Graph neural network-based communication network robustness testing method and related device

Abstract

The application provides a communication network robustness test method based on a graph neural network and related equipment; the method comprises the following steps: inputting graph data of a communication network into a graph convolutional neural network, slicing the graph convolutional neural network, and determining a slice attribute matrix; determining the spatial range of the perturbed slice attribute matrix, classifying the perturbed nodes by using the sliced graph convolutional neural network, obtaining a perturbed classification result, and constructing a constraint condition by using the perturbed classification result and the perturbed node attribute matrix; constructing a linear boundary of each layer activation function to determine an output boundary, performing back propagation based on the output boundary of the layer, obtaining the output boundary of the sliced graph convolutional neural network, determining the maximum value of the perturbation budget according to whether the output of the node under the current perturbation budget meets the constraint condition, and judging whether the classification result of the node is reliable according to the maximum value of the perturbation budget.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of communication network resistance to attack, and in particular to a communication network robustness verification method based on a graph neural network and related equipment. BACKGROUND

[0002] In a communication network, when a node therein is attacked, the data related to the attribute of the node is disturbed, so that it is difficult to determine the category of the node. When a neural network is used to determine the category of the node, the attribute data of the node is disturbed, and problems such as determining a key node as a non-key node occur. SUMMARY

[0003] Therefore, the purpose of the present application is to provide a communication network robustness verification method based on a graph neural network and related equipment.

[0004] To achieve the above purpose, the present application provides a communication network robustness verification method based on a graph neural network, comprising:

[0005] The attributes of all nodes in a preset communication network are combined to form graph data of the communication network, and the graph data is input into a preset graph convolutional neural network. For each node, the graph convolutional neural network is sliced to obtain a sliced graph convolutional neural network, and a slice attribute matrix is determined.

[0006] The spatial range of the slice attribute matrix of the node after being disturbed by an attack is determined, the disturbed node is classified by using the sliced graph convolutional neural network to obtain a classification result after disturbance, and a constraint condition in the spatial range is constructed by using the classification result after disturbance and the attribute matrix of the disturbed node.

[0007] A linear boundary of an activation function is constructed for each layer of the sliced graph convolutional neural network to determine an output boundary of the layer, back propagation is performed based on the output boundary of the layer to obtain an output boundary of the sliced graph convolutional neural network, and whether the output of the node under a current disturbance budget meets the constraint condition is determined to determine a maximum value of the disturbance budget. Whether the classification result of the node is reliable is determined based on the maximum value of the disturbance budget.

[0008] Further, the graph data includes a node attribute matrix, and each layer of the graph convolutional neural network includes a message passing matrix.

[0009] Further, the graph convolutional neural network is sliced to obtain a slice attribute matrix, comprising:

[0010] slice the message passing matrix of each layer of the graph convolutional neural network to obtain a sliced message passing matrix, and slice the node attribute matrix to obtain a sliced attribute matrix;

[0011] The sliced message passing matrix includes rows and columns corresponding to the node disturbed by the attack, and includes rows and columns corresponding to the neighbor nodes of the node in multiple hops;

[0012] The sliced attribute matrix includes rows of the node disturbed by the attack, and includes rows of the neighbor nodes of the node in multiple hops;

[0013] The sliced attribute matrix includes rows of the node disturbed by the attack, and includes rows of the neighbor nodes of the node in multiple hops;

[0014] Further, the disturbance budget includes a global disturbance budget and a local disturbance budget;

[0015] Further, determining the spatial range of the sliced attribute matrix of the node after being disturbed by the attack includes:

[0016] For the node disturbed by the attack, determining the node attribute matrix of the sliced attribute matrix of the node after being disturbed by the attack;

[0017] Using the sliced attribute matrix of the node before disturbance and the node attribute matrix after disturbance, the spatial range is constructed as shown below:

[0018]

[0019] wherein, The spatial range based on the global disturbance budget Q and the local disturbance budget q is represented by The node attribute matrix after disturbance is represented by The sliced attribute matrix before disturbance is represented by Q, the global disturbance budget, q represents the local disturbance budget about the node, and there is q=k·Q, k represents a preset constant, L represents the number of layers of the graph convolutional neural network, N L-1 The neighbor node of the node in the L-1th hop is represented by the subscript nj, and the element in the nth row and jth column of the matrix is represented by n: all elements in the nth row.

[0020] Further, the constraint condition includes a first constraint condition and a second constraint condition;

[0021] Further, the constraint condition in the spatial range is constructed using the disturbed classification result and the disturbed node attribute matrix, including:

[0022] For the node disturbed by the attack, after the sliced graph convolutional neural network classifies the node attribute matrix after disturbance, the probability of the real class and the maximum probability are determined.

[0023] a difference between the probability of the real class and the maximum probability is greater than zero as the first constraint condition;

[0024] the spatial range as the second constraint condition for the perturbed node attribute matrix.

