A graph anomaly detection method and device based on diffusion model

Abstract

The present invention discloses a method and device for detecting anomalies in a graph based on a diffusion model, wherein the method comprises: obtaining graph data, encoding a node feature matrix and an adjacency matrix in the graph data into a latent space using a pre-trained autoencoder, and obtaining a latent space embedding; training an unconditional diffusion model using a forward diffusion process and a reverse diffusion process, training a conditional diffusion model based on the common features, guiding the unconditional diffusion model and the conditional diffusion model to construct discriminative features by a classifier-free method, and integrating the discriminative features into the latent space, and obtaining a latent space embedding with discriminative features; based on the latent space embedding with discriminative features, reconstructing the node feature matrix and the adjacency matrix in the graph data respectively, and calculating the reconstruction error, and identifying entities with high reconstruction errors as abnormalities. The present invention can be applied to various real-life scenarios, is simple and efficient, and has significantly improved graph anomaly detection performance on multiple data sets.

Description

Technical Field

[0001] The present application relates to the technical field of graph anomaly detection, and more specifically to a method and device for graph anomaly detection based on a diffusion model. Background Art

[0002] The graph anomaly detection (GAD) task aims to detect abnormal targets (such as nodes, edges, subgraphs, etc.) in the graph structure. Existing research is divided into two branches: semi-supervised learning and unsupervised learning. Semi-supervised learning uses a small part of labeled data to learn how to identify abnormal patterns and predict the remaining unlabeled data. However, accurate label annotation consumes a lot of time and manpower, which limits the widespread application of semi-supervised methods.

[0003] Strategies based on unsupervised reconstruction are able to directly capture node features and local structures and do not require data labels. Specifically, these methods assume that abnormal entities exhibit more complex features and distributions and are significantly more difficult to reconstruct. Therefore, they use encoders such as autoencoders (AEs) and graph neural networks (GNNs) to map graph data into latent spaces. Subsequently, these graph embeddings are re-decoded into the initial graph data entities, where those entities that exhibit higher reconstruction errors are considered more likely to be abnormal.

[0004] However, abnormal entities in real scenarios often disguise themselves among normal entities (e.g., having significant overlaps in common attributes with normal entities or frequently interacting with normal entities), shifting the focus of reconstruction-based models to the overlapping common content, thereby reducing the model's ability to identify truly distinguishing features (e.g., transaction information in financial fraud). As a result, both abnormal and normal entities can be accurately reconstructed, reducing the effectiveness of the detection method. Moreover, using variational autoencoder (VAE)-based methods faces a significant challenge: it constrains the distribution of data in the latent space to a Gaussian distribution, resulting in a uniform data distribution, which limits the model's expressiveness and makes it challenging to distinguish between abnormal and normal samples.

[0005] In recent years, diffusion models (DMs) have gained widespread attention due to their significant progress in generating high-quality images and videos. Representative models such as DDPM, SMG, and SDE have been widely used in various fields. For example, for graph neural networks (GNNs), researchers have explored the use of diffusion models (DMs) to enhance molecular graph modeling, protein design, drug discovery, material design, etc., and have achieved significant improvements. In graph anomaly detection (GAD), some researchers use variational autoencoders (VAE) combined with diffusion models (DMs) to generate effective anomaly samples to solve the problem of class imbalance and improve the performance of downstream anomaly detection methods. However, such methods cannot directly detect abnormal samples. Summary of the invention

[0006] The embodiments of the present invention provide a method, device, electronic device and storage medium for detecting anomalies in a graph based on a diffusion model, so as to solve the problem that abnormal samples cannot be directly detected in the related art.

