Staged anomaly detection method for super-large-scale industrial software supply chain

Abstract

The invention discloses a super-large-scale industrial software supply chain staged anomaly detection method based on a graph neural network, a software anomaly detection task is divided into two stages to be processed, in a rapid pollution stage, a simple model is used for rapidly learning a global anomaly mode, and the anomaly detection efficiency is improved. Possible abnormal nodes and areas are screened out; in the accurate detection stage, a more complex model is used for completing detection of abnormal nodes. Besides, the'confusion degree 'of nodes on the graph is defined according to the Lyapunov coefficient in the chaos theory, and the behavior pattern of abnormal nodes on the graph is rapidly diffused by using the rapid over-smooth'defect' of the graph neural network, so that the propagation process of the whole chaos system is simulated; in this way, the abnormal mode of the global node can be quickly learned, and candidate abnormal nodes and areas can be quickly and accurately screened out.

Description

Technical Field

[0001] The present invention belongs to the technical field of data mining, and specifically relates to a phased anomaly detection method for a very large-scale industrial software supply chain based on a graph neural network. Background Art

[0002] The development of the software industry and the rise of the open source movement in recent years have promoted the globalization, diversification and complexity of the industrial software supply chain, and at the same time, how to manage the industrial software supply chain has become a very thorny issue. The industrial software supply chain involves a long supply chain, many suppliers, and complex personnel and industries, resulting in a large number of attack surfaces exposed to attackers, and the scale of supply chain software is also expanding rapidly. According to public data from the National Computer Security Center (NCSC) of the United States, the number of public repositories hosted by GitHub, a popular software development and source code management platform, has surged from 46,000 in February 2009 to 28 million in January 2020; with such a large scale of supply chain software, it has become very difficult to determine whether a software has vulnerabilities and whether it will have an impact on industrial software.

[0003] In recent years, graph neural networks have achieved excellent performance in various graph-structured data mining tasks. Compared with other deep learning techniques, graph neural networks further consider the relationships between data and can capture complex patterns that are useful for outlier detection. For example, DOMINANT proposed in the literature [Ding K, Li J, Bhanushali R, et al. Deep Anomaly Detection on Attributed Networks [M / OL] / / Proceedings of the 2019 SIAM International Conference on Data Mining (SDM). Society for Industrial and Applied Mathematics, 2019: 594–602] uses a graph neural network based on message passing and an autoencoder to detect global and structural anomalies. DOMINANT uses a graph neural network based on message passing to uniformly model the topological structure and node attributes, then uses an autoencoder to reconstruct the original data, and finally discovers abnormal structures and attributes by measuring the reconstruction error of the nodes.

[0004] With the amazing expressive power of the Transformer framework, the combination of graph neural networks and Transformer has gradually become a hot topic of research. For example, TADDY proposed in the literature [Liu Y, Pan S, Wang YG, et al. Anomaly Detection in Dynamic Graphs via Transformer [J]. IEEE Transactions on Knowledge and Data Engineering, 2023, 35(12): 12081–12094] is a framework for anomaly detection in attributeless dynamic graphs. In order to capture the spatiotemporal context of each target edge, TADDY performs edge-based substructure sampling to obtain target nodes and context nodes in multiple timestamps. Then, TADDY generates node encoding and spatiotemporal information through the spatiotemporal node encoding module and the dynamic graph Transformer module respectively. Finally, in the discriminative anomaly detector, negative sampling is performed to generate pseudo negative edges, and the edge scoring module is used to calculate the output anomaly score.

