Abnormal node detection method and system based on multi-view network

Abstract

The invention discloses an abnormal node detection method and system based on a multi-view network, and the method comprises the steps: converting a heterogeneous attribute network into a multi-layer view network through multi-view modeling, applying a part of weight sharing encoder to each layer of view network, and extracting the potential representation of each layer of nodes; based on an attention mechanism, learning a fusion weight of each layer of potential characterization to obtain a fused potential characterization; structure and node attributes in each layer of network are reconstructed, a pre-trained model is adopted, cross entropy is used to measure a reconstruction error of potential characterization of each layer, and a mean square error is used to measure the reconstruction error; and adopting a pre-trained model to calculate the variance of the potential characterization of the node to be detected in each layer of the multi-layer view network as the behavior anomaly score of the node, thereby realizing the detection and identification of the abnormal user node. According to the method, multi-view information can be dynamically fused, a cross-view abnormal mode is mined, and a detection framework with high robustness is provided, so that abnormal user node detection challenges in a complex network are dealt with.

Description

Technical Field

[0001] The present invention relates to the field of data mining, and in particular to a method and system for detecting abnormal nodes based on a multi-view network. Background Art

[0002] In modern networked systems (such as social networks, financial transaction networks, and the Internet of Things), anomalous nodes typically refer to entities whose behavior patterns or attributes significantly deviate from normal ranges. Examples include fake accounts in social networks, malicious endpoints in communication networks, and pathogenic genes in biological networks. These anomalous nodes can lead to network degradation, the spread of security vulnerabilities, and even systemic risks. Therefore, efficient and accurate detection of anomalous nodes is crucial for network security, fraud prevention, and system operations.

[0003] Traditional anomaly detection relies on manual rules or statistical analysis, but these methods struggle to meet real-time and generalization requirements in large-scale, high-dimensional, and dynamically evolving complex networks. With the advancement of machine learning, data-driven anomaly detection algorithms are becoming mainstream, but their performance is highly dependent on the representation capabilities and modeling methods of network data.

[0004] Currently, abnormal node detection methods can be divided into the following two categories:

[0005] The first type of method is based on single-view networks. This type of method only uses a single data view (such as topological structure or node attributes) for detection, mainly including: 1) Structural feature method: identifying anomalies (such as malicious nodes with sudden degree changes) through topological indicators such as node degree, clustering coefficient, and Betweenness; 2) Attribute analysis method: making judgments based on statistical deviations of node attributes (such as user registration information and behavior logs) (such as outlier detection algorithms LOF and One-Class SVM); 3) Embedding learning method: using graph embedding technology (such as DeepWalk and Node2Vec) to map nodes into low-dimensional vectors, and then detecting anomalies through clustering or classification models.

[0006] The second type of method is based on multi-view networks. This type of method attempts to integrate multi-source data, such as topological structure + node attributes + temporal behavior to improve detection effects. It mainly includes: 1) view splicing and fusion: directly splicing multi-view features and inputting them into traditional machine learning models; 2) collaborative training method: optimizing the model through consistency constraints between multiple views (such as co-training); 3) graph neural network (GNN) method: using multi-view GNN (such as RGCN, HAN) to aggregate heterogeneous information and generate node representations.

[0007] Although the above methods have made some progress, the following key issues still exist. For single-view methods, relying solely on a single view data makes it difficult to capture the multi-dimensional associations of nodes in complex networks, resulting in a high missed detection rate. For example, fraudulent users with normal topology may be exposed through attribute views. For multi-view methods, existing multi-view fusion strategies are mostly static weight allocations that cannot adapt to dynamic networks and ignore high-order interactions between views, resulting in limited discrimination capabilities. In addition, existing methods are sensitive to data sparsity, noise, and adversarial attacks, and lack explainable analysis of the causes of anomalies. Therefore, there is an urgent need for a detection framework that can dynamically fuse multi-view information, mine cross-view anomaly patterns, and has strong robustness to meet the challenges of abnormal node detection in complex networks. Summary of the Invention

[0008] In order to solve the above problems, the present invention proposes a method and system for abnormal node detection based on a multi-view network.