[0007] In a first aspect, the present invention provides a method for detecting anomalies in a graph based on a diffusion model, the method comprising:

[0008] Obtain graph data, and use a pre-trained autoencoder to encode a node feature matrix and an adjacency matrix in the graph data into a latent space to obtain a latent space embedding;

[0009] Using the forward diffusion process and the reverse diffusion process to train the unconditional diffusion model, the general information in the latent space embedding is obtained through the trained unconditional diffusion model, wherein the general information is a feature that includes both discriminative information and common information;

[0010] Initializing the average value of latent space embeddings of all nodes as common features, training a conditional diffusion model based on the common features, and retaining the common features in the latent space embeddings through the trained conditional diffusion model;

[0011] The unconditional diffusion model and the conditional diffusion model are guided by a classifier-free method to construct discriminative features, and the discriminative features are integrated into a latent space to obtain a latent space embedding with discriminative features;

[0012] Based on latent space embedding with discriminative features, the node feature matrix and adjacency matrix in the graph data are reconstructed respectively, and the reconstruction error is calculated. The entities with high reconstruction error are identified as abnormalities.

[0013] In an optional embodiment, the autoencoder uses an autoencoder combined with a graph convolutional neural network.

[0014] In an optional embodiment, the autoencoder training comprises the following steps:

[0015] Obtain graph data, and use the encoder to encode the node feature matrix and adjacency matrix in the graph data into the latent space to obtain the latent space embedding;

[0016] Use the decoder to reconstruct the node feature matrix and adjacency matrix from the latent space embedding;

[0017] The reconstruction error is used as the loss function of the autoencoder.

[0018] In an optional embodiment, the unconditional diffusion model is trained by using the forward diffusion process and the reverse diffusion process, and the general information in the latent space embedding is obtained by using the trained unconditional diffusion model, including:

[0019] Use the forward diffusion process to obtain a latent space embedding with a time step smaller than the total time length perturbation;

[0020] reconstructing the latent space embedding based on the perturbed latent space embedding using a reverse diffusion process;

[0021] A denoising score matching loss function is designed to match the forward and reverse noises to train the unconditional diffusion model, and the trained unconditional diffusion model retains general information.

[0022] In an optional embodiment, initializing the average value of latent space embeddings of all nodes as common features, training a conditional diffusion model based on the common features, and retaining the common features in the latent space embeddings by the trained conditional diffusion model includes:

[0023] Initialize the average value of latent space embeddings of all nodes as the common features;

[0024] When training the unconditional diffusion model, the relationship between the latent space embedding reconstructed in each iteration and the current common features is calculated. Similarity;

[0025] pass The normalized exponential function of similarity calculates the weight of the latent space embedding of each node, assigning a relatively low weight to nodes that are significantly deviated from the current common features, and deriving a comprehensive common feature;

[0026] The common features of the last iteration are taken as the final common features, and the conditional diffusion model is trained based on the final common features.

[0027] In an optional embodiment, guiding the unconditional diffusion model and the conditional diffusion model to construct discriminative features by no classifier, and integrating the discriminative features into the latent space to obtain the latent space embedding with the discriminative features includes:

[0028] Subtracting the general information obtained by the unconditional diffusion model from the common content obtained by the conditional diffusion model to obtain discriminative features;

[0029] Sampling is performed through the modified score function, and latent space embedding with discriminative features is reconstructed in the sampling stage.

[0030] In an optional embodiment, based on latent space embedding with discriminative features, reconstructing the node feature matrix and the adjacency matrix in the graph data respectively, and calculating the reconstruction error, identifying the entity with high reconstruction error as abnormal includes:

[0031] Use the decoder to reconstruct the node feature matrix and adjacency matrix in the graph data;

[0032] The reconstruction error is calculated again, and entities with higher reconstruction errors are identified as anomalies.

[0033] Compared with the prior art, the graph anomaly detection method based on the diffusion model of the present invention has the following beneficial effects:

[0034] This method maps the input graph data to the latent space first, and then uses the double diffusion model method to encapsulate the general content through the unconditional diffusion model, and extract the common content through the conditional diffusion model. Then, in a way without classifier guidance, the parallel sampling of the two diffusion models is enabled without any additional parameters, and the discriminative content is identified by the difference between the representations captured by the two diffusion models. Finally, the latent space is decoded to embed the reconstructed graph data, and the reconstruction error between the original data is calculated. The nodes with higher errors are more likely to be abnormal nodes. The present invention can be applied to various real-world scenarios, is simple and efficient, and has significantly improved the performance of graph anomaly detection on multiple data sets.