[0005] The above methods have achieved success in their respective fields, but there are still some problems in the application of ultra-large-scale graphs. First, the DOMINANT method based on message passing graph neural network is faster, but the effect is not as good as the Transformer-based model. Moreover, when the number of layers of the message passing graph neural network is gradually superimposed, the model performance will decrease. Although the Transformer-based model has good performance, due to the inherent high time complexity of Transformer O(N 2 ), which makes it impossible to use it directly on ultra-large-scale graphs. On an ultra-large-scale graph dataset with more than 100 million nodes, if each node is represented by an embedded vector of single-precision floating-point numbers, the calculation time of a Transformer will exceed one day; in addition, ultra-large-scale graph data also requires a lot of storage space. For example, GitHub data containing 28 million public repositories can no longer be placed on a single graphics card with a maximum memory of 80G (Nvidia H100). Therefore, these huge storage requirements and time requirements are unacceptable for the software anomaly detection task of ultra-large-scale industrial software supply chain data. Summary of the invention

[0006] In view of the above, the present invention provides a phased anomaly detection method for ultra-large-scale industrial software supply chain based on graph neural network, which adopts a phased detection framework to complete the software anomaly detection task of ultra-large-scale industrial software supply chain data.

[0007] A phased anomaly detection method for a large-scale industrial software supply chain based on a graph neural network includes the following steps:

[0008] (1) Obtain all data of the industrial software supply chain, including the ID, version number, dependencies between software, software description, and software code of each supply chain software;

[0009] (2) Establish and initialize a directed graph based on the dependencies between software, and divide all nodes in the directed graph into training sets and validation sets in proportion;

[0010] (3) Build a fast contamination model based on a gated graph neural network, train the model using the training set, and verify the model using the validation set to save the optimal model parameters;

[0011] (4) Use the trained fast contamination model to infer the nodes in the directed graph, obtain a new vector representation of each node, and filter the nodes in the graph according to the abnormal probability;

[0012] (5) Build and train an accurate detection model based on Graph Transformer;

[0013] (6) Use the trained precision detection model to infer the nodes that have been screened and retained, obtain a new vector representation of each node, and identify whether these nodes are abnormal.

[0014] Furthermore, the specific implementation method of establishing and initializing the directed graph in step (2) is as follows: first, each supply chain software corresponds to a node in the directed graph, and the dependency relationship between the software corresponds to an edge in the directed graph. If the software corresponding to node B depends on the software corresponding to node A, then the edge between nodes A and B is from A to B; then, a Gaussian distribution with a mean of 0 and a variance of 1 is used to initialize the vector representation of all nodes, and the edge weight is initialized using the node degree information. The weight of each edge includes an out-degree weight and an in-degree weight; for an edge pointing from A to B, its out-degree weight is the reciprocal of the out-degree of node A, and its in-degree weight is the reciprocal of the out-degree of node B. The out-degree of any node is represented by the number of edges with the node as the starting node.

[0015] Furthermore, the fast contamination model is composed of a cascade of multiple layers of gated graph neural networks, and the reasoning process of each layer of the gated graph neural network is expressed as follows:

[0016]

[0017] in: Output the vector representation of all nodes for the t-1th layer of the gated graph neural network, is the out-degree weight of the edge between node i and all other nodes, is the in-degree weight of the edge between node i and all other nodes, i is the index number of any node, n is the number of nodes in the directed graph, H and b are the learnable weight matrix and bias term respectively, T represents transpose, represents the state of node i in the t-th layer of the gated graph neural network, and are the vector representations of the output node i of the t-th layer and the t-1-th layer of the gated graph neural network, σ() is the sigmoid function, and are the reset gate and update gate of node i in the t-th layer gated graph neural network, W z and U z is the learnable update gate weight matrix, W r and U r is the learnable reset gate weight matrix, tanh() is the hyperbolic tangent activation function, W o and U o is the learnable activation function weight matrix, ⊙ represents element-by-element multiplication, is the intermediate variable of node i in the t-th layer gated graph neural network.

[0018] Furthermore, in the step (3), the idea of ​​chaos theory is used to calculate the Lyapunov coefficient between the node and the neighbor node in the directed graph as the loss of the positive sample pair, and the Lyapunov coefficient between the node and the non-neighbor node in the directed graph is calculated as the loss of the negative sample pair, and then these two parts of the loss are combined as the loss function L of the model, and then the Adam optimizer is used to continuously iteratively update the model parameters through the gradient descent method until the loss function L converges and the training is completed;

[0019]

[0020] Where: T is the number of layers of the gated graph neural network, is the initial vector representation of node i, is the initial vector representation of neighbor node j, is the vector representation of the neighbor node j output by the t-th layer gated graph neural network, N is the number of nodes in the training set, J is the number of neighbor nodes of node i, is the initial vector representation of non-neighbor node k, is the vector representation of the non-neighbor node k output by the t-th layer of the gated graph neural network, K is the number of non-neighbor nodes of node i, D E () represents the Euclidean distance, is the Lyapunov coefficient between node i and its neighboring nodes, is the Lyapunov coefficient between node i and non-neighboring nodes.

