Anomaly subgraph detection method based on asymmetric autoencoder

Abstract

The application relates to an abnormal subgraph detection method based on an asymmetric autoencoder, relates to the technical field of anomaly detection and deep learning, and comprises the following steps: constructing a background graph and an abnormal graph dataset; constructing an abnormal graph detection network model; combining a threshold decision method to perform abnormal graph detection; and performing performance evaluation. The abnormal subgraph detection method based on the asymmetric autoencoder has the learning ability and reconstruction ability of an asymmetric autoencoder for the characteristics of a background graph adjacency matrix, and combines a threshold decision method in traditional abnormal subgraph detection, so that the method has the flexibility of threshold decision and the high efficiency of a deep learning method, and can improve the adaptability and flexibility of the detection method; the asymmetric autoencoder is used to perform data dimension reduction on the background graph adjacency matrix by using a lightweight encoder, and to perform data reconstruction by using a four-layer decoder, so that the robustness and accuracy of the detection method can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of anomaly detection and deep learning, and particularly relates to an anomaly subgraph detection method based on an asymmetric autoencoder. BACKGROUND

[0002] In recent years, network anomaly detection technology has become a research hotspot and has been widely applied in many fields such as communication networks, computer networks and social networks. Network anomaly detection technology usually relies on relational data, that is, information describing the connection between network nodes, to identify whether a small abnormal network is hidden in a large background network. In order to effectively represent the relationship data between network nodes, a random graph model is usually used to characterize the characteristics of the network. Among them, the anomaly graph and the background graph are mathematical abstractions of the abnormal network and the background network respectively, and the anomaly graph can be expressed as an embedded anomaly subgraph in the background graph. Accordingly, the network anomaly detection problem can be further formalized as an anomaly subgraph detection problem in the graph model framework.

[0003] In anomaly subgraph detection with a random graph as a background graph, traditional methods use statistical quantities, decision thresholds and other means to detect whether there is an anomaly subgraph embedded in the background graph. Threshold decision has the characteristics of fast calculation speed, wide applicability and easy combination with other methods. Although the statistical quantity can effectively summarize the statistical characteristics of the data, its composition is too dependent on a specific hypothesis distribution, and if the data does not conform to the hypothesis, the constructed statistical quantity may be biased. Secondly, the traditional method usually assumes that the data is linearly related, and the constructed mathematical model may not be able to capture the potential nonlinear relationship. Deep learning methods can extract nonlinear features between data through multiple levels of nonlinear transformation, and dynamically adjust to adapt to different data distributions and changes, reducing the dependence on specific hypothesis distribution. In the deep learning network, the autoencoder class network has attracted widespread attention in the field of anomaly subgraph detection due to its strong ability to process a large amount of unlabeled data, good data reconstruction effect, lightweight structure and high flexibility. Among them, the asymmetric autoencoder uses the asymmetric characteristics of the encoder and the decoder structure to learn more complex mappings, thereby better capturing the nonlinear relationships and potential features in the input data. SUMMARY

[0004] Therefore, the purpose of the present application is to provide an anomaly subgraph detection method based on an asymmetric autoencoder.

[0005] In order to achieve the above purpose, the technical scheme of the present application is as follows:

[0006] An anomaly subgraph detection method based on an asymmetric autoencoder, comprising the following steps:

[0007] Step 1, constructing a background graph and an anomaly graph data set;

[0008] Step 1.1, constructing a background graph data set;

[0009] Step 1.2, constructing an anomaly graph data set;

[0010] Step 2, constructing an anomaly graph detection network;

[0011] Step 2.1, building an asymmetric autoencoder network model;

[0012] Step 2.2, training the asymmetric autoencoder network model;

[0013] Step 3, combining threshold decision method for anomaly graph detection;

[0014] According to the final loss of the asymmetric autoencoder network model training stage, the upper and lower limits of the decision threshold interval are determined, and the threshold interval is determined as a background graph, and the threshold interval is determined as an anomaly graph;

[0015] Step 4, performance evaluation;

[0016] Use multiple indicators to evaluate performance.

