Abnormal subgraph detection method and device based on high-order sampling contrast learning

Abstract

The invention discloses an abnormal subgraph detection method based on high-order sampling contrast learning, and the method comprises the steps: building an abnormal feature contrast learning model based on a graph convolution model, and enabling the abnormal feature contrast learning model to be used for learning the vector representation of nodes and k-order neighborhood subgraphs, and k is greater than or equal to 2; extracting k-order neighbor sub-graphs of the nodes by using a k-order neighborhood sampling strategy, and generating a positive instance pair and a negative instance pair for comparative learning to train an abnormal feature comparative learning model; and extracting abnormal features by adopting the trained abnormal feature comparison learning model, detecting an abnormal node set, obtaining an abnormal sub-graph, and finally obtaining an optimal abnormal sub-graph according to an abnormal sub-graph evaluation method. According to the method, a self-supervised deep learning method in a comparative learning method is adopted, a model does not need to be trained through manual labeling, abnormal feature modes in graph data are actively learned from disordered metadata, and targets of abnormal sub-graphs are mined.

Description

Technical Field

[0001] The present invention relates to the technical field of data mining, and in particular to an abnormal subgraph detection method and device based on high-order sampling contrast learning. Background Art

[0002] At present, abnormal subgraph detection is an important research problem in the field of data mining. It is a technology for identifying abnormal substructures or subgraphs in graph data. It is of great significance in many practical applications. Graph data usually represents complex relationships between objects, such as social networks, network traffic, biological networks, etc. In these graphs, abnormal subgraphs may represent some prominent patterns or events, such as abnormal network behaviors, abnormal relationships in social circles, etc. The goal of abnormal subgraph detection is to find subgraphs or substructures that do not conform to normal patterns. These anomalies may include isolated nodes, abnormal connection patterns, abnormal dense subgraphs, etc. Common algorithms include methods based on statistical models (such as outlier detection), graph traversal algorithms (such as subgraph mining algorithms), and machine learning-based methods (such as clustering, classifiers). Traditional abnormal subgraph detection methods determine whether a subgraph is abnormal or not, all of which rely on the abnormal feature data values ​​of the nodes in the observed network. However, the complexity of node attributes and node relationships in existing networks poses challenges to the extraction of abnormal features in graph data. To solve this problem, we introduce a contrastive learning method - a self-supervised deep learning method, which trains the model without manual labeling, actively learns abnormal feature patterns in graph data from messy metadata, and mines the target of abnormal subgraphs. Summary of the invention

[0003] The present invention provides an abnormal subgraph detection method and device based on high-order sampling contrast learning to solve the technical problems existing in the known technology.

[0004] The technical solution adopted by the present invention to solve the technical problems existing in the known technology is:

[0005] An abnormal subgraph detection method based on high-order sampling contrastive learning is proposed. The method constructs an abnormal feature contrastive learning model based on a graph convolutional model to learn the vector representation of nodes and k-order neighborhood subgraphs, where k≥2; a k-order neighborhood sampling strategy is used to extract the k-order neighborhood subgraph of the node, and positive instance pairs and negative instance pairs for contrastive learning are generated to train the abnormal feature contrastive learning model; the trained abnormal feature contrastive learning model is used to extract abnormal features, detect abnormal node sets, and obtain abnormal subgraphs. According to an abnormal subgraph evaluation method, the optimal abnormal subgraph is finally obtained.

[0006] Furthermore, the method comprises the following steps:

[0007] Step 1: Build a graph model to extract the relationship between nodes and edges in the data set;

[0008] Step 2: formulate a k-order neighborhood sampling strategy to construct a subgraph of the positive and negative instance pairs;

[0009] Step 3: Use the graph convolution model to build an abnormal feature comparison learning model to learn the feature vectors of nodes and subgraphs;

[0010] Step 4: Use the abnormal feature comparison learning model to learn the positive and negative instance pairs and calculate the abnormal feature value of the node;

[0011] Step 5: sort the nodes in reverse order according to their abnormal feature values ​​and select the first Q abnormal nodes;

[0012] Step 6: Based on the random walk algorithm, a set of subgraphs to be selected with abnormal nodes as the starting point is generated;

[0013] Step 7: Calculate the outlier value of the subgraph and select the largest outlier connected subgraph as the optimal outlier subgraph.

[0014] Furthermore, step 1 includes the following method steps:

[0015] Define the attribute graph G = (V, E, A, X), where V is the node set, E is the edge set, and A is the adjacency matrix. n is the number of graph nodes, X is the attribute feature matrix of the attribute graph G, m is the feature vector dimension of each node;

[0016] Set Hop (k) is the characteristic vector of the k-order neighbors of all nodes in graph G, and is represented in the form of a column vector; k is the high-order number, k is a hyperparameter, Hop (k) The calculation formula is as follows:

[0017]

[0018] Hop (k) =ak -1 Hop (1) ;

[0019] Where:

[0020] a(h,f) is the h-th row and f-th column element of the adjacency matrix A;

[0021] h is the row number of the adjacency matrix A;

[0022] f is the column number of the adjacency matrix A;

[0023] Hop (1) is the feature vector of the first-order neighbors of all nodes in graph G;

[0024] A k-1 is the k-1th power of the adjacency matrix A.

