Attribute graph anomaly detection method based on multi-embedding comparison

Abstract

The invention provides an attribute graph anomaly detection method based on multi-embedding comparison, and belongs to the field of anomaly detection. Experiments are carried out on a plurality of real world data sets, attributes and structure information of nodes are considered, and various abnormal conditions are accurately identified, especially provided role anomalies are taken as the purpose. And performing multi-embedding comparison on node attribute information, structure information and comprehensive information, and performing feature extraction through a memory network enhanced graph decoder. And aiming at the problem of anomaly detection in the graph, abnormal nodes are identified by utilizing a multi-embedded comparison module and memory network enhancement, and an effective anomaly detection result is finally obtained. Simulation results show that compared with other mainstream methods, the method provided by the invention has effectiveness and superiority in the aspect of identifying various types of anomalies, especially has excellent performance in role anomaly detection, and has relatively high practical value.

Description

Technical Field

[0001] The present invention belongs to the field of anomaly detection, and relates to a graph anomaly detection method based on a multi-embedded contrast module and a memory network enhancement, and more specifically, to a method for fusing node attributes and structural information and using a memory network and a multi-embedded contrast module to identify abnormal nodes. Background Art

[0002] In recent years, the extensive application of attributed graphs in fields such as social networks, scientific citation networks, and network anomaly traffic has made the data present unique characteristics such as complexity, diversity, and connectivity. With the continuous upgrading of the understanding of network behavior and the demand for network security, traditional anomaly detection methods have been proven to be insufficient to meet these evolving needs. Therefore, new anomaly detection methods are urgently needed to provide enhanced accuracy and sensitivity to meet these challenges. In addition, deep learning has been widely used in anomaly detection, extending anomaly detection from traditional methods to solutions based on deep neural networks. At present, the mainstream anomaly detection method based on deep learning uses the comprehensive consideration of node attributes and structural information as a means to identify abnormal nodes, but ignores the complex potential relationship between node attributes and structural information. Therefore, a new method is needed that can fully utilize node attributes and structural information while effectively mining their potential relationships.

[0003] The attribute graph anomaly detection method based on multi-embedding comparison requires a comparison module and memory network suitable for processing multiple embedding representations of nodes. The traditional attribute encoder and structure encoder have the limitation of not being able to fully capture the complex relationship between node attributes and structural information; the simple direct comparison of attribute embedding and structure embedding without considering the comprehensive embedding method only focuses on the partial information difference of the node without considering the overall comprehensive information, which leads to inaccurate and unstable identification of abnormal nodes. Therefore, the module selection of the graph anomaly detection method based on the idea of ​​integrating node attributes and structural information is particularly important.

[0004] In view of the limitation of traditional anomaly detection methods that only rely on single information of node attributes or structures and their inadequacy in mining complex relationships between node attributes and structures, the application of multi-embedding comparison modules and memory networks in the field of graph anomaly detection has made them have potential value for further mining. By utilizing the node comprehensive embedding, attribute embedding and structure embedding features extracted from the multi-embedding comparison module and memory network, integrating the multi-embedding comparison module with the memory network can enhance the accuracy and sensitivity of anomaly detection and further improve the ability to identify node anomalies.

[0005] The present invention proposes a graph anomaly detection model based on a multi-embedding comparison module and a memory network enhancement. By determining the node information differences that have the greatest impact on the accuracy of overall network anomaly detection, that is, the differences between comprehensive embedding and attribute embedding and structural embedding, and analyzing and processing these differences, the efficiency of the model is improved while ensuring the accuracy of abnormal node identification. Solving the problem of identifying abnormal nodes is a problem based on comparative analysis of multiple embedding representations. The method of introducing a multi-embedding comparison module is used to comprehensively consider various information of the nodes. Considering the adaptability of anomaly detection to complex network structures and node attribute information, a memory network is added to the model. Through the interaction between its internal memory mechanism and comprehensive embedding, the model's detection ability and the ability to reconstruct node attribute information are further improved. Summary of the invention

[0006] The purpose of the present invention is to provide an attribute graph anomaly detection method based on multi-embedding comparison to solve the above-mentioned existing anomaly detection accuracy problems, insufficient utilization of node attributes and structural information, and adaptability to complex network structures.