[0009] In a first aspect, an embodiment of the present application provides a method for detecting abnormal nodes based on a multi-view network, the method comprising:

[0010] Latent representation extraction step: Convert a heterogeneous attribute network into a multi-layer view network through multi-view modeling, apply a partially weighted shared encoder to each layer of the view network, and extract the node latent representation of each layer;

[0011] Information fusion step: Based on the attention mechanism, the fusion weights of the potential representations of each layer are learned to obtain the fused potential representation;

[0012] Model training steps: Reconstruct the structure and node attributes of each layer of the network based on the fused latent representation of each layer. Use a pre-trained model, measure the reconstruction error of the latent representation of each layer using cross entropy, and measure the reconstruction error using mean squared error. The model includes an encoder and a decoder.

[0013] Abnormal node acquisition steps: Using a pre-trained model, the variance of the potential representation of the node to be detected in each layer of the multi-layer view network is calculated as the node's behavioral anomaly score. The weighted combination of the structure reconstruction loss and the attribute reconstruction loss is used as the final anomaly score to achieve detection and identification of abnormal nodes.

[0014] In a specific embodiment of the present invention, the above-mentioned potential representation extraction step includes:

[0015] Initialize a multi-layer view network and convert the heterogeneous attribute network of multi-view modeling into a multi-layer view network;

[0016] Multiple independent encoders are used to extract multi-layer latent representations. For the k-th layer network, the structure and attribute information of the multi-layer view network is input into the encoder, and the output node is the latent representation learned from the k-layer network; the encoder is a GCN encoder, and the parameters of the GCN encoder are set to partial weight sharing.

[0017] In a specific embodiment of the present invention, the above-mentioned model training step includes:

[0018] For each layer of the network, the structure matrix is reconstructed by the encoder based on the potential representation learned by the encoder;

[0019] Cross entropy is used to measure the reconstruction effect. For the k-th layer network, the decoder is used to reconstruct the adjacency matrix and calculate the reconstruction error; the decoder is the GCN decoder;

[0020] The total structural reconstruction error of the multi-layer network is obtained by weighting the fusion coefficients obtained by the attention mechanism. The decoder is used to reconstruct the node attributes. The fused potential representation and the original adjacency matrix of the network are input into the decoder to reconstruct the node attributes.

[0021] The error of node attributes is reconstructed using mean square error, and the overall loss is the weighted sum of the structure reconstruction error and the attribute reconstruction error;

[0022] By minimizing the loss function of structure reconstruction loss and attribute reconstruction loss, it gradually approaches the original multi-view attribute network.

[0023] In a specific embodiment of the present invention, the abnormal node acquisition step includes:

[0024] For the node to be detected, the behavior consistency score of the deviation between the node to be detected in the k-th layer view and the overall behavior is calculated. The larger the behavior consistency score, the greater the variance of the behavior representation of the node to be detected in each view, the more inconsistent the behavior pattern is, and the higher the abnormality;

[0025] The weighted average of the behavior consistency score and the reconstruction anomaly score is used as the overall anomaly score; nodes with high sorting priority are selected as abnormal nodes according to the preset threshold.

[0026] In a second aspect, an embodiment of the present invention provides a multi-view network-based abnormal node detection system, which adopts the above-mentioned multi-view network-based abnormal node detection method. The system includes:

[0027] Latent Representation Extraction Module: This module transforms a heterogeneous attribute network into a multi-layer view network through multi-view modeling. A partially weight-sharing encoder is applied to each layer of the view network to extract the latent representation of nodes in each layer.

[0028] Information fusion module: Based on the attention mechanism, it learns the fusion weights of the potential representations of each layer to obtain the fused potential representation;

[0029] Model training module: Reconstructs the structure and node attributes of each layer of the network based on the fused latent representation of each layer. Using a pre-trained model, the reconstruction error of the latent representation of each layer is measured using cross entropy and mean square error. The model includes an encoder and a decoder.

[0030] Abnormal node acquisition module: Using a pre-trained model, the variance of the potential representation of the node to be detected in each layer of the multi-layer view network is calculated as the node's behavioral anomaly score. The weighted sum of the joint structure reconstruction loss and attribute reconstruction loss is used as the final anomaly score to achieve detection and identification of abnormal nodes.

