Dynamic graph anomaly detection method based on graph embedding and diffusion sampling

Abstract

The application provides a dynamic graph anomaly detection method based on graph embedding and diffusion sampling, aiming to improve the accuracy of anomaly edge detection. The method comprises the following steps: obtaining a dynamic graph dataset and dividing it into a set of adjacency matrices, and randomly initializing node features; generating an adjacency matrix and calculating a diffusion matrix within a time window, and selecting the most influential nodes to form a subgraph; inputting the subgraph into a node-spatial information fusion module, extracting features through two layers of GCN model and GRU unit; negative sampling of anomaly edges, combining node features and sending them into an anomaly detector to obtain an anomaly score; and calculating a cross-entropy loss function based on the anomaly score and training the model. The method reduces the influence of neighbor noise through diffusion sampling, fuses structure and time information, and effectively improves the performance of dynamic graph anomaly detection.

Description

Technical Field

[0001] This invention belongs to the field of data mining and complex network research technology, and in particular relates to a dynamic graph anomaly detection method based on graph embedding and diffusion sampling. Background Technology

[0002] In recent years, graph research has received significant attention and development in fields such as social networks, knowledge graphs, e-commerce, and transportation networks. In the real world, the properties and connections of graphs change over time. Taking social networks as an example, users evolve through online activities on social platforms, causing their attributes and connections with other users to constantly change. Therefore, unlike static graphs, dynamic graphs need to be analyzed over time to capture these changes. In the field of dynamic graph technology, the detection of abnormal edges is a crucial task. For instance, in a social network, spam or other harassing information may appear, and even fake news may spread. Detecting such abnormal messages is essential for maintaining a healthy online community environment.

[0003] Existing dynamic graph anomaly detection methods can be broadly classified into two categories: autoencoder-based methods and end-to-end methods. Autoencoder-based methods typically obtain an initial encoding through an initial feature encoding method, then reconstruct the initial encoding using an encoder and decoder, calculate the error, and train to obtain suitable encoder parameters to obtain the final latent representation vector. End-to-end methods are models that directly learn from the original dynamic graph input to the anomaly detection output, usually based on supervised or semi-supervised learning. They do not require intermediate steps such as feature extraction and reconstruction, but directly learn the mapping from input to output.

[0004] End-to-end methods are better able to capture the changes in dynamic graphs over time, which is highly advantageous for tasks that require dynamic tracking and anomaly identification. However, their performance often depends on high-quality labeled data; without sufficient anomaly labels, the model's detection performance may degrade. Most end-to-end methods first obtain the embedding representations of graph nodes and then derive anomaly scores based on the embeddings. However, existing methods do not consider the importance of nodes, leading to the influence of unnecessary node noise.

[0005] Furthermore, the existing technology has the following three problems that have not yet been well resolved:

[0006] (1) Capturing the dynamics of graph evolution. Current research focuses on static graphs, with fewer methods for handling dynamic graphs. Existing methods for capturing the dynamics of graph evolution only use recurrent neural network models or attention mechanisms, lacking ideas for obtaining long-term dynamic evolution.

[0007] (2) The obtained context information of the nodes is inaccurate. Existing methods extract the h-hop neighbors of the target node or use them as context. However, this strategy leads to performance degradation and inefficiency under the power-law distribution of real-world datasets. For popular nodes with high degree, the number of h-hop neighbors is explosive, causing the noise information of nodes in the sampled context to affect the accuracy of anomaly detection. Secondly, sampling h-hop neighbors ignores the different importance of nodes in the graph structure. The importance of neighbors between nodes varies depending on their type; for example, closer neighbors have a greater influence on the node. However, this simple strategy can only consider shared neighbors and exclusive neighbors equally when sampling context nodes.

[0008] (3) Fusion of structural and temporal information. Existing methods model the topological structure and temporal dynamics separately, which may lead to insufficient utilization of the structural information in the residuals, resulting in information loss and reduced model performance. Therefore, designing a method that can better fuse structural and temporal information is also an important challenge for anomaly edge detection;

[0009] Therefore, it is essential to provide a dynamic graph anomaly detection method based on graph embedding and diffusion sampling to overcome the shortcomings of existing methods. Summary of the Invention

[0010] The purpose of this invention is to provide a dynamic graph anomaly detection method based on graph embedding and diffusion sampling, which can improve the accuracy of anomaly edge detection and provide a new research idea for end-to-end dynamic graph anomaly detection methods.

