A graph data anomaly detection method based on hypergraph contrastive learning

Abstract

The present invention relates to a graph data anomaly detection method based on hypergraph contrastive learning, belonging to the field of graph data anomaly detection. The method comprises: calculating the node Jaccard similarity of an original graph and constructing hyperedges based on the node Jaccard similarity to obtain a hypergraph; generating positive and negative samples required for contrastive learning based on the hyperedge homogeneity of the hypergraph, performing contrastive learning training, and obtaining a contrastive learning training model; obtaining node and hyperedge representations based on the contrastive learning training model, reconstructing the node attributes and hypergraph structure in two sets of enhanced views, and combining the reconstruction errors in multiple views to perform anomaly detection. The present invention enhances the model's ability to capture abnormal patterns and improves the robustness of anomaly detection.

Description

Technical Field

[0001] The present invention belongs to the field of graph data anomaly detection, and specifically relates to a graph data anomaly detection method based on hypergraph contrastive learning. Background Art

[0002] In the real world, many application scenarios can be represented by graph structures, such as social networks, financial transaction systems, and bioinformatics networks. However, graph data can contain abnormal nodes or edges, which can negatively impact system stability and the accuracy of data analysis. Therefore, anomaly detection, as a key technology, plays an important role in maintaining system security and data credibility.

[0003] Most existing graph anomaly detection methods are based on ordinary graphs, where edges represent only binary relationships between two nodes. However, in real applications, complex multi-dimensional relationships may exist between multiple nodes. Relying solely on binary relationships to model the graph structure can lead to loss of information about key anomaly patterns, thus compromising anomaly detection effectiveness. Therefore, introducing hypergraphs to model multi-dimensional relationships can more comprehensively represent the complex structure of data, thereby improving the accuracy of anomaly detection. Summary of the Invention

[0004] The purpose of the present invention is to make full use of existing graph data to generate a robust anomaly detection model, and to provide a graph data anomaly detection method based on hypergraph contrastive learning. First, the node Jaccard similarity of the original graph is calculated, and hyperedges are constructed based on the node Jaccard similarity; then, according to the homogeneity of the hyperedges, some hyperedges with low homogeneity are screened out, and masked to generate enhanced samples for contrastive learning training model; finally, anomaly detection is performed by combining attributes and topology reconstruction.

[0005] To achieve the above objectives, the technical solution of the present invention is: a graph data anomaly detection method based on hypergraph contrastive learning, comprising:

[0006] Calculate the node Jaccard similarity of the original graph, and construct hyperedges based on the node Jaccard similarity to obtain a hypergraph;

[0007] Based on the hypergraph, positive and negative samples required for contrastive learning are generated according to the homogeneity of hyperedges, and contrastive learning training is performed to obtain a contrastive learning training model;

[0008] Based on the contrastive learning training model, node and hyperedge representations are obtained, and the node attributes and hypergraph structures in the two sets of enhanced views are reconstructed separately. The reconstruction errors in multiple views are combined to perform anomaly detection.

[0009] Furthermore, the hypergraph construction process is as follows:

[0010] Traverse the original graph Each node , get the node The first-order neighbor set of , node set , E is the edge set, i=1,2,3,……,n, n is the total number of nodes, ;

[0011] For any pair of nodes ,in and , computing nodes and nodes The number of common neighbors, that is, the intersection of neighbor sets In order to measure the structural similarity between nodes, the Jaccard similarity coefficient is introduced for measurement:

[0012]

[0013] Representation node and nodes The Jaccard similarity value of is a node The set of first-order neighbors of ;

[0014] Set similarity threshold Filter, where , if the node similarity value Exceeding the threshold , then the corresponding node pairs are regarded as semantically consistent candidate relations and added to the same hyperedge Aggregate the node groups that meet the conditions and finally generate a hyperedge set: ,in, is the total number of hyperedges, and , each hyperedge Contains a set of similar nodes, which are similar in structure, and the resulting hypergraph Expressed as .

[0015] Furthermore, the function for determining whether a node pair is connected as a hyperedge is defined as follows:

[0016]

[0017] =1 means that the node pairs can be connected as hyperedges, =0 means that the node pair cannot be connected as a hyperedge.