[0035] In a second aspect, an embodiment of the present invention provides a graph anomaly detection device based on a diffusion model, comprising:

[0036] A mapping module is used to obtain graph data, and use a pre-trained autoencoder to encode the node feature matrix and the adjacency matrix in the graph data into a latent space to obtain a latent space embedding;

[0037] An unconditional model building module, used to train an unconditional diffusion model using a forward diffusion process and a reverse diffusion process, and obtain general information in the latent space embedding through the trained unconditional diffusion model, wherein the general information is a feature that contains both discriminative information and common information;

[0038] A conditional model construction module, used to initialize the average values ​​of latent space embeddings of all nodes as common features, train a conditional diffusion model based on the common features, and retain the common features in the latent space embeddings through the trained conditional diffusion model;

[0039] A guided sampling module, used for guiding the unconditional diffusion model and the conditional diffusion model to construct discriminative features by a non-classifier, and integrating the discriminative features into a latent space to obtain a latent space embedding with discriminative features;

[0040] The reconstruction and recognition module is used to reconstruct the node feature matrix and adjacency matrix in the graph data based on the latent space embedding with discriminative features, calculate the reconstruction error, and identify entities with high reconstruction errors as abnormalities.

[0041] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a processor, a communication interface, a memory and a bus, wherein the processor, the communication interface and the memory communicate with each other through the bus, and the processor can call logic instructions in the memory to execute the steps of the method provided in the first aspect.

[0042] In a fourth aspect, an embodiment of the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the graph anomaly detection method based on the diffusion model as described in the first aspect.

[0043] Compared with the prior art, the beneficial effects of the diffusion model-based graph anomaly detection device, electronic device and storage medium of the present invention are the same as those of the diffusion model-based graph anomaly detection method described in the first aspect, so they will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 is a flow chart of a method for detecting anomalies in a graph based on a diffusion model in an embodiment of the present invention;

[0046] Figure 2 Schematic diagram of an automatic encoder according to an embodiment of the present invention;

[0047] Figure 3 Schematic diagram of training a diffusion model in an embodiment of the present invention;

[0048] Figure 4 is a structural block diagram of a graph anomaly device based on a diffusion model in an embodiment of the present invention;

[0049] Figure 5 1 is a structural block diagram of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0050] In order to more clearly understand the purpose, technical solutions and advantages of the present application, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0051] Unless otherwise defined, the technical terms or scientific terms involved in this application shall have the general meaning understood by people with general skills in the technical field to which this application belongs. The words "one", "a", "the", "these" and the like in this application do not indicate a quantitative limitation, and they may be singular or plural. The terms "include", "comprise", "have" and any variants thereof involved in this application are intended to cover non-exclusive inclusions; for example, a process, method and system, product or device comprising a series of steps or modules (units) is not limited to the listed steps or modules (units), but may include unlisted steps or modules (units), or may include other steps or modules (units) inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships, for example, "A and / or B" may mean: A exists alone, A and B exist at the same time, and B exists alone. Generally, the character " / " indicates that the objects associated with each other are in an "or" relationship. The terms "first", "second", "third", etc. in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0052] In an embodiment of the present invention, a diffusion model-based graph anomaly detection method (DiffGAD) is provided. Figure 1 is a flow chart of the graph anomaly detection method based on the diffusion model of the present invention, such as Figure 1 As shown, the process includes the following steps:

[0053] S101. Obtaining graph data , use the pre-trained autoencoder to transform the graph data The node feature matrix in and the adjacency matrix Encode into the latent space and get the latent space embedding :

[0054] ,

[0055] in, , represents the dimension of latent space embedding, is the encoder in the autoencoder.