[0011] The technical solution adopted in this invention is a dynamic graph anomaly detection method based on graph embedding and diffusion sampling, characterized by comprising the following steps:

[0012] Step S1: Obtain the dynamic graph dataset, and divide the edge indices at all times into an adjacency matrix set {A0…A1} by time. t}, randomly initialize the feature of each node to X; where, Let represent the adjacency matrix at time t. Let n represent the set of real numbers, and n represent the number of nodes.

[0013] Step S2: Within the time window, generate an adjacency matrix based on the edge index of each timestamp, and calculate all diffusion matrices within the window time t.

[0014] Step S3: Based on the diffusion matrix S obtained in step S2 at time t t For the diffusion matrix S t For each row, select the k most influential nodes to obtain the node set of the subgraph at time t. Let n represent the set of real numbers, and n represent the number of nodes.

[0015] Step S4: Represent the sub-graph window obtained in S3. The input is fed into the node spatiotemporal information fusion module to obtain the node feature representation at each time step. The spatiotemporal information fusion module includes a feature extraction module and a time information extraction module;

[0016] Step S5: Negatively sample outlier edges, combining outlier edges, normal edges, and the node feature representations obtained in S4 for each time step, which are then used for outlier edge detection. The anomaly scores of all edges are obtained by feeding them into the anomaly detector.

[0017] Step S6: Based on the edge anomaly scores obtained in S5, calculate the loss function and minimize the loss to train the model.

[0018] Furthermore, in step S2, the original graph is used for diffusion operations to quantify the importance of nodes and the nodes between them. The k nodes with the greatest influence on the target node are obtained through the diffusion matrix. For a given adjacency matrix of a static graph... in, Let n represent the set of real numbers and n represent the number of nodes; the graph diffusion matrix is ​​defined as:

[0019]

[0020] Where S represents the graph diffusion matrix, T m Let θ represent the m-th power of the generalized transition matrix T. m Represents the weighting coefficients that determine the proportion of global to local information; Let n represent the set of real numbers, and n represent the number of nodes.

[0021] Furthermore, in step S3, the node set of all node subgraphs at time t... The formula is shown below:

[0022]

[0023] in, S represents the set of nodes in the subgraph at time t. t S represents the diffusion matrix at time t, and topk(·) represents the diffusion matrix S. t For each row, select the k nodes with the greatest influence;

[0024] After calculating the subgraph nodes corresponding to all window times, the obtained subgraph windows are represented as follows: Where t represents the current time and w represents the size of the time window. Let v represent the set of nodes in the subgraph at time t, and v represent the time within the time window.

[0025] Furthermore, in step S4, the feature extraction module uses a two-layer GCN model to obtain the node features for each timestamp, and randomly initializes the node features. The initial feature is represented as X, and its formula is as follows:

[0026]

[0027] in, Let W represent the sum of the adjacency matrix and the identity matrix, and let W represent the trainable weight matrix. express The angle matrix, Z (0) This indicates the eigenvalues ​​W after passing through one layer of GCN. (0) Z represents the trainable weight parameters of the first layer of the GCN. (1) This indicates that the eigenvalues ​​W after two layers of GCN are... (1) This represents the trainable weight parameters of the second-layer GCN, and Relu(·) represents the Relu activation function;

[0028] GCN is used to obtain node features at each time step. and under the time window in, Let n represent the set of real numbers, and d represent the number of nodes. str This represents the dimension after extracting structural information. This represents the structural features of a node at time v within a time window. Let v represent the set of node structure features of the graph with a time window of size w at time t, where v ranges from [tw, t].