[0017] In the above technical solution, in step 1.1, the CL random graph model is used to construct the background graph data set, including the following steps:

[0018] The CL random graph model is used to generate a background graph with a size of , wherein is the number of vertices;

[0019] The adjacency matrix of the background graph with a size of is converted into a tensor with a size of for storage, forming a CL background graph data set, wherein is the network channel.

[0020] In the above technical solution, in step 1.2, the ER model is used to construct the anomaly graph data set, including the following steps:

[0021] First, randomly select vertices on the CL background graph, set the edge connection probability factor between the vertices, and use the ER model to construct an ER subgraph;

[0022] Then, embed the ER subgraph into the CL background graph to form an anomaly graph;

[0023] Finally, the adjacency matrix of the anomaly graph with a size of is converted into a tensor with a size of for storage, forming a CL anomaly graph data set, wherein is the network channel. is the number of vertices.

[0024] In the above technical solution, in step 1.1, the R-MAT random graph model is used to construct the background graph data set, including the following steps:

[0025] First, the R-MAT random graph model is used to generate a background graph with a size of , wherein is the number of vertices;

[0026] Secondly, the probability of edge connection to the recursive sub-matrix of the graph is defined, and the probability matrix , wherein , , , are constants, and the sum of the four is 1;

[0027] Then, an empty adjacency matrix is generated, the adjacency matrix is divided into four equal size sub-matrices, and for each edge to be added, a sub-matrix is randomly selected according to the probability matrix ; the operation of adding edges in the selected sub-matrix is repeated until the required graph size is reached or all edges are added, and the generation of the R-MAT background graph is completed;

[0028] Finally, the background graph adjacency matrix with a size of is converted into a tensor with a size of for storage, constituting the R-MAT background graph data set, wherein is the network channel.

[0029] In the above technical solution, in step 1.2, the R-MAT random graph model is used to construct the anomaly graph data set.

[0030] In the above technical solution, in step 2.1, in the asymmetric autoencoder network model built:

[0031] The encoder is composed of two layers of neural networks, and the decoder is composed of four layers of neural networks; each layer of neural network of the encoder is composed of a convolutional layer, a batch normalization layer, an activation function layer and a maximum pooling layer; each layer of neural network of the decoder is composed of a convolutional layer, a batch normalization layer, an activation function layer and an up-sampling layer; wherein:

[0032] The convolutional layer is used for data structure feature learning and data dimension reduction at the same time;

[0033] The batch normalization layer is used for normalizing the data;

[0034] The activation function layer is used to enhance the learning ability of the network by introducing nonlinearity and prevent overfitting;

[0035] The max-pooling layer is used to further reduce the dimension of the data while retaining the main features;

[0036] The up-sampling layer is used to interpolate the data to restore the dimension of the input data.

[0037] In the above technical solution, step 2.2 specifically includes the following steps:

[0038] Let the background graph adjacency matrix tensor be The encoder is responsible for reducing the dimension of the input tensor In the asymmetric auto-encoder network model The size of , is the batch size of each network iteration, is the network channel, is the number of vertices; The encoding process is represented as:

[0039]

[0040] wherein, is the encoder, is the tensor output after dimension reduction coding, with a size of , is the network channel after dimension reduction coding, is the number of vertices after dimension reduction coding;

[0041] The decoder is responsible for up-sampling decoding the tensor encoded by the encoder:

[0042]

[0043] wherein, is the decoder, is the reconstructed background graph adjacency matrix tensor, with a size of ;

[0044] The minimum mean square error of and is used as the reconstruction error to optimize the asymmetric auto-encoder network model:

[0045]

[0046] wherein, represents the minimum mean square error, represents the loss of the asymmetric auto-encoder network model training;

[0047] The asymmetric auto-encoder network model is trained, and the loss is calculated until Converge smoothly so that the decoder can restore the input data to the greatest extent possible.