[0031] In a specific embodiment of the present invention, the steps executed by the potential representation extraction module include:

[0032] Initialize a multi-layer view network and convert the heterogeneous attribute network of multi-view modeling into a multi-layer view network;

[0033] Multiple independent encoders are used to extract multi-layer latent representations. For the k-th layer network, the structure and attribute information of the multi-layer view network is input into the encoder, and the output node is the latent representation learned from the k-layer network; the encoder is a GCN encoder, and the parameters of the GCN encoder are set to partial weight sharing.

[0034] In a specific embodiment of the present invention, the model training module executes the following steps:

[0035] For each layer of the network, the structure matrix is reconstructed by the encoder based on the potential representation learned by the encoder;

[0036] Cross entropy is used to measure the reconstruction effect. For the k-th layer network, the decoder is used to reconstruct the adjacency matrix and calculate the reconstruction error; the decoder is the GCN decoder;

[0037] The total structural reconstruction error of the multi-layer network is obtained by weighting the fusion coefficients obtained by the attention mechanism. The decoder is used to reconstruct the node attributes. The fused potential representation and the original adjacency matrix of the network are input into the decoder to reconstruct the node attributes.

[0038] The error of node attributes is reconstructed using mean square error, and the overall loss is the weighted sum of the structure reconstruction error and the attribute reconstruction error;

[0039] By minimizing the loss function of structure reconstruction loss and attribute reconstruction loss, it gradually approaches the original multi-view attribute network.

[0040] In a specific embodiment of the present invention, the abnormal node acquisition module executes the following steps:

[0041] For the node to be detected, the behavior consistency score of the deviation between the node to be detected in the k-th layer view and the overall behavior is calculated. The larger the behavior consistency score, the greater the variance of the behavior representation of the node to be detected in each view, the more inconsistent the behavior pattern is, and the higher the abnormality;

[0042] The weighted average of the behavior consistency score and the reconstruction anomaly score is used as the overall anomaly score; nodes with high sorting priority are selected as abnormal nodes according to the preset threshold.

[0043] In a third aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of a method for detecting abnormal nodes based on a multi-view network when the program is executed by a processor.

[0044] In a fourth aspect, an embodiment of the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the abnormal node detection method based on a multi-view network are implemented.

[0045] Compared with the related existing technologies, it has the following outstanding beneficial effects:

[0046] (1) This paper proposes an unsupervised outlier node detection algorithm that identifies outlier nodes in the network that deviate from the majority nodes in terms of behavior patterns, structure, and attributes through encoder-decoder reconstruction and behavior consistency score calculation. This method does not require manually labeled labels.

[0047] (2) The present invention is interpretable: The proposed method uses a weighted combination of structural reconstruction error, attribute reconstruction error, and cross-view behavioral consistency score as the anomaly score, rather than a "black box" approach. This method is interpretable and can integrate node anomaly scores from other dimensions.

[0048] (3) The present invention is effective and robust: Extensive experiments on multiple datasets demonstrate the effectiveness and robustness of the proposed algorithm. On four real datasets, the detection performance is improved by 3.66% to 7.93% compared to the best performing baseline. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0050] Figure 1 Schematic diagram of an abnormal node detection method based on a multi-view network according to the present invention;

[0051] Figure 2 Schematic diagram of an abnormal node detection system based on a multi-view network according to the present invention;

[0052] Figure 3 Schematic diagram of computer hardware of the present invention. DETAILED DESCRIPTION

[0053] In this disclosure, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, "at least one of a, b, or c" can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or plural.

[0054] It should also be understood that the term "and / or" in this document simply describes an association between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A alone, A and B together, or B alone. A and B can be singular or plural. Furthermore, the character " / " in this document generally indicates an "or" relationship between the related objects, but it may also indicate an "and / or" relationship. For specific understanding, please refer to the context.

[0055] It should also be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0056] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interface, indirect coupling or communication connection of the device or unit, which can be electrical, mechanical or other forms.

[0057] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0058] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0059] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0060] To illustrate the above-mentioned features and effects of the present invention more clearly and easily, the following embodiments are specifically described below with reference to the accompanying drawings. This specification discloses one or more embodiments incorporating the features of the present invention. The disclosed embodiments are for illustrative purposes only. The scope of protection of the present invention is not limited to the disclosed embodiments; the present invention is defined by the appended claims.

