Attribute graph anomaly detection method based on pseudo tag and multi-view graph learning
By using the method of pseudo -label and multi -view diagram learning in the attribute diagram abnormal detection, the problem of large -scale diagram data calculations and sparse labels are solved, and more efficient abnormal detection effects are achieved.
Patent Information
- Application Number
- CN202411515226.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-29
- Publication Date
- 2025-01-28
AI Technical Summary
The existing technology has a large amount of calculation and extremely uneven label distribution in large-scale attribute graph abnormality detection, making it difficult to effectively detect abnormal behaviors in virtual currency transactions.
Using the attribute diagram abnormal detection method based on pseudo -labels and multi -view diagrams, the Luwen community is divided through the graph calculating platform Graphscope, generated pseudo -labels, and designed a multi -task -driven and across angle comparison learning mechanism, using the GCN encoder and self -self -self Attention mechanism learning node level and community level embedding.
The scale of calculation is reduced, the granularity of the label is increased, the recall and accuracy of the abnormal detection is improved, and the large -scale diagram data can be effectively processed.
Smart Images
Figure CN119377852A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of anomaly detection, and in particular to an attribute graph anomaly detection method based on pseudo-label and multi-view graph learning. Background Art
[0002] Virtual currencies use blockchain technology to achieve decentralized, anonymous and secure transactions, making cross-border transfers faster and less costly. Common virtual currencies include Bitcoin, Ethereum, Litecoin, Tether, etc. On the other hand, the use of virtual currencies has also brought some controversy, including volatility, abuse of anonymity, and regulatory issues with the traditional financial system. Since the convenience and anonymity of virtual currency transactions are far higher than traditional transaction methods, more and more criminals choose to use virtual currency to complete payments and transfer funds. Therefore, it is very necessary to detect illegal and criminal behavior on virtual currency transaction data.
[0003] In tasks such as anomaly detection and anti-money laundering, graph neural networks have achieved remarkable results because they can combine attribute information with topological structure information for learning. In the process of applying graph neural network technology to real-world data, there are several challenges: First, there are exchanges such as Huobi and Binance on the blockchain, where the fund pool addresses hide the actual transaction parties, which is a kind of data-level noise that misleads the anomaly detection model to make wrong judgments. Secondly, the labels in real business scenarios are often very sparse. Traditional methods based on modeling normal samples such as iForest, HDBSCAN, and z-score are difficult to learn abnormal behavior patterns, resulting in a low recall rate of abnormal samples. Finally, the amount of data in real business scenarios is too large, and the existing attribute graph anomaly detection methods use small data sets and generally use unsupervised methods. DOMINANT and GUIDE designed a graph reconstruction method to learn the features of most normal nodes to separate the small number of abnormal nodes, which cannot be applied to large-scale graph data.
[0004] Existing attribute graph anomaly detection technology starts from data distribution, and a large number of unsupervised methods based on graph contrastive learning are designed to solve this problem. However, label information is still very important for anomaly detection tasks, so completely abandoning labels may not be an ideal choice. Instead, we should explore how to incorporate label information into the design of anomaly detection methods to improve the performance of the model. Summary of the invention
[0005] The purpose of the present invention is to propose a property graph anomaly detection method based on pseudo-labels and multi-view graph learning in response to the deficiencies of the prior art. First, the graph computing platform GraphScope framework is used to perform Leuven community division on the graph structure data to obtain several subgraphs and their community-level pseudo-labels. The graph neural network encoder is used to encode some communities, and the obtained embeddings are respectively input into the self-attention module and the readout module within the community to obtain the representation of the perspective within the community. Then, the contrastive learning mechanism is used to combine the intra-community perspective embedding with the inter-community perspective embedding, and together with the subgraph level classification task, the update of the model parameters is jointly guided. By inputting the graph structure to be detected into the trained model, the nodes with higher anomaly scores can be output. Compared with the prior art, the present invention solves the problems of large computational complexity and extremely uneven label distribution in large-scale property graph anomaly detection.