[0021] Furthermore, in step (4), all nodes in the directed graph are inferred by the trained fast contamination model to obtain new vector representations, and then the new vector representations are calculated by the softmax function to obtain the abnormal probability of the nodes, and the nodes with abnormal probability less than 50% are deleted to form a new directed graph.

[0022] Furthermore, the precise detection model is composed of a cascade of multiple layers of Graph Transformer, and the reasoning process of each layer of Graph Transformer is expressed as follows:

[0023]

[0024]

[0025] in: and are the vector representations of the output node i of the Graph Transformer at the t-th layer and the t-1th layer, respectively. A is the weight matrix of the edge in the directed graph. GGNN() is the mapping function of the gated graph neural network. d is the vector dimension of the node. W Q , W K , W V is the learnable attention mechanism weight matrix, T represents transposition, softmax() is the softmax function, BatchNorm() represents batch normalization, Dropout() is a random deactivation operation used to suppress overfitting, W AG and b AG is the learnable weight matrix and bias term, is the intermediate variable of node i in the t-th layer Graph Transformer.

[0026] Furthermore, in step (5), the cross entropy loss is used to train the precision detection model, and the specific loss function loss expression is as follows:

[0027]

[0028] in: is the vector representation of the output node i of the Mth layer Graph Transformer, M is the number of layers of Graph Transformer, N is the number of nodes in the training set, is the abnormal probability of node i, y i is the real label of whether the supply chain software corresponding to node i is abnormal.

[0029] Furthermore, in step (6), the nodes that are screened and retained are inferred through the trained precision detection model to obtain a new vector representation, and the new vector representation is then calculated through the softmax function to obtain the abnormal probability of the node. For nodes with an abnormal probability greater than 50%, it is determined that the supply chain software corresponding to these nodes has anomalies.

[0030] A computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor is used to execute the computer program to implement the above-mentioned ultra-large-scale industrial software supply chain phased anomaly detection method.

[0031] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the above-mentioned method for detecting anomalies in stages in a supply chain of ultra-large-scale industrial software.

[0032] Based on the above technical solution, the present invention has the following beneficial technical effects:

[0033] 1. The present invention is the first method to apply the idea of ​​phased detection to the software anomaly detection task of ultra-large-scale industrial software supply chain. The present invention divides the software anomaly detection task into two stages for processing. In the rapid contamination stage, the present invention uses a simple model to quickly learn the global anomaly pattern and screen out possible abnormal nodes and regions; in the precise detection stage, the present invention uses a more complex model to complete the detection of abnormal nodes; for ultra-large-scale graph structure data, this method combines efficiency and accuracy, and has very good scalability.

[0034] 2. The present invention is the first method to use the idea of ​​chaos theory to simulate the diffusion of anomalies in supply chain software on a graph structure. It defines the "degree of chaos" of nodes on the graph according to the Lyapunov coefficient in chaos theory, and uses the "defect" of rapid over-smoothing of graph neural networks to quickly diffuse the behavior patterns of abnormal nodes on the graph, simulating the propagation process of the entire chaotic system. In this way, the present invention can quickly learn the abnormal patterns of global nodes and quickly and accurately screen out candidate abnormal nodes and regions.

[0035] 3. In the precise detection stage, in order to alleviate the high time complexity of the commonly used Transformer type models, the present invention combines position encoding, structural encoding, local message passing mechanism and global attention mechanism to realize a Graph Transformer model with low time complexity and powerful performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1This is a schematic diagram of the process principle of the ultra-large-scale industrial software supply chain phased anomaly detection method based on graph neural network of the present invention. DETAILED DESCRIPTION

[0037] In order to describe the present invention more specifically, the technical solution of the present invention is described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0038] like Figure 1 As shown, the method for detecting software anomalies in a large-scale industrial software supply chain based on a graph neural network of the present invention comprises the following steps:

[0039] (1) Input all data of the industrial software supply chain, including the ID, version number, dependencies between software, software description, software code, etc. of each supply chain software.