[0025] Furthermore, step 2 includes the following method steps:

[0026] Formulate the following k-order neighborhood sampling strategy:

[0027] Let node v i is the starting point of the walking path, i is the node number; node v i The adjacent next hop is a positive sampling node or Negative Sampling Node and The calculation formula is as follows:

[0028]

[0029] Where:

[0030] N i For node v i The set of neighbor nodes;

[0031] v g For node v i Neighbor nodes of

[0032] g is the node v i The sequence number of the neighbor node;

[0033] Assume: E P is a positive instance pair; E N is a negative instance pair; For node v i The positive instance subgraph obtained by sampling the k-order neighborhood of the starting node; For node v j is the starting node, and the negative instance subgraph is obtained by k-order neighborhood sampling; j is the node v j The serial number of and i≠j; therefore, E P and E N It is expressed as follows:

[0034] E P =(v i ,P i ),E N =(v i ,P j ).

[0035] Furthermore, step 3 includes the following method steps:

[0036] Construct a graph convolution model so that the mathematical expression of the graph convolution model is as follows:

[0037]

[0038] in: I is the identity matrix, D is the degree matrix of the attribute graph G, σ(·) is the activation function ReLU, W (l-1) is the parameter matrix of the l-1th layer of the graph convolution model, H (0) =X;H (l) is the output vector of the lth layer of the graph convolutional model, H (l-1) is the output vector of the l-1th layer of the graph convolution model; l is the sequence number of the neural network layer in the graph convolution model;

[0039] The graph convolution model is used to build an abnormal feature contrast learning model; the abnormal feature contrast learning model includes node v i The feature vector learning model, subgraph P i The feature vector learning model and the similarity measurement model of positive and negative instance pairs;

[0040] set up For node v i The characteristic vector of For subgraph P i The eigenvector of

[0041] Define node v i The mathematical expression of the feature vector learning model is as follows:

[0042]

[0043] Where:

[0044] For node v i The initial value of the eigenvector, that is, v i Attribute characteristics;

[0045] For node v i The feature vector of the learning model's layer l output vector;

[0046] For node v i The feature vector of the learning model's l-1th layer output vector;

[0047] X(i) is the i-th row vector of the attribute feature matrix X;

[0048] Define subgraph P i The mathematical expression of the feature vector learning model is as follows:

[0049]

[0050] Where:

[0051] For subgraph P i The feature vector of the learning model's output matrix of the first layer;

[0052] For subgraph P i The feature vector of the learning model's l-1th layer output matrix;

[0053] For subgraph P i The eigenvector of

[0054] is an intermediate variable; For subgraph P i The degree matrix of ; I is the identity matrix;

[0055] is an intermediate variable; For subgraph P i The adjacency matrix of ; I is the identity matrix;

[0056] t=|P i | is the subgraph P i The number of nodes;

[0057] For subgraph P i The representation matrix The sth row of ;

[0058] s is the matrix row number;

[0059] The mathematical expression of the similarity measurement model of positive and negative instance pairs is as follows:

[0060]

[0061] sti≠j;

[0062] Where:

[0063] x i + For the positive instance v i and P i Similarity measures of feature vectors;

[0064] x i - For negative instance v i and P j Similarity measures of feature vectors;

[0065] Bilinear(·) is the similarity function;

[0066] is the negative sampling instance subgraph Pj The feature vector of .

[0067] Furthermore, in step 4, when using the abnormal feature contrast learning model to learn positive and negative instance pairs, the following cost objective function is set:

[0068]

[0069]

[0070] Where:

[0071] is the binary cross entropy loss with a sigmoid layer;

[0072] N is the batch parameter;

[0073] x i For node v i and the similarity measure of the subgraph,

[0074] y i For node v i The labels of the positive and negative instance pairs corresponding to the subgraphs, y i ={0,1};

[0075] x + For a positive instance pair (v i ,P i )’s similarity measure set;

[0076] x - is a negative instance pair (v i ,P j ) is a set of similarity measures.

[0077] Furthermore, in step 4, the method for calculating the abnormal characteristic value of the node includes the following method steps:

[0078] Defining the attribute network V is the node set, E is the edge set, is the abnormal feature vector of the graph, n is the number of nodes;

[0079] set up For node v i The abnormal feature measurement score of

[0080] The calculation formula is as follows:

[0081]

[0082] Furthermore, step 5 includes the following method steps:

[0083] Calculate the anomaly scores of all nodes and sort them. Assuming that the abnormal characteristics of the data set conform to a uniform distribution, calculate the probability distribution of the outlier value of each node, set the abnormal significance level threshold α, and mark the nodes with anomaly probability less than or equal to α as abnormal nodes.