[0018] Furthermore, based on the hypergraph, positive and negative samples required for contrastive learning are generated according to the homogeneity of hyperedges, and contrastive learning training is performed as follows:

[0019] (1) Design a node encoder, which is constructed as follows:

[0020]

[0021]

[0022] and Respectively expressed in Layer Hyperedge and nodes The embedding representation of , initially, , is a node The attribute feature vector of Represents a hyperedge homogeneity, Indicates that it contains nodes The set of all hyperedges, hyperedges with high homogeneity are given high weights, and hyperedges with low homogeneity are given low weights, It is a learnable parameter matrix used to adjust the embedding of nodes;

[0023] (2) Based on the homogeneity of hyperedges, Filter out the hyperedges with low homogeneity, get the low homogeneity hyperedge set, and randomly select a hyperedge from the low homogeneity hyperedge set , super edge Include nodes, for each node of the hyperedge , Represents a hyperedge Node set, when the probability is greater than the preset first probability value , then perform masking operation: randomly select hyperedge Another node ,if , using node The attribute feature vector of Replace Node The attribute feature vector of ,in ; Another probability mechanism is introduced, for each node in the selected node set , when the probability is greater than the preset second probability value , replace its attribute feature vector with an all-zero vector, where ; Then add the perturbation at the hyperedge level, by constructing a probability matrix , when the probability is greater than the preset third probability value , then the hyperedges are retained and two sets of hypergraph views with structural differences are obtained for comparative learning training. Indicates the The probability that a hyperedge is preserved during the perturbation process;

[0024] (3) Contrastive learning training:

[0025]

[0026]

[0027]

[0028] represents the cluster-level contrast loss, which aims to optimize the model by comparing the cluster membership probability of each node under different views; 、 represents the cluster-level loss of different views, represents the number of clusters, and The cluster projection matrix represents two views. The cluster-level contrast loss formula aims to make the probability distribution of nodes of the same class similar in different views, while making the probability distribution of nodes of different classes different in different views. represents the hyperedge-level loss, and the goal is to maximize the mutual information between hyperedge representations from different views, 、 represents the hyperedge-level loss of different views, and Represents the hyperedge projection matrix of the two views. For each hyperedge, and is a positive sample pair, and for different hyperedges, the hyperedge projection matrices of the two views are negative sample pairs; represents the final contrast loss, and is a hyperparameter that balances the cluster-level contrastive loss and the edge-level loss.

[0029] Furthermore, the masking operation formula is expressed as follows:

[0030] .

[0031] Furthermore, we perform graph reconstruction based on the node and hyperedge embeddings obtained through contrastive learning training, and use the reconstruction error to perform anomaly detection, as follows:

[0032] The goal of graph reconstruction is to minimize the reconstruction error of structure and attributes:

[0033]

[0034]

[0035] represents the attribute reconstruction loss, Indicates the sequence number of the enhanced view, represents the attribute matrix, represents the reconstructed attribute matrix, represents the structural reconstruction loss, represents the incidence matrix of the hypergraph, Represents the reconstructed association matrix; balancing the structural reconstruction loss and the attribute reconstruction loss yields the reconstruction loss:

[0036]

[0037] Is a balanced hyperparameter, and the anomaly score of each node is calculated by reconstruction error to measure the degree of abnormality of the node:

[0038]

[0039] Representation node The anomaly score, and Representation node The original structure vector and the reconstructed structure vector, and Representation node The original attribute feature vector and the reconstructed attribute feature vector.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] 1. This invention enhances the model's ability to capture abnormal patterns, introduces high-order semantic relationships by constructing a hypergraph structure, and improves the model's ability to identify abnormalities by combining contrastive learning.

[0042] 2. Improved the robustness of anomaly detection. By combining the structure and attribute reconstruction mechanism, the stability of the model under abnormal information fusion is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 Schematic diagram of the overall process of an embodiment of the present invention. DETAILED DESCRIPTION

[0044] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings.

[0045] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present application belongs.

[0046] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0047] The present invention provides a graph data anomaly detection method based on hypergraph contrastive learning, comprising:

[0048] Calculate the node Jaccard similarity of the original graph, and construct hyperedges based on the node Jaccard similarity to obtain a hypergraph;

[0049] Based on the hypergraph, positive and negative samples required for contrastive learning are generated according to the homogeneity of hyperedges, and contrastive learning training is performed to obtain a contrastive learning training model;

[0050] Based on the contrastive learning training model, node and hyperedge representations are obtained, and the node attributes and hypergraph structures in the two sets of enhanced views are reconstructed separately. The reconstruction errors in multiple views are combined to perform anomaly detection.

[0051] The following is a specific implementation process of the present invention.