[0048] In the above technical solution, the multiple indicators used in step 4 include: accuracy 、 Score, false alarm rate and false negative rate .

[0049] In the above technical solution, in step 4, the accuracy 、 Score, false alarm rate and false negative rate The expressions are:

[0050]

[0051]

[0052]

[0053]

[0054] in, True negative, is a true positive, A false positive It is a false negative.

[0055] The present invention has the following beneficial effects:

[0056] The abnormal subgraph detection method based on an asymmetric autoencoder of the present invention utilizes the learning and reconstruction capabilities of the background image adjacency matrix features of the asymmetric autoencoder, combined with the threshold judgment method in traditional abnormal subgraph detection, so that the method has both the flexibility of threshold judgment and the high efficiency of deep learning methods, which can improve the adaptability and flexibility of the detection method.

[0057] The abnormal subgraph detection method based on an asymmetric autoencoder of the present invention utilizes an asymmetric autoencoder to perform data dimensionality reduction on the background image adjacency matrix using a lightweight encoder and uses a four-layer decoder to reconstruct the data, thereby improving the robustness and accuracy of the detection method. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0059] Figure 1 It is a flowchart of the abnormal subgraph detection method based on asymmetric autoencoder of the present invention;

[0060] Figure 2is an asymmetric autoencoder network model architecture diagram of an asymmetric autoencoder-based abnormal subgraph detection method of the present application;

[0061] Figure 3 is an asymmetric autoencoder network model training principle diagram of an asymmetric autoencoder-based abnormal subgraph detection method of the present application;

[0062] Figure 4 is a loss curve diagram of an asymmetric autoencoder-based abnormal subgraph detection method of the present application in a CL background graph training set;

[0063] Figure 5 is a detection result diagram of an asymmetric autoencoder-based abnormal subgraph detection method of the present application in a CL data set;

[0064] Figure 6 is a loss curve diagram of an asymmetric autoencoder-based abnormal subgraph detection method of the present application in a R-MAT background graph training set;

[0065] Figure 7 is a detection result diagram of an asymmetric autoencoder-based abnormal subgraph detection method of the present application in a R-MAT data set. DETAILED DESCRIPTION

[0066] The inventive idea of the present application is:

[0067] The present application aims at the problem of abnormal subgraph detection, and combines a traditional threshold decision method with deep learning technology to construct an asymmetric autoencoder-based abnormal subgraph detection method, which aims to realize accurate identification of abnormal subgraphs.

[0068] The asymmetric autoencoder-based abnormal subgraph detection method of the present application combines a traditional threshold decision-based abnormal subgraph detection method with a deep learning method, learns the adjacency matrix features of a background graph by using an asymmetric autoencoder, and reconstructs the background graph by using the learned features. The reconstruction loss of the background graph fluctuates in a threshold interval, while the reconstruction loss of an abnormal graph exceeds the threshold interval, and the abnormal graph is detected by using threshold decision.

[0069] The asymmetric autoencoder-based abnormal subgraph detection method of the present application fully utilizes the data processing capability of deep learning technology and the flexibility of threshold decision method, improves the accuracy of abnormal subgraph detection, and takes Erdős-Rényi (ER) abnormal subgraph embedded in Chung-Lu (CL) and Recursive Matrix Stochastic Kronecker Graph (R-MAT) background graphs as examples to verify the effectiveness of the method of the present application.

[0070] The application will be described in detail below with reference to the drawings and examples.

[0071] Example one:

[0072] Referring to Figure 1 , the asymmetric autoencoder-based abnormal subgraph detection method of the application comprises the following steps:

[0073] Step 1, constructing a background graph and an abnormal graph data set;

[0074] Step 1.1, constructing a background graph data set by using a CL random graph model, comprising the following steps:

[0075] A CL random graph model is used to generate a background graph with a size of , which is used to simulate an actual network structure, wherein, is the number of vertices;

[0076] Then, the adjacency matrix of the background graph with a size of is converted into a tensor with a size of for storage, thereby constituting a CL background graph data set, wherein, is a network channel;

[0077] In the simulation experiment, the CL background graph data set has 1000 background graphs, among which 200 background graphs are randomly selected as a training set, and the other 800 background graphs are selected as a test set, , , , ; wherein, is the average degree of vertices, is a power-law degree distribution threshold.

