A phased anomaly detection method for ultra-large-scale industrial software supply chains

Abstract

This invention discloses a phased anomaly detection method for ultra-large-scale industrial software supply chains based on graph neural networks. It divides the software anomaly detection task into two stages. In the rapid contamination stage, a simple model is used to quickly learn global anomaly patterns and filter out potential anomaly nodes and regions. In the precise detection stage, a more complex model is used to detect anomaly nodes. Furthermore, this invention defines the "disorder level" of nodes on the graph based on the Lyapunov coefficients in chaos theory and utilizes the "defect" of rapid oversmoothing in graph neural networks to rapidly propagate the behavioral patterns of anomaly nodes on the graph, simulating the propagation process of the entire chaotic system. In this way, this invention can quickly learn the global node anomaly patterns and quickly and accurately filter out candidate anomaly nodes and regions.

Description

Technical Field

[0001] This invention belongs to the field of data mining technology, specifically relating to a method for phased anomaly detection in a large-scale industrial software supply chain based on graph neural networks. Background Technology

[0002] The development of the software industry and the rise of the open-source movement in recent years have promoted the globalization, diversification, and complexity of the industrial software supply chain, making its management a very challenging issue. The industrial software supply chain involves long supply chains, numerous suppliers, and complex personnel and industries, resulting in a wide range of attack surfaces exposed to attackers. Simultaneously, the scale of the supply chain software is expanding rapidly. According to publicly available data from the U.S. National Computer Security Center (NCSC), the number of public repositories hosted by the popular software development and source code management platform GitHub surged from 46,000 in February 2009 to 28 million in January 2020. Given this massive scale of supply chain software, determining whether a particular piece of software has vulnerabilities and whether it will impact industrial software becomes extremely difficult.

[0003] In recent years, graph neural networks have achieved excellent performance in various graph-structured data mining tasks. Compared with other deep learning techniques, graph neural networks further consider the interrelationships between data and can capture complex patterns useful for outlier detection. For example, the DOMINANT proposed in the literature [Ding K, Li J, Bhanushali R, et al. Deep Anomaly Detection on Attributed Networks [M / OL] / / Proceedings of the 2019 SIAM International Conference on Data Mining (SDM). Society for Industrial and Applied Mathematics, 2019:594–602] uses a message-passing graph neural network in conjunction with an autoencoder to detect global and structural anomalies. DOMINANT uses a message-passing graph neural network to uniformly model the topology and node attributes, then uses an autoencoder to reconstruct the original data, and finally discovers the structure and attributes of anomalies by measuring the reconstruction error of the nodes.

[0004] With the remarkable expressive power of the Transformer framework, the combination of graph neural networks and Transformer has gradually become a research hotspot. For example, TADDY, proposed in the literature [Liu Y, Pan S, Wang YG, et al. Anomaly Detection in Dynamic Graphs via Transformer[J].IEEE Transactions on Knowledge and Data Engineering, 2023, 35(12):12081–12094], is a framework for handling attributeless dynamic graph anomaly detection. In order to capture the spatiotemporal context of each target edge, TADDY performs edge-based substructure sampling to obtain target nodes and context nodes in multiple timestamps. Then, TADDY generates node codes and spatiotemporal information through the spatiotemporal node encoding module and the dynamic graph Transformer module, respectively. Finally, in the discriminative anomaly detector, negative sampling is performed to generate pseudo-negative edges, and the edge scoring module is used to calculate the output anomaly score.

[0005] The methods described above have achieved success in their respective fields; however, some problems remain when applied to ultra-large-scale graphs. First, the DOMINANT method, based on message-passing graph neural networks, is fast, but its performance is inferior to Transformer-based models. Furthermore, as the number of layers in a message-passing graph neural network increases, model performance degrades. While Transformer-based models perform well, their inherently high time complexity (O(N)) hinders their application. 2 This limitation makes it unsuitable for use on extremely large-scale graphs. On a graph dataset exceeding 100 million nodes, if each node uses a single-precision floating-point embedding vector, a single Transformer computation can take over a day. Furthermore, extremely large-scale graph data demands enormous storage space; for example, GitHub data containing 28 million public repositories cannot fit on a single graphics card with a maximum of 80GB of VRAM (Nvidia H100). Therefore, these massive storage and time requirements are unacceptable for software anomaly detection tasks on extremely large-scale industrial software supply chain data. Summary of the Invention

[0006] In view of the above, the present invention provides a phased anomaly detection method for ultra-large-scale industrial software supply chain based on graph neural networks, which adopts a phased detection framework to complete the software anomaly detection task of ultra-large-scale industrial software supply chain data.