[0084] Further, step 7 includes the following method steps:

[0085] Assume S is an abnormal connected subgraph of G′, and the calculation formula for the abnormal degree measurement of subgraph S is as follows:

[0086]

[0087] set up

[0088]

[0089] a,b>0;

[0090] Where:

[0091] is the most significant abnormal connected subgraph;

[0092] α is the significance level of abnormal features;

[0093] N α (S) is the number of abnormal nodes in subgraph S;

[0094] N(S) is the number of nodes in subgraph S;

[0095] f(α,N α (S), N(S)) is a parameter-free graph scanning statistic function that quantifies the degree of abnormality of the subgraph S;

[0096] For node v i The outlier probability of

[0097] The Berk-Jones function in the statistical function for the non-parametric plot scan;

[0098] KL(·) is the Kullback-Liebler divergence function;

[0099] a is an intermediate variable;

[0100] b is an intermediate variable.

[0101] The present invention also provides a device for an abnormal subgraph detection method based on high-order sampling contrast learning, comprising a memory and a processor, wherein the memory is used to store a computer program; the processor is used to execute the computer program and implement the steps of the abnormal subgraph detection method based on high-order sampling contrast learning as described above when executing the computer program.

[0102] The advantages and positive effects of the present invention are:

[0103] The present invention discloses an abnormal subgraph detection method based on high-order sampling contrastive learning, which adopts a self-supervised deep learning method in contrastive learning method, trains the model without manual labeling, actively learns abnormal feature patterns in graph data from messy metadata, and mines the target of abnormal subgraphs. BRIEF DESCRIPTION OF THE DRAWINGS

[0104] Figure 1 This is a workflow diagram of an abnormal subgraph detection method based on high-order sampling contrast learning of the present invention.

[0105] Figure 2 It is a schematic diagram of an abnormal subgraph detection method based on high-order sampling contrast learning of the present invention.

[0106] Figure 3 It is a performance evaluation comparison chart of using an abnormal subgraph detection method based on high-order sampling contrast learning of the present invention and a prior art method to test different data sets.

[0107] In the figure: e is the number of training times; E is the total number of training times; is the binary cross entropy loss with sigmoid layer; W is the graph convolution model parameter matrix; k is the high-order order; n B is the number of batches divided into training sets; α is the significance level of abnormal features; G is the attribute graph; t is the subgraph P i The number of nodes; is the abnormal feature vector of the graph. DETAILED DESCRIPTION

[0108] The present invention will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0109] The Chinese meanings of the following English words, phrases and abbreviations are as follows:

[0110] DOMINANT: An existing anomalous node detection algorithm.

[0111] CoLA: An existing anomalous node detection algorithm.

[0112] ANEMONE: An existing anomalous node detection algorithm.

[0113] GRADATE: An anomalous node detection algorithm.

[0114] AS-GAE: An abnormal subgraph detection algorithm based on graph autoencoder and residual graph calculation method.

[0115] ASD-HC: The algorithm proposed by this invention.

[0116] Cora: A citation dataset.

[0117] ACM: A citation dataset.

[0118] Citeseer: A citation dataset.

[0119] Flickr: A photo sharing dataset.

[0120] BlogCatalog: A dataset of blog sites.

[0121] Berk-Jones: A nonparametric scanning statistic technique.

[0122] Kullback-Liebler: A divergence function that quantifies the difference between two probability distributions.

[0123] NPGS: (Non-Parametric Graph Scan) statistics, non-parametric scanning statistics, represents a class of statistical methods.

[0124] RWR: (Random Walk with Restart), an algorithm to measure the relevance or importance of a node.

[0125] GCN: (Graph Convolutional Network), a type of neural network used to process graph structured data.

[0126] See also Figures 1 to 3 An abnormal subgraph detection method based on high-order sampling contrastive learning is proposed. The method constructs an abnormal feature contrastive learning model based on a graph convolutional model to learn the vector representation of nodes and k-order neighborhood subgraphs, where k≥2; a k-order neighborhood sampling strategy is used to extract the k-order neighborhood subgraph of the node, and positive and negative instance pairs are generated for contrastive learning to train the abnormal feature contrastive learning model; the trained abnormal feature contrastive learning model is used to extract abnormal features, detect abnormal node sets, and obtain abnormal subgraphs. According to the abnormal subgraph evaluation method, the optimal abnormal subgraph is finally obtained.