[0078] Step 1.2, constructing an abnormal graph data set by using an ER model, comprising the following steps:

[0079] First, randomly selecting vertices on the CL background graph, setting a vertex-to-vertex edge connection probability factor , and constructing an ER subgraph by using an ER model; the random edge structure of the ER subgraph is significantly different from the power-law distribution random edge structure of the background graph, and can form a local connection relationship anomaly, thereby simulating a potential abnormal network;

[0080] Then, embedding the ER subgraph into the CL background graph to constitute an abnormal graph, at this time, the abnormal graph contains a mixed structure of the background graph and the ER subgraph, and contains an abnormal area while maintaining the overall structure;

[0081] Finally, converting the adjacency matrix of the abnormal graph with a size of into a tensor with a size of for storage, thereby constituting a CL abnormal graph data set;

[0082] In the simulation experiment, the CL anomaly map dataset contains 1000 anomaly maps, of which 200 are randomly selected as test set 1 and the other 800 are selected as test set 2. , .

[0083] Step 2: Build an abnormal subgraph detection network model;

[0084] Step 2.1, build an asymmetric autoencoder network model;

[0085] An asymmetric autoencoder is a deep learning model designed to effectively learn the latent representation of data through an asymmetric structure. The encoder and decoder have significant differences in the number of network layers and nodes. During training, the asymmetric autoencoder optimizes the model by calculating the minimum mean square error between the input and the reconstructed output.

[0086] The asymmetric autoencoder network model architecture is as follows Figure 2 As shown in the figure, the encoder consists of two layers of neural networks, which retain effective potential features as much as possible, while the decoder consists of four layers of neural networks, which enhances the ability to restore data details and focuses on reconstructing the output from the latent space. Each layer of the encoder's neural network consists of a convolutional layer (Conv2d), a batch normalization layer (BatchNorm2d), an activation function layer (ReLu) and a maximum pooling layer. Each layer of the decoder's neural network consists of a convolutional layer (Conv2d), a batch normalization layer (BatchNorm2d), an activation function layer (ReLu) and an upsampling layer. The convolutional layer is used to learn data structure features and reduce data dimensionality. The batch normalization layer is used to normalize the data, which can reduce the interference of data outliers and make feature extraction network training faster and more stable. The activation function layer enhances the network learning ability and prevents overfitting by introducing nonlinearity. The maximum pooling layer is only used in the encoder to further reduce the dimensionality of the data while retaining the main features. The upsampling layer is only used in the decoder to interpolate and increase the dimensionality of the data, gradually restoring it to the input data dimension.

[0087] Step 2.2: Train the asymmetric autoencoder network model.

[0088] The training principle of the asymmetric autoencoder network model is as follows Figure 3 As shown, let the background image adjacency matrix tensor be , the encoder is responsible for converting the input tensor Perform dimensionality reduction encoding to better learn the potential structural features of the input data in the asymmetric autoencoder network model the size of the batch size of each network iteration, , the network channel, the number of vertices; the encoding process can be represented as:

[0089]

[0090] wherein, the encoder, the tensor output after dimension reduction encoding, with a size of , the network channel after dimension reduction encoding, the number of vertices after dimension reduction encoding;

[0091] The decoder is responsible for decoding the tensor output by the encoder to perform dimensionality decoding:

[0092]

[0093] wherein, the decoder, the reconstructed background graph adjacency matrix tensor, with a size of ;

[0094] The minimum mean square error of and is used as the reconstruction error to optimize the asymmetric autoencoder network model:

[0095]

[0096] wherein, represents the minimum mean square error, represents the loss of asymmetric autoencoder network model training; the asymmetric autoencoder network model is trained, and the model loss is calculated until converges stably, so that the decoder can restore the input data to the maximum extent;

