Attribute network anomaly node detection method and system based on iterative filtering

Abstract

The present application relates to the technical field of Internet detection, and particularly relates to an attribute network abnormal node detection method and system based on iterative filtering, which takes an attribute network adjacency matrix and an attribute matrix as training data input of an abnormal node detection model, determines abnormal nodes in a to-be-detected attribute network and outputs by using an iterative filtering model training process, and in each iterative filtering model training, detects and filters abnormal nodes in the training data and updates the training data until no new abnormal node is generated in the next iterative filtering training data. The present application ensures the homogeneity assumption of the network by the iterative filtering model training process, avoids mutual interference between abnormal features and normal nodes, causes misjudgment of edge nodes, improves the detection effect of the model, and when compressing node feature extraction, not only aggregates neighbor information but also simultaneously fuses node self information, so that the extracted features contain neighbor features and retain self features to the greatest extent, avoid dilution of the features of the nodes, improve the accuracy of the detection, add node and global similarity calculation to improve the interference of reconstruction error on the abnormal misjudgment of the nodes, enhance the model recognition ability for network abnormal nodes, and have a good application prospect.

Description

Technical Field

[0001] This invention relates to the field of Internet detection technology, and in particular to a method and system for detecting abnormal nodes in attribute networks based on iterative filtering. Background Technology

[0002] With the rapid growth of the internet and social media, the detection of anomalous nodes in attribute networks—aimed at identifying nodes that significantly deviate from the majority of normal nodes—has become a hot topic in academic research and industrial practice. In real-world networks such as social media, bioinformatics networks, financial transaction networks, and communication networks, not only are the number of nodes enormous, but their interrelationships are also intricate, and the nodes themselves carry rich attribute information. These networks also face various potential threats and risks, such as cybersecurity issues, the spread of misinformation on social media, financial fraud, abnormal health monitoring, and other anomalies in network operation. To effectively address these challenges, academia and industry are increasingly turning to exploring how to utilize node attribute information to identify and analyze anomalous nodes in networks.

[0003] Traditional network anomaly detection often employs methods such as decision tree algorithms with specific rules, statistical methods, and clustering. Furthermore, with the development of machine learning, machine learning-based methods have emerged. These methods utilize feature extraction and data dimensionality reduction, then employ classifiers for effective classification to identify anomaly nodes in attribute networks. While these methods have achieved some success in anomaly detection based on low-dimensional and simple network structures, they face two major limitations: First, as the dimensionality of network data increases, these methods become insufficient in feature extraction, failing to effectively identify complex patterns in high-dimensional data; second, these early methods often fail to fully consider the network topology, neglecting anomaly patterns that may arise from interactions between nodes, leading to poor detection performance. The rapid development of deep learning technology, especially the rise of graph neural networks (GNNs), has provided a new direction for solving these problems. Graph neural networks are naturally suited for processing graph-structured data, possessing powerful network feature extraction and learning capabilities, thus significantly improving the accuracy and efficiency of anomaly node detection. Graph neural networks rely on the homogeneity assumption, meaning that nodes connected by edges possess similar features or belong to the same category. However, the presence of anomalous nodes undermines this assumption. An anomalous node is often connected to several normal nodes, causing the node features extracted by the graph neural network to be mixed with abnormal information. Secondly, when calculating anomaly scores, only the reconstruction error is considered, comparing only the original and reconstructed information of the nodes. Since anomalous nodes interfere with the feature learning of normal nodes, the interfered nodes may not be reconstructable. Summary of the Invention

[0004] To address this, the present invention provides an anomalous node detection method and system for attribute networks based on iterative filtering, which solves the problem of misjudging edge nodes in existing network node anomaly detection. By using iterative filtering in the training process, the method avoids interference from noisy data, improves the performance of network anomaly node detection, and enhances the modeling effect of attribute networks.

[0005] According to the design scheme provided by this invention, on the one hand, a method for detecting abnormal nodes in an attribute network based on iterative filtering is provided, comprising:

[0006] Obtain graph network data of the attribute network to be detected, wherein the graph network data includes attribute network nodes, attribute network adjacency matrix and attribute network attribute matrix;

[0007] The adjacency matrix of the attribute network and the attribute matrix are used as the training data input of the abnormal node detection model. The abnormal nodes in the attribute network to be detected are determined and output using the iterative filtering model training process. In each iteration of the filtering model training, abnormal nodes in the training data are detected and filtered and the training data is updated until the training data of the next iteration of filtering no longer generates new abnormal nodes.

[0008] The abnormal node detection model includes a weight-sharing encoder that learns network embeddings and attribute embeddings based on graph network data of the attribute network and based on shared weight parameters; a feature fusion unit that combines the learned network embeddings and attribute embeddings in the feature space to obtain node embedding information and global network information; a dual-channel decoder that reconstructs the network structure and node attributes of the attribute network from the combined network features; an abnormal node discriminator that determines network node abnormalities based on the similarity between network structure reconstruction error, node attribute reconstruction error, node embedding information and global network information; and a node filter that filters the determined network abnormal nodes and their corresponding features.

[0009] As part of the iterative filtering-based abnormal node detection method for attribute networks of this invention, the weighted shared encoder further includes the process of learning network embedding and attribute embedding based on graph network data of the attribute network and shared weight parameters, comprising:

[0010] The adjacency matrix and attribute matrix of the attribute network are used as inputs for network embedding learning, and the network embedding is learned based on the degree matrix and shared weight parameters of the attribute network.

[0011] The identity matrix and attribute matrix are used as inputs for attribute embedding learning. Attribute embeddings are learned based on shared weight parameters, which are used to map network embeddings and attribute embeddings to the same feature space.