[0029] Furthermore, in step S4, the time information extraction module includes a GRU module and a self-attention mechanism module. First, the time information is extracted through the GRU module, and its formula is as follows:

[0030]

[0031]

[0032] h t =(1-z) t )⊙h t-1 +z t ⊙h′ t (9)

[0033] Where ⊙ represents element-wise multiplication, W Z U z b z W r Ur b r W h U h b h W are the trainable parameters in a GRU unit. Z U represents the weight matrix of the updated gate. z This represents the recursive weight matrix of the update gate, used for the hidden state at the current time step, b. z W represents the bias vector of the updated gate. r U represents the weight matrix of the reset gate. r The recursive weight matrix for the reset gate is used to represent the hidden state at the current time step, b. r W represents the bias vector of the reset gate. h The weight matrix U represents the candidate hidden state. h The recursive weight matrix representing the candidate hidden state, used for the hidden state at the current time step, b h The bias vector represents the candidate hidden state. This indicates that the node structure features at time t have passed through two layers of GCN, h t-1 Z represents the state at time t-1. t Indicates the update gate, r t This indicates resetting the door, h′ t H represents the candidate hidden state. t From its previous state h t-1 The calculation is derived from the state passed to time t, where σ(·) represents the sigmoid activation function and tanh(·) represents the tanh function. The GRU network takes the features of each timestamp as input and inputs the output of the current timestamp into the next timestamp.

[0034] Furthermore, in step S4, after extracting time information through the GRU module, an adaptive self-attention mechanism module is added to obtain the time information. Obtain the final node embedding representation. Among them, h v H represents the spatiotemporal characteristics of a node at time v within a time window. t Let v represent the node features within a time window of size w at time t, where the range of v is [tw, t].

[0035] The formula is shown below:

[0036]

[0037] Among them, W Q W K W V Denotes the trainable parameters, d embThe spatiotemporal feature dimension of a node is represented by Q, K, and V, which represent the three matrices of the attention mechanism used to calculate the similarity between vectors; softmax(·) represents the softmax function, and Pooling(·) represents the average pooling operation. H represents the structural features of a node at time t. t K represents the node characteristics at time t within the time window. T Representing the transpose of K, we finally obtain This represents the final node feature representation. Let n represent the set of real numbers, and d represent the number of nodes. emb The spatiotemporal characteristics of a node are represented by its dimension.

[0038] Furthermore, in step S5, the node feature representation of abnormal edge detection... in, Let n represent the set of real numbers, and d represent the number of nodes. emb The spatiotemporal feature representation dimension of a node is shown below. The anomaly detector uses a fully connected neural network, and the formula for the anomaly score of the edge between nodes i and j is as follows:

[0039]

[0040] Here, mlp(·) represents a two-layer fully connected neural network, and score(i,j) represents the anomaly score of the edge between nodes i and j. It is the final feature representation of nodes i and j used for anomaly edge detection.

[0041] Furthermore, in step S6, the loss function adopted is the cross-entropy loss function, the formula of which is shown below:

[0042]

[0043] Where N represents the sum of negative and positive sampled edges, and y represents the current index of the traversed edge sum. Represents the loss function. and Let represent the anomaly scores of positive and negative sample edges between nodes i and j, respectively.

[0044] Furthermore, in step S2, the method for calculating the diffusion matrix is ​​modified according to the Laplace operator, and the diffusion matrix S at time t is... t The formula is shown below:

[0045]

[0046] Among them, S tLet D denote the diffusion matrix at time t, D denote the angle matrix, α∈(0,1), α denote the propagation probability, A denote the adjacency matrix of the graph, and I denote the propagation matrix at time t. n Represents an identity matrix with n nodes; in, Let n represent the set of real numbers, and n represent the number of nodes.

[0047] The beneficial effects of this invention are as follows: This application provides a dynamic graph anomaly detection method based on graph embedding and diffusion sampling. This scheme obtains node features by introducing diffusion sampling to sample a dedicated subgraph for each node, thereby reducing the impact of useless neighbor noise on the node embedding representation. Furthermore, it introduces an attention mechanism and a gated recurrent neural network, and adds structural information residual connections, thus more effectively fusing structural and temporal information to obtain the final representation and calculate the anomaly score of the edges. This invention represents an innovative exploration of dynamic graph anomaly detection methods, which is beneficial for exploring complex network structures and can promote the development of the field of complex network research. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a flowchart of an embodiment of the method of the present invention.