[0056] It should be noted that the autoencoder includes the encoder and decoder . Graph data usually includes nodes, node feature matrices, adjacency matrices, edges, edge features, and subgraphs. In social networks, these components together constitute a complete description of the graph data. In graph neural networks and other graph-related machine learning tasks, this information is used for various tasks such as node classification, link prediction, and community discovery. For example, in social network analysis, nodes may represent users, edges represent interactions between users, node features may contain user profile information, and the adjacency matrix describes who follows whom. In financial transaction networks, nodes may be accounts, edges are fund transfer records, and node features may contain information such as the account's historical transaction behavior.

[0057] It should be noted that if Figure 2 and Figure 3 As shown in Figure 1, the autoencoder uses an autoencoder combined with a graph convolutional neural network. The graph convolutional neural network (GCN) is mainly used to encode graph data in this method. , the graph structure (adjacency matrix) and node feature information are integrated into latent space embedding, providing a powerful feature representation for subsequent graph anomaly detection tasks.

[0058] Specifically, the autoencoder is used for graph data Pre-training is required before processing. The autoencoder training includes the following steps:

[0059] Get graph data , using the encoder The graph data The node feature matrix in and the adjacency matrix Encode into the latent space and get the latent space embedding ;

[0060] ,

[0061] in, , Represents the dimension of latent space embedding.

[0062] Using decoder to embed from latent space Reconstruct the node feature matrix and adjacency matrix;

[0063] ,

[0064] in, and The decoders are used to predict node features and graph structure (adjacency matrix) respectively.

[0065] Using the reconstruction error as the loss function of the autoencoder, the following formula is shown:

[0066] ,

[0067] in, represents the L2 norm, Hyperparameters for balancing the effects of feature and structure reconstruction.

[0068] Due to the sparsity of abnormal entities, discriminative content (features) are difficult to capture, while common content (features) are easy to obtain. Therefore, in order to implicitly capture this discriminative information, an unconditional diffusion model (DM) is trained to focus on constructing features that contain general information (both discriminative information and common information).

[0069] S102, training an unconditional diffusion model using a forward diffusion process and a reverse diffusion process, and obtaining general information in latent space embedding through the trained unconditional diffusion model, where the general information is a feature that includes both discriminative information and common information;

[0070] The first thing to understand is that the forward diffusion process is the process of gradually adding noise to the data in the diffusion model. In this process, the original data is gradually perturbed until it is completely covered by noise. Specifically, during the forward diffusion process, the latent space embedding is gradually added with noise, moving it away from the original state. Through a series of small time step perturbations, the latent space embedding gradually loses its original information until it becomes unrecognizable. The goal of the forward diffusion process is to create an orderly noise addition process so that the final data is composed entirely of noise. This process simulates the process of gradual degradation of data and provides a basis for denoising in the reverse process.

[0071] The reverse diffusion process is the process of removing noise in the diffusion model, aiming to gradually restore the original data. Specifically, in the reverse diffusion process, the data is restored to a state close to the original by gradually removing the noise. This process is achieved by reconstructing the latent space embedding, that is, by gradually removing the noise added in the forward diffusion process, so that the latent space embedding gradually approaches its original state. The goal of the reverse diffusion process is to gradually remove the noise until an embedding representation close to the original data is obtained. By gradually removing the noise, the original latent space embedding can eventually be restored from the noisy latent space embedding.

[0072] More specifically, the forward diffusion process and the reverse diffusion process are used to train the unconditional diffusion model, and the general information in the latent space embedding obtained by the trained unconditional diffusion model includes:

[0073] Use the forward diffusion process to obtain a time step smaller than the total time length ( ) Perturbed latent space embedding :

[0074] ,

[0075] in, For the S101 autoencoder The latent space embedding obtained by encoding, .

[0076] Perturbation-based latent space embedding , using the reverse diffusion process to reconstruct the latent space embedding ;

[0077] ,

[0078] in, is the score function, yes The first derivative of .