[0012] As part of the iterative filtering-based attribute network anomaly node detection method of this invention, the feature fusion processor further includes the process of combining the learned network embeddings and attribute embeddings in the feature space to obtain node embedding information and global network information, comprising:

[0013] Alignment between network embedding and attribute embedding is established through element-wise multiplication operations to obtain consistency information between the two;

[0014] The network embedding and attribute embedding are merged using element-wise addition to obtain complementary information.

[0015] By merging the consistent and complementary information from both, the final node embedding representation is obtained, which is then used to obtain global network information and the similarity between node embedding information and global information.

[0016] As part of the iterative filtering-based abnormal node detection method for attribute networks of this invention, the process of reconstructing the network structure and node attributes of the attribute network from the combined network features by the dual-channel decoder further includes:

[0017] Node attributes are reconstructed by feature transformation using an attribute decoder, which employs a fully connected neural network structure.

[0018] The network topology is reconstructed by using a structure decoder to combine network features and calculate inner product.

[0019] As part of the iterative filtering-based attribute network anomaly node detection method of this invention, the anomaly node discriminator further includes the following process for determining network node anomalies based on network structure reconstruction error, node attribute reconstruction error, and the similarity between node embedding information and network global information:

[0020] Obtain the network structure reconstruction error and node attribute reconstruction error, and calculate the similarity between the two based on node embedding information and network global information;

[0021] The network node anomaly score is calculated by using the reconstruction error and similarity and combining the balance parameter. The network nodes are sorted according to the anomaly score, and the abnormal nodes in the network are filtered out according to the sorting result and the preset anomaly threshold.

[0022] As part of the iterative filtering-based attribute network anomaly node detection method of this invention, the node filter further includes the process of filtering the identified network anomaly nodes and their corresponding features, comprising:

[0023] Locate the abnormal network node and modify the row data corresponding to the abnormal node in the adjacency matrix to remove the abnormal node from the graph network data.

[0024] As the attribute network anomaly node detection method based on iterative filtering of this invention, the training loss function of the anomaly node detection model is further expressed as: L=α1R S +α2R A +α3s sim Where α1, α2, and α3 are equilibrium parameters, and R S Let the network structure reconstruction error be R. A S represents the attribute reconstruction error. sim The similarity between node embedded information and global network information.

[0025] Furthermore, this invention also provides an attribute network anomaly node detection system based on iterative filtering, comprising: a data acquisition module and an anomaly detection module, wherein,

[0026] The data acquisition module is used to acquire graph network data of the attribute network to be detected, wherein the graph network data includes attribute network nodes, attribute network adjacency matrix and attribute network attribute matrix;

[0027] The anomaly detection module is used to take the adjacency matrix of the attribute network and the attribute matrix as the training data input of the anomaly node detection model. It uses the iterative filtering model training process to determine the anomaly nodes in the attribute network to be detected and output them. In each iteration of the filtering model training, it detects and filters the anomaly nodes in the training data and updates the training data until the training data of the next iteration of filtering no longer generates new anomaly nodes.

[0028] The abnormal node detection model includes a weight-sharing encoder that learns network embeddings and attribute embeddings based on graph network data of the attribute network and based on shared weight parameters; a feature fusion unit that combines the learned network embeddings and attribute embeddings in the feature space to obtain node embedding information and global network information; a dual-channel decoder that reconstructs the network structure and node attributes of the attribute network from the combined network features; an abnormal node discriminator that determines network node abnormalities based on the similarity between network structure reconstruction error, node attribute reconstruction error, node embedding information and global network information; and a node filter that filters the determined network abnormal nodes and their corresponding features.

[0029] The beneficial effects of this invention are:

[0030] This invention, in the process of detecting abnormal nodes, initially screens potential abnormal nodes and filters them from the training dataset. This process is repeated iteratively to update the dataset until no new abnormal nodes are generated, ensuring the homogeneity assumption of the network and avoiding interference between abnormal features and normal nodes, which could lead to misjudgments of edge nodes, thereby improving the model's detection performance. When compressing node features, it not only aggregates neighbor information but also integrates the node's own information, ensuring that the extracted features include both neighbor features and retain the node's own features to the greatest extent, avoiding the dilution of the node's own features and improving detection accuracy. Since normal nodes in the local area where an abnormal node is located are interfered with, the reconstruction error is large and prone to misjudgment. Based on the reconstruction error, the similarity calculation between the node and the global area is added to effectively improve the interference of the reconstruction error on the misjudgment of node anomalies, enhance the model's ability to identify abnormal nodes in the network, and improve the performance of attribute network node modeling. It can be applied to the needs of attribute network abnormal behavior detection tasks in fields such as network security and social media, and has good application prospects. Attached image description:

[0031] Figure 1 This is a schematic diagram of the attribute network abnormal node detection process based on iterative filtering in the embodiment;

[0032] Figure 2 This is a schematic diagram of the encoder's experimental effect in the embodiment;

[0033] Figure 3 This is a schematic diagram comparing the AUC of each model in the embodiment;

[0034] Figure 4 This is a schematic diagram of the experimental results of the model on the dataset in the example. Detailed implementation method:

[0035] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0036] Attribute network anomaly detection has wide applications in the real world, such as detecting malicious information spreaders in social networks and information fraudsters in financial networks. Existing anomaly detection methods based on graph neural networks and the idea of ​​compression and reconstruction suffer from inaccuracies in the node features learned by the local network where the anomaly node is located due to interference between anomaly and normal nodes during compression encoding. This leads to misclassification of edge nodes when detecting anomalies. See the embodiments of this invention. Figure 1 As shown, an anomalous node detection method for attribute networks based on iterative filtering is provided, comprising:

[0037] S101. Obtain the graph network data of the attribute network to be detected, wherein the graph network data includes attribute network nodes, attribute network adjacency matrix and attribute network attribute matrix;

[0038] S102. Use the adjacency matrix of the attribute network and the attribute matrix as the training data input of the abnormal node detection model. Use the iterative filtering model training process to determine the abnormal nodes in the attribute network to be detected and output them. In each iteration of the filtering model training, detect and filter the abnormal nodes in the training data and update the training data until the training data of the next iteration of filtering no longer generates new abnormal nodes.