[0050] Figure 2 This is a schematic diagram of the abnormal edge detection method of the present invention. Detailed Implementation

[0051] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0052] Example 1

[0053] This invention provides a dynamic graph anomaly detection method based on graph embedding and diffusion sampling, such as... Figures 1-2 As shown, it includes the following steps:

[0054] Step S1: Obtain the dynamic graph dataset, and divide the edge indices at all times into an adjacency matrix set {A0…A1} by time. t}, randomly initialize the feature of each node to X; where, Let represent the adjacency matrix at time t. Let n represent the set of real numbers, and n represent the number of nodes.

[0055] Step S2: Within the time window, an adjacency matrix is ​​generated based on the edge index of each timestamp. Then, all diffusion matrices within the window are calculated. Unlike traditional neighbor sampling methods, this invention uses the original graph for diffusion operations. Through graph diffusion, the importance between nodes is quantified. For example, the importance of node i to node j is the value in row i and column j of the diffusion matrix; the larger the value, the higher the importance. Thus, the k nodes with the greatest influence on the target node are obtained through the diffusion matrix. This reduces the noise impact of useless neighbor nodes and improves the accuracy of anomaly detection. For a given adjacency matrix of a static graph... in, Let n represent the set of real numbers, and n represent the number of nodes. The graph diffusion matrix is ​​defined as:

[0056]

[0057] Where S represents the graph diffusion matrix, T m Let θ represent the m-th power of the generalized transition matrix T. m Represents the weighting coefficients that determine the proportion of global to local information; Let n represent the set of real numbers, and n represent the number of nodes.

[0058] For the diffusion operation used in this embodiment, to avoid multi-step iterations, the method for calculating the diffusion matrix is ​​modified according to the Laplace operator. The diffusion matrix S at time t is... t The formula is shown below:

[0059]

[0060] Among them, S t Let D denote the diffusion matrix at time t, D denote the angle matrix, α∈(0,1), α denote the propagation probability, A denote the adjacency matrix of the graph, and I denote the propagation matrix at time t. n Represents an identity matrix with n nodes; in, Let n represent the set of real numbers, and n represent the number of nodes.

[0061] Step S3: Based on the diffusion matrix S obtained in step S2 at time t t For the diffusion matrix S t For each row, select the k most influential nodes to obtain the node set of the subgraph at time t. Let n represent the set of real numbers, and n represent the number of nodes. The formula is shown below:

[0062]

[0063] in, S represents the set of nodes in the subgraph at time t. t S represents the diffusion matrix at time t, and topk(·) represents the diffusion matrix S. t For each row, select k nodes with the greatest influence.

[0064] After calculating the subgraph nodes corresponding to all window times, the obtained subgraph windows are represented as follows: Where t represents the current time and w represents the size of the time window. Let v represent the set of nodes in the subgraph at time t, and v represent the time within the time window.

[0065] Step S4: Represent the sub-graph window obtained in S3. The input is fed into the node spatiotemporal information fusion module to obtain the feature representation of each time moment. The spatiotemporal information fusion module includes a feature extraction module and a time information extraction module.

[0066] The feature extraction module uses a two-layer GCN model to obtain the node features for each timestamp. The node features are randomly initialized, with the initial feature represented as X, and its formula is as follows:

[0067]

[0068] in, Let W represent the sum of the adjacency matrix and the identity matrix, and let W represent the trainable weight matrix. express The angle matrix, Z (0) This indicates the eigenvalues ​​W after passing through one layer of GCN. (0) Z represents the trainable weight parameters of the first layer of the GCN. (1) This indicates that the eigenvalues ​​W after two layers of GCN are... (1) This represents the trainable weight parameters of the second-layer GCN, and Relu(·) represents the Relu activation function.

[0069] Using graph convolutional layers, each node can aggregate embeddings from its neighbors. Structural information is extracted by stacking graph convolutional layers in the neural network, and then the target node embedding is extracted separately from the subgraph sampled at each node, obtaining the node features at each time step. and under the time window in, Let n represent the set of real numbers, and d represent the number of nodes. str This represents the dimension after extracting structural information. This represents the structural features of a node at time v within a time window. Let v represent the set of node structure features of the graph with a time window of size w at time t, where v ranges from [tw, t].