[0079] The denoising score matching (DSM) loss function is designed to match the forward and reverse noises to train the unconditional diffusion model. The trained unconditional diffusion model retains general information:

[0080] ,

[0081] in, is a neural network that is able to learn the noise added in the forward process.

[0082] S103, embed the latent space of all nodes The average value is initialized as the common feature , based on common features Train the conditional diffusion model to retain the common features in the latent space embedding through the trained conditional diffusion model;

[0083] Specifically, the latent space of all nodes is embedded into The average value is initialized as the common feature , based on common features Train the conditional diffusion model. The common features retained in the latent space embedding by the trained conditional diffusion model include:

[0084] Embed the latent space of all nodes The average value of is initialized as the common feature ;

[0085] When training the unconditional diffusion model, calculate the latent space embedding reconstructed in each iteration Shared features with current Between Similarity:

[0086] ,

[0087] in, Represents a node.

[0088] pass The normalized exponential function of similarity calculates the weight of the latent space embedding of each node, assigning relatively low weights to nodes that significantly deviate from the current common features, and deriving a comprehensive common feature:

[0089] ,

[0090] in, To control the weight Temperature coefficient of smoothness. Larger Represents the current latent space embedding Make a greater contribution to the update process.

[0091] The updating process of common features is:

[0092] ,

[0093] in, It is the common feature updated in the next training iteration, and the common feature of the last iteration is used as the final common feature And remain unchanged in the subsequent detection stage, based on the final common features Training the conditional diffusion model.

[0094] ,

[0095] The trained conditional diffusion model is able to preserve common information (features).

[0096] S104, constructing discriminative features by guiding the unconditional diffusion model and the conditional diffusion model without a classifier, and integrating the discriminative features into the latent space to obtain a latent space embedding with discriminative features;

[0097] By distinguishing the general content (information) from the common content (information), the discriminative content can be separated. By applying a classifier-free bootstrap between two trained diffusion models, the discriminative information will be integrated into the latent space. This process enables the latent space to distinguish between normal and abnormal distributions in the overlapping area, thereby achieving the distinction between abnormal samples and normal samples.

[0098] Specifically, the discriminative features are constructed by guiding the unconditional diffusion model and the conditional diffusion model without a classifier, and the discriminative features are integrated into the latent space to obtain the latent space embedding with discriminative features, including:

[0099] The general information obtained by the unconditional diffusion model and the common content obtained by the conditional diffusion model are subtracted to obtain discriminative features;

[0100] ,

[0101] in, is a hyperparameter for adjusting the strength.

[0102] It should be noted that the corrected score function needs to be calculated:

[0103] ,

[0104] Sampling is performed through the modified score function, and latent space embedding with discriminative features is reconstructed in the sampling stage .

[0105] Anomaly detection based on reconstruction error is essentially more in line with classification tasks rather than generation tasks, and the diffusion model is slightly modified to better suit this task. In the sampling stage, the latent space embedding is initialized using Gaussian noise, which is different from the traditional diffusion model. Then generate latent space embedding The difference is that the present invention embeds the original latent space through the forward diffusion process Use a smaller time step Perturb to get the initialization point of the reverse process. In this process, it is possible to control), thereby further enhancing the model’s discriminative ability. Specifically, a smaller time step The noise with a value of The noise of the value retains more local, small-scale general content. By retaining these contents, the constructed latent space can accurately represent the data. This enhancement effectively expands the distribution difference between abnormal and normal entities, thus forming a powerful and discriminative latent space.

[0106] S105. Latent space embedding based on discriminative features , respectively reconstruct the graph data The node feature matrix in and the adjacency matrix , and calculate the reconstruction error, identifying entities with high reconstruction error as abnormalities.

[0107] Latent space embedding based on discriminative features , respectively reconstruct the node feature matrix in the graph data and the adjacency matrix , and calculate the reconstruction error, identifying entities with high reconstruction error as abnormalities including:

[0108] Reconstructing graph data using decoder The node feature matrix in and the adjacency matrix ;

[0109] The reconstruction error is calculated again, and entities with higher reconstruction errors are identified as anomalies.