[0007] In order to achieve the above object, the present invention provides the following scheme:

[0008] The present invention provides a method for detecting anomalies in attribute graphs based on multi-embedding comparison, comprising the following steps:

[0009] S1: The model obtains the attribute matrix and structure matrix of the node, and processes them through the attribute encoder, structure encoder and GCN encoder in the multi-embedding comparison module, and aggregates the processing results into comprehensive embedding, attribute embedding and structure embedding;

[0010] S2: The comprehensive embedding obtained in S1 is used as the input of the memory-guided decoder, and the memory module enhances the comprehensive embedding to express the node attribute information, thereby obtaining an enhanced comprehensive embedding;

[0011] S3: Use the enhanced comprehensive embedding generated in S2 as the basis for calculating the loss function and anomaly score, establish a loss function based on the reconstruction error of node attributes and structure and the difference between the comprehensive embedding and the attribute / structure embedding, and calculate the anomaly score based on the loss function;

[0012] S4: Use optimization algorithms to minimize the loss function and obtain the optimal parameters of the model;

[0013] S5: Sort the nodes according to the calculated anomaly scores and identify abnormal nodes.

[0014] Furthermore, in S1, the comprehensive embedding, attribute embedding and structural embedding are summarized as follows:

[0015] First, for the processing of the attribute matrix: let the node attribute matrix be Where N represents the number of nodes, F represents the dimension of each node attribute; attribute encoder Enc X By formula h x =σ(W A ·X+b A ) processes the node attribute matrix X and outputs the attribute embedding h x ,here and denote the weight matrix and bias vector of the attribute encoder respectively, and D is the target embedding dimension;

[0016] Next, for the processing of the structure matrix: let the adjacency matrix of the graph be Structure Encoder Enc A By formula h a =σ(W S ·A+b S ) Encode the graph adjacency matrix A into a structural embedding h a ,in and Represent the weights and biases of the structure encoder respectively;

[0017] Then, for the generation of comprehensive embedding: define the adjacency matrix of graph G = (V, E) as A, introduce the identity matrix I N Get the modified adjacency matrix And calculate The degree matrix in Through graph convolution operation Here H (l) is the node feature matrix of the lth layer, the input layer H (0) =P,W (l) represents the weight matrix of the lth layer, σ is a nonlinear activation function such as ReLU; if the GCN encoder contains L layers, the final comprehensive embedding can be expressed as h = H (L) , thereby integrating the attribute information of the node and the local neighborhood information in the graph structure.

[0018] Furthermore, in S2, the memory module is used to enhance the expression of node attribute information by comprehensive embedding, and the specific steps of obtaining enhanced comprehensive embedding are:

[0019] First, the attribute matrix is ​​reconstructed: the comprehensive embedding h is used as the query z input to the memory module; the weight w is calculated through the attention mechanism i , the formula is in Used to retrieve the memory item m that is most similar to the query from the memory i , forming a weighted representation The enhanced synthesis is embedded in Input to the attribute decoder to reconstruct the attribute matrix. The reconstruction process can be expressed as

[0020] Next is the structural matrix reconstruction: directly reconstruct the adjacency matrix from the comprehensive embedding h, and set the reconstructed adjacency matrix to be The reconstruction process can be expressed as This is because the comprehensive embedding h has effectively integrated the attributes and structural information of the nodes, and the structural information is relatively stable and single, sufficient to reflect the basic structural pattern in the graph, so the adjacency matrix can be directly decoded from h through the structural decoder No memory module is required.