[0006] The object of the present invention is achieved in that:
[0007] A method for anomaly detection in attribute graphs based on pseudo-labels and multi-view graph learning is mainly designed to solve the two main challenges of anomaly detection in practical application scenarios using graph neural network technology: large data scale and extremely scarce labels. This method first generates pseudo-labels based on Leuven community division to improve label granularity, and then designs a multi-task driven, cross-view comparative learning mechanism to train a subgraph encoder that mines more information to complete the anomaly detection task on large-scale data. Specifically, it includes the following steps:
[0008] 1) Construct a data set; input a graph structure data set G, which is required to include node numbers starting from 0, edges represented by node numbers, node features, and node labels;
[0009] 2) Based on the graph computing platform GraphScope, the Leuven community is divided into graph G, and the clustering information in the graph is obtained through the community division algorithm to obtain several subgraphs G1, G2, ..., G n ;
[0010] 3) Design an encoder based on a two-layer graph neural network GCN. For the i-th subgraph G i have:
[0011]
[0012] Where D i Represents the subgraph G i The degree matrix, A i Represents the subgraph G i The adjacency matrix of i Representation and subgraph G i Diagonal matrices of equal size, L i is the subgraph G i The Laplacian matrix of
[0013] Get the node level representation as follows:
[0014]
[0015] Where W (0) , W (1) are the weight matrices of the first and second GCN network layers, respectively, X i is the subgraph G i The feature matrix of all nodes in , ReLU is the activation function, Represents the subgraph G i Node-level representation of
[0016] Get community level representation as follows:
[0017]
[0018] Among them, readout is the readout function, mean_pooling represents the mean aggregation function, Represents the subgraph G i community-level representation of
[0019] 4) Add a self-attention mechanism to the model to allow nodes in the same community to interact more deeply:
[0020]
[0021] Where dk is the length of the node feature, softmax is the activation function, Represents the subgraph G i Self-attention node-level representation;
[0022] 5) For all nodes in a community, the node representation is as close to the center vector of the community as possible and as far away from the center vectors of other communities as possible. Therefore, the representation of all nodes in a community and the community-level representation of the community are set as positive sample pairs, and the representation of all nodes in a community and the community-level representation of other communities are set as negative sample pairs; for a community, three negative sample pairs are extracted, and cosine similarity is selected as the similarity measurement function. The higher the similarity score between positive sample pairs, the better, and vice versa for negative sample pairs;
[0023]
[0024] in Represents the subgraph G i The similarity score of the positive sample pair is is the subgraph G iThe j-th negative sample pair similarity score, τ is a hyperparameter, set to 0.2, exp is the exponential function of e, log is the logarithmic function, n is the number of sub-graphs, and L1 is the contrastive learning loss function;
[0025] 6) The community-level representation is classified into two categories to assist model training; the output of the community-level classification module is:
[0026]
[0027] Linear is a linear layer, Dropout is a random hidden layer, It is the binary classification result predicted by the linear layer; the cross entropy loss function is used as the binary classification task loss function:
[0028]
[0029] Where w is the binary classification weight, y i is the real binary classification result of the community, and L2 is the binary classification loss function of the community;
[0030] 7) The final loss function combines the contrastive learning loss function with the community binary classification loss function, and guides the model to optimize parameters through back propagation of the loss function, thus obtaining a graph neural network-based model CPPAD that captures multiple perspectives; input the graph structure to be detected into the trained model to output nodes with higher anomaly scores.
[0031] Further, the step 4) specifically includes:
[0032] Within a community, each node interacts with other node representations with different attention weights. The attention mechanism is used to achieve interaction, making fuller use of cross-node information within the community. The additional self-attention mechanism can better learn the global information within the subgraph:
[0033]
[0034] Where dk is the length of the node feature, softmax is the activation function, Represents subgraph G i Node-level representation of Represents subgraph G i Self-attention node-level representation.
[0035] Further, the positive sample pair in step 5) is defined as:
[0036]
[0037] in Represents subgraph G iThe community level representation of , norm represents the regularization function, Represents subgraph G i The positive sample pairs for each node in .
[0038] Negative samples are defined as:
[0039]
[0040] in Represents subgraph G # community-level representation of Represents subgraph G i Negative sample pairs for each node in .
[0041] Use cosine similarity to measure the similarity between two vectors. Two vectors, the magnitude of the vector is marked as The calculation formula of cosine similarity cos_sim is:
[0042] The mean similarity of positive samples is:
[0043]
[0044] Where mean is the mean aggregation function, Represents subgraph G i The mean similarity score of the positive sample pairs of each node in .
[0045] The mean similarity of negative sample scores is:
[0046]
[0047] in Represents subgraph G i The mean similarity score of the negative sample pairs for each node in .
[0048] The contrastive learning loss function for this part is set to:
[0049]
[0050] in Represents subgraph G i The similarity score of the positive sample pair is is the subgraph G i The j-th negative sample similarity score, τ is a hyperparameter set to 0.2, exp is the exponential function of e, log is the logarithmic function, n is the number of subgraphs, and L1 is the contrastive learning loss function.