[0025] Further, the linear boundary includes a linear boundary upper bound and a linear boundary lower bound;

[0026] The linear boundary of the activation function of each layer of the sliced graph convolutional neural network is constructed to determine the output boundary of the layer, comprising:

[0027] For the activation function of each layer of the sliced convolutional neural network, in response to determining that the inputs of the activation function of the layer are all in the positive interval, the linear boundary upper bound and the linear boundary lower bound of the activation function of the layer are both set to h(y)=y;

[0028] In response to determining that the inputs of the activation function of the layer are all in the negative interval, the linear boundary upper bound and the linear boundary lower bound of the activation function of the layer are both set to h(y)=0;

[0029] In response to determining that the inputs of the activation function of the layer exist in both the positive interval and the negative interval, the linear boundary upper bound of the activation function of the layer is set to and the linear boundary lower bound is set to h R (y)=0, h R (y)=y and ;

[0030] wherein y represents the input of the activation function of the layer, and there exists y∈[R,U], R represents the first boundary of the input of the activation function, U represents the second boundary of the activation function, h(y) represents the linear boundary when the inputs of the activation function are all in the positive interval or all in the negative interval, h U (y) represents the linear upper boundary when the inputs of the activation function of the layer exist in both the positive interval and the negative interval, h R (y) represents the linear lower boundary when the inputs of the activation function of the layer exist in both the positive interval and the negative interval, represents the linear boundary upper bound of the kth element in the matrix of the input of the lth layer of the sliced graph convolutional neural network, represents the linear boundary lower bound of the kth element in the matrix of the input of the lth layer of the sliced graph convolutional neural network;

[0031] The linear boundary is used to replace the activation function of the layer, and the output boundary of the layer is obtained.

[0032] Further, the maximum value of the perturbation budget is determined according to whether the output of the node under the current perturbation budget meets the constraint condition, comprising:

[0033] In each iteration, the local perturbation budget of the node in the current round is determined according to the global perturbation budget in the current round;

[0034] Under the global perturbation budget in the current round and the local perturbation budget in the current round, it is judged whether the output result of the sliced graph convolutional neural network meets the constraint condition;

[0035] In response to determining that it does not meet, the current global perturbation budget is reduced by a preset step to obtain the global perturbation budget in the next round;

[0036] In response to determining that it meets, the current global perturbation budget is increased by a preset step of the local perturbation budget in the current round to obtain the global perturbation budget in the next round;

[0037] In response to determining that the preset iteration round is reached, the maximum value of the perturbation budget is determined.

[0038] Further, it is judged whether the classification result of the node is reliable according to the maximum value of the perturbation budget, comprising:

[0039] In response to determining that the node satisfies the constraint condition after being attacked and perturbed under the maximum value of the perturbation budget, it is determined that the classification result of the node is reliable.

[0040] Based on the same inventive concept, the application also provides a communication network robustness verification device based on a graph neural network, comprising a slicing module, a spatial range defining module and a lower boundary determining module;

[0041] The slicing module is configured to group the attributes of all nodes in a preset communication network into graph data of the communication network, input the graph data into a preset graph convolutional neural network, for each node, slice the graph convolutional neural network to obtain a sliced graph convolutional neural network, and determine a sliced attribute matrix.

[0042] The spatial range defining module is configured to determine the spatial range of the sliced attribute matrix of the node after being attacked and perturbed, classify the perturbed node using the sliced graph convolutional neural network to obtain a perturbed classification result, and construct a constraint condition in the spatial range using the perturbed classification result and the perturbed node attribute matrix.

[0043] The lower boundary determination module is configured to construct a linear boundary of an activation function for each layer of the sliced graph convolutional neural network to determine an output boundary of the layer, perform back propagation based on the output boundary of the layer to obtain an output boundary of the sliced graph convolutional neural network, determine a maximum value of the perturbation budget according to whether the output of the node under the current perturbation budget meets the constraint condition, and determine whether the classification result of the node is reliable according to the maximum value of the perturbation budget.

[0044] Based on the same inventive concept, the present application also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the graph neural network-based communication network robustness verification method according to any one of the above.

[0045] Based on the same inventive concept, the present application also provides a non-transitory computer readable storage medium, wherein the non-transitory computer readable storage medium stores computer instructions for causing the computer to execute the graph neural network-based communication network robustness verification method described above.

[0046] Based on the same inventive concept, the present application also provides a computer program product, comprising computer program instructions, which, when executed on a computer, cause the computer to execute the graph neural network-based communication network robustness verification method according to any one of the above.

[0047] As can be seen from the above, the graph neural network-based communication network robustness verification method and related devices provided by the present application are based on grouping the attributes of each node in the communication network into graph data, thereby using a graph convolutional neural network to classify each node in the graph data, and slicing the graph convolutional neural network, thereby reducing the size of the graph convolutional neural network while reducing other potential perturbations in addition to attack perturbations that need to be considered when verifying robustness; by defining the spatial range of node perturbation, a constraint condition on the classification result is constructed, and the maximum value of the perturbation budget that satisfies the constraint condition is determined, wherein the linear boundary is used to replace the activation function, and the output boundary of the graph convolutional neural network is determined by back propagation, so as to adjust the global perturbation budget in conjunction with the constraint condition, thereby obtaining the maximum value of the global perturbation budget, and using it as a lower bound of robustness, thereby determining whether the classification result of the node is correct when the node is perturbed. BRIEF DESCRIPTION OF DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the application or the related art, the following will briefly introduce the drawings needed to be used in the embodiments or the related art description. Obviously, the drawings in the following description only constitute the embodiments of the application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0049] Figure 1 Flow chart of the communication network robustness verification method based on a graph neural network according to an embodiment of the application;

[0050] Figure 2 Structure schematic diagram of the communication network robustness verification device based on a graph neural network according to an embodiment of the application;

[0051] Figure 3 Structure schematic diagram of the electronic device according to an embodiment of the application. DETAILED DESCRIPTION

[0052] In order to make the objectives, technical solutions and advantages of the application clearer, the following will further describe the application in detail with specific embodiments and with reference to the drawings.