[0061] The following is a system embodiment corresponding to the above method embodiment. This embodiment can be implemented in conjunction with the above embodiment. The relevant technical details mentioned in the above embodiment are still valid in this embodiment and will not be repeated here to reduce repetition. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the above embodiment.

[0062] The method of the present invention aims to propose a method and system for abnormal node detection based on a multi-view network. Specifically, it includes: in an attribute network, first converting it into a multi-layer view network by multi-view modeling. Subsequently, for the multi-view network, a weight-sharing encoder is used to obtain the representation of the node in each layer. Subsequently, in the information fusion stage, an attention mechanism is used to assign learnable fusion weights to each layer of the network. In the reconstruction stage, an inner product decoder is used for the structure matrix of each layer, and the attribute reconstruction matrix, the fused representation of the nodes of each layer and the original structure matrix are used as input, and a layer of GCN is used as the attribute decoder. The structure and attributes of the network are used as self-supervisory labels for training. After the training is completed, the variance of the potential representation of a single node in the multi-layer network is calculated as the behavioral anomaly score of the node, and the weighted sum of the joint structure reconstruction loss and the attribute reconstruction loss is used as the final anomaly score, and the topK nodes with the highest ranking are selected to be identified as abnormal nodes. The method specifically includes:

[0063] Step 1: Convert the heterogeneous attribute network into a multi-layer view network through multi-view modeling. Apply a partially weight-sharing encoder to each layer of the network to extract the latent representation of the nodes in each layer.

[0064] Step 2: Using the attention mechanism, we learn the fusion weights of the representations at each layer, and then obtain the fused latent representation. For each network layer, we use cross-entropy to measure the reconstruction error at each layer, and mean squared error to measure the attribute reconstruction error. We introduce hyperparameters to balance these two errors, which serve as the optimization objective function for unsupervised learning. Training is then performed to update the encoder and decoder parameters.

[0065] Step 3: Calculate the deviation between the node's representation at each layer and the average representation at that layer as the layer's deviation. Apply variance to calculate the inconsistency of the node's behavior patterns at each layer. The final anomaly score is the weighted sum of the behavioral anomaly score and the reconstruction anomaly score. Select the top k nodes or truncate them according to a threshold to obtain the anomaly nodes.

[0066] The following describes the method of the embodiment of the present application in detail with reference to specific embodiments:

[0067] Example 1

[0068] like Figure 1 As shown, the embodiment of the present application proposes an abnormal node detection method based on a multi-view network, which is applied to fraudulent user detection. The method includes:

[0069] Latent representation extraction step 101: constructing a heterogeneous attribute network based on fraudulent user information, converting the heterogeneous attribute network into a multi-layer view network through multi-view modeling, applying a partial weight sharing encoder to each layer of the view network, and extracting the latent representation of the nodes in each layer;

[0070] Information fusion step 102: learning the fusion weights of the potential representations of each layer based on the attention mechanism to obtain a fused potential representation;

[0071] Model training step 103: Reconstructing the structure and node attributes of each layer of the network based on the fused latent representation of each layer using a pre-trained model, using cross entropy to measure the reconstruction error of the latent representation of each layer, and using mean square error to measure the reconstruction error; wherein the model includes an encoder and a decoder;

[0072] Abnormal node acquisition step 104: Using the pre-trained model, the variance of the potential representation of the node to be detected in each layer of the multi-layer view network is calculated as the node's behavioral abnormality score, and the weighted sum of the joint structure reconstruction loss and attribute reconstruction loss is used as the final abnormality score to achieve detection and identification of abnormal nodes.

[0073] In a specific embodiment of the present invention, the potential representation extraction step 101 includes:

[0074] Initialize a multi-layer view network and convert the heterogeneous attribute network of multi-view modeling into a multi-layer view network;

[0075] Multiple independent encoders are used to extract multi-layer latent representations. For the k-th layer network, the structure and attribute information of the multi-layer view network is input into the encoder, and the output node is the latent representation learned from the k-layer network; the encoder is a GCN encoder, and the parameters of the GCN encoder are set to partial weight sharing.