[0097] In the simulation experiment, 32, 1, , , 200 CL background graphs of the background graph training set are used as training data, and the trained asymmetric autoencoder network model Model-CL is obtained after the model loss converges stably, and the final loss ;

[0098] Step 3, combine the threshold decision method to detect abnormal graphs;

[0099] ​When the trained asymmetric autoencoder network model is used for anomaly image detection, when the input data is a background image, theoretically the loss generated by the asymmetric autoencoder network model will not be too far away from the final loss in the training phase, but will fluctuate within a certain small range. When the input data is an anomaly image, the difference between the loss generated by the asymmetric autoencoder network model and the final loss will exceed the small range of loss fluctuation of the asymmetric autoencoder network model. Taking advantage of this, the upper and lower limits of the judgment threshold interval are determined according to the final loss of the asymmetric autoencoder network model in the training phase. If it is within the threshold interval, it is judged as a background image, and if it exceeds the threshold interval, it is an anomaly image.

[0100] In the simulation experiment, the final loss fluctuation size is selected as The values ​​around are used as the network loss fluctuation range of the background image input during detection, and the upper and lower limits of the judgment threshold range of the CL background image are respectively and ;

[0101] Step 4: Performance evaluation;

[0102] Use accuracy (Accuracy), The performance of the abnormal subgraph detection method based on the asymmetric autoencoder network model is evaluated by four indicators: F1-score, False Positive Rate (FPR), and False Negative Rate (FNR). The expressions of the four indicators are:

[0103]

[0104]

[0105]

[0106]

[0107] in, True negative, is a true positive, A false positive It is a false negative.

[0108] The asymmetric autoencoder network model is trained using the CL background image training set, and the loss curve is as follows: Figure 4 As shown. Figure 4It can be seen that the loss of the proposed method converges rapidly with the increase of the number of training rounds. When the training round is 40, the model has converged smoothly. The background image label is set to 0 and the abnormal image label is set to 1. The trained model is evaluated using the CL background image training set and the CL abnormal image test set 1 respectively. The abnormal image detection results are as follows: Figure 5 As shown. Figure 5 It can be seen that the method of the present invention can accurately detect abnormal images, and the accuracy rate is 99.25%. The score is 0.99, the false alarm rate is 0%, and the missed alarm rate is 1.5%. In order to test the detection performance of the asymmetric autoencoder network model Model-CL, the method of the present invention is used to conduct experiments on the CL background image test set and the CL abnormal image test set 2 three times: 300, 200 and 200 respectively, and the average accuracy is 98.44%, the average The score was 0.9838, the average false alarm rate was 0%, and the average missed alarm rate was 3.13%.

[0109] Example 2:

[0110] To further verify the performance of the method of the present invention, the R-MAT random graph model is used to construct background image and anomaly image datasets for experiments. Corresponding to step 1.1, the specific process of using the R-MAT random graph model to construct the background image dataset is as follows:

[0111] First, the R-MAT random graph model is used to generate The background image is used to simulate the actual network structure, where is the number of vertices; probability matrix defines the probability of an edge connecting to a recursive submatrix of the graph, where 、 、 、 All of them are constants, and the sum of the four is 1. First, generate an empty adjacency matrix, divide the adjacency matrix into four sub-matrices of equal size, and for each edge to be added, calculate the probability matrix , randomly select a submatrix; repeat the operation of adding edges in the selected submatrix until the required graph size is reached or all edges are added, completing the generation of the R-MAT background graph; then, The background image adjacency matrix is ​​converted to The tensor is stored to form the R-MAT background image dataset, where For network channels;

[0112] In the simulation experiment, the R-MAT background image dataset has a total of 1000 background images, of which 200 background images are randomly selected as training sets and the other 800 as test sets. , , , , , ;

[0113] In the simulation experiment corresponding to step 1.2, the R-MAT anomaly graph dataset has a total of 1000 anomaly graphs, of which 200 are randomly selected as test set 1, and the other 800 are selected as test set 2, , ;