[0040] (2) Construct a directed graph: Connect each supply chain software according to the dependency relationship and model it as a directed graph G(V,E), where V is the set of all nodes representing the software, E is the set of all edges representing the dependency relationship, and the v of each node is i ∈V represents a software, and each edge represents (v i ,v i+1 )∈E represents the i+1th software v i+1 Depends on the i-th software v i When a certain software is relied upon many times, it usually means that the more important the software is, the more edges there are connecting the corresponding nodes of the software in the directed graph.

[0041] (3) Initialize the nodes and edges on the graph: Initialize all nodes v using a Gaussian distribution with a mean of 0 and a variance of 1 i ∈V corresponds to the vector representation Where |V| is the number of nodes, d represents the vector dimension; the edge weights are initialized using the node degree information, and the weight of each edge is the inverse of the node out-degree of the edge. The weight of all edges is a (i,j) Composition Matrix A out Each line of For node v i and the out-degree weights of all nodes, A in Each line of Represents node v i With the in-degree weights of all nodes, the edge (v i ,v j ) is expressed as

[0042]

[0043] Where: O(vi ) is the edge (v i ,v j )’s starting node v i The out-degree, I(v j ) is the edge (v i ,v j )’s terminal node v j The out-degree of .

[0044] (4) Constructing the data set: Randomly select 80% and 20% of the nodes on the graph as the training set and validation set.

[0045] (5) Vector representation of training nodes: The vector representation v of all nodes in the training set in the directed graph G(V,E) is i After learning the fast contamination model based on the gated graph neural network, the updated vector representation of each node is obtained Specifically, for the vector representation v i , and its update function is:

[0046]

[0047] Among them: Matrix Define the degree of connection between a node in the graph and other nodes, which is determined by the weight value A of the edge in the graph. (i,j) composition, is the node v in A i With the out-degree weights of all n nodes and node v i and the in-degree weights of all n nodes, is the vector representation of all nodes at time t-1, is the weight matrix, b is the bias term, For node v i The state at time t, and They are node v at time t i The reset gate and update gate of W respectively decide what information to discard and retain; z and U z are the first weight and the second weight of the update gate, respectively, r and U r are the first weight and the second weight of the reset gate, respectively, o and U o are the first weight and the second weight of the activation function respectively, tanh() is the hyperbolic tangent function activation function in the neural network, is the node vector representation of the candidate at time t, σ() is the sigmoid function, ⊙ represents element-by-element multiplication, is the node vector representation at time t.

[0048] (6) Training the fast contamination model: The present invention uses the idea of ​​chaos theory to calculate the Lyapunov coefficient between a node and its neighboring nodes in the graph. As the loss of positive sample pairs, calculate the Lyapunov coefficient between the node and the non-neighboring node As the loss of the negative sample pair, the two parts of the loss are then combined as the final loss value, and then the Adam optimizer is used to reduce the loss value, thereby training the fast contamination model. The specific definition of the loss function is as follows:

[0049]

[0050] Where: T is the number of layers of the gated graph neural network in the fast contamination model, For node v i Vector representation without gated graph neural network layer, For node v i The vector representation after t layers of gated graph neural network training, D E () represents the Euclidean distance; node j is the neighbor node of node i, J is the number of neighbor nodes of node i, node k is the non-neighbor node sampled by node i, K is the number of non-neighbor nodes of node i, generally speaking, J=K.

[0051] (7) Evaluation effect: In each round of training of the fast contamination model, the validation set data is used to evaluate the effect of the fast contamination model, and then the model M with the lowest loss is selected and saved.

[0052] (8) Load the model for inference: Load the model M, use the model M to perform inference in the dataset, and then represent the vector v of the obtained node. i , and apply the softmax function to obtain the probability of each node being abnormal, and then delete the nodes with abnormal probability less than 50% to form a new directed graph G(V,E).