[0021] Furthermore, in S3, the following steps are included:

[0022] Calculate the loss function; the loss function consists of the following four parts: Attribute Reconstruction Loss: It measures the original attribute matrix X and the reconstructed attribute matrix The difference between the two; the calculation method is loss x =f(h x ,h,o x ),in h x is attribute embedding, h is comprehensive embedding, o x is the relevant parameter;

[0023] Structure Reconstruction Loss: measures the original adjacency matrix \(X\) and the reconstructed adjacency matrix The difference between them; the calculation method is loss x =f(h a ,h,o a ), here h a is the structural embedding, o a is the relevant parameter;

[0024] Comprehensive Embedding and Attribute Embedding Difference Loss: reflects the comprehensive embedding h and attribute embedding h x The difference between them is calculated as loss cx =f(h cx ,h,o cx );

[0025] Comprehensive Embedding and Structure Embedding Difference Loss: reflects the comprehensive embedding h and the structural embedding h a The difference between them is calculated by loss ca =f(h ca ,h,o ca );

[0026] The total loss loss is the sum of these four losses, that is, loss = loss x +loss a +loss cx +loss ca ; By minimizing this objective function, the model iteratively approximates the input attribute network using the node encoder until the objective function converges;

[0027] Calculate the anomaly score; the anomaly score is obtained by adding the attribute reconstruction error, the structure reconstruction error, and the difference between the comprehensive embedding and the attribute / structure embedding; unlike the loss function calculation, the anomaly score is calculated for each node separately. The sum of these four types of losses; for each node v i After a certain number of training iterations, the anomaly score calculation formula is score = o x +o a +o cx +o ca ; This score assigns a quantitative degree of abnormality to each node, with higher scores indicating a higher likelihood that the node is abnormal.

[0026] Furthermore, in S4, the following specific steps are included:

[0027] In this article, the optimization algorithm used for model training is the Adam optimizer; the Adam optimizer is an optimization algorithm based on gradient descent, which combines the advantages of the Adagrad and RMSProp algorithms, can adaptively adjust the learning rate, and use different learning rates to update the step size for different parameters; this enables the model to converge to a better solution faster during training.

[0028] Furthermore, in S5, the following specific steps are included:

[0029] As mentioned above, the anomaly score is obtained by adding the attribute reconstruction error, the structure reconstruction error, and the difference between the comprehensive embedding and the attribute / structure embedding. i After a certain number of training iterations, the anomaly score calculation formula is score = o x +o a +o cx +o ca This score assigns a quantitative degree of abnormality to each node, with higher scores indicating a higher likelihood that the node is abnormal.

[0030] In the sorted node list, select several nodes in the front as abnormal nodes. The selection criteria can be determined according to the specific application scenario and requirements. For example, nodes with anomaly scores higher than a certain threshold can be selected as abnormal nodes, or nodes ranked in the top k (k is a pre-set integer) can be selected as abnormal nodes. These selected nodes are the abnormal nodes identified by the model. They show great differences in attributes and structures compared with normal nodes, and may correspond to abnormal behaviors or phenomena in the network, such as fake accounts in social networks, abnormal operations in recommendation systems, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A flowchart of a method for detecting anomalies in an attribute graph based on multi-embedding comparison provided by an embodiment of the present invention;

[0032] Figure 2 A framework diagram of a method for detecting anomalies in an attribute graph based on multi-embedding comparison provided by an embodiment of the present invention;

[0033] Figure 3 A data set detection result diagram under the attribute graph anomaly detection method based on multi-embedding comparison provided in an embodiment of the present invention;

[0034] Figure 4 A parameter sensitivity diagram of the attribute graph anomaly detection method based on multi-embedding comparison provided in an embodiment of the present invention; DETAILED DESCRIPTION

[0035] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the protection scope of the present invention.

[0036] The core of the present invention is to provide an attribute graph anomaly detection method based on multi-embedding comparison, which can characterize nodes from multiple perspectives through multi-embedding comparison, is sensitive to attribute and structural consistency anomaly detection, improves the ability to reconstruct normal node attribute features, and improves anomaly detection accuracy and sensitivity.

[0037] In order to enable those skilled in the art to better understand the solution of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0038] Figure 1 An attribute graph anomaly detection method based on multi-embedding comparison is provided in an embodiment of the present invention, such as Figure 1 As shown, the following steps are included:

[0039] S1: converges into comprehensive embedding, attribute embedding and structural embedding;

[0040] First, for the processing of the attribute matrix: let the node attribute matrix be Where N represents the number of nodes, F represents the dimension of each node attribute; attribute encoder Enc X By formula h x =σ(W A ·X+b A ) processes the node attribute matrix X and outputs the attribute embedding h x ,here and denote the weight matrix and bias vector of the attribute encoder respectively, and D is the target embedding dimension;