[0114] In the simulation experiment corresponding to step 2.2, 32, 1, , , 200 R-MAT background graphs of the background graph training set are used as training data, and the trained asymmetric autoencoder network model Model-RMAT is obtained after the model loss converges smoothly. A total of 100 rounds of training are performed to obtain the final loss ;

[0115] In the simulation experiment corresponding to step 3, the value with an upper and lower fluctuation of is selected as the network loss fluctuation interval when the input is the background graph, and the upper and lower limits of the R-MAT background graph decision threshold interval are and ;

[0116] The other steps and simulation experiment conditions are the same as in Example 1.

[0117] The asymmetric autoencoder network model is trained using the R-MAT background graph training set, and the loss curve is shown in Figure 6 . The background graph label is set to 0, and the anomaly graph label is set to 1. The R-MAT background graph training set and the R-MAT anomaly graph test set 1 are used to evaluate the trained model, and the anomaly graph detection result is shown in Figure 7 . As shown in Figure 7 , the method of the present application can accurately detect the anomaly graph, and the accuracy is 96.50%, the score is 0.96, the false alarm rate is 1%, and the missed report rate is 6%. In order to test the detection performance of the asymmetric autoencoder network model Model-RMAT, the R-MAT background graph test set and the R-MAT anomaly graph test set 2 are divided into three times: 300, 200 and 200, respectively, for experiment, and the average accuracy is 96.14%, the average score is 0.9538, the average false alarm rate is 0.75%, and the average missed report rate is 7.88%.

[0118] In summary, the simulation results show that the method of the application achieves good abnormal subgraph detection performance on both CL data sets and R-MAT data sets, thereby verifying the effectiveness of the method of the application.

[0119] The asymmetric autoencoder-based abnormal subgraph detection method of the application utilizes the learning ability and reconstruction ability of asymmetric autoencoding on the features of the background graph adjacency matrix, and combines the threshold decision method in traditional abnormal subgraph detection, so that the method has both the flexibility of threshold decision and the efficiency of deep learning method, and can improve the adaptability and flexibility of the detection method.

[0120] The asymmetric autoencoder-based abnormal subgraph detection method of the application utilizes the learning ability and reconstruction ability of asymmetric autoencoding on the features of the background graph adjacency matrix, and combines the threshold decision method in traditional abnormal subgraph detection, so that the method has both the flexibility of threshold decision and the efficiency of deep learning method, and can improve the adaptability and flexibility of the detection method.

[0121] Obviously, the above embodiments are only examples for clearly illustrating but not limiting the embodiments. Based on the above description, other different forms of changes or variations can be made by those skilled in the art. Here, all the embodiments need not and cannot be exhausted. The obvious changes or variations derived therefrom are still within the protection scope of the present application.

Claims

1. A method for detecting abnormal subgraphs based on an asymmetric autoencoder, characterized in that: The following steps are involved: Step 1: Construct background image and anomaly image datasets; Step 1.1, build background image dataset; Step 1.2: Construct anomaly graph dataset; Step 2: Build an anomaly graph detection network; Step 2.1, build an asymmetric autoencoder network model; Step 2.2: Train the asymmetric autoencoder network model. Step 3: Combine the threshold judgment method to detect abnormal images; The upper and lower limits of the judgment threshold interval are determined according to the final loss of the asymmetric autoencoder network model in the training phase. The image within the threshold interval is judged as a background image, and the image exceeding the threshold interval is judged as an abnormal image. Step 4: Performance evaluation; Use multiple metrics for performance evaluation; In step 2.1, in the asymmetric autoencoder network model built: The encoder consists of two layers of neural networks, and the decoder consists of four layers of neural networks. Each layer of the encoder neural network consists of a convolutional layer, a batch normalization layer, an activation function layer, and a maximum pooling layer. Each layer of the decoder neural network consists of a convolutional layer, a batch normalization layer, an activation function layer, and an upsampling layer. The convolution layer is used to learn the data structure features and reduce the data dimension at the same time; The batch normalization layer is used to normalize the data; The activation function layer is used to enhance the network learning ability and prevent overfitting by introducing nonlinearity; The maximum pooling layer is used to further reduce the dimension of the data while retaining the main features; The upsampling layer is used to interpolate and increase the dimension of the data, gradually restoring it to the size of the input data dimension.