[0039] The abnormal node detection model includes a weight-sharing encoder that learns network embeddings and attribute embeddings based on graph network data of the attribute network and based on shared weight parameters; a feature fusion unit that combines the learned network embeddings and attribute embeddings in the feature space to obtain node embedding information and global network information; a dual-channel decoder that reconstructs the network structure and node attributes of the attribute network from the combined network features; an abnormal node discriminator that determines network node abnormalities based on the similarity between network structure reconstruction error, node attribute reconstruction error, node embedding information and global network information; and a node filter that filters the determined network abnormal nodes and their corresponding features.

[0040] The attribute network is defined as G = (V, A, X), where V = {v1, v2, v3, ..., v...}. n}(|V|=n) represents a node in the attribute network; Represents the adjacency matrix of an attribute network, when A ij When = 0, it indicates node v i and node v j There are no edges connecting them, A ij =1 indicates that there is an edge connecting the two; The attribute matrix representing the network, the vector in the i-th row. Represents the i-th node v in the attribute network i Attribute information.

[0041] For a given attribute network G = (V, A, X), learn a function f to calculate anomaly scores based on the adjacency matrix A and the attribute matrix X, for each node v in the network. i Each node can be scored as an anomaly score S based on its degree of anomaly. i ; This results in nodes with higher anomaly scores (S) i The larger the score, the higher the node is considered an anomaly. Nodes are sorted based on their anomaly scores, with the higher-ranking nodes being considered anomalous.

[0042] See Figure 1The model framework shown is based on compression-reconstruction unsupervised anomaly detection, which can be represented as AnomFFNF. It consists of five main parts: a weight-shared encoder, a feature fusion unit, a dual-channel decoder, an anomaly discriminator, and a node filter. The weight-shared encoder learns both network embeddings and attribute embeddings simultaneously. The feature fusion unit merges the original attribute information of nodes with smoothed network information to ensure information integrity and consistency; the fused embedding vectors are computed through Readout to obtain global network information, and the similarity between each node and the global information is calculated. The dual-channel decoder decodes the learned sample data to reconstruct the samples and calculates the reconstruction error. The anomaly discriminator combines the network reconstruction error, attribute reconstruction error, and the similarity between each node and the global information to calculate anomaly scores, thus initially screening out anomaly nodes. The node filter further filters out potential anomaly nodes and retrains the weight-shared encoder using the filtered network.

[0043] Specifically, the weight-shared encoder, based on the graph network data of the attribute network and learning network embeddings and attribute embeddings based on shared weight parameters, can be designed to include:

[0044] The adjacency matrix and attribute matrix of the attribute network are used as inputs for network embedding learning, and the network embedding is learned based on the degree matrix and shared weight parameters of the attribute network.

[0045] The identity matrix and attribute matrix are used as inputs for attribute embedding learning. Attribute embeddings are learned based on shared weight parameters, which are used to map network embeddings and attribute embeddings to the same feature space.

[0046] Weight-sharing encoders can learn network embeddings and attribute embeddings simultaneously in a shared latent space. Specifically, weight-sharing encoders have two inputs.

[0047] First, for network embedding, the input is the adjacency matrix A of the network and the attribute matrix X of the nodes. Where H... 0 =X.

[0048] H l+1 =σ(D -1 / 2 AD -1 / 2 H l W l (1)

[0049] In formula (1), H l H l+1 W l These represent the input, output, and shared weight parameters of the weight-sharing autoencoder, respectively. d represents the degree matrix of the attribute network, and D... -1 / 2 AD -1 / 2Let represent the normalized adjacency matrix. Furthermore, σ(.) represents the activation function.

[0050] Secondly, in order to capture the attribute information of the nodes, the identity matrix I and the attribute matrix F are used. 0 =X is used as input. The specific method is shown in formula (2):

[0051] F l+1 =σ(IF l W l (2)

[0052] F in formula (2) l F l+1 W l These represent the input, output, and shared weight parameters of the node attributes, respectively, where the shared parameter matrix W... l It is shared with formula (1).

[0053] Since the network information and node attribute information of the attribute network are mapped to a low-dimensional space through the same parameter matrix, it can be ensured that the structure after mapping is in the same feature space.

[0054] The feature fusion processor, which combines the learned network embeddings and attribute embeddings in the feature space to obtain node embedding information and global network information, can be designed to include:

[0055] Alignment between network embedding and attribute embedding is established through element-wise multiplication operations to obtain consistency information between the two;

[0056] The network embedding and attribute embedding are merged using element-wise addition to obtain complementary information.

[0057] By merging the consistent and complementary information from both, the final node embedding representation is obtained, which is then used to obtain global network information and the similarity between node embedding information and global information.

[0058] To maintain the consistency and integrity of the embedded network information, a feature fusion method is used to combine the network embedding H in the feature space. l and attribute embedding F l .