[0127] Preferably, the method may include the following steps:

[0128] Step 1: Build a graph model to extract the relationship between nodes and edges in the data set;

[0129] Step 2: formulate a k-order neighborhood sampling strategy to construct a subgraph of the positive and negative instance pairs;

[0130] Step 3: Use the graph convolution model to build an abnormal feature comparison learning model to learn the feature vectors of nodes and subgraphs;

[0131] Step 4: Use the abnormal feature comparison learning model to learn the positive and negative instance pairs and calculate the abnormal feature value of the node;

[0132] Step 5: sort the nodes in reverse order according to their abnormal feature values ​​and select the first Q abnormal nodes;

[0133] Step 6: Based on the random walk algorithm, a set of subgraphs to be selected with abnormal nodes as the starting point is generated;

[0134] Step 7: Calculate the outlier value of the subgraph and select the largest outlier connected subgraph as the optimal outlier subgraph.

[0135] Preferably, step 1 may include the following method steps:

[0136] Define the attribute graph G = (V, E, A, X), where V is the node set, E is the edge set, and A is the adjacency matrix. n is the number of graph nodes, X is the attribute feature matrix of the attribute graph G, m is the feature vector dimension of each node;

[0137] Set Hop (k) is the characteristic vector of the k-order neighbors of all nodes in graph G, and is represented in the form of a column vector; k is the high-order number, k is a hyperparameter, Hop (k) The calculation formula is as follows:

[0138]

[0139] Hop (k) =A k-1 Hop (1) ;

[0140] Where:

[0141] a(h,f) is the h-th row and f-th column element of the adjacency matrix A;

[0142] h is the row number of the adjacency matrix A;

[0143] f is the column number of the adjacency matrix A;

[0144] Hop (1) is the feature vector of the first-order neighbors of all nodes in graph G;

[0145] A k-1 is the k-1th power of the adjacency matrix A.

[0146] Preferably, step 2 may include the following method steps:

[0147] Formulate the following k-order neighborhood sampling strategy:

[0148] Let node v i is the starting point of the walking path, i is the node number; node v i The adjacent next hop is a positive sampling node or Negative Sampling Node and The calculation formula is as follows:

[0149]

[0150] Where:

[0151] N i For node v i The set of neighbor nodes of

[0152] v g For node v i Neighbor nodes of

[0153] g is the node v i The sequence number of the neighbor node;

[0154] Assume: E P is a positive instance pair; E N is a negative instance pair; For node v i The positive instance subgraph obtained by sampling the k-order neighborhood of the starting node; For node v j is the starting node, and the negative instance subgraph is obtained by k-order neighborhood sampling; j is the node v j The serial number of and i≠j; therefore, E P and E N It is expressed as follows:

[0155] E P =(v i ,P i ),E N =(v i ,P j ).

[0156] Preferably, step 3 may include the following method steps:

[0157] Construct a graph convolution model so that the mathematical expression of the graph convolution model is as follows:

[0158]

[0159] in: I is the identity matrix, D is the degree matrix of the attribute graph G, σ(·) is the activation function ReLU, W (l-1) is the parameter matrix of the l-1th layer of the graph convolution model, H (0) =X;H (l) is the output vector of the lth layer of the graph convolutional model, H (l-1) is the output vector of the l-1th layer of the graph convolution model; l is the sequence number of the neural network layer in the graph convolution model;

[0160] The graph convolution model is used to build an abnormal feature contrast learning model; the abnormal feature contrast learning model includes node v i The feature vector learning model, subgraph P i The feature vector learning model and the similarity measurement model of positive and negative instance pairs;

[0161] set up For node v i The characteristic vector of For subgraph P i The eigenvector of

[0162] Define node v i The mathematical expression of the feature vector learning model is as follows:

[0163]

[0164] Where:

[0165] For node v i The initial value of the eigenvector, that is, v i Attribute characteristics;

[0166] For node v i The feature vector of the learning model's layer l output vector;

[0167] For node v i The feature vector of the learning model's l-1th layer output vector;

[0168] X(i) is the i-th row vector of the attribute feature matrix X;

[0169] Define subgraph P i The mathematical expression of the feature vector learning model is as follows:

[0170]

[0171] Where:

[0172] For subgraph P i The feature vector of the learning model's output matrix of the first layer;

[0173] For subgraph P i The feature vector of the learning model's l-1th layer output matrix;

[0174] For subgraph P i The eigenvector of

[0175] is an intermediate variable; For subgraph P i The degree matrix of ; I is the identity matrix;

[0176] is an intermediate variable; For subgraph P i The adjacency matrix of ; I is the identity matrix;

[0177] t=|P i | is the subgraph P i The number of nodes;

[0178] For subgraph P i The representation matrix The sth row of ;

[0179] s is the matrix row number;

[0180] The mathematical expression of the similarity measurement model of positive and negative instance pairs is as follows:

[0181]

[0182] sti≠j;

[0183] Where:

[0184] x i + For the positive instance v i and P i Similarity measures of feature vectors;

[0185] x i - For negative instance v i and P j Similarity measures of feature vectors;

[0186] Bilinear(·) is the similarity function;

[0187] is the negative sampling instance subgraph P j The feature vector of .

