A graph anomaly detection method based on multi-view graph embedding and node prototype comparison

Abstract

A graph anomaly detection method based on multi-perspective graph embedding and node prototype comparison includes the following steps: S1 graph anomaly detection dataset collection and preprocessing, dataset label construction; S2 graph anomaly detection model construction based on multi-perspective graph embedding and node prototype comparison; S3 iterative optimization of the model using a training set; S4 repeatedly executing S2 and S3 until the total loss value tends to be stable; completing the training of the graph anomaly detection model; S5 predicting the abnormal probability of the node on the test set, if the probability exceeds a specified threshold, it is regarded as an abnormal node. The invention constructs a multi-perspective adjacency matrix through the KNN algorithm, fuses the node attribute similarity with the original adjacency relationship, generates an enhanced adjacency matrix reflecting attribute similarity, and provides richer input for the graph neural network. The present invention significantly improves the distinction between normal nodes and abnormal nodes through the learning of multi-perspective graph embedding and the node prototype comparison strategy, and effectively improves the performance of graph anomaly detection.

Description

Technical Field

[0001] The present invention belongs to the field of graph anomaly detection (GAD), and in particular relates to a graph anomaly detection method based on multi-view graph embedding and node prototype comparison. Background Art

[0002] Graphs are complex data structures composed of nodes and edges. Nodes represent entities, and edges describe the relationships between entities. They are effective in modeling various complex systems in the real world. Graph anomaly detection aims to identify nodes, edges, or subgraphs in graph data that deviate significantly from normal patterns, such as fraudulent transaction nodes in financial networks and anomalous accounts on social platforms. The core challenge lies in integrating node topology with attribute feature information, while also addressing the sparsity and disguised nature of anomaly samples and the complexity of data scale.

[0003] Among existing graph anomaly detection technologies, traditional methods, such as those based on statistics, density, or clustering, rely on artificial features or global distribution assumptions, making it difficult to capture nonlinear relationships and localized anomalous patterns in graph data. With the development of graph neural networks (GNNs), GNN-based methods have significantly improved detection performance by aggregating neighborhood information through message passing mechanisms and learning high-dimensional representations of graph data. However, traditional GNN methods are generally limited by the "homogeneity assumption"—that is, the assumption that adjacent nodes have similar features or labels. The low-frequency filtering characteristics of GNNs can smooth out key differences between anomalous and normal nodes, resulting in insufficient detection capabilities for anomalies disguised as mimicking normal node structures or features.

[0004] Therefore, it is necessary to propose a new graph anomaly detection method to identify the noise patterns of abnormal nodes and edges in graph data, design a GNN architecture with heterogeneity awareness, and learn discriminative node representations to solve the technical problems existing in existing graph anomaly detection methods. Summary of the Invention

[0005] To address the problem that traditional graph neural networks are difficult to effectively distinguish normal nodes from abnormal nodes based on the homogeneity assumption, this paper proposes an attribute graph abnormal node detection method based on multi-perspective graph embedding and node prototype comparison.

[0006] First, a graph anomaly detection method based on multi-view graph embedding and node prototype comparison is provided, comprising the following steps:

[0007] S1. Graph anomaly detection dataset collection and preprocessing, dataset label construction;

[0008] S2. Construction of graph anomaly detection model based on multi-view graph embedding and node prototype comparison;

[0009] S3. Use the training set to iteratively optimize the model

[0010] S4. Repeat S2 and S3 until the total loss value stabilizes; the training of the graph anomaly detection model is completed.

[0011] S5. Predict the abnormal probability of the node on the test set. If the probability exceeds the specified threshold, it is considered an abnormal node.

[0012] Preferably, S1 includes:

[0013] S1.1. Data acquisition and cleaning: For the original data set containing node adjacency relationships and attribute features, remove noise data (such as isolated nodes), retain valid nodes, and obtain the adjacency matrix and attribute feature matrix .

[0014] S1.2, Abnormal label injection, for datasets with abnormal labels, directly use the existing labels. For datasets without abnormal labels, generate artificial abnormal nodes by injecting structural abnormalities (such as fully connected subgraphs) and attribute abnormalities (such as replacing feature vectors with high Euclidean distance vectors). Finally, construct the adjacency matrix , node features and exception labels Graph data.

[0015] Preferably, S2 includes:

[0016] S2.1. KNN-enhanced adjacency matrix generation.

