Graph anomaly detection method and system based on high-order structure self-supervised learning

Abstract

The invention discloses a graph anomaly detection method and system based on high-order structure self-supervised learning, and belongs to the technical field of anomaly detection. The method specifically comprises the following steps: selecting a target node from nodes of a to-be-detected graph, and sampling based on the target node to obtain a sub-graph of the target node; meanwhile, obtaining a node motif matrix of the target node by utilizing a motif counting algorithm; reconstructing the node motif matrix through an auto-encoder, and obtaining a node anomaly score of a to-be-detected graph motif level; through node-subgraph comparative learning of the target node and subgraph attribute reconstruction, obtaining a feature anomaly score of the to-be-detected graph node on a subgraph level; and in combination with the node abnormal score of the motif level and the feature abnormal score of the sub-graph level, identifying abnormal nodes in the graph. According to the method, the multi-view self-supervised learning task is designed for the high-order structure characteristics in the graph structure data, the utilization efficiency of high-order information is effectively improved, and the accuracy of anomaly detection is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of graph anomaly detection, and more particularly to a graph anomaly detection method and system based on high-order structure self-supervised learning. Background Art

[0002] As the scale of various network systems continues to expand and their interaction patterns become increasingly diverse, complex systems in the real world are becoming highly dynamic and diverse, and are also facing various external attack threats. Anomalies manifest in a variety of ways, such as spammers, disinformation propagators, fraudulent or bot accounts in social networks, intruders in computer networks, and damaged equipment or faulty units in industrial systems. These anomalous entities often severely impact the stability and security of the entire system. Against this backdrop, graph anomaly detection, a key technology for identifying anomalous nodes and connections in graph-structured data, has attracted widespread attention. Graph anomaly detection is not only used to identify fake accounts, spam, and fraudulent behavior in social networks, but also has important applications in areas such as computer network security, financial risk monitoring, and industrial system fault detection. With the widespread use of graph data and the advent of the big data era, accurately and rapidly detecting anomalies in massive, high-dimensional graph data has become a pressing research challenge.

[0003] Traditional graph anomaly detection methods are mainly divided into two categories: those based on probabilistic statistics and traditional machine learning techniques. The former judges anomalies by assuming that normal data follows a specific distribution or probabilistic model, but it is highly dependent on prior knowledge and has high complexity. The latter uses methods such as clustering, decision trees, classification, and nearest neighbors to reduce dependence on data distribution, but has obvious limitations when processing large-scale, high-dimensional, and highly nonlinear graph data. In recent years, with the breakthroughs of deep learning technology in fields such as natural language processing and image processing, graph deep learning-based methods use graph neural networks to learn the deep relationships between nodes and edges in the graph, showing significant advantages in anomaly detection tasks. However, due to the difficulty of collecting anomaly labels and the lack of model generalization, traditional supervised learning methods still cannot meet practical needs.

[0004] In recent years, graph contrastive learning has provided a new research perspective for anomaly detection, leveraging its label-free, self-supervised learning mechanism. Existing methods typically construct comparisons between nodes and subgraphs, or between nodes, leveraging significant differences between positive and negative samples to improve anomaly detection performance, thus advancing the development of graph representation learning. However, existing graph contrastive learning methods have design limitations. On the one hand, these methods often focus on extracting structural information, such as the relationship between nodes and subgraphs or between nodes, while neglecting the rich high-level information inherent in graph data. On the other hand, generative learning cannot be completely replaced by contrastive learning for learning node attributes, and has its own advantages. Summary of the Invention

[0005] In view of this, the present invention provides a graph anomaly detection method and system based on high-order structure self-supervised learning. By extracting two high-order structures, motifs and subgraphs, from graph data and designing different preset tasks in a targeted manner, it can not only fully mine the node anomaly patterns at the motif level, but also capture the anomalies of nodes in structure and attributes, and organically structure generative learning and comparative learning to make up for their respective shortcomings.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] A graph anomaly detection method based on high-order structure self-supervised learning includes the following steps:

[0008] Step S1: Select a target node from the nodes of the graph to be detected, and perform sampling based on the target node to obtain a subgraph of the target node;

[0009] At the same time, the node motif matrix of the target node is obtained by using the motif counting algorithm;

[0010] Step S2: reconstruct the node motif matrix through the autoencoder and obtain the node anomaly score of the graph motif level to be detected;

[0011] Step S3: Obtain the feature anomaly score of the node to be detected at the subgraph level through node-subgraph comparative learning and subgraph attribute reconstruction of the target node;

[0012] Step S4: Combine the node anomaly score at the motif level with the feature anomaly score at the subgraph level to identify abnormal nodes in the graph.

[0013] Furthermore, in step S1, sampling based on the target node specifically includes the following steps:

[0014] A target node is randomly selected from the nodes of the graph to be detected, and the neighborhood of the target node is sampled using a random walk strategy with restart, and a subgraph containing the target node and its neighborhood nodes is obtained as a positive subgraph;

[0015] A random walk strategy with restart is used to sample the neighborhood of non-target nodes, and a subgraph including the non-target node and its neighborhood nodes is obtained as a negative subgraph.