[0070] The time information extraction module includes a GRU (Gated Recurrent Unit) module and a self-attention mechanism module. First, the GRU module captures time information and mitigates the vanishing and exploding gradient problems. Its formula is shown below:

[0071]

[0072] h t =(1-z) t )⊙h t-1 +z t ⊙h′ t (9)

[0073] Where ⊙ represents element-wise multiplication, W Z U z b z W r U r b r W h U h b h W are the trainable parameters in a GRU unit. Z U represents the weight matrix of the updated gate. z This represents the recursive weight matrix of the update gate, used for the hidden state at the current time step, b. z W represents the bias vector of the updated gate. r U represents the weight matrix of the reset gate. r The recursive weight matrix for the reset gate is used to represent the hidden state at the current time step, b. r W represents the bias vector of the reset gate. h The weight matrix U represents the candidate hidden state. h The recursive weight matrix representing the candidate hidden state, used for the hidden state at the current time step, b h The bias vector represents the candidate hidden state. This indicates that the node structure features at time t have passed through two layers of GCN, h t-1 Z represents the state at time t-1. t Indicates the update gate, r t This indicates resetting the door, h′ t H represents the candidate hidden state. t From its previous state h t-1The values ​​are calculated to represent the state passed up to time t. σ(·) represents the sigmoid activation function, which transforms the data into numbers in the range [0,1]. tanh(·) represents the tanh function, which transforms the data into values ​​in the range [-1,1]. The GRU network takes the features of each timestamp as input and inputs the output of the current timestamp into the next timestamp.

[0074] Secondly, to fully consider the impact of historical information and the periodicity of user behavior, an adaptive self-attention mechanism module is added after the GRU module. Obtain the final node embedding representation. Among them, h v H represents the spatiotemporal characteristics of a node at time v within a time window. t This represents the node features within a time window of size w at time t, where v ranges from [tw, t].

[0075] The formula is shown below:

[0076]

[0077] Among them, W Q W K W V Denotes the trainable parameters, d emb The spatiotemporal feature dimension of a node is represented by Q, K, and V, which represent the three matrices of the attention mechanism used to calculate the similarity between vectors; softmax(·) represents the softmax function, and Pooling(·) represents the average pooling operation. H represents the structural features of a node at time t. t K represents the node characteristics at time t within the time window. T Let K be the transpose matrix. Finally, we obtain... This represents the final node feature representation. Let n represent the set of real numbers, and d represent the number of nodes. emb The spatiotemporal characteristics of a node are represented by its dimension.

[0078] Step S5: Negatively sample outlier edges, then use the outlier edges, normal edges, and the node feature representations obtained in S4 for each time step to finally detect outlier edges. The anomaly scores of all edges are obtained by feeding them into the anomaly detector, where, Let n represent the set of real numbers, and d represent the number of nodes. emb The spatiotemporal feature representation of a node is shown in the dimension. The anomaly detector uses a fully connected neural network, and the formula for the anomaly score of the edge between nodes i and j is as follows:

[0079]

[0080] Here, mlp(·) represents a two-layer fully connected neural network, and score(i,j) represents the anomaly score of the edge between nodes i and j. It is the final feature representation of nodes i and j used for anomaly edge detection.

[0081] Step S6: Based on the edge anomaly scores obtained in S5, calculate the loss function and minimize the loss to train the model. Since the label values ​​are only 0 and 1, the cross-entropy loss function is used, and its formula is shown below:

[0082]

[0083] Where N represents the sum of negative and positive sampled edges, and y represents the current index of the traversed edge sum. Represents the loss function. and Let represent the anomaly scores of the positive and negative sample edges between nodes i and j, respectively.

[0084] Based on the four real-world network datasets in Table 1, a dynamic graph anomaly detection method based on graph embedding and diffusion sampling is used.