[0007] A phased anomaly detection method for ultra-large-scale industrial software supply chains based on graph neural networks includes the following steps:

[0008] (1) Obtain all data from the industrial software supply chain, including the ID, version number, dependencies between software, software description, and software code of each software in the supply chain;

[0009] (2) Establish a directed graph based on the dependencies between software and initialize it. Divide all nodes in the directed graph into training set and validation set according to the proportion.

[0010] (3) Construct a fast contamination model based on a gated graph neural network, train the model using the training set, and validate the model using the validation set to save the optimal model parameters;

[0011] (4) Use the trained fast contamination model to reason about the nodes in the directed graph, obtain new vector representations for each node, and filter the nodes in the graph according to the anomaly probability.

[0012] (5) Construct and train a precise detection model based on Graph Transformer;

[0013] (6) Use the trained accurate detection model to reason about the selected and retained nodes, obtain new vector representations of each node, and identify whether these nodes are abnormal.

[0014] Further, the specific implementation of establishing and initializing the directed graph in step (2) is as follows: First, each supply chain software is mapped to a node in the directed graph, and the dependency relationship between the software is mapped to an edge in the directed graph. If the software corresponding to node B depends on the software corresponding to node A, then the edge between nodes A and B points from A to B. Then, a Gaussian distribution with a mean of 0 and a variance of 1 is used to initialize the vector representation of all nodes, and the degree information of the nodes is used to initialize the weight of the edges. The weight of each edge includes the out-degree weight and the in-degree weight. For an edge pointing from A to B, its out-degree weight is the reciprocal of the out-degree of node A, and its in-degree weight is the reciprocal of the out-degree of node B. The out-degree of any node is represented by the number of edges starting from that node.

[0015] Furthermore, the rapid pollution model is composed of a cascaded multi-layer gated graph neural network, and the inference process expression of each layer of the gated graph neural network is as follows:

[0016]

[0017] in: The output vector representation of all nodes of the (t-1)th layer gated graph neural network is provided. Let be the out-degree weight of the edges between node i and all other nodes. Let be the in-degree weight of the edges between node i and all other nodes, where i is the index of any node, n is the number of nodes in the directed graph, and H and b are the learnable weight matrix and bias term, respectively. T Indicates transpose. Let i represent the state of node i in the t-th layer of the gated graph neural network. and Let be the vector representations of the output node i of the gated graph neural networks at layers t and (t-1) respectively, and σ() be the sigmoid function. and These are the reset gate and update gate for node i in the t-th layer gated graph neural network, respectively. z and U z W is a learnable update gate weight matrix. r and U r Let W be a learnable reset gate weight matrix, tanh() be the hyperbolic tangent activation function, and W be the weight matrix. o and U o Let be the learnable activation function weight matrix, where ⊙ denotes element-wise multiplication. Let be the intermediate variable of node i in the t-th layer gated graph neural network.

[0018] Furthermore, in step (3), during the training of the fast contamination model, the idea of ​​chaos theory is used to calculate the Lyapunov coefficient between a node and its neighboring nodes in the directed graph as the loss of positive sample pairs, and the Lyapunov coefficient between a node and its non-neighboring nodes in the directed graph as the loss of negative sample pairs. Then, these two losses are combined as the loss function L of the model. The Adam optimizer is then used to iteratively update the model parameters using gradient descent until the loss function L converges, and the training is completed.