[0110] It should be noted that the decoder has been trained in the above, and the following formula Replace with a reconstructed latent space embedding with discriminative content :

[0111] ,

[0112] Reconstruct graph data separately The node feature matrix in and the adjacency matrix The reconstruction error is calculated by the following formula:

[0113] ,

[0114] Entities that exhibit higher reconstruction errors are identified as anomalies.

[0115] As shown in Table 1, multiple data sets are statistically analyzed. Experiments show that the performance of graph anomaly detection on multiple data sets is significantly improved, and it is an effective graph anomaly detection method. The experimental results are shown in Table 2, where the best result is represented by a dotted underline and the second best result is represented by a straight underline. DiffGAD can achieve the top two results on all data sets, and the average ROC-AUC performance is improved by more than 9% compared with previous methods.

[0116] Table 1: Dataset statistics

[0117]

[0118] Table 2: ROC-AUC indicators of DiffGAD on multiple datasets

[0119]

[0120] The embodiment of the present invention also provides a graph anomaly detection device based on a diffusion model, which is used to implement the above method embodiment, and will not be repeated hereafter. The terms "module", "unit", "subunit", etc. used below can implement a combination of software and / or hardware for a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware or a combination of software and hardware is also possible and conceivable.

[0121] like Figure 4 As shown, Figure 4: is a structural block diagram of a graph anomaly detection device based on a diffusion model in the present invention, the device comprising:

[0122] A mapping module 100 is used to obtain graph data, and use a pre-trained autoencoder to encode a node feature matrix and an adjacency matrix in the graph data into a latent space to obtain a latent space embedding;

[0123] An unconditional model building module 200 is used to train an unconditional diffusion model using a forward diffusion process and a reverse diffusion process, and obtain general information in the latent space embedding through the trained unconditional diffusion model, wherein the general information is a feature that contains both discriminative information and common information;

[0124] A conditional model construction module 300 is used to initialize the average values ​​of latent space embeddings of all nodes as common features, train a conditional diffusion model based on the common features, and retain the common features in the latent space embeddings through the trained conditional diffusion model;

[0125] A guided sampling module 400 is used to guide the unconditional diffusion model and the conditional diffusion model to construct discriminative features by a classifier-free method, and integrate the discriminative features into a latent space to obtain a latent space embedding with discriminative features;

[0126] The reconstruction and identification module 500 is used to reconstruct the node feature matrix and the adjacency matrix in the graph data based on the latent space embedding with discriminative features, calculate the reconstruction error, and identify the entity with high reconstruction error as abnormal.

[0127] The device maps the input graph data to the latent space, encapsulates the general content through the unconditional diffusion model, extracts the common content through the conditional diffusion model, and then uses the method without classifier guidance to enable parallel sampling of the two diffusion models without any additional parameters, and identifies the discriminative content through the difference between the representations captured by the two diffusion models. Finally, the latent space is decoded to embed the reconstructed graph data, and the reconstruction error between the original data is calculated. Nodes with higher errors are more likely to be abnormal nodes.

[0128] Figure 5 A structural block diagram of an electronic device provided by an embodiment of the present invention, such as Figure 5 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 communicate with each other through the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute the following method:

[0129] Obtain graph data, and use a pre-trained autoencoder to encode a node feature matrix and an adjacency matrix in the graph data into a latent space to obtain a latent space embedding;

[0130] Using the forward diffusion process and the reverse diffusion process to train the unconditional diffusion model, the general information in the latent space embedding is obtained through the trained unconditional diffusion model, wherein the general information is a feature that includes both discriminative information and common information;

[0131] Initializing the average value of latent space embeddings of all nodes as common features, training a conditional diffusion model based on the common features, and retaining the common features in the latent space embeddings through the trained conditional diffusion model;

[0132] The unconditional diffusion model and the conditional diffusion model are guided by a classifier-free method to construct discriminative features, and the discriminative features are integrated into a latent space to obtain a latent space embedding with discriminative features;

[0133] Based on latent space embedding with discriminative features, the node feature matrix and adjacency matrix in the graph data are reconstructed respectively, and the reconstruction error is calculated. The entities with high reconstruction error are identified as abnormalities.