[0041] Next, for the processing of the structure matrix: let the adjacency matrix of the graph be Structure Encoder Enc A By formula h a =σ(W S ·A+b S ) Encode the graph adjacency matrix A into a structural embedding h a ,in and Represent the weights and biases of the structure encoder respectively;

[0042] Then, for the generation of comprehensive embedding: define the adjacency matrix of graph G = (V, E) as A, introduce the identity matrix I N Get the modified adjacency matrix And calculate The degree matrix in Through graph convolution operation Here H (l) is the node feature matrix of the lth layer, the input layer H (0) =X,W (l)represents the weight matrix of the lth layer, σ is a nonlinear activation function such as ReLU; if the GCN encoder contains L layers, the final comprehensive embedding can be expressed as h = H (L) , thereby integrating the attribute information of the node and the local neighborhood information in the graph structure.

[0043] S2: The memory module enhances the comprehensive embedding to express the node attribute information, and the specific steps of obtaining the enhanced comprehensive embedding are:

[0044] First, the attribute matrix is ​​reconstructed: the comprehensive embedding h is used as the query z input to the memory module; the weight w is calculated through the attention mechanism i , the formula is in Used to retrieve the memory item m that is most similar to the query from the memory i , forming a weighted representation The enhanced synthesis is embedded in Input to the attribute decoder to reconstruct the attribute matrix. The reconstruction process can be expressed as

[0045] Next is the structural matrix reconstruction: directly reconstruct the adjacency matrix from the comprehensive embedding h, and set the reconstructed adjacency matrix to be The reconstruction process can be expressed as This is because the comprehensive embedding h has effectively integrated the attributes and structural information of the nodes, and the structural information is relatively stable and single, sufficient to reflect the basic structural pattern in the graph, so the adjacency matrix can be directly decoded from h through the structural decoder No memory module is required.

[0046] S3: Use the enhanced comprehensive embedding as the basis for calculating the loss function and anomaly score, and calculate the anomaly score based on the loss function:

[0047] Calculate the loss function; the loss function consists of the following four parts: Attribute Reconstruction Loss: It measures the original attribute matrix X and the reconstructed attribute matrix The difference between the two; the calculation method is loss x =f(h x ,h,o x ),in h x is attribute embedding, h is comprehensive embedding, o x is the relevant parameter;

[0048] Structure Reconstruction Loss: measures the original adjacency matrix \(X\) and the reconstructed adjacency matrix The difference between them; the calculation method is lossx =f(h a ,h,o a ), here h a is the structural embedding, o a is the relevant parameter;

[0049] Comprehensive Embedding and Attribute Embedding Difference Loss: reflects the comprehensive embedding h and attribute embedding h x The difference between them is calculated as loss cx =f(h cx ,h,o cx );

[0050] Comprehensive Embedding and Structure Embedding Difference Loss: reflects the comprehensive embedding h and the structural embedding h a The difference between them is calculated by loss ca =f(h ca ,h,o ca );

[0051] The total loss loss is the sum of these four losses, that is, loss = loss x +loss a +loss cx +loss ca ; By minimizing this objective function, the model iteratively approximates the input attribute network using the node encoder until the objective function converges;

[0052] Calculate the anomaly score; the anomaly score is obtained by adding the attribute reconstruction error, the structure reconstruction error, and the difference between the comprehensive embedding and the attribute / structure embedding; unlike the loss function calculation, the anomaly score is calculated for each node separately. The sum of these four types of losses; for each node v i After a certain number of training iterations, the anomaly score calculation formula is score = o x +o a +o cx +o ca ; This score assigns a quantitative degree of abnormality to each node, with higher scores indicating a higher likelihood that the node is abnormal.

[0053] S4: Use optimization algorithm to minimize the loss function to obtain the optimal parameters of the model;

[0054] In this article, the optimization algorithm used for model training is the Adam optimizer; the Adam optimizer is an optimization algorithm based on gradient descent, which combines the advantages of the Adagrad and RMSProp algorithms, can adaptively adjust the learning rate, and use different learning rates to update the step size for different parameters; this enables the model to converge to a better solution faster during training.