[0019]

[0020] Where: T is the number of layers in the gated graph neural network. Let be the initial vector representation of node i. Let be the initial vector representation of neighbor node j. Let J be the vector representation of the output neighbor node j of the t-th layer gated graph neural network, where N is the number of nodes in the training set and J is the number of neighbor nodes of node i. Let be the initial vector representation of the non-neighbor node k. Let D be the vector representation of the output of non-neighbor node k in the t-th layer gated graph neural network, where K is the number of non-neighbor nodes of node i, and D is the vector representation of the output of node i. E () indicates Euclidean distance. Let Lyapunov be the coefficient between node i and its neighboring nodes. Let be the Lyapunov coefficient between node i and its non-neighboring nodes.

[0021] Furthermore, in step (4), all nodes in the directed graph are inferred through the trained fast contamination model to obtain new vector representations. The new vector representations are then used to calculate the abnormal probability of the nodes using the softmax function. Nodes with an abnormal probability of less than 50% are deleted to form a new directed graph.

[0022] Furthermore, the accurate detection model consists of multiple cascaded Graph Transformers, and the inference process expression for each Graph Transformer is as follows:

[0023]

[0024]

[0025] in: and Let A and W be the vector representations of node i output by the t-th and (t-1)-th layers of the Graph Transformer, respectively. Let A be the weight matrix of the edges in the directed graph, GGNN() be the mapping function of the gated graph neural network, d be the vector dimension of the node, and W be the vector dimension of the node. Q W K W V The weight matrix represents the learnable attention mechanism. T This indicates transpose, softmax() is the softmax function, BatchNorm() represents batch normalization, Dropout() is a random deactivation operation used to suppress overfitting, and W AG and b AG For learnable weight matrices and bias terms, Let i be an intermediate variable of node i in the t-th layer Graph Transformer.

[0026] Furthermore, in step (5), cross-entropy loss is used to train the accurate detection model. The specific loss function expression is as follows:

[0027]

[0028] in: Let be the vector representation of the output node i of the M-th layer Graph Transformer, where M is the layer number of the Graph Transformer and N is the number of nodes in the training set. Let y be the anomaly probability of node i. i This is the actual label indicating whether the supply chain software corresponding to node i is abnormal.

[0029] Furthermore, in step (6), the nodes that are selected and retained are inferred through the trained accurate detection model to obtain a new vector representation. The new vector representation is then used to calculate the abnormal probability of the node through the softmax function. For nodes with an abnormal probability greater than 50%, it is determined that the supply chain software corresponding to these nodes is abnormal.

[0030] A computer device includes a memory and a processor, wherein the memory stores a computer program and the processor executes the computer program to implement the above-described method for phased anomaly detection in a large-scale industrial software supply chain.

[0031] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned method for phased anomaly detection in a large-scale industrial software supply chain.

[0032] Based on the above technical solution, the present invention has the following beneficial technical effects:

[0033] 1. This invention is the first method to apply the concept of phased detection to software anomaly detection in a large-scale industrial software supply chain. It divides the software anomaly detection task into two phases. In the rapid contamination phase, this invention uses a simple model to quickly learn global anomaly patterns and filter out possible anomaly nodes and regions. In the precise detection phase, this invention uses a more complex model to detect anomaly nodes. For large-scale graph structure data, this approach combines efficiency and accuracy and has excellent scalability.

[0034] 2. This invention is the first method to use the ideas of chaos theory to simulate the propagation of anomalies in supply chain software on a graph structure. It defines the "degree of disorder" of nodes on the graph based on the Lyapunov coefficients in chaos theory, and uses the "defect" of fast oversmoothing in graph neural networks to rapidly propagate the behavioral patterns of abnormal nodes on the graph, simulating the propagation process of the entire chaotic system. In this way, this invention can quickly learn the abnormal patterns of global nodes and quickly and accurately filter out candidate abnormal nodes and regions.

[0035] 3. In the accurate detection stage, in order to alleviate the high time complexity of commonly used Transformer-type models, this invention combines positional encoding, structural encoding, local message passing mechanism and global attention mechanism to realize a Graph Transformer model with low time complexity and high performance. Attached Figure Description

[0036] Figure 1This is a schematic diagram illustrating the process principle of the phased anomaly detection method for ultra-large-scale industrial software supply chain based on graph neural networks of the present invention. Detailed Implementation

[0037] To describe the present invention in more detail, the technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0038] like Figure 1 As shown, the present invention provides a method for detecting software anomalies in a large-scale industrial software supply chain based on graph neural networks, comprising the following steps:

[0039] (1) Input all data of the industrial software supply chain. The data includes the ID, version number, dependencies between software, software description, software code, etc. of each supply chain software.