[0188] Preferably, in step 4, when using the abnormal feature contrast learning model to learn the positive and negative instance pairs, the following cost objective function can be set:

[0189]

[0190] Where:

[0191] is the binary cross entropy loss with a sigmoid layer;

[0192] N is the batch parameter;

[0193] x i For node v i and the similarity measure of the subgraph,

[0194] y i For node v i The labels of the positive and negative instance pairs corresponding to the subgraphs, y i ={0,1};

[0195] x + For a positive instance pair (v i ,P i )’s similarity measure set;

[0196] x - is a negative instance pair (v i ,P j ) is a set of similarity measures.

[0197] Preferably, in step 4, the method for calculating the abnormal characteristic value of the node includes the following method steps:

[0198] Defining the attribute network V is the node set, E is the edge set, is the abnormal feature vector of the graph, n is the number of nodes;

[0199] set up For node v i The abnormal feature measurement score of

[0200] The calculation formula is as follows:

[0201]

[0202] Preferably, step 5 may include the following method steps:

[0203] Calculate the anomaly scores of all nodes and sort them. Assuming that the abnormal characteristics of the data set conform to a uniform distribution, calculate the probability distribution of the outlier value of each node, set the abnormal significance level threshold α, and mark the nodes with anomaly probability less than or equal to α as abnormal nodes.

[0204] Preferably, step 7 may include the following method steps:

[0205] Assume S is an abnormal connected subgraph of G′, and the calculation formula for the abnormal degree measurement of subgraph S is as follows:

[0206]

[0207] set up

[0208]

[0209] a,b>0;

[0210] Where:

[0211] is the most significant abnormal connected subgraph;

[0212] α is the significance level of abnormal features;

[0213] N α (S) is the number of abnormal nodes in subgraph S;

[0214] N(S) is the number of nodes in subgraph S;

[0215] f(α,N α (S), N(S)) is a parameter-free graph scanning statistic function that quantifies the degree of abnormality of the subgraph S;

[0216] For node v i The outlier probability of

[0217] The Berk-Jones function in the statistical function for the non-parametric plot scan;

[0218] KL(·) is the Kullback-Liebler divergence function;

[0219] a is an intermediate variable;

[0220] b is an intermediate variable.

[0221] The present invention also provides a device for an abnormal subgraph detection method based on high-order sampling contrast learning, comprising a memory and a processor, wherein the memory is used to store a computer program; the processor is used to execute the computer program and implement the steps of the abnormal subgraph detection method based on high-order sampling contrast learning as described above when executing the computer program.

[0222] The following is a preferred embodiment of the present invention to further illustrate the working process and working principle of the present invention:

[0223] An abnormal subgraph detection method based on high-order sampling contrastive learning is introduced into the graph anomaly detection framework. The GCN deep model is used to learn the vector representation of nodes and k-order neighborhood subgraphs. The contrastive learning method is used to extract abnormal features and detect abnormal node sets. According to the abnormal subgraph evaluation method, the optimal abnormal subgraph is finally obtained.

[0224] The present invention provides an abnormal subgraph detection method based on high-order sampling contrast learning, which includes the following method steps:

[0225] 1) High-order neighborhood sampling modeling

[0226] Define the attribute graph G = (V, E, A, X), where V is the node set, E is the edge set, and A is the adjacency matrix. n is the number of graph nodes, X is the attribute feature matrix of the attribute graph G, m is the feature vector dimension of each node;

[0227] Set Hop (k) It is the feature vector of the k-order neighbors of all nodes in graph G, and is represented in the form of a column vector; is a hyperparameter, which is a high-order number; Hop (k) The calculation formula is as follows:

[0228]

[0229] Hop (k) =A k-1 Hop (1) ;

[0230] Where:

[0231] a(h,f) is the h-th row and f-th column element of the adjacency matrix A;

[0232] h is the row number of the adjacency matrix A;

[0233] f is the column number of the adjacency matrix A;

[0234] Hop (1) is the feature vector of the first-order neighbors of all nodes in graph G;

[0235] A k-1 is the k-1th power of the adjacency matrix A.

[0236] The k-order neighborhood sampling strategy is:

[0237] (1) Positive example for E P Neutron P i :v i is the starting point of the walking path, node v i The adjacent next hop is node (the node with the maximum value of the k-th order eigenvector), and so on.

[0238] (2) Negative instance pair E N Neutron P j :v j is the starting point of the walking path, node v j The adjacent next hop is node (the node with the minimum k-th eigenvector), and so on.

[0239] 2) Abnormal feature comparison learning model

[0240] The model uses the k-order neighborhood sampling strategy to extract the k-order neighbor subgraph of the node and construct the positive and negative instance pairs required for contrastive learning. P and negative instance pair E N It is expressed as follows:

[0241] E P =(v i ,P i ),E N =(v i ,P j ),st i≠j. (1)

[0242] Among them, P i and P j The nodes v i and node v j The subgraph obtained by sampling the k-order (maximum or minimum) neighborhood of the starting node. i and subgraph P i The vector corresponding to and The vector representation can be optimized by the graph convolutional network (GCN) deep model.