[0053]

[0054] in: Indicates the probability of whether the supply chain software represented by the i-th node predicted by the model is abnormal.

[0055] (9) Learn the vector representation of each node on the new dataset: The new vector representation v of all nodes in the training set in the new directed graph G(V,E) is i After learning the accurate detection model based on Graph Transformer, the updated vector representation v of each node is obtained i :

[0056]

[0057] Among them: GGNN() is the mapping function of the gated graph neural network, is the vector representation of node i learned by the previous Graph Transformer model, W Q , W K and W V are learnable weights, d is the length of the vector, BatchNorm is a batch normalization method, Dropout is a method based on randomly discarding some weights to prevent overfitting, W AG and b AG are the learnable weights and biases, respectively.

[0058] (10) Training the precise detection model: The present invention uses the node vector and the softmax function to obtain the probability of whether each node is abnormal, and uses the cross entropy loss to train the precise detection model. The loss function is defined as:

[0059]

[0060] Where: y i The true label indicating whether the supply chain software represented by the i-th node is abnormal. It represents the probability of whether the supply chain software represented by the i-th node predicted by the model is abnormal, and n is the number of all supply chain software.

[0061] Next, we experimentally compare the method of the present invention with other existing methods. In order to comprehensively evaluate the performance of the method of the present invention, we fully investigated the commonly used data sets in the field of anomaly detection research: ogbn-papers100M, IGB-large, DGraph-Fin, T-Social, and selected Accuracy, ROC_AUC, G-mean, Macro-F1 and EpochTime (the time for training a model for one epoch) as experimental indicators. The lower the EpochTime, the better, and the higher the other indicators, the better.

[0062] The compared existing detection models are mainly divided into three groups: the first group is some common graph neural network models, including graph neural networks based on message passing such as GAT, GGNN, and GraphSAGE; the second group is some GraphTransformer-based models, including GraphFormer and GraphGPS; the third group is some state-of-the-art methods (SOTA GAD Models) in the field of anomaly detection in the past two years, including BWGNN, GHRN, GAGA, and GRADATE; the experimental comparison results are shown in Table 1:

[0063] Table 1

[0064]

[0065]

[0066] From the experimental comparison results in the table, it can be seen that the present invention achieves the best results on most data sets and indicators, and also performs well in terms of time efficiency. The specific analysis is as follows:

[0067] On the DgraphFin and ogbn-papers100M datasets, the graph neural network model and the GraphTransformers model achieved very high accuracy, but the G-mean of these models were all 0, which shows that these models completely failed to identify any abnormal nodes in the case of very unbalanced data distribution such as graph anomaly detection; although the SOTA GAD models have lower accuracy, they have higher ROC-AUC and G-mean, which shows that these models fully consider the category balance problem of abnormal nodes and normal nodes. Obviously, the SOTA GAD Models are better. The present invention not only significantly surpasses the SOTA GAD Models in terms of accuracy, ROC-AUC and F1-Macro, but also exceeds the above models in the G-mean indicator, which shows that the present invention not only has good discrimination ability, but also maintains excellent sensitivity to unbalanced samples.

[0068] On the T-Social dataset, the graph neural network model and the Graph Transformers model still have very high accuracy and very low G-mean, while the SOTA GAT models fully consider the category balance problem of abnormal nodes and normal nodes, and achieve a better balance overall. The present invention has advantages and disadvantages in the four indicators compared with the SOTA GAT models. We believe that the reason is caused by the T-Social dataset. The T-Social dataset is a social network dataset, and there are few clustered abnormal nodes commonly seen in the DgraphFin dataset. The fast contamination stage of the present invention "contaminates" normal nodes through abnormal nodes during operation; therefore, in this case, if there are no clustered abnormal nodes, the proportion of normal nodes in the data set recalled by the model will be higher, which will affect the performance of the precise detection model.