[0053] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the application should be understood as the usual meanings understood by those skilled in the art to which the embodiments of the application belong. The terms "first", "second" and similar terms used in the embodiments of the application do not represent any order, number or importance, but are only used to distinguish different components. The terms "include" or "contain" and similar terms mean that the elements or objects before the terms cover the elements or objects listed after the terms and their equivalents, and do not exclude other elements or objects. The terms "connect" or "connected" and similar terms are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect.

[0054] As described in the background section, the related communication network robustness verification method based on a graph neural network is still difficult to meet the needs of communication networks in actual use.

[0055] The applicant has found that the main problem of the related communication network robustness verification method based on a graph neural network is that, in a communication network, when a node therein is attacked, the data related to the attribute of the node will be disturbed, so that it is difficult to determine the category of the node, and when a neural network is used to determine the category of the node, the attribute data of the node will be disturbed, and problems such as determining a key node as a non-key node will occur.

[0056] Based on this, one or more embodiments in the present application provide a communication network robustness checking method based on a graph neural network.

[0057] In the embodiments of the present application, the communication network contains a plurality of nodes as a specific example.

[0058] Among them, there are base stations as key nodes, repeaters as general nodes, etc.

[0059] In the present embodiment, the key nodes and general nodes are classified as categories of nodes, and other categories such as unimportant nodes, or for example, trusted nodes, untrusted nodes, etc. can also be included.

[0060] Among them, each node can only belong to one category.

[0061] Further, when any node in the communication network is attacked, the attribute of the node will be maliciously disturbed, that is, maliciously modified.

[0062] Further, the trained GCN (graph convolutional neural network) can use the attribute of the node to classify the node.

[0063] As can be seen, when the node is attacked, the degree of disturbance of its attribute is different, which can cause different results of the classification of the node by the GCN, that is, after the node is attacked, the classification result of the node will appear inconsistent with the true category of the node.

[0064] The embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0065] Reference Figure 1 The communication network robustness checking method based on a graph neural network of one embodiment of the present application includes the following steps:

[0066] Step S101, the attributes of all nodes in the preset communication network form the graph data of the communication network, the graph data is input into the preset graph convolutional neural network, for each node, the graph convolutional neural network after slicing is obtained by slicing the graph convolutional neural network, and the slicing attribute matrix is determined.

[0067] In the embodiments of the present application, the related data of each node in the communication network can form the graph data about the communication network, and the GCN can be used to process each node in the graph data, and before the GCN predicts each node, the GCN is pruned or sliced to reduce the size of the GCN and reduce other potential disturbances in addition to attack disturbances that need to be considered when verifying robustness.

[0068] Specifically, attribute data related to the attribute of each node can be determined, and the attribute data of the respective nodes can be grouped into a node attribute matrix in the graph data: X e {0, 1} N*D An adjacency matrix of the graph data can be constructed for the communication network: A e {0, 1} N*N to represent the topological structure information of the graph data, and the graph data is represented as G = (A, X) accordingly.

[0069] where N represents the number of nodes, D represents the number of columns in X, and the class set of the classification of each node is C = {1, …, K}.

[0070] Based on this, a general expression of the GCN for classifying nodes can be represented as follows:

[0071]

[0072] where H (l) represents the output matrix of the lth layer of the GCN, σ (l) (*) represents the operation of the ReLU (activation function) of the lth layer of the GCN, represents the message propagation matrix of the l-1th layer of the GCN, W (l-1) represents the trainable weight of the l-1th layer of the GCN, and b (l-1) represents the trainable bias of the l-1th layer of the GCN.

[0073] Further, for the message propagation matrix of each layer, the following equation is met:

[0074]

[0075] where satisfies the following equation:

[0076]

[0077] where I N×N represents the identity matrix.

[0078] In the present embodiment, the output matrix H of the GCN represents the probability of assigning the node t to the category c, and N l (t) represents the l-hop neighbor nodes of the node t, that is, all nodes reachable from the node t in l hops or less, including the node t itself.

[0079] Further, for the GCN with L layers, there is a message propagation mechanism, and the output matrix H of the node t only depends on its L-1-hop neighbor nodes N L-1The node in (t), according to which, when the GCN is sliced, in the sliced property matrix and the sliced message propagation matrix of the l-th layer of the GCN, only the elements required by the output matrix of the operation node t of the layer are included.

[0080] Based on this, the sliced message propagation matrix and the sliced property matrix can be expressed as follows:

[0081] Wherein, l = 1, …, L-1

[0082]

[0083] Wherein, The sliced message propagation matrix is represented by The sliced property matrix is represented by The subscript of indicates that the rows and columns of the matrix are sliced, for example, The subscript of contains the rows corresponding to the two-hop neighbor nodes of the node t and the columns corresponding to the three-hop neighbor nodes of the node t, The subscript of indicates the rows of the L-1-hop neighbor nodes of the node t and the row of the node t itself.