[0243] Define node v i The mathematical expression of the feature vector learning model is as follows:

[0244]

[0245] in Represents node vi The attribute features of , that is, the i-th row vector of the attribute matrix X.

[0246] Construct a graph convolution model so that the mathematical expression of the graph convolution model is as follows:

[0247]

[0248] in: I is the identity matrix, D is the degree matrix of the attribute graph G, σ(·) is the activation function ReLU, W (l-1) is the parameter matrix of the l-1th layer of the graph convolution model, H (0) =X;H (l) is the output vector of the lth layer of the graph convolutional model, H (l-1) is the output vector of the l-1th layer of the graph convolutional model; l is the sequence number of the neural network layer in the graph convolutional model.

[0249] set up For node v i The characteristic vector of For subgraph P i The eigenvector of

[0250] Define node v i The mathematical expression of the feature vector learning model is as follows:

[0251]

[0252] Where:

[0253] For subgraph P i The feature vector of the learning model's output matrix of the first layer;

[0254] For subgraph P i The feature vector of the learning model's l-1th layer output matrix;

[0255] For subgraph P i The eigenvector of

[0256] is an intermediate variable; For subgraph P i The degree matrix of ; I is the identity matrix;

[0257] is an intermediate variable; For subgraph P i The adjacency matrix of ; I is the identity matrix;

[0258] t=|P i | is the subgraph Pi The number of nodes;

[0259] For subgraph P i The representation matrix The sth row of ;

[0260] s is the matrix row number;

[0261] Define the similarity measures of positive and negative instance pairs as x + (See formula (7)) and x - (See formula (8)).

[0262]

[0263] Where:

[0264] x i + For the positive instance v i and P i Similarity measures of feature vectors;

[0265] x i - For negative instance v i and P j Similarity measures of feature vectors;

[0266] Bilinear(·) is the similarity function;

[0267] is the negative sampling instance subgraph P j The feature vector of .

[0268] The cost objective function of the abnormal feature comparison learning model of the present invention is defined as follows:

[0269]

[0270] Where:

[0271] is the binary cross entropy loss with a sigmoid layer;

[0272] N is the batch parameter;

[0273] x i For node v i and the similarity measure of the subgraph,

[0274] y i For node v i The labels of the positive and negative instance pairs corresponding to the subgraphs, y i ={0,1};

[0275] x + For a positive instance pair (v i ,P i )’s similarity measure set;

[0276] x - is a negative instance pair (v i ,P j ) is a set of similarity measures.

[0277] 3) Abnormal subgraph detection model

[0278] Defining the attribute network V is the node set, is the set of edges, is the node abnormal feature vector, n is the number of nodes, let For node v i The abnormal feature measurement score of

[0279] The calculation formula is as follows:

[0280]

[0281] Calculate the abnormal scores of all nodes and sort them. Assuming that the abnormal characteristics of the data set conform to the uniform distribution, calculate the probability distribution of the abnormal value of each node According to the abnormal significance level α, Nodes with a value less than α are marked as abnormal nodes. The abnormal degree measurement of subgraph S is as follows:

[0282] Assume S is an abnormal connected subgraph of G′, and the calculation formula for the abnormal degree measurement of subgraph S is as follows:

[0283]

[0284] set up

[0285]

[0286] a,b>0;

[0287] Where:

[0288] is the most significant abnormal connected subgraph;

[0289] α is the significance level of abnormal features;

[0290] N α (S) is the number of abnormal nodes in subgraph S;

[0291] N(S) is the number of nodes in subgraph S;

[0292] f(α,Nα (S), N(S)) is a parameter-free graph scanning statistic function that quantifies the degree of abnormality of the subgraph S;

[0293] For node v i The outlier probability of

[0294] The Berk-Jones function in the statistical function for the non-parametric plot scan;

[0295] KL(·) is the Kullback-Liebler divergence function;

[0296] a is an intermediate variable;

[0297] b is an intermediate variable.

[0298] The abnormal subgraph detection algorithm proposed in the present invention can be as follows (all variables are expressed in vector form or matrix form): (1). Initialization: deep model parameter matrix, calculate K-order neighborhood vector.

[0299] (2) Generate positive instance subgraphs and negative instance subgraphs for all nodes.

[0300] (3). Optimize the graph convolution model and learn the vector representation of nodes and subgraphs.

[0301] (4). Calculate the similarity index of positive and negative instance pairs.

[0302] (5). Calculate the cost function.

[0303] (6). Iterative optimization algorithm model.

[0304] (7). Calculate the outlier values ​​of all nodes.