[0040] (2) Constructing a directed graph: Connect each supply chain software according to its dependencies, modeling it as a directed graph G(V,E), where V is the set of all nodes representing software, E is the set of all edges representing dependencies, and each node's v... i ∈V represents a software, and each edge represents (v i ,v i+1 )∈E represents the (i+1)th software v i+1 Depends on the i-th software v i When a piece of software is relied upon a lot, it usually indicates that the software is more important, and therefore, there will be more edges connecting the corresponding node of the software in the directed graph.

[0041] (3) Initialize the nodes and edges on the graph: Initialize all nodes v using a Gaussian distribution with a mean of 0 and a variance of 1. i Vector representation of ∈V Where |V| represents the number of nodes, and d represents the vector dimension; the edge weights are initialized using the node degree information, and the weight of each edge is the reciprocal of the out-degree of the node on that edge. The weights of all edges are a. (i,j) Composition matrix A out each line For node v i A is the out-degree weight of all nodes. in each line Represents node v i The in-degree weights of all nodes, and the edge (v) in graph G(V,E) i ,v j The weights of ) are expressed as

[0042]

[0043] Where: O(v)i ) is an edge (v i ,v j The starting node v) i out-degree, I(v) j ) is an edge (v i ,v j The terminal node v j The degree of departure.

[0044] (4) Constructing the dataset: Randomly select 80% and 20% of the nodes on the graph as the training set and validation set, respectively.

[0045] (5) Vector representation of training nodes: The vector representation of all nodes in the training set of the directed graph G(V,E) is v. i After learning from the fast contamination model based on a gated graph neural network, the updated vector representation of each node is obtained. Specifically, for the vector representation v i Its update function is:

[0046]

[0047] Where: matrix The degree of connection between nodes in a graph is defined by the weight A of the edges in the graph. (i,j) composition, For node v in A i The out-degree weights of all n nodes and node v i The in-degree weights of all n nodes, Let be the vector representation of all nodes at time t-1. Here is the weight matrix, and b is the bias term. For node v i The state at time t, and These are node v at time t. i The reset and update gates determine which information to discard and retain, respectively; W z and U z These are the first and second weights of the update gate, W. r and U r These are the first and second weights of the reset gate, W. o and U o These are the first and second weights of the activation function, respectively, and tanh() is the hyperbolic tangent activation function in a neural network. Let be the candidate node vector representation at time t, σ() be the sigmoid function, and ⊙ denote element-wise multiplication. Let be the node vector representation at time t.

[0048] (6) Training a fast contamination model: This invention uses the idea of ​​chaos theory to calculate the Lyapunov coefficients between nodes and their neighbors in the graph. As the loss for positive sample pairs, the Lyapunov coefficient between the node and its non-neighboring nodes is calculated. The loss is calculated as the loss for negative sample pairs. The two losses are then combined to obtain the final loss value, which is then used by the Adam optimizer to reduce the loss value, thereby training a fast contamination model. The specific definition of the loss function is as follows:

[0049]

[0050] Where: T is the number of layers in the gated graph neural network in the fast contamination model. For node v i Vector representation before passing through the gated graph neural network layer For node v i The vector representation of D after training a t-layer gated graph neural network. E () represents Euclidean distance; node j is the neighbor node of node i, J is the number of neighbor nodes of node i, node k is the sampled non-neighbor node of node i, K is the number of non-neighbor nodes of node i, and generally J = K.

[0051] (7) Evaluation of performance: During each round of training of the fast contamination model, the performance of the fast contamination model is evaluated using the validation set data, and then the model M with the lowest loss is selected and saved.