[0059] First, alignment between network embeddings and attribute embeddings is established through element-wise multiplication, denoted by the symbol ×. The purpose of element-wise multiplication is to enhance task-relevant information while mitigating the influence of task-independent details between network embeddings and attribute embeddings. The consistency information between network embeddings and attribute embeddings is represented by Z. con To represent, see formula (3) for specific calculations:

[0060] Z con=H l ×F l (3)

[0061] Secondly, to fully utilize network and attribute information, an element-wise addition method is used to merge network embeddings and attribute embeddings. This fusion method can integrate network and attribute information, thereby promoting information complementarity. The complementary information of network embeddings and attribute embeddings is represented by Z. com The calculation process is shown in formula (4).

[0062] Z com =H l +F l (4)

[0063] Next, merge the consistent information Z. con and complementary information Z com The final node embedding representation Z is obtained, and the specific calculation process is shown in formula (5):

[0064] Z = Z con +Z com (5)

[0065] Finally, based on the final embedding representation Z of the nodes, the global information of the entire network and the similarity between each node and the global information are calculated. Since the vast majority of nodes in the network are normal nodes, and abnormal nodes only account for a small portion, the normal pattern of a node can be approximated by the vector of the entire network. Under this premise, as long as the similarity between the node vector and the vector representation of the entire network is calculated, the degree of node abnormality can be determined. For example, if a node is a normal node, then the representation vector of that node is similar to the vector of the normal pattern; conversely, if a node is an abnormal node, then its representation vector is far from the vector of the normal pattern. The global information g of the network is obtained using the Readout function, and the specific process is shown in formula (6).

[0066]

[0067] Similarity calculation uses a bilinear model. The vector similarity between each node and the normal pattern is calculated using a bilinear model, and the similarity is represented by a sign. The specific calculation is shown in formula (7).

[0068]

[0069] Here, W is a learnable parameter matrix that makes the vector of each node as close as possible to the vector of the normal pattern.

[0070] The process by which the dual-channel decoder reconstructs the network structure and node attributes of the attribute network from the combined network features can be designed to include:

[0071] Node attributes are reconstructed by feature transformation using an attribute decoder, which employs a fully connected neural network structure.

[0072] The network topology is reconstructed by using a structure decoder to combine network features and calculate inner product.

[0073] To reconstruct the network structure and node attributes from low-dimensional features z that integrate network and attribute information, this embodiment employs a dual-channel decoder. The reconstruction process includes the following steps:

[0074] First, the attribute decoder uses a fully connected neural network to perform feature transformation and reconstruct node attributes. See formula (8) for the specific formula.

[0075]

[0076] in, This represents the reconstructed attribute features. l∈(1,2,3...) represents the number of layers in the decoder.

[0077] Next, the low-dimensional embedding similarity of each node pair is calculated using the inner product to reconstruct the edges of the network topology. Similar to the attribute decoder, the low-dimensional feature Z, which fuses network and attribute information, is used as the input to the structure decoder. See Equation (9).

[0078]

[0079] In the structure decoder, (.)T is used to denote the transpose of the matrix, and the Sigmoid activation function is used for normalization, i.e., Sigmoid(.).

[0080] Specifically, the process by which the abnormal node discriminator determines network node anomalies based on network structure reconstruction errors, node attribute reconstruction errors, and the similarity between node embedding information and global network information can be designed to include:

[0081] Obtain the network structure reconstruction error and node attribute reconstruction error, and calculate the similarity between the two based on node embedding information and network global information;

[0082] The network node anomaly score is calculated by using the reconstruction error and similarity and combining the balance parameter. The network nodes are sorted according to the anomaly score, and the abnormal nodes in the network are filtered out according to the sorting result and the preset anomaly threshold.

[0083] Graph neural network (Graph Neural Network) models have achieved excellent expressive power in attribute network representations with structure and attributes. However, Graph Neural Network models are designed based on the homogeneity assumption, meaning that nodes connected by edges have similar features or belong to the same category. This is the main reason why Graph Neural Network models can extract good features. However, in the task of detecting abnormal nodes in attribute networks, the presence of abnormal nodes violates the homogeneity assumption of Graph Neural Network models. For example, an abnormal node may be connected to several normal nodes. In this case, the abnormal node vector representation obtained by aggregation through the Graph Neural Network may be similar to that of normal nodes, making it impossible to distinguish between normal and abnormal nodes. Therefore, using Graph Neural Network models solely for feature extraction has drawbacks.

[0084] To make graph neural network models effective for anomaly node detection tasks, two key issues need to be addressed: (1) leveraging the powerful expressive capabilities of graph neural networks without violating their homogeneity assumption; and (2) resolving the inconsistency between the connections of normal and abnormal nodes to prevent the introduction of noisy data into the node representation.

[0085] First, the existence of outlier nodes violates the homogeneity assumption of graph neural networks. Second, there are inconsistent edges between outlier and normal nodes. Ultimately, these problems arise from outlier nodes and their connections to normal nodes. Therefore, we can consider removing the edges between outlier nodes during the aggregation process. If only normal nodes are aggregated, the graph neural network will adhere to the homogeneity assumption, maintaining the purity of node representation vector learning, and thus resolving the aforementioned problems. Therefore, the key to solving these two problems lies in how to identify outlier nodes and remove them from the graph—that is, designing an outlier node discriminator.

[0086] Secondly, in the task of detecting abnormal nodes in attribute networks, normal nodes constitute the majority of the total data, while abnormal nodes account for only a small portion. The encoder can capture the features of normal nodes but struggles to capture the features of abnormal nodes. Therefore, a compression-reconstruction approach is used for abnormal node detection. First, the encoder compresses the data to a low dimension, and then the decoder reconstructs the data. The encoder can learn normal data patterns but cannot effectively reconstruct abnormal nodes from the low dimension. The few abnormal nodes that appear often have significant reconstruction errors after compression-reconstruction, thus detecting abnormal nodes in the network. Therefore, reconstruction error is used as one of the criteria for identifying abnormal nodes.