[0305] (8) According to the abnormal significance value α, identify the abnormal node set

[0306] (9) Starting from all the nodes in the abnormal node set, the random walk algorithm is used to construct the subgraph set {S0, S1, ...}.

[0307] (10). According to the subgraph anomaly evaluation function f(α,N α (S), N(S)), filter out the largest abnormal connected subgraph

[0308] Characteristics and effects of the method of the present invention:

[0309] 1. In the attribute network, a high-order neighborhood sampling strategy is constructed to construct a subgraph of positive and negative instance pairs;

[0310] 2. Use the GCN model to learn node and subgraph representation vectors;

[0311] 3. According to the contrastive learning algorithm, extract abnormal features in the graph and filter out abnormal nodes;

[0312] 4. Based on the random walk algorithm RWR, generate a subgraph to be selected with the abnormal node as the starting point;

[0313] 5. Use NPGS statistics to evaluate the outliers of the subgraph and select the most abnormal connected subgraph.

[0314] The above-mentioned graph convolution model, abnormal feature contrast learning model, k-order neighborhood sampling strategy, random walk algorithm RWR, Berk-Jones function, Kullback-Liebler divergence function and other algorithms, models and functional modules of the present invention can adopt applicable algorithms, models and functional modules in the prior art, or adopt algorithms, models and functional modules in the prior art and construct them by conventional technical means.

[0315] The embodiments described above are only used to illustrate the technical ideas and features of the present invention, and their purpose is to enable those skilled in the art to understand the contents of the present invention and implement them accordingly. The patent scope of the present invention cannot be limited only by this embodiment, that is, any equivalent changes or modifications made to the spirit disclosed by the present invention still fall within the patent scope of the present invention.

Claims

1. A method for detecting abnormal subgraphs based on high-order sampling contrastive learning, characterized in that: This method constructs an abnormal feature contrast learning model based on a graph convolutional model, which is used to learn the vector representation of nodes and k-order neighborhood subgraphs, where k≥2; the k-order neighborhood subgraph of the node is extracted using a k-order neighborhood sampling strategy, and positive and negative instance pairs are generated for contrast learning to train the abnormal feature contrast learning model; the trained abnormal feature contrast learning model is used to extract abnormal features, detect abnormal node sets, and obtain abnormal subgraphs. According to the abnormal subgraph evaluation method, the optimal abnormal subgraph is finally obtained.

2. The abnormal subgraph detection method based on high-order sampling contrast learning according to claim 1 is characterized in that: The method comprises the following steps: Step 1: Build a graph model to extract the relationship between nodes and edges in the data set; Step 2: formulate a k-order neighborhood sampling strategy to construct a subgraph of the positive and negative instance pairs; Step 3: Use the graph convolution model to build an abnormal feature comparison learning model to learn the feature vectors of nodes and subgraphs; Step 4: Use the abnormal feature comparison learning model to learn the positive and negative instance pairs and calculate the abnormal feature value of the node; Step 5: sort the nodes in reverse order according to their abnormal feature values ​​and select the first Q abnormal nodes; Step 6: Based on the random walk algorithm, a set of subgraphs to be selected with abnormal nodes as the starting point is generated; Step 7: Calculate the outlier value of the subgraph and select the largest outlier connected subgraph as the optimal outlier subgraph.

3. The abnormal subgraph detection method based on high-order sampling contrast learning according to claim 2 is characterized in that: Step 1 includes the following method steps: Define the attribute graph G = (V, E, A, X), where V is the node set, E is the edge set, and A is the adjacency matrix. n is the number of graph nodes, X is the attribute feature matrix of the attribute graph G, m is the feature vector dimension of each node; Set Hop (k) is the characteristic vector of the k-order neighbors of all nodes in graph G, and is represented in the form of a column vector; k is the high-order number, k is a hyperparameter, Hop (k) The calculation formula is as follows: s.t.,1≤h≤n,1≤f≤n; Hop (k) =A k-1 ·Hop (1) ; Where: a(h,f) is the h-th row and f-th column element of the adjacency matrix A; h is the row number of the adjacency matrix A; f is the column number of the adjacency matrix A; Hop (1) is the feature vector of the first-order neighbors of all nodes in graph G; A k-1 is the k-1th power of the adjacency matrix A.