[0052] (8) Load the model for inference: Load model M, use model M for inference in the dataset, and then generate the vector representation v of the obtained nodes. i Furthermore, the softmax function is applied to obtain the probability of whether each node is abnormal, and then nodes with an abnormal probability of less than 50% are deleted to form a new directed graph G(V,E).

[0053]

[0054] in: This represents the probability that the supply chain software represented by the i-th node predicted by the model is abnormal.

[0055] (9) Learn the vector representation of each node on the new dataset: Take the new vector representations v of all nodes on the training set in the new directed graph G(V,E). i After learning from the accurate detection model based on Graph Transformer, the updated vector representation v of each node is obtained. i :

[0056]

[0057] Where: GGNN() is the mapping function of the gated graph neural network. W is the vector representation of node i learned by the previous Graph Transformer model. Q W K and W V Here, represents the learnable weights, d is the length of the vector, BatchNorm is a batch normalization method, Dropout is a method to prevent overfitting by randomly discarding some weights, and W... AG and b AG These are the learnable weights and biases, respectively.

[0058] (10) Training the accurate detection model: This invention uses node vectors and the softmax function to obtain the probability of whether each node is abnormal, and uses cross-entropy loss to train the accurate detection model. The loss function is defined as:

[0059]

[0060] Where: y i This represents the true label indicating whether the supply chain software represented by the i-th node is abnormal. This represents the probability that the supply chain software represented by the i-th node predicted by the model is abnormal, where n is the total number of supply chain software.

[0061] Next, we conducted experiments to compare the method of this invention with other existing methods. In order to comprehensively evaluate the performance of the method of this invention, we thoroughly investigated the commonly used datasets in the field of anomaly detection research: ogbn-papers100M, IGB-large, DGraph-Fin, and T-Social. The experimental metrics selected were Accuracy, ROC_AUC, G-mean, Macro-F1, and EpochTime (the time to train the model for one epoch). Among them, the lower the EpochTime, the better, and the higher the other metrics, the better.

[0062] The existing detection models compared are mainly divided into three groups: the first group consists of some common graph neural network models, including message-passing based graph neural networks such as GAT, GGNN, and GraphSAGE; the second group consists of some GraphTransformer-based models, including GraphFormer and GraphGPS; the third group consists of some state-of-the-art (SOTA) GAD models in the field of anomaly detection in the last two years, including BWGNN, GHRN, GAGA, and GRADATE. The experimental comparison results are shown in Table 1.

[0063] Table 1

[0064]

[0065]

[0066] The experimental comparison results in the table show that the present invention achieves optimal results on most datasets and metrics, while also demonstrating excellent time efficiency. A detailed analysis follows:

[0067] On the DgraphFin and OGBN-Papers100M datasets, graph neural network models and GraphTransformers models achieved very high accuracy, but their G-mean was 0. This indicates that these models failed to identify any anomalous nodes in graph anomaly detection, a dataset with a highly imbalanced distribution. While state-of-the-art (SOTA) GAD models had lower accuracy, they possessed higher ROC-AUC and G-mean, demonstrating that they adequately considered the class balance between anomalous and normal nodes. Clearly, SOTA GAD models performed better. This invention not only significantly outperforms SOTA GAD models in accuracy, ROC-AUC, and F1-Macro, but also surpasses them in G-mean, indicating that this invention not only possesses excellent discrimination ability but also maintains outstanding sensitivity to imbalanced samples.

[0068] On the T-Social dataset, graph neural network models and graph transformers still achieve very high accuracy and very low G-mean. State-of-the-art (SOTA) GAT models, however, fully consider the class balance between anomalous and normal nodes, achieving a better overall balance. Compared to SOTA GAT models, this invention shows mixed results across four metrics. We believe the reason lies in the T-Social dataset. The T-Social dataset is a social network dataset and rarely contains the clusters of anomalous nodes common in the DgraphFin dataset. In contrast, the rapid contamination stage of this invention "contaminates" normal nodes outward from anomalous nodes during operation. Therefore, in this case, if clusters of anomalous nodes are lacking, the proportion of normal nodes in the model's recalled dataset will be higher, which will affect the performance of the accurate detection model.