[0084] It can be seen that if the network depth l increases, the sliced message propagation matrix becomes smaller, and in the last layer of the GCN, only the single-hop neighbor nodes of the node t need to be considered.

[0085] Further, according to the sliced message propagation matrix and the sliced property matrix, the sliced GCN as shown below can be determined:

[0086] Wherein, l = 2, …, L

[0087] Wherein, l = 2, …, L-1

[0088]

[0089] Wherein, the output matrix of the l-th layer of the sliced GCH, the trainable weight W (·) And the bias b (·) Will not change due to the slicing of other arbitrary matrices, and if the network depth l increases, the matrix shape of each layer operation will become smaller, and until the last layer L, the output matrix of the sliced GCH Will be reduced to a vector representing only the log probability of the node t.

[0090] At the same time, the output of the sliced GCN can also be expressed as:

[0091]

[0092] wherein, θ represents the parameters of the GCN that can be trained, and there exists θ = {W (·) ,b (·)}, represents the prediction result of the category of the node t, that is, the output matrix of the GCN

[0093] In step S102, the spatial range of the slice attribute matrix of the node after being disturbed by the attack is determined, the disturbed node is classified by using the sliced graph convolutional neural network, and the classification result after being disturbed is obtained. The constraint condition in the spatial range is constructed by using the classification result after being disturbed and the disturbed node attribute matrix.

[0094] In the embodiment of the present application, for the above-mentioned sliced GCN, after the input of the graph data, for the related data points of any node t therein, when the attack disturbance to the node is less than the maximum value of the global disturbance budget, the prediction result of the sliced GCN for the node will not change due to the disturbance.

[0095] Based on this, the spatial range of the sliced attribute matrix after being disturbed under the global disturbance budget can be constructed, and the constraint condition in the spatial range can be constructed.

[0096] Specifically, for any node disturbed by the attack, the slice attribute matrix of the node The node attribute matrix after being disturbed to it is represented as The slice attribute matrix in the embodiment is a binary attribute matrix.

[0097] Further, the spatial range of the disturbed node attribute matrix as shown below is constructed:

[0098]

[0099] wherein, represents the spatial range based on the global disturbance budget Q and the local disturbance budget q, Q represents the global disturbance budget, q represents the local disturbance budget about the node, and there exists q = k·Q, K represents a preset constant, L represents the number of layers of the graph convolutional neural network, N L-1 represents the neighbor node of the L-1th hop of the node; the subscript nj represents the element in the nth row and jth column of the matrix, and n: represents all elements in the nth row.

[0100] It can be seen that, in the embodiment, the disturbance of is measured by the matrix 0 norm of the difference between the two, that is, the number of changed attributes. ​​​

[0101] In this embodiment, for the disturbed node t, it is classified using the sliced ​​GCN, and the perturbed classification result is obtained accordingly. The perturbed classification result can be used to construct the constraints within the constructed spatial range.

[0102] Specifically, as mentioned above, the output matrix of GCN This represents the probability of predicting node t as a category, and the category with the highest probability is taken as the prediction result.

[0103] Based on this, and based on the predetermined true category y of node t... * After using the sliced ​​GCN to classify and predict the perturbed node t, we can obtain a prediction that node t is the true class y. * The probability of [the first category] and the probability of [the second category] and other categories.

[0104] Furthermore, from the probabilities of each category, the category y with the highest probability is determined, and this category y is used as the classification result for the node t.

[0105] Based on this, using the difference between the probability of the true class and the maximum probability, the following first constraint can be constructed:

[0106]

[0107] Among them, can Represented as m t (y * ,y), is used to characterize the output margin when the perturbation level of node t is maximized.

[0108] Furthermore, the spatial range determined above is used to constrain the perturbed node attribute matrix, and this constrained matrix is ​​used as the second constraint condition:

[0109]

[0110] It can be determined that for all y≠y * There exists m t (y * If ,y)>0 holds true, then node t can be considered robust under the global perturbation budget Q. Here, we can consider the condition m t (y * The maximum value of Q when y)> is used as the lower bound of robustness.

[0111] That is, the perturbation budget Q represents the global perturbation that the graph data can tolerate, when the node is attacked and perturbed, if the attribute of the node is changed too much, then the final classification result of the node will be inconsistent with the true result. By determining the range of the allowable perturbation, it can be determined whether the classification result of the node by the GCN can still be trusted after the node is attacked and perturbed.

[0112] In step S103, a linear boundary of an activation function is constructed for each layer of the sliced graph convolutional neural network to determine an output boundary of the layer, and based on the output boundary of the layer, back propagation is performed to obtain an output boundary of the sliced graph convolutional neural network, and based on whether the output of the node under the current perturbation budget satisfies the constraint condition, the maximum value of the perturbation budget is determined, and whether the classification result of the node is trusted is determined based on the maximum value of the perturbation budget.

