edges from the adjacency matrix and adds a corresponding number of edges.

[0191] GNF and FM are perturbations of node features. GD and edge modification EM are graph augmentation methods widely used on graph edges.

[0192] Attribute-enhanced views also involve modifications to the edges. They achieved best performance on all four datasets, as shown in Table 3. Figure 6As shown. For ease of description, the model after replacing attribute enhancement is denoted as: FG - Enhancement Method. For example, FG-GCN: indicates the model obtained by replacing attribute enhancement with GNF.

[0193] Table 3 shows the research on ablation strategies enhanced by graphs.

[0194]

[0195] from Figure 6 It is evident that the attribute augmentation method achieves the best AUC across all four datasets, outperforming the best-performing comparison method, EM, by 1.61%. Further analysis reveals that: GNF's feature perturbation of nodes may disrupt the features of normal nodes, impairing the comparison between a node and its neighbors and undermining the foundation of attribute network anomaly detection. Consequently, some normal nodes are incorrectly classified as anomalies, leading to lower model performance. GD and EM, employing structure-based graph augmentation methods, fail to ensure sufficiently high attribute contrast, resulting in limited performance improvements. The attribute augmentation method, without disrupting node attributes, utilizes both structure and attributes for graph augmentation, ensuring edges connect points with similar attributes. This allows the model to more accurately capture node features, thus effectively improving anomaly detection performance.

[0196] To verify the effectiveness of the full-granularity anomaly detection incorporating global features, the new model obtained by removing global features is compared with the model in this solution:

[0197] The new model, which incorporates global granularity features, is compared with the original model in the (CoLA) node-subgraph comparison, (ANEMON) node-subgraph comparison, and node-node comparison. The impact of global granularity features on anomaly node detection is analyzed.

[0198] For ease of description, N represents a node, S represents a subgraph, and GLO represents the global graph. For example, NS represents a node-subgraph comparison. Specific comparison information is shown in Table 4.

[0199] Table 4 shows the AUC values ​​of each model after adding global features.

[0200]

[0201] As shown in Table 4, the addition of global granular features improved the model's performance on all four datasets, with AUC values ​​increasing by 1.61%, 1.17%, 3.12%, and 1.54%, respectively. This demonstrates the necessity of global granular features in anomaly detection. In the (ANEMON) and (CoLA) models, simply adding global granular features resulted in an AUC value increase of at least 1.1%. This indicates that anomaly features in attribute networks are not limited to node-level and subgraph-level features but also include global granular features. Therefore, incorporating global feature capture is beneficial for performance improvement in attribute network anomaly detection.

[0202] Based on the above experimental data, it can be demonstrated that the proposed solution, by utilizing attribute-enhanced sampling and introducing global graph information, can improve the accuracy of detecting abnormal nodes in attribute networks and can be deployed and applied in actual attribute network security analysis.

[0203] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0204] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0205] The units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations are not considered to be beyond the scope of this invention.

[0206] Those skilled in the art will understand that all or part of the steps in the above methods can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk. Optionally, all or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiments can be implemented in hardware or as a software functional module. This invention is not limited to any particular combination of hardware and software.

[0207] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for full-granularity anomaly detection of network nodes based on attribute augmentation sampling, characterized in that, Include: An attribute-enhanced network is obtained from the original attribute network using attribute enhancement methods. Positive and negative sample pairs between the original and enhanced attribute networks are generated through subgraph sampling using interval random walks. The attribute-enhanced network obtained from the original attribute network includes: first, extracting key attribute features of the nodes in the original attribute network using a trained autoencoder to obtain a new attribute feature matrix; then, calculating the similarity between any two nodes. If the similarity between nodes is greater than a similarity threshold and there are no edges connecting the nodes, an edge is added between the corresponding nodes to obtain a new adjacency matrix, and the corresponding attribute-enhanced network is generated. Subgraph sampling using an over-interval random walk generates positive and negative sample pairs for both the original attribute network and the attribute enhancement network. This process includes: starting from the target node, performing positive sample subgraph sampling on both the original and attribute enhancement networks based on a restarted random walk, resulting in positive sample pairs on the original and attribute enhancement networks, each consisting of the target node and a positive sample subgraph; then, performing subgraph sampling on the second node, which is two hops away from the target node, to obtain a subgraph starting from the second node, and using this subgraph as the negative sample subgraph for the target node, resulting in negative sample pairs on both the original and attribute enhancement networks, each consisting of the target node and a negative sample subgraph. We construct a full-granularity contrastive learning network using positive and negative sample pairs, which includes node-subgraph, node-node, subgraph-subgraph, and node-global comparisons, in order to capture anomalous information of nodes at the subgraph, node, and global levels. The construction of a full-granularity contrastive learning network, including node-subgraph, node-node, subgraph-subgraph, and node-global comparisons, involves: first, setting contrastive learning losses for each granularity (node-subgraph, node-node, subgraph-subgraph, and node-global comparisons), and setting a joint training objective function based on each granularity contrastive learning loss; then, using positive and negative sample pairs from the original attribute network and attribute enhancement network, along with global network information, as input data to the GCN neural network structure, training the GCN neural network based on the joint training objective function, and using the trained GCN neural network as the full-granularity contrastive learning network. The anomaly score of each node is calculated based on the full-granularity contrastive learning network, and the abnormal nodes in the attribute network are determined based on the anomaly score. The anomaly score includes the node-subgraph anomaly score, the node-node anomaly score, and the node-global anomaly score.