[0076] More specifically, (1) the definition of the multi-view attribute network in the implementation example of the present invention. Represents a multi-view attribute network. Where V is the node set, A i is the adjacency matrix of the network under the i-th view, X i is the node attribute matrix under the i-th view.

[0077] (2) In order to effectively learn the specific knowledge under each view, multiple independent GCNs are used to design the encoder module. Specifically, a 2-layer GCN is used to extract the potential representation for each layer of the network, and in order to be able to map the information of each layer into the same subspace, the parameters of the second layer of GCN are set to be contributing. For the k-th layer network, the input is its structure and attribute information, and the output is the potential representation Z learned by the node from the layer network. k .

[0078]

[0079] in, represents the reparameterized adjacency matrix, W kW represents the weight parameter of the GCN used for the k-th view, σ(·) represents the nonlinear activation function, usually the ReLU function. shared Represents the weight parameters of the second layer GCN shared by multiple views.

[0080] (3) After the multi-layer graph encoder generates multiple layers of potential representations of nodes, they need to be fused. Using the attention mechanism, each layer of the network learns personalized fusion coefficients to achieve more effective feature fusion. The node features of the multi-layer network are used to generate the query vector q through a fully connected layer:

[0081] q=FC(X)=XW q +b q (Formula 2)

[0082] Among them, FC(·) represents the fully connected layer, W q ,b q are the weights and biases of the fully connected layer respectively. Afterwards, the fully connected layer is used to linearly project the average node representation of the k-th layer network Then calculate the similarity between the query vector q and the projected representation. The similarity between the query vector and the k-th layer network is the inner product of the vector and the representation mean, that is:

[0083]

[0084] Apply the Softmax function to convert the obtained similarity into probability, that is:

[0085]

[0086] α k That is the fusion weight coefficient of the k-th layer network.

[0087] (4) After obtaining the fusion weight coefficients of each layer of the network based on the attention mechanism, the potential representation of the fusion is calculated as:

[0088]

[0089] In a specific embodiment of the present invention, the model training step 102 includes:

[0090] For each layer of the network, the structure matrix is reconstructed by the encoder based on the potential representation learned by the encoder;

[0091] Cross entropy is used to measure the reconstruction effect. For the k-th layer network, the decoder is used to reconstruct the adjacency matrix and calculate the reconstruction error; the decoder is the GCN decoder;

[0092] The total structural reconstruction error of the multi-layer network is obtained by weighting the fusion coefficients obtained by the attention mechanism. The decoder is used to reconstruct the node attributes. The fused potential representation and the original adjacency matrix of the network are input into the decoder to reconstruct the node attributes.

[0093] The error of node attributes is reconstructed using mean square error, and the overall loss is the weighted sum of the structure reconstruction error and the attribute reconstruction error;

[0094] By minimizing the loss function of structure reconstruction loss and attribute reconstruction loss, it gradually approaches the original multi-view attribute network.

[0095] Specifically, (5) after encoding the structure and attribute information in different layers through a multi-layer network encoder and fusing their representations, it is necessary to reconstruct the structure and node attributes in each layer of the network, thereby learning the underlying pattern of the main body of the data. In order to reconstruct the structure of each layer of the network, for each layer of the network, based on the representation Z learned by the encoder k , calculate the inner product between node pairs, and then apply the Sigmoid function to calculate the probability of the link. The reconstructed structure matrix is:

[0096]

[0097] The above formula uses the inner product to calculate the similarity between any two nodes and applies the Sigmoid function to convert it into the probability of the existence of the reconstructed edge.

[0098] When measuring the structural reconstruction error, the link generation process of the network follows the Bernoulli distribution, so we consider using cross entropy to measure the reconstruction effect. For the k-th layer network, the adjacency matrix reconstructed by the decoder is The reconstruction error is

[0099]

[0100] This formula calculates all elements of the adjacency matrix and can also be understood as a loss measure for the binary classification task of determining whether there is an edge between any two nodes in the network.

[0101] The structural reconstruction error of each layer is weighted according to the fusion coefficient obtained by the attention mechanism to obtain the total structural reconstruction error of the multi-layer network

[0102]

[0103] (6) When reconstructing node attributes, a GCN is used as a decoder, and the input is the fused potential representation Z fusion And the original adjacency matrix of the network, the reconstructed node attributes are

[0104]

[0105] Among them, W dec Represents the weight parameters of the attribute decoder GCN.