[0069] On the IGB-Large dataset, due to its enormous size (over 440GB after processing), most models were unable to complete the anomaly detection task. For example, in graph neural network models, the training time for GAT and GGNN models exceeded one day per epoch, while the Graph Transformer model experienced out-of-memory errors. In SOTAGAD models, GAGA requires preprocessing graph data into sequence data; however, given the massive number of nodes and complex node attributes in the IGB-Large dataset, GAGA could not complete the process within one day. Besides GAGA, GRADATE also could not complete the process within one day due to complex data preprocessing (including subgraph generation and random walk sampling). Compared to BWGNN and GHRN models, the model in this invention outperforms them in all metrics. Combining the results from four datasets, we can see that this invention uses the simple and fast GraphSAGE model to quickly filter candidate nodes in the rapid contamination stage, and then uses a more complex model to process a smaller number of nodes with a more balanced data distribution in the accurate detection stage, thus balancing model performance and efficiency. In terms of time, this invention takes longer than the GraphSAGE model due to the use of a more complex loss function. However, as the dataset size increases, we can see that the time required to train one epoch does not increase significantly with the growth of the dataset. The speed advantage over other models becomes increasingly greater. For example, in the DgraphFin dataset, the training efficiency of this invention is inferior to GraphSAGE and BWGNN. However, in the ogbn-papers100M dataset, the efficiency of our model far surpasses all models except GraphSAGE. This fully demonstrates the high efficiency of the phased processing idea of ​​this invention.

[0070] The above description of the embodiments is provided to enable those skilled in the art to understand and apply the present invention. Those skilled in the art can readily make various modifications to the above embodiments and apply the general principles described herein to other embodiments without creative effort. Therefore, the present invention is not limited to the above embodiments, and any improvements and modifications made to the present invention by those skilled in the art based on the disclosure thereof should be within the scope of protection of the present invention.

Claims

1. A phased anomaly detection method for ultra-large-scale industrial software supply chains based on graph neural networks, comprising the following steps: (1) Obtain all data from the industrial software supply chain, including the ID, version number, dependencies between software, software description, and software code of each software in the supply chain; (2) Establish a directed graph based on the dependencies between software and initialize it. Divide all nodes in the directed graph into training set and validation set according to the proportion. (3) Construct a fast contamination model based on a gated graph neural network, train the model using the training set, and validate the model using the validation set to save the optimal model parameters; The rapid contamination model consists of a cascaded multi-layer gated graph neural network, and the inference process expression of each layer of the gated graph neural network is as follows: in: The output vector representation of all nodes of the (t-1)th layer gated graph neural network is provided. Let be the out-degree weight of the edges between node i and all other nodes. Let be the in-degree weight of the edges between node i and all other nodes, where i is the index of any node, n is the number of nodes in the directed graph, H and b are the learnable weight matrix and bias term, respectively, and T denotes the transpose. Let i represent the state of node i in the t-th layer of the gated graph neural network. and Let be the vector representations of the output node i of the gated graph neural networks at layers t and (t-1) respectively, and σ() be the sigmoid function. and These are the reset gate and update gate for node i in the t-th layer gated graph neural network, respectively. z and U z W is a learnable update gate weight matrix. r and U r Let W be a learnable reset gate weight matrix, tanh() be the hyperbolic tangent activation function, and W be the weight matrix. o and U o Let be the learnable activation function weight matrix, where ⊙ denotes element-wise multiplication. Let i be the intermediate variable of node i in the t-th layer gated graph neural network; During the training of the fast contamination model, the idea of ​​chaos theory is used to calculate the Lyapunov coefficient between a node and its neighboring nodes in the directed graph as the loss for positive sample pairs, and the Lyapunov coefficient between a node and its non-neighboring nodes in the directed graph as the loss for negative sample pairs. Then, these two losses are combined as the loss function L of the model. The Adam optimizer is then used to iteratively update the model parameters using gradient descent until the loss function L converges, and the training is completed. Where: T is the number of layers in the gated graph neural network. Let be the initial vector representation of node i. Let be the initial vector representation of neighbor node j. Let J be the vector representation of the output neighbor node j of the t-th layer gated graph neural network, where N is the number of nodes in the training set and J is the number of neighbor nodes of node i. Let be the initial vector representation of the non-neighbor node k. Let D be the vector representation of the output of non-neighbor node k in the t-th layer gated graph neural network, where K is the number of non-neighbor nodes of node i, and D is the vector representation of the output of node i. E () indicates Euclidean distance. Let Lyapunov be the coefficient between node i and its neighboring nodes. Let be the Lyapunov coefficient between node i and its non-neighboring nodes, and e be the natural constant; (4) Use the trained fast contamination model to reason about the nodes in the directed graph, obtain new vector representations of each node, and filter the nodes in the graph according to the anomaly probability. (5) Construct and train a precise detection model based on Graph Transformer; (6) Use the trained accurate detection model to reason about the selected and retained nodes, obtain new vector representations of each node, and identify whether these nodes are abnormal.