[0113] In the embodiments of the present application, a linear boundary can be constructed for each layer of the sliced GCN, and based on the output boundary determined by the linear boundary, back propagation is performed to determine the output boundary of the sliced GCN. Accordingly, the maximum value of the perturbation budget that satisfies the constraint condition can be determined according to the constraint condition constructed above, so as to determine whether the classification result of the node is trusted.

[0114] Specifically, each layer of the sliced GCN is provided with a ReLU, and the linear boundary of the ReLU can be constructed according to the input of the ReLU, wherein the linear boundary of the ReLU includes an upper linear boundary and a lower linear boundary.

[0115] Firstly, the range of the ReLU can be framed as follows:

[0116] α R (y+β R )≤σ(y)≤α U (y+β U )

[0117] Wherein, α R is a first lower boundary parameter matrix of the preset lower linear boundary, β R is a second lower boundary parameter matrix of the preset lower linear boundary, α U is a second upper boundary parameter matrix of the preset upper linear boundary, and β U is a second upper boundary parameter matrix of the preset upper linear boundary.

[0118] Based on this, for the ReLU of each layer of the sliced GCN, the output of the ReLU has different linear boundaries when the input of the ReLU is different.

[0119] Specifically, when the inputs of the ReLU are all in the positive interval, the linear boundary upper bound and the linear boundary lower bound of the ReLU of the layer can be set as h(y) = y; when the inputs of the ReLU are all in the negative interval, the linear boundary upper bound and the linear boundary lower bound of the ReLU of the layer can be set as h(y) = 0; when the inputs of the ReLU exist in both the positive interval and the negative interval, the linear boundary upper bound of the ReLU can be set as h (y) = 0, h R (y) = y and R (y) = 0, h R (y) = y, and the linear boundary lower bound of the ReLU can be set as h (y) = 0, h (y) = y, and the linear boundary lower bound of the ReLU can be set as h

[0120] (y) = 0, h (y) = y, and the linear boundary lower bound of the ReLU can be set as h

[0121] (y) = 0, h (y) = y, and the linear boundary lower bound of the ReLU can be set as h (y) = 0, h

[0122] (y) = y, and the linear boundary lower bound of the ReLU can be set as h (y) = 0, h (y) = y, and the linear boundary lower bound of the ReLU can be set as h (y) = 0, h (y) = y, and the linear boundary lower bound of the ReLU can be set as h (y) = 0, h (y) = y, and the linear boundary lower bound of the ReLU can be set as h R (y) = 0, h R (y) = y, and the linear boundary lower bound of the ReLU can be set as h U (y) = 0, h U (y) = y, and the linear boundary lower bound of the ReLU can be set as h (y) = 0, h

[0123] (y) = y, and the linear boundary lower bound of the ReLU can be set as h (y) = 0, h (y) = y, and the linear boundary lower bound of the ReLU can be set as h

[0124] (y) = 0, h (y) = y, and the linear boundary lower bound of the ReLU can be set as h (y) = 0, h

[0125] (y) = y, and the linear boundary lower bound of the ReLU can be set as h (y) = 0, h (y) = y, and the linear boundary lower bound of the ReLU can be set as h

[0126] (y) = 0, h (y) = y, and the linear boundary lower bound of the ReLU can be set as h (y) = 0, h

[0127] (y) = y, and the linear boundary lower bound of the ReLU can be set as h (l) (y) = 0, h (y) = y, and the linear boundary lower bound of the ReLU can be set as h (y) = 0, h

[0128] In the embodiment, the node attribute matrix is a binary attribute matrix, i.e., each element in the matrix takes only 0 or 1, thus, to ensure that the upper bound and the lower bound of the GCN are not the same, it is required that α L , β L , α U and β U are all different matrices.

[0129] Based on this, when back propagation is performed, the output matrix of the second layer of the GCN is: wherein E is a matrix with the same dimension as W , and all elements of the matrix are 1, and only contain positive and negative terms of W (1) , and the rest of the terms are equal to 0.

[0130] Further, after back propagation, the upper bound and the lower bound of the GCN can be determined as shown below:

[0131]

[0132] wherein the output matrix of the sliced GCN for the node t, under the global perturbation budget Q, has a lower bound of the probability of the real classification y * in the prediction result greater than the upper bound of the probability of any other classification y, i.e., when , it can be proved that the classification result of the node t is robust under the perturbation budget, i.e., when the above constraint condition is met, the classification result of the node t under the perturbation budget is reliable.

[0133] wherein when W is calculated by back propagation, the bound of each layer is taken as the lower bound, which can ensure that the final result W is minimum; when W is calculated by back propagation, the bound of each layer is taken as the upper bound, which can ensure that the final result W is maximum.

[0134] Further, whether W is established can be determined to decide whether to increase the perturbation budget or reduce the perturbation budget, and the maximum value of the perturbation budget can be approached through iteration within a limited number of times.

[0135] Specifically, in the first round of iteration, the global perturbation budget Q is initialized, and using the global perturbation budget, the local perturbation budget q of the current round of iteration can be determined.

[0136] Based on this, the attributes of the nodes are perturbed in the order of the node t, the one-hop neighbor node and the two-hop neighbor node, until the number of attribute changes is equal to Q, wherein the number of attribute changes of a single node is less than or equal to q.​

[0137] Further, the GCN after slicing is used to classify the node t after being disturbed under Q and q, and output a classification result.