[0017] The KNN algorithm is used to calculate the attribute similarity between nodes and select each node The enhanced adjacency matrix is ​​constructed by using the most similar neighbors.

[0018] S2.2. Feature extraction based on BWGNN model.

[0019] The adjacency matrix and attribute feature matrix of the original graph and enhanced graph are input into the customized spectral filter BWGNN model to obtain node representation.

[0020] S2.3. Node representation fusion based on attention mechanism.

[0021] The node representations of the original graph and the enhanced graph are fused through the weighted attention mechanism.

[0022] S2.4. Prototype contrastive learning of node representations.

[0023] The average value of all normal and abnormal node embeddings is calculated as the prototype of normal nodes and abnormal nodes, and the distance between the node embedding of a certain category and the corresponding prototype is minimized.

[0024] S2.5. Abnormal node detection.

[0025] The node representation is input into the classifier to predict the abnormal probability of the node and realize abnormal node detection.

[0026] Preferably, S3 is specifically:

[0027] By jointly optimizing the node classification loss Compared with the prototype loss Update model parameters,

[0028] The total loss function is:

[0029]

[0030] in is the loss weight parameter, and the parameters of the BWGNN model and attention module are adjusted through back propagation.

[0031] In a second aspect, a graph anomaly detection system based on multi-view graph embedding and node prototype comparison is provided, which is used to execute the method described in the first aspect, including:

[0032] The data processing module is used for graph anomaly detection dataset collection and preprocessing, and abnormal node injection.

[0033] The model building module builds a graph anomaly detection model based on multi-view graph embedding and node prototype comparison, including KNN-enhanced adjacency matrix generation, feature extraction based on the BWGNN model, node representation fusion based on the attention mechanism, prototype comparison learning of node representation, and abnormal node detection;

[0034] The calculation optimization module is used to update the model parameters according to the node classification loss and the prototype contrast loss.

[0035] The inference prediction module is used to predict the abnormal probability of a node.

[0036] According to a third aspect, a computer storage medium is provided, wherein a computer program is stored in the computer storage medium; when the computer program is executed on a computer, the computer executes the method according to the first aspect.

[0037] In a fourth aspect, an electronic device is provided, including:

[0038] Memory, used to store computer programs;

[0039] A processor is configured to execute the computer program to implement the method according to the first aspect.

[0040] The advantages and beneficial effects of the present invention are as follows:

[0041] 1. Multi-dimensional information fusion enhances anomaly characterization. Traditional GNNs rely on homogeneity assumptions, making it difficult to capture the disguised behavior of abnormal nodes. This paper constructs a multi-perspective adjacency matrix using the KNN algorithm, integrating node attribute similarity with the original adjacency relationships to generate an enhanced adjacency matrix reflecting attribute similarity, providing richer input for graph neural networks.

[0042] 2. Prototype contrast learning improves heterogeneity discrimination. To address the problem of abnormal node noise interfering with model training, this paper introduces a prototype contrast mechanism for normal and abnormal node representations. By explicitly modeling the feature centers of the two types of nodes, the embedding of normal nodes is forced to be close to the normal prototype, and abnormal nodes to be close to the abnormal prototype, reducing the misleading information caused by abnormal node disguise. Through multi-perspective graph embedding learning and node prototype contrast strategies, this paper significantly improves the distinction between normal and abnormal nodes, effectively improving graph anomaly detection performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A flowchart of a graph anomaly detection method based on multi-view graph embedding and node prototype comparison is provided in an embodiment of the present invention.

[0044] Figure 2 This is an architectural diagram of a graph anomaly detection method based on multi-view graph embedding and node prototype comparison provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0045] The present invention will be further described below with reference to specific embodiments and accompanying drawings.

[0046] To address the difficulty of traditional graph neural networks in effectively distinguishing normal from abnormal nodes based on the assumption of homogeneity, this paper proposes an innovative heterogeneity-aware mechanism. Leveraging the KNN algorithm, this paper constructs an enhanced adjacency matrix, providing structural information from the perspective of node attribute similarity, enabling precise extraction of node features. Furthermore, by introducing a comparative learning module for prototype representations of normal and abnormal nodes, the model's ability to capture heterogeneous relationships between nodes is enhanced.

[0047] Taking the public graph anomaly detection datasets Yelp, Amazon, and Pubmed as examples, the process of the present invention is specifically explained.