[0087] Next, since the compressed-reconstruction attribute network anomaly detection method aims to learn node representations by reconstructing the original data, rather than learning node representations through anomaly detection itself, although node anomaly scores can be calculated based on the reconstruction error, this type of method only achieves suboptimal performance because it does not directly target anomaly detection. To compensate for the shortcomings of compressed-reconstruction, this embodiment designs a task directly targeting attribute network anomaly detection based on the calculated reconstruction error. Specifically, it calculates the similarity between nodes and global information, using the similarity between the vectors of each node and the normal pattern as the basis for directly identifying anomalies and as the target for optimizing the loss function. (Improving the ability to identify edge nodes)

[0088] Finally, abnormal nodes are determined by comprehensively calculating the reconstruction error and the similarity between the node and the global information.

[0089] Using the similarity between nodes and global information calculated by formula (7), formulas (8) and (9) are used to reconstruct the structure and attributes. First, the structural reconstruction error and attribute reconstruction error are calculated, and the structural reconstruction error is denoted as R. S The attribute reconstruction error is R. A For specific calculations, see formulas (10) and (11).

[0090]

[0091]

[0092] Then, the reconstruction error and the similarity in formula (7) are used to calculate v for each node. i The abnormal value is worth scoring:

[0093]

[0094] The first term represents the reconstruction error of the original sample structure. The second term represents the reconstruction error of the original sample attributes. The third term is the distance between each node and the normal pattern vector. Normal nodes have a high similarity to normal pattern vectors, resulting in a close distance and a smaller overall value for this term; abnormal nodes have a low similarity to normal pattern vectors, resulting in a large distance and a larger overall value for this term. α1, α2, and α3 are three balancing parameters. In summary, nodes with higher scores are more likely to be abnormal nodes. Therefore, anomaly rankings are calculated based on anomaly scores to filter out abnormal nodes.

[0095] Specifically, the process of filtering identified abnormal network nodes and their corresponding features by the node filter can be designed to include:

[0096] Locate the abnormal network node and modify the row data corresponding to the abnormal network node in the adjacency matrix to remove the abnormal network node from the graph network data.

[0097] Based on the discriminator's identification of potentially abnormal nodes, the specific implementation of the node filter is as follows: before inputting the nodes and structure into the weight-sharing encoder, the abnormal node discriminator is used to locate abnormal nodes and remove them from the graph. Specifically, the row data of the corresponding node in the adjacency matrix can be modified to 0, so that the inconsistent noise influence is removed when the graph neural network is aggregated, which follows the homogeneity assumption of the graph neural network and enhances the feature extraction capability of the graph neural network.

[0098] In addition, based on the abnormal nodes identified by the discriminator, their attributes are set to 0, thus avoiding noise interference in the graph vectors read out by Readout. This makes the vector representation of the entire graph more consistent with the normal pattern in the network data. The filtered normal pattern vectors are then applied to the abnormal node discriminator, which can further feed back into the abnormal node discriminator and the weight-sharing encoder.

[0099] The loss function is crucial for training and optimization, and is an important part of optimizing the model. The entire model employs global training, adding node filters and calculating the similarity between nodes and the global hierarchy on top of compression-reconstruction. The training process is mainly similar to compression-reconstruction; therefore, the model's loss is the sum of the reconstruction error and the global distance metric between nodes, which can be mathematically expressed as:

[0100]

[0101] Among them, α1, α2 and α3 are the same as in formula (12), and these three parameters are used to control the balance of the three losses.

[0102] Furthermore, based on the above method, this embodiment of the invention also provides an attribute network anomaly node detection system based on iterative filtering, comprising: a data acquisition module and an anomaly detection module, wherein,

[0103] The data acquisition module is used to acquire graph network data of the attribute network to be detected, wherein the graph network data includes attribute network nodes, attribute network adjacency matrix and attribute network attribute matrix;

[0104] The anomaly detection module is used to take the adjacency matrix of the attribute network and the attribute matrix as the training data input of the anomaly node detection model. It uses the iterative filtering model training process to determine the anomaly nodes in the attribute network to be detected and output them. In each iteration of the filtering model training, it detects and filters the anomaly nodes in the training data and updates the training data until the training data of the next iteration of filtering no longer generates new anomaly nodes.

[0105] The abnormal node detection model includes a weight-sharing encoder that learns network embeddings and attribute embeddings based on graph network data of the attribute network and based on shared weight parameters; a feature fusion unit that combines the learned network embeddings and attribute embeddings in the feature space to obtain node embedding information and global network information; a dual-channel decoder that reconstructs the network structure and node attributes of the attribute network from the combined network features; an abnormal node discriminator that determines network node abnormalities based on the similarity between network structure reconstruction error, node attribute reconstruction error, node embedding information and global network information; and a node filter that filters the determined network abnormal nodes and their corresponding features.

[0106] To verify the effectiveness of this solution, the following explanation is based on experimental data:

[0107] To verify the effectiveness of the proposed solution model, experiments were conducted on four public datasets focusing on the following three aspects, and the experimental results were analyzed.

[0108] 1. The impact of different encoders on the detection results of abnormal nodes in attribute networks. This section mainly analyzes the impact of commonly used graph encoders GCN, GAT, and GIN on the experimental results.

[0109] 2. Comparison of the proposed model with benchmark models. The AnomFFNF model in this proposal is compared with existing classic attribute network anomaly node detection models.