[0069] On the IGB-Large dataset, since the dataset is very large (the processed dataset size exceeds 440G), most models cannot complete the anomaly detection task normally. For example, in the graph neural network model, the training time of GAT and GGNN models in one epoch has exceeded one day, and the Graph Transformer model will be out of memory; in SOTAGAD models, GAGA needs to preprocess the graph data into sequence data, but facing the massive nodes and complex node attributes in the IGB-Large dataset, GAGA can no longer complete the processing within 1 day; in addition to GAGA, GRADATE also cannot complete the processing within 1 day due to complex data preprocessing (including subgraph generation, random walk sampling, etc.). Compared with the BWGNN and GHRN models, the model of the present invention is superior to them in all indicators. Combining the results of the four data, we can see that the present invention uses the GraphSAGE model with simple structure and fast speed to quickly complete the screening of candidate nodes in the rapid pollution stage, and then in the precise detection stage, we use a complex model to process a small number of nodes with more balanced data distribution, thereby taking into account both model performance and efficiency. In terms of time, the present invention takes longer than the GraphSAGE model because it uses a more complex loss function. However, as the size of the dataset increases, we can see that the time required to train an epoch does not increase much with the growth of the dataset, and the speed advantage over other models is getting bigger and bigger. For example, in the DgraphFin dataset, the training efficiency of the present invention is inferior to GraphSAGE and BWGNN. However, in the ogbn-papers100M dataset, the efficiency of our model is far ahead of all models except GraphSAGE, which fully reflects the efficiency of the staged processing idea of ​​the present invention.

[0070] The above description of the embodiments is to facilitate the understanding and application of the present invention by those skilled in the art. It is obvious that those skilled in the art can easily make various modifications to the above embodiments and apply the general principles described herein to other embodiments without creative work. Therefore, the present invention is not limited to the above embodiments. Improvements and modifications made by those skilled in the art to the present invention based on the disclosure of the present invention should be within the protection scope of the present invention.

Claims

1. A phased anomaly detection method for a large-scale industrial software supply chain based on a graph neural network, comprising the following steps: (1) Obtain all data of the industrial software supply chain, including the ID, version number, dependencies between software, software description, and software code of each supply chain software; (2) Establish and initialize a directed graph based on the dependencies between software, and divide all nodes in the directed graph into training sets and validation sets in proportion; (3) Build a fast contamination model based on a gated graph neural network, train the model using the training set, and verify the model using the validation set to save the optimal model parameters; (4) Use the trained fast contamination model to infer the nodes in the directed graph, obtain a new vector representation of each node, and filter the nodes in the graph according to the abnormal probability; (5) Build and train an accurate detection model based on Graph Transformer; (6) Use the trained precision detection model to infer the nodes that have been screened and retained, obtain a new vector representation of each node, and identify whether these nodes are abnormal.

2. The method for phased anomaly detection in a large-scale industrial software supply chain according to claim 1 is characterized in that: The specific implementation method of establishing and initializing the directed graph in step (2) is as follows: first, each supply chain software corresponds to a node in the directed graph, and the dependency relationship between the software corresponds to an edge in the directed graph. If the software corresponding to node B depends on the software corresponding to node A, then the edge between nodes A and B is from A to B; then, a Gaussian distribution with a mean of 0 and a variance of 1 is used to initialize the vector representation of all nodes, and the edge weight is initialized using the node degree information. The weight of each edge includes an out-degree weight and an in-degree weight; for an edge pointing from A to B, its out-degree weight is the reciprocal of the out-degree of node A, and its in-degree weight is the reciprocal of the out-degree of node B. The out-degree of any node is represented by the number of edges with the node as the starting node.

3. The method for phased anomaly detection in a large-scale industrial software supply chain according to claim 1 is characterized in that: The fast contamination model is composed of a cascade of multiple layers of gated graph neural networks. The inference process of each layer of gated graph neural network is expressed as follows: in: Output the vector representation of all nodes for the t-1th layer of the gated graph neural network, is the out-degree weight of the edge between node i and all other nodes, is the in-degree weight of the edge between node i and all other nodes, i is the index number of any node, n is the number of nodes in the directed graph, H and b are the learnable weight matrix and bias term respectively, T represents transpose, represents the state of node i in the t-th layer of the gated graph neural network, and are the vector representations of the output node i of the t-th layer and the t-1-th layer of the gated graph neural network, σ() is the sigmoid function, and are the reset gate and update gate of node i in the t-th layer gated graph neural network, W z and U z is the learnable update gate weight matrix, W r and U r is the learnable reset gate weight matrix, tanh() is the hyperbolic tangent activation function, W o and U o is the learnable activation function weight matrix, ⊙ represents element-by-element multiplication, is the intermediate variable of node i in the t-th layer gated graph neural network.