[0048] The Yelp dataset contains user review data on different businesses such as hotels and restaurants. It consists of approximately 160,000 businesses and 8.63 million reviews from eight metropolitan areas. Vertices represent reviews, and edges represent the relationship between reviews (such as the same user posting or the same product posting with the same rating or month). Spam reviews are considered abnormal vertices.

[0049] The Amazon dataset is a user review network under the Amazon music equipment category. The vertices are users, and the edges are the relationships between users (such as reviewing the same product or having the same star rating in the same week). Users who write fake reviews are considered abnormal vertices.

[0050] The Pubmed dataset consists of a biomedical citation network with scientific publications as vertices and citation relationships as edges. This dataset is used for node classification tasks. In the experiment, the category with the fewest publications is considered an outlier. The details of the dataset are shown in Table 1:

[0051] Table 1: Dataset details

[0052] Dataset Number of nodes Number of sides Abnormal node ratio Yelp 45954 8097302 14.5% Amazon 11944 9557648 6.9% Pubmed 19717 88651 20.8%

[0053] A graph anomaly detection method based on multi-view graph embedding and node prototype comparison includes the following steps:

[0054] S1. Graph anomaly detection dataset collection and preprocessing, dataset label construction.

[0055] S1.1. Data acquisition and cleaning: For the original data set containing node adjacency relationships and attribute features, remove noise data (such as isolated nodes), retain valid nodes, and obtain the adjacency matrix and attribute feature matrix .

[0056] S1.2, Abnormal label injection, for datasets with abnormal labels, directly use the existing labels. For datasets without abnormal labels, generate artificial abnormal nodes by injecting structural abnormalities (such as fully connected subgraphs) and attribute abnormalities (such as replacing feature vectors with high Euclidean distance vectors). Finally, construct the adjacency matrix , node features and exception labels Graph data.

[0057] S2. Construction of graph anomaly detection model based on multi-view graph embedding and node prototype comparison.

[0058] S2.1, KNN enhanced adjacency matrix generation. Original adjacency matrix Directly reflects the real connection relationship of nodes in the graph and captures the original structural information. KNN enhanced adjacency matrix The KNN algorithm is used to calculate the attribute similarity between nodes and select each node The most similar neighbors construct an enhanced adjacency matrix, the formula is: This matrix strengthens the connection between nodes with similar attributes and is used to capture feature homogeneity patterns.

[0059] S2.2. Feature extraction based on the BWGNN model. BWGNN refers to the Beta Wavelet Graph Neural Network. BWGNN uses multiple layers of graph convolution layers and uses wavelet kernels in parallel. , and then aggregate the corresponding filtering results. The propagation process of BWGNN is:

[0060]

[0061]

[0062] in, represents a multilayer perceptron, Represents an aggregate function, Corresponding to beta wavelet, the node embedding representation is obtained after aggregation , Indicates the The node representation calculated by beta wavelet is, .

[0063] The adjacency matrix of the original graph Feature Matrix and KNN enhanced adjacency matrix , feature matrix Input BWGNN respectively, extract multimodal node representation, and obtain original graph features respectively and KNN graph features .

[0064] S2.3. Node representation fusion based on attention mechanism. The node representations of the two modalities are fused through the weighted attention mechanism. The formula is:

[0065] .

[0066] in, It is an adaptive weight that dynamically balances the contribution of original structure and attribute similarity.

[0067] S2.4. Prototype contrast learning of node representation. Define normal node prototype and abnormal node prototype , calculate the mean of all normal and abnormal node embeddings:

[0068]

[0069]

[0070] By minimizing the node embedding and the corresponding prototype distance, strengthens the clustering of normal and abnormal patterns, and the loss function is:

[0071]

[0072] S2.5, abnormal node detection. The node is represented by Input the Feedforward Neural Network (FFN) for classification and output the abnormality probability .

[0073] Let the parameters of the feedforward neural network be the weight matrix and the bias vector ( represents the number of network layers), then for the node Representation , the abnormal probability calculation process is:

[0074]

[0075]

[0076] in is an activation function (such as ReLU), used to introduce nonlinearity; Map the output to interval, get the abnormal probability ( The closer it is to 1, the more likely the node is an anomaly).

[0077] The classification loss uses the cross entropy function:

[0078]

[0079] S3. Use the training set to iteratively optimize the model, and finally optimize the node classification loss by joint optimization. Compared with the prototype loss Update the model parameters, the total loss function is:

[0080]

[0081] in is the loss weight parameter, and the parameters of the BWGNN model and attention module are adjusted through back propagation.