[0051] Further, the step 6) specifically includes:
[0052] The community level classification module output is:
[0053]
[0054] For a binary classification task, the loss function is the cross entropy loss function:
[0055]
[0056] Furthermore, step 7) combines the contrastive learning loss function with the community binary classification loss function, specifically including:
[0057] Where α is a hyperparameter:
[0058] L=α*L1+L2
[0059] The model is optimized by back propagating the loss function, and finally a graph neural network model that captures multiple perspectives is obtained. By inputting the graph dataset to be detected into the trained model, the nodes with higher anomaly scores can be output.
[0060] Compared with the prior art, the present invention has the following beneficial technical effects and significant technical progress:
[0061] 1) The present invention proposes to use the graph computing platform GraphScope framework to perform Leuven community partition on graph G to obtain subgraphs G1, G2, ... Gn and their community-level pseudo labels. Then the GCN encoder is used to encode some communities, which reduces the calculation scale and improves the label granularity;
[0062] 2) This paper proposes the CPPAD model to better mine known label information and interactively learn node-level embedding and graph-level embedding of communities from multiple perspectives. The self-attention mechanism is used to learn global perspective information, the GNN encoder is used to learn neighborhood information, and an unsupervised contrastive learning loss function on the graph is designed. The intra-community perspective embedding and the extra-community perspective embedding are combined, and together with the sub-graph level classification task, the model parameters are updated;
[0063] 3) The dataset proposed in this invention performs CEX identification and cleaning on the three-month historical transaction records of USDT on TRON and constructs node timing features. BRIEF DESCRIPTION OF THE DRAWINGS
[0064] Figure 1 It is a flow chart of the present invention;
[0065] Figure 2 This is a schematic diagram of the specific operation of Example 1. DETAILED DESCRIPTION
[0066] The present invention is further described below in conjunction with specific embodiments and drawings.
[0067] Aiming at the task of attribute graph anomaly detection, the present invention proposes an attribute graph anomaly detection method based on pseudo-labels and multi-view graph learning. In order to better solve the two challenges of large-scale graph data calculation and extremely sparse labels, the CPPAD model is designed. First, pseudo-labels are designed based on the Louvain algorithm to reduce the calculation scale and improve the label granularity. On the other hand, in order to better mine known label information, the node-level embedding and graph-level embedding of the community are interactively learned from multiple perspectives. By inputting the graph structure to be detected into the trained model, nodes with higher anomaly scores can be output. Experimental results on real anomaly detection datasets have demonstrated the effectiveness of this method.
[0068] See also Figure 1 The present invention provides an attribute graph anomaly detection method based on pseudo-label and multi-view graph learning, which specifically includes the following steps:
[0069] 1) Dataset construction. Taking the Tether transaction records on the TRON chain as an example, the process of constructing graph structure data is as follows:
[0070] 1.1: Crawling USDT transaction data on the TRON chain for three months, encrypting the wallet addresses. The labels in the data set come from police annotations, including 152 exchange addresses, 422 abnormal addresses with known criminal records, and the rest are unlabeled addresses.
[0071] 1.2: Delete transaction data with a single transaction amount of less than 1USDT or more than 600,000USDT. 1.3: The characteristics of each wallet address are composed of its historical transaction behavior information, that is, the total number of transactions of the wallet address, the number of funds inflow and outflow of the wallet address, and the 50 operations of the account within three months. If the user's operation behavior in the time period is less than 50, padding is performed. If it exceeds 50, 50 operations are randomly sampled. Funds inflow is recorded as a positive number, outflow is recorded as a negative number, and the value is the transaction amount. Since the range of transaction amounts is large, the transaction amount is quantified. Specifically, (-inf,-100000,-10000,-1000,-500,-100,-10,-1,-1,1,10,100,500,1000,10000,100000,inf) is mapped to (-7,-6,-5,-4,-3,-2,-1,0,1,2,3,4,5,6,7). Correspondingly, the timestamps of the 50 operations are also quantized. The timestamp of the first operation is 0, and the timestamp of the last operation is 1. The timestamps of the transactions between these two timestamps are normalized by min-max. The final feature length is 103.
[0072] 1.4: Based on the existing 152 exchange labels and constructed node features, use xgboost to determine whether an address is an exchange address. Set multiple groups of xgboost parameters for grid search, and take the group with the best performance to predict the remaining unlabeled addresses. Take the first 20 addresses predicted as the most likely exchanges to expand the exchange address labels. The expanded exchange addresses contain 20+152=172. After removing the relevant transactions of these 172 exchanges, the transaction data was reduced from 75511642 to 41943040, and the number of wallet addresses was reduced from 10725573 to 7744029.