4. The method for detecting anomalies in phases in a large-scale industrial software supply chain according to claim 3 is characterized in that: In the step (3), during the training of the fast contamination model, the idea of ​​chaos theory is used to calculate the Lyapunov coefficient between the node and the neighbor node in the directed graph as the loss of the positive sample pair, and the Lyapunov coefficient between the node and the non-neighbor node in the directed graph is calculated as the loss of the negative sample pair, and then these two parts of the loss are combined as the loss function L of the model, and then the Adam optimizer is used to continuously iteratively update the model parameters through the gradient descent method until the loss function L converges and the training is completed; Where: T is the number of layers of the gated graph neural network, is the initial vector representation of node i, is the initial vector representation of neighbor node j, is the vector representation of the neighbor node j output by the t-th layer gated graph neural network, N is the number of nodes in the training set, J is the number of neighbor nodes of node i, is the initial vector representation of non-neighbor node k, is the vector representation of the non-neighbor node k output by the t-th layer of the gated graph neural network, K is the number of non-neighbor nodes of node i, D E () represents the Euclidean distance, is the Lyapunov coefficient between node i and its neighboring nodes, is the Lyapunov coefficient between node i and non-neighboring nodes.

5. The method for phased anomaly detection in a large-scale industrial software supply chain according to claim 1 is characterized in that: In the step (4), all nodes in the directed graph are inferred by the trained fast contamination model to obtain new vector representations, and then the new vector representations are calculated by the softmax function to obtain the abnormal probability of the nodes, and the nodes with abnormal probability less than 50% are deleted to form a new directed graph.

6. The method for detecting anomalies in a phased manner in a large-scale industrial software supply chain according to claim 1 is characterized in that: The precise detection model is composed of multiple layers of Graph Transformer cascades. The reasoning process of each layer of Graph Transformer is expressed as follows: in: and are the vector representations of the output node i of the Graph Transformer at the t-th layer and the t-1th layer, respectively. A is the weight matrix of the edge in the directed graph. GGNN( ) is the mapping function of the gated graph neural network. d is the vector dimension of the node. W Q , W K , W V is the learnable attention mechanism weight matrix, T represents transposition, softmax( ) is the softmax function, BatchNorm( ) represents batch normalization, Dropout( ) is a random deactivation operation used to suppress overfitting, W AG and b AG is the learnable weight matrix and bias term, is the intermediate variable of node i in the t-th layer Graph Transformer.

7. The method for phased anomaly detection in a large-scale industrial software supply chain according to claim 6 is characterized in that: In step (5), the cross entropy loss is used to train the accurate detection model. The specific loss function loss expression is as follows: in: is the vector representation of the output node i of the Mth layer Graph Transformer, M is the number of layers of Graph Transformer, N is the number of nodes in the training set, is the abnormal probability of node i, y i is the real label of whether the supply chain software corresponding to node i is abnormal.

8. The method for phased anomaly detection in a large-scale industrial software supply chain according to claim 1 is characterized in that: In the step (6), the nodes that are screened and retained are inferred through the trained precision detection model to obtain a new vector representation, and the new vector representation is then calculated through the softmax function to obtain the abnormal probability of the node. For nodes with an abnormal probability greater than 50%, it is determined that the supply chain software corresponding to these nodes has an abnormality.

9. A computer device comprising a memory and a processor, characterized in that: The memory stores a computer program, and the processor is used to execute the computer program to implement the method for phased anomaly detection in a very large-scale industrial software supply chain as described in any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it implements the method for detecting anomalies in phases in a very large-scale industrial software supply chain as described in any one of claims 1 to 8.

Images