[0134] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0135] An embodiment of the present invention further provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method provided in each of the above embodiments is implemented, for example, including:

[0136] Obtain graph data, and use a pre-trained autoencoder to encode a node feature matrix and an adjacency matrix in the graph data into a latent space to obtain a latent space embedding;

[0137] Using the forward diffusion process and the reverse diffusion process to train the unconditional diffusion model, the general information in the latent space embedding is obtained through the trained unconditional diffusion model, wherein the general information is a feature that includes both discriminative information and common information;

[0138] Initializing the average value of latent space embeddings of all nodes as common features, training a conditional diffusion model based on the common features, and retaining the common features in the latent space embeddings through the trained conditional diffusion model;

[0139] The unconditional diffusion model and the conditional diffusion model are guided by a classifier-free method to construct discriminative features, and the discriminative features are integrated into a latent space to obtain a latent space embedding with discriminative features;

[0140] Based on latent space embedding with discriminative features, the node feature matrix and adjacency matrix in the graph data are reconstructed respectively, and the reconstruction error is calculated. The entities with high reconstruction error are identified as abnormalities.

[0141] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0142] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A graph anomaly detection method based on a diffusion model, characterized in that: The graph anomaly detection method comprises: Obtain graph data, and use a pre-trained autoencoder to encode a node feature matrix and an adjacency matrix in the graph data into a latent space to obtain a latent space embedding; The autoencoder uses an autoencoder combined with a graph convolutional neural network; The automatic encoder training comprises the following steps: Get graph data , using the encoder The graph data The node feature matrix in and the adjacency matrix Encode into the latent space and get the latent space embedding , ,in, , represents the dimension of latent space embedding; Use the decoder to reconstruct the node feature matrix and adjacency matrix from the latent space embedding; ； in, and Decoders for predicting node features and adjacency matrices respectively; Using the reconstruction error as a loss function of the autoencoder; ； in, represents the L2 norm, Hyperparameters to balance the effects of feature and structure reconstruction; Using the forward diffusion process and the reverse diffusion process to train the unconditional diffusion model, the general information in the latent space embedding is obtained through the trained unconditional diffusion model, wherein the general information is a feature that includes both discriminative information and common information; The unconditional diffusion model is trained by using the forward diffusion process and the reverse diffusion process, and the general information in the latent space embedding is obtained by the trained unconditional diffusion model, including: Use the forward diffusion process to obtain a time step Less than the total time Perturbed Latent Space Embedding ; ； in, For the autoencoder The latent space embedding obtained by encoding, ; Latent space embedding based on the perturbation , using the reverse diffusion process to reconstruct the latent space embedding ; ； in, is the score function, yes The first derivative of ; Designing a denoising score matching loss function to match forward and reverse noises to train an unconditional diffusion model, wherein the trained unconditional diffusion model retains general information; Initializing the average value of latent space embeddings of all nodes as common features, training a conditional diffusion model based on the common features, and retaining the common features in the latent space embeddings through the trained conditional diffusion model; The unconditional diffusion model and the conditional diffusion model are guided by a classifier-free method to construct discriminative features, and the discriminative features are integrated into a latent space to obtain a latent space embedding with discriminative features; Based on latent space embedding with discriminative features, the node feature matrix and adjacency matrix in the graph data are reconstructed respectively, and the reconstruction error is calculated. The entities with high reconstruction error are identified as abnormalities.