[0082] S4. Repeat S2 and S3 until the total loss value stabilizes; the training of the graph anomaly detection model is completed.

[0083] S5. Predict the abnormal probability of the node on the test set. If the probability exceeds the specified threshold, it is considered an abnormal node.

[0084] The embodiment of the present invention further provides a graph anomaly detection system based on multi-view graph embedding and node prototype comparison, including the following modules:

[0085] The data processing module is used for graph anomaly detection dataset collection and preprocessing, and abnormal node injection.

[0086] The model building module builds a graph anomaly detection model based on multi-view graph embedding and node prototype comparison, including KNN-enhanced adjacency matrix generation, feature extraction based on the BWGNN model, node representation fusion based on the attention mechanism, prototype comparison learning of node representation, and abnormal node detection;

[0087] The calculation optimization module is used to update the model parameters according to the node classification loss and the prototype contrast loss.

[0088] The inference prediction module is used to predict the abnormal probability of a node.

[0089] An embodiment of the present invention also provides a graph anomaly detection device based on multi-perspective graph embedding and node prototype comparison, comprising: a memory for storing a computer program; a processor for executing the computer program to implement a graph anomaly detection method based on multi-perspective graph embedding and node prototype comparison as described in the above scheme.

[0090] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A graph anomaly detection method based on multi-view graph embedding and node prototype comparison, characterized by: The steps include: S1. Graph anomaly detection dataset collection and preprocessing, dataset label construction; S2. Construction of graph anomaly detection model based on multi-view graph embedding and node prototype comparison; S2.

1. KNN-enhanced adjacency matrix generation The KNN algorithm is used to calculate the attribute similarity between nodes and select each node The most similar neighbors are used to build an enhanced adjacency matrix; S2.2 Feature extraction based on BWGNN model The adjacency matrix and attribute feature matrix of the original graph and the enhanced graph are input into the customized spectral filter BWGNN model to obtain node representation; S2.

3. Node Representation Fusion Based on Attention Mechanism The node representations of the original graph and the enhanced graph are fused through the weighted attention mechanism; S2.

4. Prototype Contrastive Learning of Node Representations Calculate the average value of all normal and abnormal node embeddings as the prototypes of normal nodes and abnormal nodes, and minimize the distance between the node embedding of a certain category and the corresponding prototype; S2.

5. Abnormal Node Detection Input the node representation into the classifier to predict the abnormal probability of the node and realize abnormal node detection; S3. Use the training set to iteratively optimize the model; S4. Repeat S2 and S3 until the total loss value stabilizes; the training of the graph anomaly detection model is completed; S5. Predict the abnormal probability of the node on the test set. If the probability exceeds the specified threshold, it is considered an abnormal node.

2. The graph anomaly detection method based on multi-view graph embedding and node prototype comparison according to claim 1, characterized in that: S1 includes: S1.

1. Data acquisition and cleaning: For the original data set containing node adjacency relationships and attribute features, remove noise data, retain valid nodes, and obtain the adjacency matrix and attribute feature matrix ; S1.2, Abnormal label injection, for datasets with abnormal labels, directly use the existing labels; For data sets without abnormal labels, artificial abnormal nodes are generated by injecting structural anomalies and attribute anomalies; finally, an adjacency matrix is ​​constructed. , node features and exception labels Graph data.

3. A graph anomaly detection system based on multi-view graph embedding and node prototype comparison, characterized by: Used to perform the method according to any one of claims 1 to 2, characterized in that the detection system comprises: Data processing module, used for graph anomaly detection dataset collection and preprocessing, and abnormal node injection; The model building module is used to build a graph anomaly detection model based on multi-view graph embedding and node prototype comparison. It includes KNN-enhanced adjacency matrix generation, feature extraction based on the BWGNN model, node representation fusion based on the attention mechanism, prototype comparison learning of node representation, and abnormal node detection. Computational optimization module, used to update model parameters based on node classification loss and prototype contrast loss; The inference prediction module is used to predict the abnormal probability of a node.

4. A computer storage medium, characterized in that The computer storage medium stores a computer program; when the computer program is run on a computer, the computer executes the method according to any one of claims 1 to 2.

5. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the method according to any one of claims 1 to 2.

Images