[0110] 3. Analyze the impact of feature fusion and node filtering on abnormal node detection. Based on the idea of ​​ablation experiments, the feature fusion part was removed and compared with the model in this case; the node filtering module was removed and compared with this model to verify the effectiveness of this model.

[0111] Experiments were conducted on three widely used attribute network anomaly detection benchmark datasets, as shown in Table 1: Citeseer, Cora, and Pubmed.

[0112] Citeseer: This dataset consists of 3327 scientific papers, represented by Nodes. There are 4732 citation links, represented by Edges. The Attributes dimension of each scientific paper is 3703.

[0113] Cora: This dataset consists of 2708 papers, represented by Nodes. There are 5429 citation links, represented by Edges. Each paper has Attributes indicating whether it contains a certain keyword; the attributes have 1433 dimensions.

[0114] PubMed: This dataset consists of 19,717 publications, with 44,338 citation links between nodes. Each publication's Attributes dimension is 500.

[0115] Table 1 Statistical Analysis of Attribute Network Information

[0116]

[0117]

[0118] The node attributes of the three datasets above are all vectorized using the bag-of-words model. Each node's attribute is represented by a vector, and the size of the vector dimension is determined by the size of the dictionary in the bag-of-words model.

[0119] Since the three datasets mentioned above did not have labeled abnormal nodes, and the experiment used structural perturbation and attribute perturbation anomaly injection methods to perturb the data.

[0120] This method injects structurally anomalous nodes by perturbing the network topology. The underlying principle is that in many real-world scenarios, few nodes in a subgraph have fully connected connections, thus fully connected structures are considered anomalous. First, m subgraphs are randomly selected from the network, each with n nodes. Then, the n nodes in these m subgraphs are fully connected, forming a fully connected structure. These fully connected nodes in the subgraphs are considered structurally anomalous nodes.

[0121] Attribute anomalous nodes are generated by perturbing node attributes. The attributes of the target node are perturbed using the node with the largest Euclidean distance from it in the network. First, m×n nodes are randomly selected from the network as candidate attribute anomalous nodes. Then, for each target node among the candidate nodes, k nodes are randomly selected from the data excluding the candidate nodes. The Euclidean distance between the target node and the k nodes is calculated, and the node j with the largest Euclidean distance from the target node is found. Next, the attribute of the target node is replaced with the attribute of node j. Finally, these m×n nodes are used to generate attribute anomalous nodes.

[0122] Based on the injection method described above and according to the network size, approximately 5% of the network size of anomalous nodes were injected into each dataset. The resulting perturbed network is shown in the last row of Table 1, with the total number of anomalies listed. In this experiment, all class labels were removed; anomalous labels are only visible during the inference phase.

[0123] The experiment used the AUC (Area Under the Curve) value as an evaluation metric to assess the model's performance.

[0124] AUC is a common metric used to evaluate the performance of binary classification models; it represents the area under the ROC curve. Physically, it represents the probability that, given random positive and negative examples, the model is more likely to predict a positive example as positive than to predict a negative example as positive. Therefore, a higher AUC value indicates better model performance, meaning the model is more accurate in distinguishing between positive and negative examples.

[0125] The operating environment used was Windows 10, Python 3.8, PyTorch 1.1, and an NVIDIA GeForce graphics card with 16GB of VRAM. To ensure the fairness of the experimental results, the model in this study and the comparative experiments used the same environment and settings: the optimizer was Adam, the learning rate was 0.01, the final node embedding dimension was set to 64, the number of layers in the graph neural network was set to 2, and the dropout value was 0.3.

[0126] 1. GNN encoder selection

[0127] This study analyzes the impact of different GNN encoders on the model, primarily exploring the effects of common graph neural network encoders GCN, GAT, and GIN on model performance. Experiments were conducted on four datasets, and the results are shown below. Figure 2 As shown.

[0128] Based on the experimental results, GIN performs best as the encoder for the entire model. Therefore, GIN can be selected as the final encoder for anomaly detection. GIN more accurately distinguishes between normal and abnormal nodes in anomaly detection tasks. While GAT is not as good as GIN in anomaly detection, it still shows some improvement over GCN. This is because GAT considers the weight contributions of different neighbors when aggregating neighbor information. Especially regarding the data imbalance problem in anomaly detection tasks, GAT mitigates the disruption of network homogeneity caused by anomaly nodes during neighbor aggregation. GCN performs only moderately in this task, mainly because the dataset contains inconsistent edges, meaning that normal and anomaly nodes are not connected correctly. GCN introduces noisy data during aggregation, causing interference to the trained graph representation.

[0129] 2. Model performance comparison experiment

[0130] This study examines the experimental results of the AnomFFNF model in this proposed solution compared to five other baseline models. The selected baseline models are as follows:

[0131] LOF (Breunig et al. 2000): An attribute-based anomaly detection method. It determines whether a node is an anomalous node by observing the attribute values ​​of the same community. It only considers the attribute information of the node and ignores the structural anomalies of the attribute network.

[0132] DOMINANT (Ding et al. 2019): An anomaly detection architecture based on graph neural networks. It utilizes graph convolution and autoencoders to jointly reconstruct the adjacency matrix and attribute matrix. The anomaly degree of each node is evaluated by calculating the reconstruction error. However, this method suffers from oversmoothing; when GCN aggregates neighbor information, it smooths out anomaly information.

[0133] AnomalyDAE (Fan et al., 2020): An anomaly detection architecture based on graph neural networks. It applies GAT to the embedding of the attribute network to learn the importance of different neighboring nodes, thereby improving anomaly detection performance. However, anomaly detection based on compression-reconstruction does not directly target anomaly detection, resulting in suboptimal results.