[0138] Based on this, it is judged whether the classification result satisfies the constraint condition in the foregoing step.

[0139] Further, when the classification result satisfies the constraint condition, it is considered that Q has not reached the lower bound of robustness, and the global disturbance budget Q is increased by q as a step, and is specifically expressed as: Q = Q + q.

[0140] Further, when the classification result does not satisfy the constraint condition, it is considered that Q exceeds the lower bound of robustness, and the global disturbance budget Q is reduced by a pre-set step, and is specifically expressed as: Q = Q - 1.

[0141] Further, the above adjusted Q is used for the next round of iteration, and after a predetermined number of iterations is reached, the maximum value of Q satisfying the constraint condition is obtained, and is taken as the lower bound of robustness.

[0142] Based on this, when the attack disturbance to the node t is less than the maximum value of Q, that is, less than the lower bound of robustness, and at the same time satisfies the constraint condition, it is considered that the attack disturbance to the node t is not enough to cause the classification result of the node t to be wrong by the GCN, that is, the classification result of the node t is reliable.

[0143] It can be seen that the communication network robustness verification method based on the graph neural network of the embodiment of the application is based on the attributes of each node in the communication network being composed into graph data, so as to use the graph convolutional neural network to classify each node in the graph data, and slice the graph convolutional neural network, so as to reduce the size of the graph convolutional neural network while reducing other potential disturbances in addition to the attack disturbance that need to be considered when verifying the robustness; by defining the spatial range of node disturbance, a constraint condition about the classification result is constructed, and the maximum value of the disturbance budget satisfying the constraint condition is determined, wherein the output boundary of the graph convolutional neural network is determined by replacing the activation function with a linear boundary and by back propagation, so as to adjust the global disturbance budget in cooperation with the constraint condition, and then the maximum value of the global disturbance budget is obtained and taken as the lower bound of robustness, and accordingly, when the node is disturbed, it is judged whether the classification result is correct.

[0144] It should be noted that the method of the embodiments of the present application can be executed by a single device, such as a computer or a server, etc. The method of the embodiments can also be applied to a distributed scenario, and be completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only execute one or more steps in the method of the embodiments of the present application, and the multiple devices can interact with each other to complete the method.

[0145] It should be noted that some embodiments of the present application have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in a different order and still achieve desirable results. Additionally, the processes depicted in the figures do not necessarily require the particular order shown or sequential order in order to achieve the desired results. In some implementations, multitasking and parallel processing can be advantageous.

[0146] Based on the same inventive concept, the embodiments of the present application also provide a communication network robustness verification device based on a graph neural network, corresponding to any of the above-mentioned embodiment methods.

[0147] Reference Figure 2 , the communication network robustness verification device based on a graph neural network comprises a slicing module 201, a spatial range definition module 202, and a lower boundary determination module 203;

[0148] The slicing module 201 is configured to group the attributes of all nodes in a preset communication network into graph data of the communication network, input the graph data into a preset graph convolutional neural network, for each node, obtain a sliced graph convolutional neural network by slicing the graph convolutional neural network, and determine a sliced attribute matrix.

[0149] The spatial range definition module 202 is configured to determine a spatial range of the sliced attribute matrix of the node after being disturbed by an attack, classify the disturbed node using the sliced graph convolutional neural network to obtain a classification result after disturbance, and construct a constraint condition in the spatial range using the classification result after disturbance and the attribute matrix of the disturbed node.

[0150] The lower boundary determination module 203 is configured to construct a linear boundary of an activation function for each layer of the sliced graph convolutional neural network to determine an output boundary of the layer, perform back propagation based on the output boundary of the layer to obtain an output boundary of the sliced graph convolutional neural network, determine a maximum value of a disturbance budget according to whether the output of the node under the current disturbance budget meets the constraint condition, and judge whether the classification result of the node is reliable according to the maximum value of the disturbance budget.

[0151] For the convenience of description, the above apparatus is described in various modules in terms of functions. Of course, the functions of the modules can be implemented in one or more software and / or hardware when implementing the embodiments of the present application.

[0152] The apparatus of the above embodiments is used to implement the corresponding communication network robustness verification method based on a graph neural network in any of the preceding embodiments, and has the beneficial effects of the corresponding method embodiments, which are not described here.

[0153] Based on the same inventive concept, corresponding to any of the above method embodiments, the embodiments of the present application also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the communication network robustness verification method based on a graph neural network as described in any of the above embodiments when executing the program.

[0154] Figure 3 A more specific hardware structure schematic diagram of an electronic device provided by the present embodiment is shown, which can include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040 and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030 and the communication interface 1040 are connected to each other through the bus 1050 for communication within the device.

[0155] The processor 1010 can be implemented in the form of a general-purpose CPU (Central Processing Unit, central processor), a microprocessor, an application specific integrated circuit (ASIC), or one or more integrated circuits, etc., for executing related programs to implement the technical solutions provided by the embodiments of the present application.

[0156] The memory 1020 can be implemented in the form of a ROM (Read Only Memory, read-only memory), a RAM (Random Access Memory, random access memory), a static storage device, a dynamic storage device, etc. The memory 1020 can store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present application are implemented by software or firmware, the related program codes are saved in the memory 1020 and executed by the processor 1010.