[0016] Furthermore,

[0017] Replace the attribute vector corresponding to the target node as the initial node in the positive subgraph with the zero vector;

[0018] Replace the attribute vectors corresponding to the non-target nodes in the negative subgraph that are the initial nodes with zero vectors.

[0019] Furthermore, in the step of obtaining the node motif matrix of the target node using a motif counting algorithm, the motif counting algorithm includes an enumeration method.

[0020] Furthermore, the step S2 specifically includes the following steps:

[0021] Step S201: Use the first graph neural network encoder based on the graph convolution layer to map the node motif matrix of the target node to a low-dimensional embedding space to obtain a high-order structural embedding representation of the target node.

[0022]

[0023] Where σ(·) represents the ReLU nonlinear activation function; GNN enc1 Represents the first graph neural network encoder based on graph convolutional layer; and Respectively represent the node motif matrix and adjacency matrix of the selected target node; is the adjacency matrix The normalized adjacency matrix; W enc1 is the parameter matrix of the first graph neural network encoder;

[0024] Step S202: Using the first graph neural network decoder based on the graph convolution layer, the obtained high-order structure embedding representation Decode it and restore it to the original vector space of the target node to obtain the motif reconstruction matrix

[0025]

[0026] Among them GNN dec1 represents the first graph neural network decoder based on graph convolutional layer, W dec1 is the parameter matrix of the first graph neural network decoder;

[0027] Step S203: Calculate the motif reconstruction matrix using the bi-norm The anomaly score f gen :

[0028]

[0029] where δ(·) represents the normalization function, represents the 2-norm, m i Represents the node motif matrix The motif vector in , Represents the reconstruction matrix The node motif vector in .

[0030] Furthermore, the step S3 specifically includes the following steps:

[0031] Obtain the subgraph attribute matrix of the target node according to the attribute matrix of the graph to be detected, reconstruct the subgraph attribute matrix through the autoencoder, and obtain the subgraph attribute anomaly score after the reconstruction of the subgraph attribute matrix;

[0032] Build a node-subgraph comparative learning model and obtain the subgraph comparative learning anomaly score through comparative learning;

[0033] The subgraph attribute anomaly score and the subgraph comparative learning anomaly score are weightedly summed to obtain the feature anomaly score of the node to be detected at the subgraph level.

[0034] Furthermore, the subgraph attribute matrix of the target node is obtained according to the attribute matrix of the graph to be detected, and the subgraph attribute matrix is ​​reconstructed through the autoencoder to obtain the subgraph attribute anomaly score after the subgraph attribute matrix is ​​reconstructed, which specifically includes:

[0035] Step S3011: Obtain the subgraph attribute matrix of the target node, and use the second graph neural network encoder based on the graph convolution layer to map the subgraph attribute matrix of the target node to the embedding space to obtain the subgraph embedding representation

[0036]

[0037] Where σ(·) represents the ReLU nonlinear activation function; GNN enc2 represents the second graph neural network encoder based on the graph convolutional layer; Represents the node attribute matrix of the selected target node; Represents the adjacency matrix of the selected target node, W enc2 represents the parameter matrix of the second graph neural network encoder;

[0038] Step S3012: The learned subgraph embedding representation is restored through a decoder based on multi-layer graph convolution so that it is in the same embedding space as the original attributes of the target node, and the subgraph attribute reconstruction matrix is ​​obtained.

[0039]

[0040] Among them GNN dec2 represents the first graph neural network decoder based on graph convolutional layer, W dec2 is the parameter matrix of the first graph neural network decoder;

[0041] Step S3013: Use the bi-norm to calculate the abnormality score f of the subgraph attribute reconstruction matrix sub1 :

[0042]

[0043] where δ(·) represents the normalization function, represents the 2-norm, x i Represents the subgraph attribute matrix The attribute vector in , Represents the subgraph attribute matrix The node attribute vector in .

[0044] Furthermore, a node-subgraph comparative learning model is constructed. Through comparative learning, a subgraph comparative learning anomaly score is obtained, which specifically includes:

[0045] Step S3021: Use the average readout function to read the target node v i The embedded representation is obtained from the subgraph attribute matrix

[0046]

[0047] Where N is the number of nodes in the subgraph, is the sub-graph attribute matrix obtained by the encoder, represents the sub-graph embedding after average readout;

[0048] Step 3022: Select the subgraph embedding containing the target node as the positive subgraph embedding Select the subgraph embedding that does not contain the target node as the negative subgraph embedding

[0049] Step S3023: Obtain the target node embedding h using the parameters of the learned subgraph embedding i , the node embedding and the subgraph embedding are in the same attribute space;

[0050] h i =σ(x i W enc2 ).

[0051] Step S3024: Construct a node-subgraph comparison learning module, use a discriminator to compare the target node embedding with the positive and negative subgraph embeddings, and obtain a preliminary score for the comparison of the positive and negative subgraphs. The specific operation is as follows:

[0052]

[0053] where h i is the node-target node embedding, W (d) is the decision parameter matrix, sp and s n are the preliminary scores obtained by comparing the target node with the positive and negative subgraphs, respectively;

[0054] Step S3024: Measure the similarity between the node and the subgraph to obtain multiple rounds of positive and negative scores And finally obtain the contrast anomaly score f sub2 (v i ), calculated as follows:

[0055]

[0056] Where R training represents the number of rounds, The two are s p and s n The specific representation of the score of the target node in round r compared with the positive and negative subgraphs respectively.