[0055] In S5, the optimization algorithm is used to minimize the loss function to obtain the optimal parameters of the model;

[0056] As mentioned above, the anomaly score is obtained by adding the attribute reconstruction error, the structure reconstruction error, and the difference between the comprehensive embedding and the attribute / structure embedding. i After a certain number of training iterations, the anomaly score calculation formula is score = o x +o a +o cx +o ca This score assigns a quantitative degree of abnormality to each node, with higher scores indicating a higher likelihood that the node is abnormal.

[0057] In the sorted node list, select several nodes in the front as abnormal nodes. The selection criteria can be determined according to the specific application scenario and requirements. For example, nodes with anomaly scores higher than a certain threshold can be selected as abnormal nodes, or nodes ranked in the top k (k is a pre-set integer) can be selected as abnormal nodes. These selected nodes are the abnormal nodes identified by the model. They show great differences in attributes and structures compared with normal nodes, and may correspond to abnormal behaviors or phenomena in the network, such as fake accounts in social networks, abnormal operations in recommendation systems, etc.

[0058] Specifically, Figure 3 The results of anomaly detection AUC obtained by different algorithms on a widely used citation network dataset are described. From the result graph, it can be observed that the attribute graph anomaly detection method based on multi-embedding comparison obtains the best detection performance and has the highest.

[0059] Specifically, Figure 4 The performance changes of the model under different parameters are described. It can be observed from the figure that the model has very high robustness.

[0060] The above is a detailed introduction to the attribute graph anomaly detection method based on multi-embedding comparison provided by the present invention. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can be referred to each other.

[0061] The contents not described in detail in the specification of the present invention belong to the prior art known to the professional and technical personnel in this field.

Claims

1. A method for detecting anomalies in attribute graphs based on multi-embedding comparison, characterized in that: The following steps are involved: S1: The model obtains the attribute matrix and structure matrix of the node, and processes them through the attribute encoder, structure encoder and GCN encoder in the multi-embedding comparison module, and aggregates the processing results into comprehensive embedding, attribute embedding and structure embedding; S2: The comprehensive embedding obtained in S1 is used as the input of the memory-guided decoder, and the memory module enhances the comprehensive embedding to express the node attribute information, thereby obtaining an enhanced comprehensive embedding; S3: Use the enhanced comprehensive embedding generated in S2 as the basis for calculating the loss function and anomaly score, establish a loss function based on the reconstruction error of node attributes and structure and the difference between the comprehensive embedding and the attribute / structure embedding, and calculate the anomaly score based on the loss function; S4: Use optimization algorithms to minimize the loss function and obtain the optimal parameters of the model; S5: Sort the nodes according to the calculated anomaly scores and identify abnormal nodes.

2. The attribute graph anomaly detection method based on multi-embedding comparison according to claim 1 is characterized in that: In step S1: First, for the processing of the attribute matrix: let the node attribute matrix be Where N represents the number of nodes, F represents the dimension of each node attribute; attribute encoder Enc X By formula h x =σ(W A ·X+b A ) processes the node attribute matrix X and outputs the attribute embedding h x ,here and denote the weight matrix and bias vector of the attribute encoder respectively, and D is the target embedding dimension; Next, for the processing of the structure matrix: let the adjacency matrix of the graph be Structure Encoder Enc A By formula h a =σ(W S ·A+b S ) Encode the graph adjacency matrix A into a structural embedding h a ,in and Represent the weights and biases of the structure encoder respectively; Then, for the generation of comprehensive embedding: define the adjacency matrix of graph G = (V, E) as A, introduce the identity matrix I N Get the modified adjacency matrix And calculate The degree matrix in Through graph convolution operation Here H (l) is the node feature matrix of the lth layer, and the input layer H (0) =X,W (l) represents the weight matrix of the lth layer, σ is a nonlinear activation function such as ReLU; if the GCN encoder contains L layers, the final comprehensive embedding can be expressed as h = H (L) , thereby integrating the attribute information of the node and the local neighborhood information in the graph structure.