[0085] Table 1 Four Real-World Network Datasets

[0086] Dataset Number of nodes Number of sides average degree UCIMessages 1899 13838 14.57 Email-DNC 1866 39264 42.08 Bitcoin-Alpha 3777 24173 12.80 Bitcoin-OTC 5881 35588 12.10

[0087] This invention selected different autoencoder models and graph neural network models to compare results based on different types of datasets. The selected models were AddGraph, StrGNN, TADDY, and RegraphGAN. The experimental results of this invention and other models are shown in Table 2, where the best values ​​are indicated in bold. AUC (Area Under Curve) was used as the evaluation metric. Compared to previous deep learning methods, the proposed method performs well, especially on the UCI Messages dataset, where it excels. Only in the 10% anomaly case on Bitcoin-OTC does it perform second only to RegraphGAN.

[0088] According to the AUC performance comparison in Table 2, the present invention exhibits an average performance gap of 2.2% compared to the best baseline. It can be seen that the method of the present invention is superior to previous methods in all aspects.

[0089] Table 2 Comparison of this invention with other deep learning anomaly detection models

[0090]

[0091] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0092] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A dynamic graph anomaly detection method based on graph embedding and diffusion sampling, characterized in that, Includes the following steps: Step S1: Obtain the dynamic graph dataset, and divide the edge indices at all times into an adjacency matrix set {A0…A1} by time. t }, randomly initialize the feature of each node to X; where, Let represent the adjacency matrix at time t. Let n represent the set of real numbers, and n represent the number of nodes. Step S2: Within the time window, generate an adjacency matrix based on the edge index of each timestamp, and calculate all diffusion matrices within the window time t. Step S3: Based on the diffusion matrix S obtained in step S2 at time t t For the diffusion matrix S t For each row, select the k most influential nodes to obtain the node set of the subgraph at time t. Let n represent the set of real numbers, and n represent the number of nodes. Step S4: Represent the sub-graph window obtained in S3. The input is fed into the node spatiotemporal information fusion module to obtain the node feature representation at each time step. The spatiotemporal information fusion module includes a feature extraction module and a time information extraction module; Step S5: Negatively sample outlier edges, combining outlier edges, normal edges, and the node feature representations obtained in S4 for each time step, which are then used for outlier edge detection. The anomaly scores of all edges are obtained by feeding them into the anomaly detector. Step S6: Based on the edge anomaly scores obtained in S5, calculate the loss function and minimize the loss to train the model; In step S3, the node set of all node subgraphs at time t. The formula is shown below: in, S represents the set of nodes in the subgraph at time t. t S represents the diffusion matrix at time t, and topk(·) represents the diffusion matrix S. t For each row, select the k nodes with the greatest influence; After calculating the subgraph nodes corresponding to all window times, the obtained subgraph windows are represented as follows: Where t represents the current time and w represents the size of the time window. Let v represent the set of nodes in the subgraph at time t, and v represent the time within the time window. In step S5, the node feature representation of abnormal edge detection in, Let n represent the set of real numbers, and d represent the number of nodes. emb The spatiotemporal feature representation dimension of a node is shown below. The anomaly detector uses a fully connected neural network, and the formula for the anomaly score of the edge between nodes i and j is as follows: Here, mlp(·) represents a two-layer fully connected neural network, and score(i,j) represents the anomaly score of the edge between nodes i and j. It is the final feature representation of nodes i and j used for anomaly edge detection.

2. The dynamic graph anomaly detection method based on graph embedding and diffusion sampling according to claim 1, characterized in that, In step S2, the original graph is used for diffusion operations to quantify the importance of nodes and the relationships between them. The k nodes with the greatest influence on the target node are obtained through the diffusion matrix. For a given adjacency matrix of a static graph... in, Let n represent the set of real numbers and n represent the number of nodes; the graph diffusion matrix is ​​defined as: Where S represents the graph diffusion matrix, T m Let θ represent the m-th power of the generalized transition matrix T. m Represents the weighting coefficients that determine the proportion of global to local information; Let n represent the set of real numbers, and n represent the number of nodes.