[0157] The input / output interface 1030 is configured to connect an input / output module to realize information input and output. The input / output module can be configured in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. The input device can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device can include a display, a speaker, a vibrator, an indicator light, etc.

[0158] The communication interface 1040 is configured to connect a communication module (not shown in the figure) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.).

[0159] The bus 1050 includes a channel to transmit information between various components (such as the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040) of the device.

[0160] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in the specific implementation process, the device can also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device can also only contain the components necessary for implementing the embodiments of the present application, and does not have to contain all the components shown in the figure.

[0161] The device of the above embodiment is used to implement the corresponding communication network robustness verification method based on a graph neural network in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which are not described here.

[0162] Based on the same inventive concept, corresponding to the method of any of the above embodiments, the present application also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the communication network robustness verification method based on a graph neural network as described in any of the above embodiments.

[0163] The computer readable medium of the embodiments can include permanent and non-permanent, removable and non-removable media, which can be implemented by any method or technology to store information. The information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0164] The storage medium of the above embodiments stores computer instructions for causing the computer to execute the communication network robustness verification method based on the graph neural network as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which are not described here.

[0165] Based on the same idea, corresponding to the method of any of the above embodiments, the present application also provides a computer program product, comprising computer program instructions, when the computer program instructions run on the computer, so that the computer executes the communication network robustness verification method based on the graph neural network as described in any of the above embodiments, has the beneficial effects of the corresponding method embodiments, which are not described here.

[0166] Those skilled in the art should understand that the above discussion of any of the embodiments is only exemplary and is not intended to imply that the scope of the present application (including claims) is limited to these examples; the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other changes of the different aspects of the embodiments of the present application as described above. In order to be brief, they are not provided in detail.

[0167] Additionally, to simplify the description and discussion, and so as not to obscure the embodiments of the application being presented, the well-known power / ground connections of integrated circuits (ICs) and other components can or can not be shown in the provided figures. Furthermore, devices can be shown in block diagram form in order to avoid obscuring the embodiments of the application being presented, and also in view of the fact that details of implementation of the devices shown can vary depending on the platform within which the embodiments of the application are to be implemented (i.e., these details should be understood as being well within the purview of one of ordinary skill in the art). Where specific details of particular implementations are set forth in order to describe example embodiments of the application, it can be understood, however, that the embodiments of the application can be practiced without these specific details. In other instances, well-known methods, procedures and circuits have not been described in detail so as not to unnecessarily obscure aspects of the embodiments of the application.

[0168] While the application has been described in connection with specific embodiments thereof, it will be understood that many modifications, substitutions and changes can be made by those skilled in the art to the specific embodiments without departing from the spirit or scope of the application. For example, other memory architectures (e.g., dynamic RAM (DRAM)) can use the embodiments discussed.

[0169] It is intended to cover all alternatives, modifications and variations of this application falling within the scope of the appended claims. Accordingly, all such changes are intended to be included within the scope of the application as claimed.

Claims

1. A method for communication network robustness test based on graph neural network, characterized in that, The method comprises the following steps: inputting graph data of all nodes in a preset communication network into a preset graph convolutional neural network, and determining a sliced graph convolutional neural network and a sliced attribute matrix for each node by slicing the graph convolutional neural network; determining a spatial range of the sliced attribute matrix of the node after being disturbed by an attack, classifying the disturbed node by using the sliced graph convolutional neural network to obtain a classification result after disturbance, and constructing a constraint condition in the spatial range by using the classification result after disturbance and the node attribute matrix after disturbance; constructing a linear boundary of an activation function for each layer of the sliced graph convolutional neural network to determine an output boundary of the layer, performing back propagation based on the output boundary of the layer to obtain an output boundary of the sliced graph convolutional neural network, and determining a maximum value of a disturbance budget according to whether the output of the node under the current disturbance budget meets the constraint condition, and judging whether the classification result of the node is reliable according to the maximum value of the disturbance budget.

2. The method of claim 1, wherein, The graph data comprises a node attribute matrix, and each layer of the graph convolutional neural network comprises a message passing matrix; the slicing of the graph convolutional neural network to obtain a sliced attribute matrix comprises: slicing the message passing matrix of each layer of the graph convolutional neural network to obtain a sliced message passing matrix, and slicing the node attribute matrix to obtain a sliced sliced attribute matrix; wherein the sliced message passing matrix comprises rows and columns corresponding to the nodes disturbed by the attack, and rows and columns corresponding to the neighbor nodes of the nodes within a plurality of hops of the nodes; the sliced attribute matrix comprises rows of the nodes disturbed by the attack, and rows of the neighbor nodes of the nodes within a plurality of hops of the nodes; the sliced graph convolutional neural network is determined by using the sliced message passing matrix and the sliced attribute matrix.