[0106] When measuring the reconstruction error of node attributes, the mean square error (MSE) is used. The reconstruction error is

[0107]

[0108] (7) The overall loss function consists of the weighted sum of the structural reconstruction error and the attribute reconstruction error, expressed as

[0109]

[0110] Where λ is the balanced structure reconstruction loss and attribute reconstruction loss By minimizing the loss function including structure reconstruction loss and attribute reconstruction loss, the framework can gradually approach the original multi-view attribute network through the convergence of the loss function.

[0111] In a specific embodiment of the present invention, the abnormal node acquisition step 103 includes:

[0112] For the node to be detected, the behavior consistency score of the deviation between the node to be detected in the k-th layer view and the overall behavior is calculated. The larger the behavior consistency score, the greater the variance of the behavior representation of the node to be detected in each view, the more inconsistent the behavior pattern is, and the higher the abnormality;

[0113] The weighted average of the behavior consistency score and the reconstruction anomaly score is used as the overall anomaly score; nodes with high sorting priority are selected as abnormal nodes according to the preset threshold.

[0114] Specifically, (8) when measuring the behavioral consistency of nodes, it is based on the assumption that the behavior of nodes in different perspectives should be consistent, and nodes with poor consistency are abnormal nodes. The calculation of behavioral consistency is implemented by variance. For node u, the degree of deviation from the overall behavior in the kth view is calculated as d k (u), the behavioral consistency score is calculated as

[0115]

[0116] Var(·) represents the variance of a set of numbers. A larger score indicates a greater variance in the node's behavior across views, meaning the behavior pattern is inconsistent and the degree of anomaly is higher.

[0117] (9) The weighted average of the behavioral consistency anomaly score and the reconstruction anomaly score is used as the overall anomaly score

[0118]

[0119] Among them, β is a hyperparameter to balance the reconstruction abnormality metric and behavioral anomaly metrics According to the preset threshold or taking the TopK nodes as abnormal nodes.

[0120] As described above, the method of the present invention can be better implemented.

[0121] Example 2

[0122] like Figure 2 As shown, an embodiment of the present application provides an abnormal node detection system based on a multi-view network, which adopts the above-mentioned abnormal node detection method based on a multi-view network. The system includes:

[0123] Latent representation extraction module 201: converts a heterogeneous attribute network into a multi-layer view network through multi-view modeling, applies a partial weight sharing encoder to each layer of the view network, and extracts the node latent representation of each layer;

[0124] Information fusion module 202: learns the fusion weights of each layer of potential representation based on the attention mechanism to obtain a fused potential representation;

[0125] Model training module 203: reconstructs the structure and node attributes of each layer of the network based on the fused latent representation of each layer, using a pre-trained model, and measures the reconstruction error of the latent representation of each layer using cross entropy and mean square error. The model includes an encoder and a decoder.

[0126] Abnormal node acquisition module 204: uses a pre-trained model to calculate the variance of the potential representation of the node to be detected in each layer of the multi-layer view network as the node's behavioral abnormality score, and uses the weighted sum of the joint structure reconstruction loss and attribute reconstruction loss as the final abnormality score to achieve detection and identification of abnormal nodes.

[0127] In a specific embodiment of the present invention, the steps performed by the potential representation extraction module 201 include:

[0128] Initialize a multi-layer view network and convert the heterogeneous attribute network of multi-view modeling into a multi-layer view network;

[0129] Multiple independent encoders are used to extract multi-layer latent representations. For the k-th layer network, the structure and attribute information of the multi-layer view network is input into the encoder, and the output node is the latent representation learned from the k-layer network; the encoder is a GCN encoder, and the parameters of the GCN encoder are set to partial weight sharing.

[0130] In a specific embodiment of the present invention, the model training module executes step 203 including:

[0131] For each layer of the network, the structure matrix is reconstructed by the encoder based on the potential representation learned by the encoder;

[0132] Cross entropy is used to measure the reconstruction effect. For the k-th layer network, the decoder is used to reconstruct the adjacency matrix and calculate the reconstruction error; the decoder is the GCN decoder;

[0133] The total structural reconstruction error of the multi-layer network is obtained by weighting the fusion coefficients obtained by the attention mechanism. The decoder is used to reconstruct the node attributes. The fused potential representation and the original adjacency matrix of the network are input into the decoder to reconstruct the node attributes.