3. The attribute graph anomaly detection method based on multi-embedding comparison according to claim 1 is characterized in that: In S2, the memory module enhances the expression of node attribute information through comprehensive embedding, and the specific steps of obtaining enhanced comprehensive embedding are: First, the attribute matrix is ​​reconstructed: the comprehensive embedding h is used as the query z input to the memory module; the weight w is calculated through the attention mechanism i , the formula is in Used to retrieve the memory item m that is most similar to the query from the memory i , forming a weighted representation The enhanced synthesis is embedded in Input to the attribute decoder to reconstruct the attribute matrix. The reconstruction process can be expressed as Next is the structural matrix reconstruction: directly reconstruct the adjacency matrix from the comprehensive embedding h, and set the reconstructed adjacency matrix to be The reconstruction process can be expressed as This is because the comprehensive embedding h has effectively integrated the attributes and structural information of the nodes, and the structural information is relatively stable and single, sufficient to reflect the basic structural pattern in the graph, so the adjacency matrix can be directly decoded from h through the structural decoder No memory module is required.

4. The attribute graph anomaly detection method based on multi-embedding comparison according to claim 1 is characterized in that: In S3, the following steps are included: Calculate the loss function; the loss function consists of the following four parts: Attribute Reconstruction Loss: It measures the original attribute matrix X and the reconstructed attribute matrix The difference between the two; the calculation method is loss x =f(h x ,h,o x ),in h x is attribute embedding, h is comprehensive embedding, o x is the relevant parameter; Structure Reconstruction Loss: measures the original adjacency matrix \(X\) and the reconstructed adjacency matrix The difference between them; the calculation method is loss x =f(h a ,h,o a ), here h a is the structural embedding, o a is the relevant parameter; Comprehensive Embedding and Attribute Embedding Difference Loss: reflects the comprehensive embedding h and attribute embedding h x The difference between them is calculated as loss cx =f(h cx ,h,o cx ); Comprehensive Embedding and Structure Embedding Difference Loss: reflects the comprehensive embedding h and the structural embedding h a The difference between them is calculated by loss ca =f(h ca ,h,o ca ); The total loss loss is the sum of these four losses, that is, loss = loss x +loss a +loss cx +loss ca ; By minimizing this objective function, the model iteratively approximates the input attribute network using the node encoder until the objective function converges; Calculate the anomaly score; the anomaly score is obtained by adding the attribute reconstruction error, the structure reconstruction error, and the difference between the comprehensive embedding and the attribute / structure embedding; unlike the loss function calculation, the anomaly score is calculated for each node separately. The sum of these four types of losses; for each node v i After a certain number of training iterations, the anomaly score calculation formula is score = o x +o a +o cx +o ca ; This score assigns a quantitative degree of abnormality to each node, with higher scores indicating a higher likelihood that the node is abnormal.

5. The attribute graph anomaly detection method based on multi-embedding comparison according to claim 1 is characterized in that: In S4, the following specific steps are included: In this article, the optimization algorithm used for model training is the Adam optimizer; the Adam optimizer is an optimization algorithm based on gradient descent, which combines the advantages of the Adagrad and RMSProp algorithms, can adaptively adjust the learning rate, and use different learning rates to update the step size for different parameters; this enables the model to converge to a better solution faster during training.

6. The attribute graph anomaly detection method based on multi-embedding comparison according to claim 1 is characterized in that: In S5, the following specific steps are included: As mentioned above, the anomaly score is obtained by adding the attribute reconstruction error, the structure reconstruction error, and the difference between the comprehensive embedding and the attribute / structure embedding; for each node v i After a certain number of training iterations, the anomaly score calculation formula is score = o x +o a +o cx +o ca ;This score assigns a quantitative degree of abnormality to each node, with higher scores indicating a higher probability that the node is abnormal; In the sorted node list, select several nodes in the front as abnormal nodes; the selection criteria can be determined according to the specific application scenario and requirements; for example, nodes with abnormal scores higher than a certain threshold can be selected as abnormal nodes, or nodes ranked in the top k (k is a pre-set integer) can be selected as abnormal nodes; these selected nodes are the abnormal nodes identified by the model, which show great differences in attributes and structures compared with normal nodes, and may correspond to abnormal behaviors or phenomena in the network, such as fake accounts in social networks, abnormal operations in recommendation systems, etc.

Images