[0134] OC-GCN (Wang et al. 2021): An anomaly detection architecture based on graph neural networks. It leverages the powerful representational capabilities of graph neural networks, such as GraghSage, to learn node embeddings in graph data. Then, it applies a binary classification approach to detect anomalous nodes in the attribute network, as the presence of anomalous nodes disrupts the homogeneity of the graph neural network.

[0135] JAANE (Fan et al., 2023): An anomaly detection architecture based on graph neural networks. During the aggregation process, it considers both the target node and its neighbors, fusing the two to learn the node's feature vector. It learns a hypersphere of normal nodes through reconstruction error and regularization modules; nodes outside the hypersphere are considered anomalous. This model alleviates the oversmoothing problem, but the presence of anomalous nodes violates the homogeneity assumption.

[0136] The AUC results for each model are as follows: Figure 3 As shown. From Figure 3 The results lead to the following conclusions.

[0137] (1) The AnomFFNF model in this proposal achieved the best results on all three datasets. Specifically, AnomFFNF achieved certain improvements on Citeseer, Cora, and PubMed, with AUC values ​​increasing by 3.46%, 1.04%, and 1.69% respectively compared to the best comparison model. This indicates that AnomFFNF ensures the resolution of the oversmoothing problem and the homogeneity assumption of the encoder through attribute fusion and node filtering, thus improving the performance of abnormal node detection.

[0138] (2) Traditional abnormal node detection methods are significantly less effective than graph neural network-based methods, which indicates that traditional mechanisms cannot simultaneously capture network attributes and structural information, thus limiting the network's processing capabilities.

[0139] (3) Among the graph neural network-based methods, AnomalyDAE and OC-GCN are significantly better than the original DOMINANT, because both alleviate the oversmoothing problem to some extent. AnomalyDAE uses GAT as an encoder and performs certain filtering in the process of aggregating neighbor information; OC-GCN uses GraghSage for graph representation learning, which alleviates the oversmoothing problem compared to the original GCN.

[0140] 3. Ablation analysis

[0141] The main focus is on how the following modules affect model performance: (1) the impact of feature fusion and (2) the impact of node filters.

[0142] The impact of feature fusion on model performance is investigated by comparing the model with the node feature fusion module removed with the model in this proposed solution. The model with the feature fusion module removed is denoted as AnomNF. The experimental results of the original model and the model with the feature fusion module removed on four datasets are as follows. Figure 4 As shown in the data, it is clear that the AnomFFNF approach in this case achieves the best AUC performance on all three datasets. Further analysis reveals that the AnomFFNF approach in this case not only aggregates neighbor information when learning the vector representation of a node, but also fuses its own information. This prevents the surrounding neighbor information from diluting the information of the abnormal node itself, thus avoiding a decrease in detection accuracy. However, the AnomNF approach in this case removes the feature fusion module and simply aggregates neighbor information. This leads to the abnormal node's own information being diluted by surrounding neighbor nodes, preventing the model from learning abnormal features and thus affecting its accuracy improvement.

[0143] The model with node filters removed is compared with the model in this solution. The new model with node filters removed is denoted as AnomFF. The experimental results of the two models on three datasets are shown in Table 2.

[0144] Table 2 Impact of Node Filters

[0145] Citeseer Cora Pubmed AnomFFNF 0.92 0.9509 0.9414 AnomNF 0.8854 0.8617 0.8967

[0146] The experimental results show that adding the outlier filtering module improves the model's performance on all three datasets, with AUC values ​​increasing by 3.46%, 8.92%, and 4.47%, respectively. This demonstrates the necessity of the node filtering module in the overall model. Adding the node filtering module helps the model eliminate potential outliers when learning node vector representations, ensuring the homogeneity assumption of the graph neural network. Removing the node discrimination module degenerates the model into a standard outlier detection model, lacking optimization for the outlier detection task. The results are significantly worse than the original model, confirming that removing the interference of outliers in the outlier detection task improves model accuracy.

[0147] The experimental data above demonstrates that the feature fusion scheme in this case can ensure that the network's own features are not diluted when fusing neighbor information, thereby avoiding misjudgments caused by the dilution of abnormal features. In node filtering, possible abnormal nodes are removed to ensure the purity of node features. The reconstruction error and the similarity between the node and the global model are used as the basis for judging node abnormalities. The similarity between the node and the global model directly targets the anomaly detection task, enhancing the model's goal-driven nature and facilitating its deployment and implementation in practical attribute network abnormal behavior detection applications.

[0148] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0149] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0150] The units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations are not considered to be beyond the scope of this invention.

[0151] Those skilled in the art will understand that all or part of the steps in the above methods can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk. Optionally, all or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiments can be implemented in hardware or as a software functional module. This invention is not limited to any particular combination of hardware and software.