4. The abnormal subgraph detection method based on high-order sampling contrast learning according to claim 3 is characterized in that: Step 2 includes the following method steps: Formulate the following k-order neighborhood sampling strategy: Let node v i is the starting point of the walking path, i is the node number; node v i The adjacent next hop is a positive sampling node or Negative Sampling Node and The calculation formula is as follows: Where: N i For node v i The set of neighbor nodes of v g For node v i Neighbor nodes of g is the node v i The sequence number of the neighbor node; Assume: E P is a positive instance pair; E N is a negative instance pair; For node v i The positive instance subgraph obtained by sampling the k-order neighborhood of the starting node; For node v j is the starting node, and the negative instance subgraph is obtained by k-order neighborhood sampling; j is the node v j The serial number of and i≠j; therefore, E P and E N It is expressed as follows: E P =(v i ,P i ),E N =(v i ,P j )。 5. The abnormal subgraph detection method based on high-order sampling contrast learning according to claim 4 is characterized in that: Step 3 includes the following method steps: Construct a graph convolution model so that the mathematical expression of the graph convolution model is as follows: in: I is the identity matrix, D is the degree matrix of the attribute graph G, σ(·) is the activation function ReLU, W (l-1) is the parameter matrix of the l-1th layer of the graph convolution model, H (0) =X;H (l) is the output vector of the lth layer of the graph convolutional model, H (l-1) is the output vector of the l-1th layer of the graph convolution model; l is the sequence number of the neural network layer in the graph convolution model; The graph convolution model is used to build an abnormal feature contrast learning model; the abnormal feature contrast learning model includes node v i The feature vector learning model, subgraph P i The feature vector learning model and the similarity measurement model of positive and negative instance pairs; set up For node v i The characteristic vector of For subgraph P i The eigenvector of Define node v i The mathematical expression of the feature vector learning model is as follows: Where: For node v i The initial value of the eigenvector, that is, v i Attribute characteristics; For node v i The feature vector of the learning model's layer l output vector; For node v i The feature vector of the learning model is the l-1 layer output vector; X(i) is the i-th row vector of the attribute feature matrix X; Define subgraph P i The mathematical expression of the feature vector learning model is as follows: Where: For subgraph P i The feature vector of the learning model's output matrix of the first layer; For subgraph P i The feature vector of the learning model's l-1th layer output matrix; For subgraph P i The eigenvector of is an intermediate variable; For subgraph P i The degree matrix of ; I is the identity matrix; is an intermediate variable; For subgraph P i adjacency matrix; I is the identity matrix; t=|P i | is the subgraph P i The number of nodes; For subgraph P i The representation matrix The sth row of ; s is the matrix row number; The mathematical expression of the similarity measurement model of positive and negative instance pairs is as follows: sti≠j; Where: x i + For the positive instance v i and P i Similarity measures of feature vectors; x i - For negative instance v i and P j Similarity measures of feature vectors; Bilinear(·) is the similarity function; is the negative sampling instance subgraph P j The feature vector of .

6. The abnormal subgraph detection method based on high-order sampling contrast learning according to claim 5 is characterized in that: Step 4: When using the abnormal feature contrast learning model to learn positive and negative instance pairs, set the following cost objective function: Where: is the binary cross entropy loss with a sigmoid layer; N is the batch parameter; x i For node v i and the similarity measure of the subgraph, y i For node v i The labels of the positive and negative instance pairs corresponding to the sub-graph, y i ={0,1}; x + For a positive instance pair (v i ,P i )’s similarity measure set; x - is a negative instance pair (v i ,P j ) is a set of similarity measures.

7. The abnormal subgraph detection method based on high-order sampling contrast learning according to claim 5 is characterized in that: In step 4, the method for calculating the abnormal characteristic value of the node includes the following method steps: Defining the attribute network V is the node set, E is the edge set, is the abnormal feature vector of the graph, n is the number of nodes; set up For node v i The abnormal feature measurement score of The calculation formula is as follows:

8. The abnormal subgraph detection method based on high-order sampling contrast learning according to claim 2 is characterized in that: Step 5 includes the following method steps: Calculate the anomaly scores of all nodes and sort them. Assuming that the abnormal characteristics of the data set conform to a uniform distribution, calculate the probability distribution of the outlier value of each node, set the abnormal significance level threshold α, and mark the nodes with anomaly probability less than or equal to α as abnormal nodes.

9. The abnormal subgraph detection method based on high-order sampling contrast learning according to claim 8 is characterized in that: Step 7 includes the following method steps: Assume S is an abnormal connected subgraph of G′, and the calculation formula for the abnormal degree measurement of subgraph S is as follows: set up b = α; a,b>0; Where: is the most significant abnormal connected subgraph; α is the significance level of abnormal features; N α (S) is the number of abnormal nodes in subgraph S; N(S) is the number of nodes in subgraph S; f(α,N α (S), N(S)) is a parameter-free graph scanning statistic function that quantifies the degree of abnormality of the subgraph S; For node v i The outlier probability of The Berk-Jones function in the statistical function for the non-parametric plot scan; KL(·) is the Kullback-Liebler divergence function; a is an intermediate variable; b is an intermediate variable.

10. A device for detecting abnormal subgraphs based on high-order sampling contrastive learning, comprising a memory and a processor, characterized in that: The memory is used to store a computer program; the processor is used to execute the computer program and implement the steps of the abnormal subgraph detection method based on high-order sampling contrast learning as described in any one of claims 1 to 9 when executing the computer program.

Images