3. The dynamic graph anomaly detection method based on graph embedding and diffusion sampling according to claim 1, characterized in that, In step S4, the feature extraction module uses a two-layer GCN model to obtain the node features for each timestamp, and randomly initializes the node features. The initial feature is represented by X, and its formula is as follows: in, Let W represent the sum of the adjacency matrix and the identity matrix, and let W represent the trainable weight matrix. express The angle matrix, Z (0) W represents the eigenvalues ​​after passing through one layer of GCN. (0) Z represents the trainable weight parameters of the first layer of the GCN. (1) This indicates that the eigenvalues ​​W after two layers of GCN are... (1) This represents the trainable weight parameters of the second-layer GCN, and Relu(·) represents the Relu activation function; GCN is used to obtain node features at each time step. and under the time window in, Let n represent the set of real numbers, and d represent the number of nodes. str This represents the dimension after extracting structural information. This represents the structural features of a node at time v within a time window. Let v represent the set of node structure features of the graph with a time window of size w at time t, where v ranges from [tw, t].

4. The dynamic graph anomaly detection method based on graph embedding and diffusion sampling according to claim 1, characterized in that, In step S4, the time information extraction module includes a GRU module and a self-attention mechanism module. First, the time information is extracted by the GRU module, and the formula is as follows: h t =(1-z t )⊙h t-1 +z t ⊙h′ t (9) Where ⊙ represents element-wise multiplication, W Z U z b z W r U r b r W h U h b h W are the trainable parameters in a GRU unit. Z U represents the weight matrix of the updated gate. z This represents the recursive weight matrix of the update gate, used for the hidden state at the current time step, b. z W represents the bias vector of the update gate. r U represents the weight matrix of the reset gate. r The recursive weight matrix for the reset gate is used to represent the hidden state at the current time step, b. r W represents the bias vector of the reset gate. h The weight matrix U represents the candidate hidden state. h The recursive weight matrix representing the candidate hidden state, used for the hidden state at the current time step, b h The bias vector represents the candidate hidden state. This indicates the node structure feature representation at time t that has passed through two layers of GCN, h t-1 Z represents the state at time t-1. t Indicates the update gate, r t This indicates resetting the door, h′ t h represents the candidate hidden state. t From its previous state h t-1 The calculation is derived from the state passed to time t, where σ(·) represents the sigmoid activation function and tanh(·) represents the tanh function. The GRU network takes the features of each timestamp as input and inputs the output of the current timestamp into the next timestamp.

5. The dynamic graph anomaly detection method based on graph embedding and diffusion sampling according to claim 4, characterized in that, In step S4, after extracting time information through the GRU module, an adaptive self-attention mechanism module is added to obtain the time information. Obtain the final node embedding representation. Among them, h v H represents the spatiotemporal characteristics of a node at time v within a time window. t Let v represent the node features within a time window of size w at time t, where the range of v is [tw, t]. The formula is shown below: Among them, W Q W K W V Denotes the trainable parameters, d emb The spatiotemporal feature dimension of a node is represented by Q, K, and V, which represent the three matrices of the attention mechanism used to calculate the similarity between vectors; softmax(·) represents the softmax function, and Pooling(·) represents the average pooling operation. H represents the structural features of a node at time t. t K represents the node characteristics at time t within the time window. T Representing the transpose of K, we finally obtain This represents the final node feature representation. Let n represent the set of real numbers, and d represent the number of nodes. emb The spatiotemporal characteristics of a node are represented by its dimension.

6. The dynamic graph anomaly detection method based on graph embedding and diffusion sampling according to claim 1, characterized in that, In step S6, the loss function used is the cross-entropy loss function, the formula of which is shown below: Where N represents the sum of negative and positive sampled edges, and y represents the current index of the traversed edge sum. Represents the loss function. and Let represent the anomaly scores of positive and negative sample edges between nodes i and j, respectively.

7. A dynamic graph anomaly detection method based on graph embedding and diffusion sampling according to claim 1 or 2, characterized in that, In step S2, the method for calculating the diffusion matrix is ​​modified according to the Laplace operator, and the diffusion matrix S at time t is... t The formula is shown below: Among them, S t Let D denote the diffusion matrix at time t, D denote the angle matrix, α∈(0,1), α denote the propagation probability, A denote the adjacency matrix of the graph, and I denote the propagation matrix at time t. n Represents an identity matrix with n nodes; in, Let n represent the set of real numbers, and n represent the number of nodes.

Images