2. The network node full-granularity anomaly detection method based on attribute augmentation sampling according to claim 1, characterized in that, A joint training objective function is set based on contrastive learning loss at various granularities, including: The target node is masked in the positive and negative sample subgraphs to obtain the hidden layer representation of the subgraph corresponding to the target node; the subgraph feature representation is obtained by aggregating node features; the target node is mapped to the subgraph embedding space and the target node embedding vector representation is obtained. The similarity between a node and a subgraph is measured based on the feature representation of the subgraph and the embedding vector representation of the target node, and the contrast loss between the node and the subgraph is obtained based on the similarity between the node and the subgraph. The similarity between nodes in positive and negative sample pairs and nodes in the subgraph is measured based on the hidden layer representation and embedding vector representation of target nodes in the subgraph, and the contrast loss between nodes is obtained based on the similarity between nodes. The subgraph comparison loss is obtained based on the embedding representation of the positive and negative sample subgraphs corresponding to the target node in the original attribute network and the attribute enhancement network. Global information is obtained based on the original attribute network embedding representation. The target node is mapped to an embedding space consistent with the global information to obtain the target node mapping representation. The similarity between the node and the global information is obtained based on the global information and the target mapping representation. The comparison loss between the node and the global information is obtained based on the similarity between the node and the global information. The joint training objective function is set based on the comparison loss between nodes and subgraphs, the comparison loss between nodes, the comparison loss between subgraphs, and the comparison loss between nodes and the global graph, and the balance factor and trade-off parameters.

3. The network node full-granularity anomaly detection method based on attribute-enhanced sampling according to claim 1 or 2, characterized in that, The joint training objective function is expressed as: L = βL NS +(1-β)L NN +γL SS +ηL NG Where β is the balance factor, γ,η are the trade-off parameters, and L NS L is the loss for comparing nodes and subgraphs. NN For node-to-node comparison loss, L SS For subgraph-to-subgraph contrast loss, L NG The loss is calculated by comparing the node with the global comparison.

4. The network node full-granularity anomaly detection method based on attribute augmentation sampling according to claim 1, characterized in that, The outlier score for each node is calculated based on a full-granularity contrastive learning network, including: Based on the similarity between nodes and subgraphs, subgraph-level anomaly scores of nodes on the original attribute network and attribute enhancement network are obtained, and anomaly scores between nodes and subgraphs are obtained based on the subgraph-level anomaly scores. Based on the similarity between nodes, the node-level anomaly score of each node in the original attribute network and the attribute enhancement network is obtained, and the anomaly score between nodes is obtained based on the node-level anomaly score. The global anomaly score of a node on the original attribute network is obtained based on the similarity between the node and the global network, and the anomaly score between the node and the global network is obtained based on the global anomaly score. The final score of the corresponding node is calculated by combining the anomaly scores of each node.

5. The network node full-granularity anomaly detection method based on attribute-enhanced sampling according to claim 1 or 4, characterized in that, node v i The final score S i The calculation formula is expressed as: Where β is the balance factor and η is the compromise parameter. These are the scores for anomalies between nodes and subgraphs, anomalies between nodes, and anomalies between nodes and the global graph.

6. The network node full-granularity anomaly detection method based on attribute augmentation sampling according to claim 1 or 4, characterized in that, Based on the outlier scores, outlier nodes in the attribute network are also identified, including: Multiple rounds of random sampling are performed on each node, and the average score of the outlier values ​​of each node in multiple rounds is taken as the final outlier value; Based on the final outlier size, the nodes are sorted, and the nodes with the highest ranking are identified as outliers according to a preset threshold.

7. A network node full-granularity anomaly detection system based on attribute augmentation sampling, characterized in that, It includes: an enhanced sampling module, a contrastive learning module, and an anomaly detection module, among which, The enhanced sampling module is used to obtain the attribute-enhanced network of the original attribute network based on attribute enhancement methods, and to generate positive and negative sample pairs between the original attribute network and the attribute-enhanced network through subgraph sampling using interval random walks. The acquisition of the attribute-enhanced network based on attribute enhancement methods includes: first, extracting key attribute features of the nodes in the original attribute network using a trained autoencoder to obtain a new attribute feature matrix; then, calculating the similarity between any two nodes; if the similarity between nodes is greater than a similarity threshold and there are no edges connecting the nodes, adding edges between the corresponding nodes to obtain a new adjacency matrix, and generating the corresponding attribute enhancement matrix. A strong network is generated by sampling positive and negative samples from the original attribute network and the attribute enhancement network through subgraph sampling using interval random walks. This includes: starting from the target node, sampling positive sample subgraphs on both the original attribute network and the attribute enhancement network based on restarted random walks, resulting in positive sample pairs on the original attribute network and the attribute enhancement network, respectively composed of the target node and the positive sample subgraph; sampling the subgraph of the second node, which is two hops away from the target node, to obtain a subgraph starting from the second node, and using this subgraph as the negative sample subgraph of the target node, resulting in negative sample pairs on both the original attribute network and the attribute enhancement network, composed of the target node and the negative sample subgraph. The contrastive learning module is used to construct a full-granularity contrastive learning network (GCN) encompassing node-subgraph, node-node, subgraph-subgraph, and node-global comparisons using positive and negative sample pairs. This network is used to capture anomalous information of nodes at the subgraph, node, and global levels. The construction of this network involves: first, setting contrastive learning losses at each granularity (node-subgraph, node-node, subgraph-subgraph, and node-global comparisons), and setting a joint training objective function based on these losses; then, using positive and negative sample pairs from the original attribute network and attribute enhancement network, along with global network information, as input data to the GCN neural network structure, training the GCN neural network based on the joint training objective function, and using the trained GCN neural network as the full-granularity contrastive learning network. The anomaly detection module is used to calculate the anomaly score of each node based on the full-granularity contrastive learning network, and to determine the abnormal nodes in the attribute network based on the anomaly score. The anomaly score includes the node-subgraph anomaly score, the node-node anomaly score, and the node-global anomaly score.

Images