2. The graph anomaly detection method based on diffusion model according to claim 1, characterized in that: Initializing the average value of latent space embeddings of all nodes as common features, training a conditional diffusion model based on the common features, and retaining the common features in the latent space embeddings by the trained conditional diffusion model includes: Initialize the average value of latent space embeddings of all nodes as the common features; When training the unconditional diffusion model, the relationship between the latent space embedding reconstructed in each iteration and the current common features is calculated. Similarity; pass The normalized exponential function of similarity calculates the weight of the latent space embedding of each node, assigning a relatively low weight to nodes that are significantly deviated from the current common features, and deriving a comprehensive common feature; The common features of the last iteration are taken as the final common features, and the conditional diffusion model is trained based on the final common features.

3. The graph anomaly detection method based on diffusion model according to claim 1, characterized in that: Guiding the unconditional diffusion model and the conditional diffusion model without a classifier to construct discriminative features, and integrating the discriminative features into the latent space, to obtain a latent space embedding with discriminative features includes: Subtracting the general information obtained by the unconditional diffusion model from the common content obtained by the conditional diffusion model to obtain discriminative features; Sampling is performed through the modified score function, and latent space embedding with discriminative features is reconstructed in the sampling stage.

4. The graph anomaly detection method based on diffusion model according to claim 1, characterized in that: Based on latent space embedding with discriminative features, the node feature matrix and adjacency matrix in the graph data are reconstructed respectively, and the reconstruction error is calculated. Entities with high reconstruction error are identified as abnormal, including: Use the decoder to reconstruct the node feature matrix and adjacency matrix in the graph data; The reconstruction error is calculated again, and entities with higher reconstruction errors are identified as anomalies.

5. A graph anomaly detection device based on a diffusion model, characterized in that: include: A mapping module is used to obtain graph data, and use a pre-trained autoencoder to encode the node feature matrix and the adjacency matrix in the graph data into a latent space to obtain a latent space embedding; The autoencoder uses an autoencoder combined with a graph convolutional neural network; The automatic encoder training comprises the following steps: Get graph data , using the encoder The graph data The node feature matrix in and the adjacency matrix Encode into the latent space and get the latent space embedding , ,in, , represents the dimension of latent space embedding; Use the decoder to reconstruct the node feature matrix and adjacency matrix from the latent space embedding; ； in, and Decoders for predicting node features and adjacency matrices respectively; Using the reconstruction error as a loss function of the autoencoder; ； in, represents the L2 norm, Hyperparameters to balance the effects of feature and structure reconstruction; An unconditional model building module, used to train an unconditional diffusion model using a forward diffusion process and a reverse diffusion process, and obtain general information in the latent space embedding through the trained unconditional diffusion model, wherein the general information is a feature that contains both discriminative information and common information; The unconditional diffusion model is trained by using the forward diffusion process and the reverse diffusion process, and the general information in the latent space embedding is obtained by the trained unconditional diffusion model, including: Use the forward diffusion process to obtain a time step Less than the total time Perturbed Latent Space Embedding ; ； in, For the autoencoder The latent space embedding obtained by encoding, ; Latent space embedding based on the perturbation , using the reverse diffusion process to reconstruct the latent space embedding ; ； in, is the score function, yes The first derivative of ; Designing a denoising score matching loss function to match forward and reverse noises to train an unconditional diffusion model, wherein the trained unconditional diffusion model retains general information; A conditional model construction module, used to initialize the average values ​​of latent space embeddings of all nodes as common features, train a conditional diffusion model based on the common features, and retain the common features in the latent space embeddings through the trained conditional diffusion model; A guided sampling module, used for guiding the unconditional diffusion model and the conditional diffusion model to construct discriminative features by a non-classifier, and integrating the discriminative features into a latent space to obtain a latent space embedding with discriminative features; The reconstruction and recognition module is used to reconstruct the node feature matrix and adjacency matrix in the graph data based on the latent space embedding with discriminative features, calculate the reconstruction error, and identify entities with high reconstruction errors as abnormalities.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the graph anomaly detection method based on the diffusion model according to any one of claims 1 to 4 is implemented.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the graph anomaly detection method based on a diffusion model as described in any one of claims 1 to 4 are implemented.

Images