3. The method of claim 1, wherein, The disturbance budget comprises a global disturbance budget and a local disturbance budget; the determination of the spatial range of the sliced attribute matrix of the node after being disturbed by the attack comprises: for the nodes disturbed by the attack, determining a node attribute matrix of the sliced attribute matrix of the node after being disturbed by the attack; the spatial range is constructed by using the sliced attribute matrix of the node before disturbance and the node attribute matrix after disturbance as shown in the following formula: wherein, denotes the space range based on a global perturbation budget Q and a local perturbation budget q, denotes a perturbed node attribute matrix, denotes the slice attribute matrix before perturbation, Q denotes the global perturbation budget, q denotes the local perturbation budget about the node, and there is q=kQ, k denotes a preset constant, L denotes a number of layers of the graph convolutional neural network, N L-1 denotes a neighbor node of the node at the L-1th hop; a subscript nj denotes an element at the n th row and the j th column of a matrix, n: denotes all elements of the n th row.

4. The method of claim 3, wherein, The constraint condition comprises a first constraint condition and a second constraint condition; the construction of the constraint condition in the spatial range by using the classification result after disturbance and the node attribute matrix after disturbance comprises: for the nodes disturbed by the attack, determining a probability of a real class and a maximum probability after the sliced graph convolutional neural network classifies the node attribute matrix after disturbance; the difference between the probability of the real class and the maximum probability is greater than zero as the first constraint condition; the spatial range is used as the second constraint condition for constraining the node attribute matrix after disturbance.

5. The method of claim 1, wherein, The linear boundary comprises an upper linear boundary and a lower linear boundary; the construction of the linear boundary of the activation function for each layer of the sliced graph convolutional neural network to determine the output boundary of the layer comprises: For an activation function of each layer of the sliced graph convolutional neural network, in response to a determination that inputs of the activation function of the layer are all in the positive interval, the linear boundary upper bound and the linear boundary lower bound of the activation function of the layer are both set as h(y) = y; in response to a determination that inputs of the activation function of the layer are all in the negative interval, the linear boundary upper bound and the linear boundary lower bound of the activation function of the layer are both set as h(y) = 0; in response to determining that the input to the layer activation function exists in both the positive interval and the negative interval, setting the linear boundary upper bound for the layer activation function to and setting the linear boundary lower bound to h R (y) = 0, h R (y) = y and one of where y represents the input of the activation function of the layer, and there exists y ∈ [R, U], R represents the first boundary of the input of the activation function, U represents the second boundary of the activation function, h(y) represents the linear boundary when the input of the activation function is in the positive interval or in the negative interval, h U (y) represents the linear upper boundary when the input of the activation function of the layer is in the positive interval and in the negative interval, R (y) represents the linear lower boundary when the input of the activation function of the layer is in the positive interval and in the negative interval, represents the linear boundary upper limit of the kth element in the matrix of the input of the lth layer of the sliced graph convolutional neural network, represents the linear boundary lower limit of the kth element in the matrix of the input of the lth layer of the sliced graph convolutional neural network. the linear boundary is used to replace the activation function of the layer, and an output boundary of the layer is obtained.

6. The method of claim 3, wherein, The maximum value of the perturbation budget is determined according to whether the output of the node under the current perturbation budget satisfies the constraint condition. In each iteration, a local perturbation budget of the node in the current iteration is determined according to a global perturbation budget of the current iteration. It is judged whether the output result of the sliced graph convolutional neural network satisfies the constraint condition under the global perturbation budget of the current iteration and the local perturbation budget of the current iteration. In response to a determination that the constraint condition is not satisfied, the current global perturbation budget is reduced by a preset step to obtain a global perturbation budget of the next iteration. In response to a determination that the constraint condition is satisfied, the current global perturbation budget is increased by a preset step of the local perturbation budget of the current iteration to obtain a global perturbation budget of the next iteration. In response to a determination that a preset iteration round is reached, the maximum value of the perturbation budget is determined.

7. The method of claim 1, wherein, It is judged whether the classification result of the node is reliable according to the maximum value of the perturbation budget. In response to a determination that the node satisfies the constraint condition after being attacked and perturbed under the maximum value of the perturbation budget, it is determined that the classification result of the node is reliable.

8. A graph neural network based communication network robustness checking apparatus, characterized in that, The method comprises a slicing module, a spatial range defining module, and a lower boundary determining module. The slicing module is configured to group attributes of all nodes in a preset communication network into graph data of the communication network, input the graph data into a preset graph convolutional neural network, for each node, slice the graph convolutional neural network to obtain a sliced graph convolutional neural network, and determine a sliced attribute matrix. The spatial range defining module is configured to determine a spatial range of the sliced attribute matrix of the node after being attacked and perturbed, classify the perturbed node by using the sliced graph convolutional neural network to obtain a perturbed classification result, and construct a constraint condition in the spatial range by using the perturbed classification result and a perturbed node attribute matrix. The lower boundary determining module is configured to construct a linear boundary of an activation function for each layer of the sliced graph convolutional neural network to determine an output boundary of the layer, perform back propagation based on the output boundary of the layer to obtain an output boundary of the sliced graph convolutional neural network, determine a maximum value of a perturbation budget according to whether an output of the node under a current perturbation budget satisfies the constraint condition, and judge whether a classification result of the node is reliable according to the maximum value of the perturbation budget.

9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable by the processor, wherein, The processor implements the method in any one of claims 1 to 7 when executing the computer program. The processor implements the method in any one of claims 1 to 7 when executing the computer program.

10. A non-transitory computer-readable storage medium, comprising: The non-transitory computer readable storage medium stores computer instructions for causing a computer to perform the method according to any one of claims 1 to 7.

Images