2. The method for phased anomaly detection in a large-scale industrial software supply chain according to claim 1, characterized in that: The specific implementation of establishing and initializing the directed graph in step (2) is as follows: First, each supply chain software is mapped to a node in the directed graph, and the dependency relationship between the software is mapped to an edge in the directed graph. If the software corresponding to node B depends on the software corresponding to node A, then the edge between nodes A and B points from A to B. Then, a Gaussian distribution with a mean of 0 and a variance of 1 is used to initialize the vector representation of all nodes, and the degree information of the nodes is used to initialize the weight of the edges. The weight of each edge includes the out-degree weight and the in-degree weight. For an edge pointing from A to B, its out-degree weight is the reciprocal of the out-degree of node A, and its in-degree weight is the reciprocal of the out-degree of node B. The out-degree of any node is represented by the number of edges starting from that node.

3. The method for phased anomaly detection in a large-scale industrial software supply chain according to claim 1, characterized in that: In step (4), all nodes in the directed graph are inferred through the trained fast contamination model to obtain new vector representations. The new vector representations are then used to calculate the abnormal probability of the nodes using the softmax function. Nodes with an abnormal probability of less than 50% are deleted to form a new directed graph.

4. The method for phased anomaly detection in a large-scale industrial software supply chain according to claim 1, characterized in that: The accurate detection model consists of multiple cascaded Graph Transformers, and the inference process expression for each Graph Transformer is as follows: in: and Let A and W be the vector representations of node i output by the t-th and (t-1)-th layers of the Graph Transformer, respectively. Let A be the weight matrix of the edges in the directed graph, GGNN() be the mapping function of the gated graph neural network, d be the vector dimension of the node, and W be the vector dimension of the node. Q W K W V Here, T represents the weight matrix of the learnable attention mechanism, softmax() is the softmax function, BatchNorm() represents batch normalization, Dropout() is a random deactivation operation used to suppress overfitting, and W... AG and b AG For learnable weight matrices and bias terms, Let i be an intermediate variable of node i in the t-th layer Graph Transformer.

5. The method for phased anomaly detection in a large-scale industrial software supply chain according to claim 4, characterized in that: In step (5), the cross-entropy loss is used to train the accurate detection model. The specific loss function expression is as follows: in: Let be the vector representation of the output node i of the M-th layer Graph Transformer, where M is the layer number of the Graph Transformer and N is the number of nodes in the training set. Let y be the anomaly probability of node i. i This is the actual label indicating whether the supply chain software corresponding to node i is abnormal.

6. The method for phased anomaly detection in a large-scale industrial software supply chain according to claim 1, characterized in that: In step (6), the selected and retained nodes are inferred through the trained accurate detection model to obtain a new vector representation. The new vector representation is then used to calculate the abnormal probability of the node through the softmax function. For nodes with an abnormal probability greater than 50%, it is determined that the supply chain software corresponding to these nodes is abnormal.

7. A computer device, comprising a memory and a processor, characterized in that: The memory contains a computer program, and the processor executes the computer program to implement the phased anomaly detection method for ultra-large-scale industrial software supply chains as described in any one of claims 1 to 6.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by the processor, it implements the phased anomaly detection method for ultra-large-scale industrial software supply chains as described in any one of claims 1 to 6.

Images