2. The abnormal subgraph detection method based on asymmetric autoencoder according to claim 1 is characterized in that In step 1.1, constructing a background image dataset using the CL random graph model includes the following steps: Use the CL random graph model to generate a The background image, where is the number of vertices; Set the size to The background image adjacency matrix is ​​converted to The tensor is stored to form the CL background image dataset, where For the network channel.

3. The abnormal subgraph detection method based on asymmetric autoencoder according to claim 2 is characterized in that: In step 1.2, constructing an abnormal graph dataset using the ER model includes the following steps: First, randomly select on the CL background image Vertices, set the edge connection probability factor between vertices , construct ER subgraph using ER model; Then, the ER subgraph is embedded into the CL background graph to form the anomaly graph; Finally, the size of The abnormal graph adjacency matrix is ​​converted into a size of The tensor is stored to form the CL anomaly map dataset, where For network channels, is the number of vertices.

4. The abnormal subgraph detection method based on asymmetric autoencoder according to claim 1 is characterized in that: In step 1.1, the background image dataset is constructed using the R-MAT random graph model, which includes the following steps: First, the R-MAT random graph model is used to generate The background image, where is the number of vertices; Second, we define the probability of an edge being connected to the recursive submatrix of the graph, the probability matrix ,in, 、 、 、 They are all constants, and the sum of the four is 1; Then, generate an empty adjacency matrix, divide the adjacency matrix into four sub-matrices of equal size, and for each edge to be added, add the edge according to the probability matrix , randomly select a submatrix; repeat the operation of adding edges in the selected submatrix until the required graph size is reached or all edges are added, completing the generation of the R-MAT background graph; Finally, the size is The background image adjacency matrix is ​​converted to The tensor is stored to form the R-MAT background image dataset, where For the network channel.

5. The abnormal subgraph detection method based on asymmetric autoencoder according to claim 4 is characterized in that: In step 1.2, the R-MAT random graph model is used to construct an anomaly graph dataset.

6. The abnormal subgraph detection method based on asymmetric autoencoder according to claim 1 is characterized in that: Step 2.2 specifically includes the following steps: Let the background image adjacency matrix tensor be , the encoder is responsible for converting the input tensor Perform dimensionality reduction encoding in the asymmetric autoencoder network model The size is converted to , is the batch size for each network iteration, For network channels, is the number of vertices; the encoding process is expressed as: ； in, For the encoder, is the output tensor after dimensionality reduction encoding, the size is , is the network channel after dimensionality reduction encoding, is the number of vertices after dimensionality reduction encoding; The decoder is responsible for encoding the tensor output by the encoder Perform dimensionality-increasing decoding: ； in, is the decoder, is the reconstructed background image adjacency matrix tensor, size is ; use and The minimum mean square error is used as the reconstruction error to optimize the asymmetric autoencoder network model: ； in, represents the minimum mean square error, Represents the loss of asymmetric autoencoder network model training; Train the asymmetric autoencoder network model and calculate the loss , until Converge smoothly so that the decoder can restore the input data to the greatest extent possible.

7. The abnormal subgraph detection method based on asymmetric autoencoder according to claim 1 is characterized in that: The multiple metrics used in step 4 include: Accuracy 、 Score, false alarm rate and false negative rate .

8. The abnormal subgraph detection method based on asymmetric autoencoder according to claim 7 is characterized in that: In step 4, the accuracy 、 Score, false alarm rate and false negative rate The expressions are: ； ； ； ； in, True negative, is a true positive, A false positive It is a false negative.

Images