[0134] The error of node attributes is reconstructed using mean square error, and the overall loss is the weighted sum of the structure reconstruction error and the attribute reconstruction error;

[0135] By minimizing the loss function of structure reconstruction loss and attribute reconstruction loss, it gradually approaches the original multi-view attribute network.

[0136] In a specific embodiment of the present invention, the abnormal node acquisition module 204 executes the following steps:

[0137] For the node to be detected, the behavior consistency score of the deviation between the node to be detected in the k-th layer view and the overall behavior is calculated. The larger the behavior consistency score, the greater the variance of the behavior representation of the node to be detected in each view, the more inconsistent the behavior pattern is, and the higher the abnormality;

[0138] The weighted average of the behavior consistency score and the reconstruction anomaly score is used as the overall anomaly score; nodes with high sorting priority are selected as abnormal nodes according to the preset threshold.

[0139] Example 3

[0140] An embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the steps of the abnormal node detection method based on a multi-view network are implemented.

[0141] Example 4

[0142] An embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps of the abnormal node detection method based on a multi-view network are implemented.

[0143] In addition, combined Figure 1The abnormal node detection method based on a multi-view network described in the embodiment of the present application can be implemented by an electronic device, such as a computer device. Figure 3 Schematic diagram of the hardware structure of a computer device according to an embodiment of the present application.

[0144] In some embodiments, the computer device may further include a communication interface 83 and a bus 80. Figure 3 As shown, the processor 81, the memory 82, and the communication interface 83 are connected via a bus 80 and communicate with each other.

[0145] Specifically, the processor 81 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0146] The memory 82 may be used to store or cache various data files required for processing and / or communication, as well as possible computer program instructions executed by the processor 81 .

[0147] The processor 81 reads and executes computer program instructions stored in the memory 82 to implement any one of the abnormal node detection methods based on a multi-view network in the above embodiments.

[0148] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0149] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A method for detecting abnormal nodes based on a multi-view network, characterized in that: Applied to fraudulent user detection, the method includes: Latent representation extraction step: constructing a heterogeneous attribute network based on fraudulent user information, converting the heterogeneous attribute network into a multi-layer view network through multi-view modeling, applying a partial weight sharing encoder to each layer of the view network, and extracting the latent representation of the nodes in each layer; Information fusion step: learning the fusion weights of the potential representations of each layer based on the attention mechanism to obtain the fused potential representation; Model training step: reconstructing the structure and node attributes of each layer of the network for the fused latent representation of each layer, using a pre-trained model, measuring the reconstruction error of the latent representation of each layer using cross entropy, and measuring the reconstruction error using mean square error; wherein the model includes: an encoder and a decoder; Abnormal node acquisition steps: Using a pre-trained model, the variance of the potential representation of the node to be detected in each layer of the multi-layer view network is calculated as the node's behavioral anomaly score. The weighted combination of the structural reconstruction loss and the attribute reconstruction loss is used as the final anomaly score to detect and identify abnormal fraudulent users.

2. The abnormal node detection method based on multi-view network according to claim 1 is characterized in that: The potential representation extraction step includes: Initializing a multi-layer view network, and converting the heterogeneous attribute network of multi-view modeling into the multi-layer view network; Multiple independent encoders are used to extract multi-layer latent representations. For the k-th layer network, the structure and attribute information of the multi-layer view network is input into the encoder, and the output node is the latent representation learned from the k-layer network; wherein the encoder is a GCN encoder, and the parameters of the GCN encoder are set to partially share weights.

3. The abnormal node detection method based on multi-view network according to claim 1 is characterized in that: The model training steps include: For each layer of the network, based on the potential representation learned by the encoder, the structure matrix is reconstructed by the encoder; The cross entropy is used to measure the reconstruction effect. For the k-th layer network, the decoder is used to reconstruct the adjacency matrix and the reconstruction error is calculated; wherein the decoder is a GCN decoder; After weighting the fusion coefficients obtained by the attention mechanism, the total structural reconstruction error of the multi-layer network is obtained; the node attributes are reconstructed using the decoder, and the fused potential representation and the original adjacency matrix of the network are input into the decoder to reconstruct the node attributes; The error of node attributes is reconstructed using mean square error, and the overall loss is the weighted sum of the structure reconstruction error and the attribute reconstruction error; By minimizing the loss function of structure reconstruction loss and attribute reconstruction loss, it gradually approaches the original multi-view attribute network.