[0073] 1.5: The wallet addresses in the USDT transaction data on the TRON chain are regarded as nodes in the graph, and the transaction behaviors are regarded as directed edges. After data processing, the data set contains 7744029 nodes, 41943040 directed edges, 403 nodes are marked as known abnormal nodes, and each node has 103-dimensional features. This graph is recorded as the UTrans data set.
[0074] 2) Based on GraphScope, Leuven community partition is performed, and cluster information in the graph is obtained through the community partition algorithm to obtain several subgraphs G1, G2, ..., G n .Decouple the anomaly detection task from the full transaction flow graph and process it at the community level, saving computing resources and expanding the anomaly detection task from the node level to the graph level.
[0075] 3) Design an encoder based on a two-layer GCN to encode each community and obtain the embedding of the internal nodes of the community and the community itself;
[0076] 3.1: Design an encoder based on a two-layer graph neural network GCN. For the i-th subgraph G i have:
[0077]
[0078] Where D i Represents the subgraph G i The degree matrix, A i Represents the subgraph G i The adjacency matrix of i Representation and subgraph G i Diagonal matrices of equal size, L i is the subgraph G i The Laplace matrix of .
[0079] 3.2: Get the node level representation as follows:
[0080]
[0081] Where W (0) , W (1) are the weight matrices of the first and second GCN network layers, respectively, X i is the subgraph G i The feature matrix of all nodes in , ReLU is the activation function, Represents subgraph G i Node level representation of .
[0082] 3.3: Obtain community level representation as follows:
[0083]
[0084] Among them, readout is the readout function, mean_pooling represents the mean aggregation function, Represents subgraph G i community-level representation of the
[0085] 4) GNN is good at capturing the neighborhood information of nodes, so the self-attention mechanism is added to allow nodes in the same community to interact more deeply. Within a community, each node should interact with other node representations with different attention weights, and the attention mechanism is used to achieve interaction, so that cross-node information in the community is more fully utilized. In addition, GNN is good at capturing the neighborhood information of nodes, so the additional self-attention mechanism can better learn global information:
[0086]
[0087] Where dk is the length of the node feature, softmax is the activation function, Represents subgraph G i Self-attention node-level representation.
[0088] 5) For all nodes in a community, the node representation is as close to the center vector of the community as possible and as far away from the center vectors of other communities as possible. Therefore, the representation of all nodes in a community and the community-level representation of the community are set as positive sample pairs, and the representation of all nodes in a community and the community-level representation of other communities are set as negative sample pairs.
[0089] 5.1: For a certain community, three negative samples are extracted and cosine similarity is selected as the similarity measurement function. The higher the similarity score of the positive sample pair, the better, and vice versa for the negative sample pair.
[0090] The positive sample is defined as:
[0091]
[0092] in Represents the subgraph G i The community level representation of , norm represents the regularization function, Represents the subgraph G i The positive sample pairs for each node in .
[0093] Negative samples are defined as:
[0094]
[0095] in Represents the subgraph G # community-level representation of Represents the subgraph G i Negative sample pairs for each node in .
[0096] 5.2: Use cosine similarity to measure the similarity between two vectors:
[0097]
[0098] The mean similarity of positive samples is:
[0099]
[0100] Where mean is the mean aggregation function, Represents the subgraph G i The mean similarity score of the positive sample pairs of each node in .
[0101] The mean similarity of negative sample scores is:
[0102]
[0103] in Represents the subgraph G i The mean similarity score of the negative sample pairs for each node in .
[0104] 5.3: The contrastive learning loss function in this part is set to:
[0105]
[0106] in Represents the subgraph G i The similarity score of the positive sample pair is is the subgraph G i The similarity score of the j-th negative sample pair, τ is a hyperparameter set to 0.2, exp is the exponential function of e, log is the logarithmic function, n is the number of subgraphs, and L1 is the contrastive learning loss function.
[0107] 6) The community-level representation is binary classified to assist model training, using a weighted cross entropy loss function;
[0108] 6.1: The output of the community level classification module is:
[0109]
[0110] Linear is a linear layer, Dropout is a random hidden layer, It is the binary classification result predicted by the linear layer.
[0111] 6.2: For the binary classification task, the loss function is the cross entropy loss function:
[0112]
[0113] Where w is the binary classification weight, y i is the true binary classification result of the community, and L2 is the binary classification loss function of the community.
[0114] 7) The final loss function combines the contrastive learning loss function with the community classification loss function, and guides the model to optimize parameters through back propagation of the loss function, thus obtaining a GCN-based encoder that captures multiple perspectives. The above two loss functions are combined, where α is a hyperparameter:
[0115] L=α*L1+L2
[0116] The model is optimized by back propagating the loss function, and finally a graph neural network model that captures multiple perspectives is obtained. By inputting the graph structure to be detected into the trained model, nodes with higher anomaly scores can be output.