[0152] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for detecting abnormal nodes in an attribute network based on iterative filtering, characterized in that, Include: Obtain graph network data of the attribute network to be detected, wherein the graph network data includes attribute network nodes, attribute network adjacency matrix and attribute network attribute matrix; The adjacency matrix of the attribute network and the attribute matrix are used as the training data input of the abnormal node detection model. The abnormal nodes in the attribute network to be detected are determined and output using the iterative filtering model training process. In each iteration of the filtering model training, abnormal nodes in the training data are detected and filtered and the training data is updated until the training data of the next iteration of filtering no longer generates new abnormal nodes. The abnormal node detection model includes a weight-sharing encoder that learns network embeddings and attribute embeddings based on graph network data of the attribute network and based on shared weight parameters; a feature fusion unit that combines the learned network embeddings and attribute embeddings in the feature space to obtain node embedding information and global network information; a dual-channel decoder that reconstructs the network structure and node attributes of the attribute network from the combined network features; an abnormal node discriminator that determines network node abnormalities based on the similarity between network structure reconstruction error, node attribute reconstruction error, node embedding information and global network information; and a node filter that filters the determined network abnormal nodes and their corresponding features. The feature fusion unit combines the learned network embeddings and attribute embeddings in the feature space to obtain node embedding information and global network information. This process includes: establishing alignment between network embeddings and attribute embeddings through element-wise multiplication to obtain consistency information; merging network embeddings and attribute embeddings through element-wise addition to obtain complementary information; and merging the consistency and complementary information to obtain the final node embedding representation, which is used to obtain global network information and the similarity between node embedding information and global information. The process of reconstructing the network structure and node attributes of an attribute network from the combined network features using a dual-channel decoder includes: using the attribute decoder to perform feature transformation to reconstruct node attributes, wherein the attribute decoder adopts a fully connected neural network structure; and using the structure decoder to reconstruct the network topology by calculating the inner product of the combined network features. The abnormal node discriminator determines network node anomalies based on network structure reconstruction error, node attribute reconstruction error, and the similarity between node embedding information and network global information. The process includes: obtaining network structure reconstruction error and node attribute reconstruction error, and calculating the similarity between the two based on node embedding information and network global information; calculating network node anomaly scores using each reconstruction error and similarity combined with a balancing parameter; sorting network nodes according to the anomaly scores; and filtering out abnormal nodes in the network based on the sorting results and a preset anomaly threshold.

2. The method for detecting abnormal nodes in an attribute network based on iterative filtering according to claim 1, characterized in that, The weight-shared encoder learns network embeddings and attribute embeddings based on graph network data from the attribute network and shared weight parameters, including: The adjacency matrix and attribute matrix of the attribute network are used as inputs for network embedding learning, and the network embedding is learned based on the degree matrix and shared weight parameters of the attribute network. The identity matrix and attribute matrix are used as inputs for attribute embedding learning. Attribute embeddings are learned based on shared weight parameters, which are used to map network embeddings and attribute embeddings to the same feature space.

3. The method for detecting abnormal nodes in an attribute network based on iterative filtering according to claim 1, characterized in that, The node filter process involves filtering identified network anomaly nodes and their corresponding features, including: Locate the abnormal network node and modify the row data corresponding to the abnormal network node in the adjacency matrix to remove the abnormal network node from the graph network data.

4. The method for detecting abnormal nodes in an attribute network based on iterative filtering according to claim 1, characterized in that, The training loss function of the anomaly node detection model is expressed as: L=a1R S +a2R A +a3s sim Where a1, a2, and a3 are equilibrium parameters, and R S Let the network structure reconstruction error be R. A For attribute reconstruction error, s sim The similarity between node embedded information and global network information.

5. An attribute network anomaly node detection system based on iterative filtering, characterized in that, It includes: a data acquisition module and an anomaly detection module, wherein, The data acquisition module is used to acquire graph network data of the attribute network to be detected, wherein the graph network data includes attribute network nodes, attribute network adjacency matrix and attribute network attribute matrix; The anomaly detection module is used to take the adjacency matrix of the attribute network and the attribute matrix as the training data input of the anomaly node detection model. It uses the iterative filtering model training process to determine the anomaly nodes in the attribute network to be detected and output them. In each iteration of the filtering model training, it detects and filters the anomaly nodes in the training data and updates the training data until the training data of the next iteration of filtering no longer generates new anomaly nodes. The abnormal node detection model includes a weight-sharing encoder that learns network embeddings and attribute embeddings based on graph network data of the attribute network and based on shared weight parameters; a feature fusion unit that combines the learned network embeddings and attribute embeddings in the feature space to obtain node embedding information and global network information; a dual-channel decoder that reconstructs the network structure and node attributes of the attribute network from the combined network features; an abnormal node discriminator that determines network node abnormalities based on the similarity between network structure reconstruction error, node attribute reconstruction error, node embedding information and global network information; and a node filter that filters the determined network abnormal nodes and their corresponding features. The feature fusion unit combines the learned network embeddings and attribute embeddings in the feature space to obtain node embedding information and global network information. This process includes: establishing alignment between network embeddings and attribute embeddings through element-wise multiplication to obtain consistency information; merging network embeddings and attribute embeddings through element-wise addition to obtain complementary information; and merging the consistency and complementary information to obtain the final node embedding representation, which is used to obtain global network information and the similarity between node embedding information and global information. The process of reconstructing the network structure and node attributes of an attribute network from the combined network features using a dual-channel decoder includes: using the attribute decoder to perform feature transformation to reconstruct node attributes, wherein the attribute decoder adopts a fully connected neural network structure; and using the structure decoder to reconstruct the network topology by calculating the inner product of the combined network features. The abnormal node discriminator determines network node anomalies based on network structure reconstruction error, node attribute reconstruction error, and the similarity between node embedding information and network global information. The process includes: obtaining network structure reconstruction error and node attribute reconstruction error, and calculating the similarity between the two based on node embedding information and network global information; calculating network node anomaly scores using each reconstruction error and similarity combined with a balancing parameter; sorting network nodes according to the anomaly scores; and filtering out abnormal nodes in the network based on the sorting results and a preset anomaly threshold.

6. An electronic device, characterized in that, include: At least one processor, and a memory coupled to said at least one processor; The memory stores a computer program that can be executed by the at least one processor to implement the method as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed, enables the implementation of the method as described in any one of claims 1 to 4.

Images