4. The abnormal node detection method based on multi-view network according to claim 1 is characterized in that: The abnormal node acquisition step includes: For the node to be detected, calculate the behavior consistency score of the deviation between the node to be detected in the k-th layer view and the overall behavior. The larger the behavior consistency score, the greater the variance of the behavior representation of the node to be detected in each view, the more inconsistent the behavior pattern is, and the higher the abnormality level. The weighted average of the consistency score and the reconstruction anomaly score is used as the overall anomaly score; according to the preset threshold or the node with the highest sorting priority, it is regarded as the anomaly node.

5. A multi-view network-based abnormal node detection system, using the multi-view network-based abnormal node detection method according to any one of claims 1 to 4, characterized in that: The system comprises: Latent Representation Extraction Module: This module transforms a heterogeneous attribute network into a multi-layer view network through multi-view modeling, applies a partially weighted shared encoder to each layer of the view network, and extracts the latent representation of nodes in each layer. Information fusion module: learns the fusion weights of the potential representations of each layer based on the attention mechanism to obtain the fused potential representation; Model training module: reconstructs the structure and node attributes of each layer of the network based on the fused potential representation of each layer, using a pre-trained model, and measures the reconstruction error of the potential representation of each layer using cross entropy and mean square error; wherein the model includes an encoder and a decoder; Abnormal node acquisition module: Using a pre-trained model, the variance of the potential representation of the node to be detected in each layer of the multi-layer view network is calculated as the node's behavioral anomaly score. The weighted sum of the joint structure reconstruction loss and attribute reconstruction loss is used as the final anomaly score to achieve detection and identification of abnormal nodes.

6. The abnormal node detection system based on multi-view network according to claim 5, characterized in that: The steps executed by the potential representation extraction module include: Initializing a multi-layer view network, and converting the heterogeneous attribute network of multi-view modeling into the multi-layer view network; Multiple independent encoders are used to extract multi-layer latent representations. For the k-th layer network, the structure and attribute information of the multi-layer view network is input into the encoder, and the output node is the latent representation learned from the k-layer network; wherein the encoder is a GCN encoder, and the parameters of the GCN encoder are set to partially share weights.

7. The abnormal node detection system based on multi-view network according to claim 5, characterized in that: The model training module execution steps include: For each layer of the network, based on the potential representation learned by the encoder, the structure matrix is reconstructed by the encoder; The cross entropy is used to measure the reconstruction effect. For the k-th layer network, the decoder is used to reconstruct the adjacency matrix and the reconstruction error is calculated; wherein the decoder is a GCN decoder; After weighting the fusion coefficients obtained by the attention mechanism, the total structural reconstruction error of the multi-layer network is obtained; the node attributes are reconstructed using the decoder, and the fused potential representation and the original adjacency matrix of the network are input into the decoder to reconstruct the node attributes; The error of node attributes is reconstructed using mean square error, and the overall loss is the weighted sum of the structure reconstruction error and the attribute reconstruction error; By minimizing the loss function of structure reconstruction loss and attribute reconstruction loss, it gradually approaches the original multi-view attribute network.

8. The abnormal node detection method based on multi-view network according to claim 5 is characterized in that: The abnormal node acquisition module performs the following steps: For the node to be detected, calculate the behavior consistency score of the deviation between the node to be detected in the k-th layer view and the overall behavior. The larger the behavior consistency score, the greater the variance of the behavior representation of the node to be detected in each view, the more inconsistent the behavior pattern is, and the higher the abnormality level. The weighted average of the consistency score and the reconstruction anomaly score is used as the overall anomaly score; according to the preset threshold or the node with the highest sorting priority, it is regarded as the anomaly node.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the abnormal node detection method based on a multi-view network according to any one of claims 1 to 4 are implemented.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the abnormal node detection method based on a multi-view network are implemented as described in any one of claims 1 to 4.

Images