[0117] Example
[0118] See also Figure 2 In this embodiment, the UTrans graph structure dataset is taken as an example, and the GraphScope framework is used to perform Leuven community partition on the original graph G to obtain subgraphs G1, G2, ...Gn and their community-level pseudo-labels. The graph neural network encoder is used to encode some communities, and the obtained embeddings are respectively input into the self-attention module and the readout module within the community. At the same time, the neighborhood information of the nodes is captured by the graph neural network, and the global information is captured by the self-attention mechanism to obtain a richer representation. The contrastive learning mechanism is used to combine the intra-community perspective embedding with the inter-community perspective embedding, and together with the subgraph-level classification task, it guides the update of the model parameters. By inputting the graph structure to be detected into the trained model, the nodes with higher anomaly scores can be output.
[0119] The above description is only a preferred embodiment of the present invention, and certain modifications may be made thereto within the scope defined by the claims of the present invention, but all modifications will fall within the protection scope of the present invention.
Claims
1. A method for attribute graph anomaly detection based on pseudo-label and multi-view graph learning, characterized in that: The method comprises the following steps: 1) Construct a data set; input a graph structure data set G, which is required to include node numbers starting from 0, edges represented by node numbers, node features, and node labels; 2) Based on the graph computing platform GraphScope, the Leuven community is divided into graph G, and the clustering information in the graph is obtained through the community division algorithm to obtain several subgraphs. , , ..., ; 3) Design an encoder based on a two-layer graph neural network GCN. For the i-th subgraph have: ， in Representing a subgraph The degree matrix of Representing a subgraph The adjacency matrix of Representation and Subgraphs Diagonal matrices of equal size, For subgraph The Laplacian matrix of ; Get the node level representation as follows: ， in , They are the weight matrices of the first GCN network layer and the second GCN network layer, For subgraph The feature matrix of all nodes in , ReLU is the activation function, Representing a subgraph Node-level representation of Get community level representation as follows: ， Among them, readout is the readout function, mean_pooling represents the mean aggregation function, Representing a subgraph community-level representation of 4) Add a self-attention mechanism to allow nodes in the same community to interact more deeply: ， Where dk is the length of the node feature, softmax is the activation function, Representing a subgraph Self-attention node-level representation; 5) Set the representation of all nodes in a community and the community-level representation of the community in which they are located as positive sample pairs, and set the representation of all nodes in a community and the community-level representation of other communities as negative sample pairs; for a community, extract three negative sample pairs, and use cosine similarity as the similarity measurement function. The higher the similarity score between positive sample pairs, the better, and vice versa for negative sample pairs; ， in Representing a subgraph The similarity score of the positive sample pair is For subgraph The j-th negative sample similarity score, τ is a hyperparameter, set to 0.2, exp is the exponential function of e, log is the logarithmic function, n is the number of subgraphs, is the contrastive learning loss function; 6) The community-level representation is classified into two categories for auxiliary training; the output of the community-level classification module is: ， Linear is a linear layer, Dropout is a random hidden layer, It is the binary classification result predicted by the linear layer; the cross entropy loss function is used as the binary classification task loss function: , Where w is the binary classification weight, is the real binary classification result of the community, is the community binary classification loss function; 7) The final loss function combines the contrastive learning loss function with the community binary classification loss function. The model is guided to optimize parameters through back propagation of the loss function, and a graph neural network-based model that captures multiple perspectives is obtained. By inputting the graph structure to be detected into the trained model, nodes with high anomaly scores can be output.
2. The attribute graph anomaly detection method according to claim 1, characterized in that: Step 5) The positive sample pair is defined as: ， in Representing a subgraph The community level representation of , norm represents the regularization function, Representing a subgraph The positive sample pairs for each node in ; Negative samples are defined as: ， in Representing a subgraph community-level representation of Representing a subgraph Negative sample pairs for each node in ; Use cosine similarity to measure the similarity between two vectors; it is known that , Two vectors, the magnitude of the vector is marked as , , the cosine similarity cos_sim calculation formula is: , The mean similarity of positive samples is: ， Where mean is the mean aggregation function, Representing a subgraph The mean similarity score of the positive sample pairs of each node in ; The mean similarity of negative sample scores is: ， in Representing a subgraph The mean similarity score of the negative sample pairs for each node in .
3. The attribute graph anomaly detection method according to claim 1, characterized in that: Step 7) combines the contrastive learning loss function with the community binary classification loss function, specifically including: ， Where α is a hyperparameter.