[0052] like Figure 1 As shown, the present invention provides a graph data anomaly detection method based on hypergraph contrastive learning, comprising the following steps:

[0053] S1. Hypergraph construction: Hyperedges are constructed based on the Jaccard similarity of nodes in the original graph to obtain a hypergraph. The hypergraph construction process is as follows:

[0054] Traverse the original graph Each node , get the node The first-order neighbor set of , node set , E is the edge set, i=1,2,3,……,n, n is the total number of nodes, ;

[0055] For any pair of nodes ,in and , computing nodes and nodes The number of common neighbors, that is, the intersection of neighbor sets In order to measure the structural similarity between nodes, the Jaccard similarity coefficient is introduced for measurement:

[0056]

[0057] Representation node and nodes The Jaccard similarity value of is a node The set of first-order neighbors of ;

[0058] Set similarity threshold Filter, where , if the node similarity value Exceeding the threshold , then the corresponding node pairs are regarded as semantically consistent candidate relations and added to the same hyperedge ; The function that determines whether a node pair is connected as a hyperedge is as follows:

[0059]

[0060] =1 means that the node pairs can be connected as hyperedges, =0 means that the node pair cannot be connected as a hyperedge;

[0061] Repeat the above process, aggregate the node groups that meet the conditions, and finally generate the hyperedge set: ,in, is the total number of hyperedges, and , each hyperedge Contains a set of similar nodes, which are similar in structure, and the resulting hypergraph Expressed as .

[0062] S2. Hypergraph Enhancement: Generate positive and negative samples required for contrastive learning based on hyperedge homogeneity and perform contrastive learning training. The details are as follows:

[0063]

[0064]

[0065] and Respectively expressed in Layer Hyperedge and nodes The embedding representation of , initially, , is a node The attribute feature vector of Represents a hyperedge homogeneity, Indicates that it contains nodes The set of all hyperedges, hyperedges with high homogeneity are given high weights, and hyperedges with low homogeneity are given low weights, It is a learnable parameter matrix used to adjust the embedding of nodes;

[0066] (2) Based on the homogeneity of hyperedges, Filter out the hyperedges with low homogeneity, get the low homogeneity hyperedge set, and randomly select a hyperedge from the low homogeneity hyperedge set , super edge Include nodes, for each node of the hyperedge , Represents a hyperedge Node set, when the probability is greater than the preset first probability value , then perform masking operation: randomly select hyperedge Another node ,if , using node The attribute feature vector of Replace Node The attribute feature vector of ,in ; The masking operation formula is specifically expressed as follows:

[0067]

[0068] Another probabilistic mechanism is introduced. For each node in the selected node set , when the probability is greater than the preset second probability value , replace its attribute feature vector with an all-zero vector, where ; Then add the perturbation at the hyperedge level, by constructing a probability matrix , when the probability is greater than the preset third probability value , then the hyperedges are retained and two sets of hypergraph views with structural differences are obtained for comparative learning training. Indicates the The probability that a hyperedge is preserved during the perturbation process;

[0069] (3) Contrastive learning training:

[0070] Enhance the robustness of the model by comparing the pre-training calculation process:

[0071]

[0072]

[0073]

[0074] represents the cluster-level contrast loss, which aims to optimize the model by comparing the cluster membership probability of each node under different views; 、 represents the cluster-level loss of different views, represents the number of clusters, and The cluster projection matrix represents two views. The cluster-level contrast loss formula aims to make the probability distribution of nodes of the same class similar in different views, while making the probability distribution of nodes of different classes different in different views. represents the hyperedge-level loss, and the goal is to maximize the mutual information between hyperedge representations from different views, 、 represents the hyperedge-level loss of different views, and Represents the hyperedge projection matrix of the two views. For each hyperedge, and is a positive sample pair, and for different hyperedges, the hyperedge projection matrices of the two views are negative sample pairs; represents the final contrast loss, and is a hyperparameter that balances the cluster-level contrastive loss and the edge-level loss.

[0075] Finally, anomaly detection is performed through graph reconstruction error. The goal of graph reconstruction is to minimize the reconstruction error of structure and attributes:

[0076]

[0077]

[0078] represents the attribute reconstruction loss, Indicates the sequence number of the enhanced view, represents the attribute matrix, represents the reconstructed attribute matrix, represents the structural reconstruction loss, represents the incidence matrix of the hypergraph, Represents the reconstructed association matrix; balancing the structural reconstruction loss and the attribute reconstruction loss yields the reconstruction loss:

[0079]

[0080] Is a balanced hyperparameter, and the anomaly score of each node is calculated by reconstruction error to measure the degree of abnormality of the node:

[0081]

[0082] Representation node The anomaly score, and Representation node The original structure vector and the reconstructed structure vector, and Representation node The original attribute feature vector and the reconstructed attribute feature vector.

[0083] The above are preferred embodiments of the present invention. Any changes made according to the technical solution of the present invention, as long as the resulting functions and effects do not exceed the scope of the technical solution of the present invention, shall fall within the scope of protection of the present invention.

Claims

1. A graph data anomaly detection method based on hypergraph contrastive learning, characterized in that: include: Calculate the node Jaccard similarity of the original graph, and construct hyperedges based on the node Jaccard similarity to obtain a hypergraph; Based on the hypergraph, positive and negative samples required for contrastive learning are generated according to the homogeneity of hyperedges, and contrastive learning training is performed to obtain a contrastive learning training model; Based on the contrastive learning training model, node and hyperedge representations are obtained. The node attributes and hypergraph structure in the two sets of enhanced views are reconstructed separately, and the reconstruction errors in multiple views are combined to perform anomaly detection. The hypergraph construction process is as follows: Traverse the original graph Each node , get the node The first-order neighbor set of , node set , E is the edge set, i=1,2,3,……,n, n is the total number of nodes, ; For any pair of nodes ,in and , computing nodes and nodes The number of common neighbors, that is, the intersection of neighbor sets In order to measure the structural similarity between nodes, the Jaccard similarity coefficient is introduced for measurement: Representation node and nodes The Jaccard similarity value of is a node The set of first-order neighbors of ; Set similarity threshold Filter, where , if the node similarity value Exceeding the threshold , then the corresponding node pairs are regarded as semantically consistent candidate relations and added to the same hyperedge Aggregate the node groups that meet the conditions and finally generate a hyperedge set: ,in, is the total number of hyperedges, and , each hyperedge Contains a set of similar nodes, which are similar in structure, and the resulting hypergraph Expressed as .

2. The method for detecting anomalies in graph data based on hypergraph contrastive learning according to claim 1, characterized in that: The function that determines whether a node pair is connected as a hyperedge is as follows: =1 means that the node pairs can be connected as hyperedges, =0 means that the node pair cannot be connected as a hyperedge.

3. The method for graph data anomaly detection based on hypergraph contrastive learning according to claim 1, characterized in that: Based on the hypergraph, positive and negative samples required for contrastive learning are generated according to the homogeneity of hyperedges, and contrastive learning training is performed as follows: (1) Design a node encoder, which is constructed as follows: and Respectively expressed in Layer Hyperedge and nodes The embedding representation of , initially, , is a node The attribute feature vector of Represents a hyperedge homogeneity, Indicates that it contains nodes The set of all hyperedges, hyperedges with high homogeneity are given high weights, and hyperedges with low homogeneity are given low weights, It is a learnable parameter matrix used to adjust the embedding of nodes; (2) Based on the homogeneity of hyperedges, Filter out the hyperedges with low homogeneity, get the low homogeneity hyperedge set, and randomly select a hyperedge from the low homogeneity hyperedge set , super edge Include nodes, for each node of the hyperedge , Represents a hyperedge Node set, when the probability is greater than the preset first probability value , then perform masking operation: randomly select hyperedge Another node ,if , using node The attribute feature vector of Replace Node The attribute feature vector of ,in ; Another probability mechanism is introduced, for each node in the selected node set , when the probability is greater than the preset second probability value , replace its attribute feature vector with an all-zero vector, where ; Then add the perturbation at the hyperedge level, by constructing a probability matrix , when the probability is greater than the preset third probability value , then the hyperedges are retained and two sets of hypergraph views with structural differences are obtained for comparative learning training. Indicates the The probability that a hyperedge is preserved during the perturbation process; (3) Contrastive learning training: represents the cluster-level contrast loss, which aims to optimize the model by comparing the cluster membership probability of each node under different views; 、 represents the cluster-level loss of different views, represents the number of clusters, and The cluster projection matrix represents two views. The cluster-level contrast loss formula aims to make the probability distribution of nodes of the same class similar in different views, while making the probability distribution of nodes of different classes different in different views. represents the hyperedge-level loss, and the goal is to maximize the mutual information between hyperedge representations from different views, 、 represents the hyperedge-level loss of different views, and Represents the hyperedge projection matrix of the two views. For each hyperedge, and is a positive sample pair, and for different hyperedges, the hyperedge projection matrices of the two views are negative sample pairs; represents the final contrast loss, and is a hyperparameter that balances the cluster-level contrastive loss and the edge-level loss.

4. The method for detecting anomalies in graph data based on hypergraph contrastive learning according to claim 3, characterized in that: The masking operation formula is as follows: 。 5. The method for detecting anomalies in graph data based on hypergraph contrastive learning according to claim 1, characterized in that: We perform graph reconstruction based on node and hyperedge embeddings obtained through contrastive learning training, and use the reconstruction error to perform anomaly detection, as follows: The goal of graph reconstruction is to minimize the reconstruction error of structure and attributes: represents the attribute reconstruction loss, Indicates the sequence number of the enhanced view, represents the attribute matrix, represents the reconstructed attribute matrix, represents the structural reconstruction loss, represents the incidence matrix of the hypergraph, Represents the reconstructed association matrix; balancing the structural reconstruction loss and the attribute reconstruction loss yields the reconstruction loss: Is a balanced hyperparameter, and the anomaly score of each node is calculated by reconstruction error to measure the degree of abnormality of the node: Representation node The anomaly score, and Representation node The original structure vector and the reconstructed structure vector, and Representation node The original attribute feature vector and the reconstructed attribute feature vector.

Images