[0057] Furthermore, the step S4 specifically includes the following steps:

[0058] The final anomaly score is obtained by weighted summing the anomaly scores at the motif level and the subgraph level.

[0059] The present invention also discloses a graph anomaly detection system based on high-order structure self-supervised learning, comprising:

[0060] Graph data acquisition module, which obtains graph structure data and constructs adjacency matrix and node attribute matrix;

[0061] The high-order structure sampling module samples two high-order structures based on the motif subgraph;

[0062] A motif-based generative learning module reconstructs the node motif matrix through an autoencoder to identify node anomalies at the motif level;

[0063] The subgraph-based contrastive learning module uses a graph convolutional network to encode the target node and its corresponding subgraph, and combines node-subgraph contrastive learning and subgraph attribute reconstruction to mine abnormal features of nodes at the subgraph level;

[0064] The anomaly scoring module identifies abnormal nodes in the graph by combining the anomaly scores of the motif and subgraph levels.

[0065] Compared with the prior art, the present invention has the following characteristics:

[0066] The method of the present invention not only improves the accuracy and robustness of anomaly detection, but also enhances the adaptability to complex and dynamic graph data, providing a more efficient and accurate solution for anomaly detection in practical applications.

[0067] Scalability: The graph structure method provided by the present invention fully combines and utilizes the high-order structural information, attribute information and topological information in the graph data through a hybrid self-supervisory method, thereby extracting more abnormal graph node representations. At the same time, the method can control the balance parameter β by adjusting the parameters during the mapping process, effectively solving the existing organic combination of generative methods and comparative methods, and using the sub-generative method to reconstruct the motif and learn the representation of the node in the high-order structure. Based on this, a high-order structure hybrid self-supervised learning graph anomaly detection model is constructed, and the three preset tasks of "motif reconstruction", "node-subgraph comparison" and "subgraph attribute reconstruction" can more effectively capture the high-order structure, attribute and topological information of the graph data. The method of the present invention can change the number of preset tasks as needed, which increases flexibility and adaptability.

[0068] Accuracy: In real-world anomaly detection tasks, the collected data often contains missing labels, and abnormal nodes will be disguised, which seriously affects the reliability of detection. The present invention uses a hybrid self-supervisory method, without the need for labels during training, and uses the comparison of "motif reconstruction" to identify anomalies in high-order structures, and uses the comparison between "node-subgraph" to derive topological information, while using "attribute reconstruction" to identify attribute anomalies. Compared with existing anomaly detection methods, the AUC indicators of five commonly used data sets, ACM, Citeseer, Cora and Pubmed, have achieved significant improvements of 3.70%, 0.19%, 1.85%, 3.80%, 2.46% and 2.77% respectively. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0070] Figure 1 This is a flow chart of a graph anomaly detection method based on high-order structure self-supervised learning according to an embodiment of the present invention.

[0071] Figure 2 Schematic diagram of high-order structure sampling according to an embodiment of the present invention.

[0072] Figure 3 Schematic diagram of the node anomaly score calculation process at the motif level for self-supervised learning according to an embodiment of the present invention.

[0073] Figure 4 A schematic diagram of the process of obtaining a subgraph contrastive learning anomaly score through contrastive learning provided in an embodiment of the present invention.

[0074] Figure 5 This is a schematic diagram of obtaining the final anomaly score according to an embodiment of the present invention.

[0075] Figure 6 2 is a block diagram of system modules according to an embodiment of the present invention. DETAILED DESCRIPTION

[0076] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0077] The present invention is described in further detail below with reference to the accompanying drawings:

[0078] This invention provides a graph anomaly detection method based on self-supervised learning of high-order structures. This method first extracts two high-order structures, motifs and subgraphs, and then designs targeted pre-set tasks to facilitate learning. This method identifies high-order structural anomalies through motif reconstruction, topological anomalies through node-subgraph comparison, and attribute anomalies through subgraph attribute reconstruction. An anomaly scoring module then calculates motif-based, subgraph-based, and comparison-based anomaly scores, and performs a weighted summation of these scores to quantify node anomalies. This method thus constructs a graph anomaly detection method based on self-supervised learning of high-order structures.

[0079] Reference Figure 1 As shown, the self-supervised graph anomaly detection method based on high-order structure of the present invention includes the following steps:

[0080] Step S1: Select a target node from the nodes of the graph to be detected, and perform sampling based on the target node to obtain a subgraph of the target node;

[0081] At the same time, the node motif matrix of the target node is obtained by using the motif counting algorithm;

[0082] Step S2: reconstruct the node motif matrix through the autoencoder and obtain the node anomaly score of the graph motif level to be detected;

[0083] Step S3: Obtain the feature anomaly score of the node to be detected at the subgraph level through node-subgraph comparative learning and subgraph attribute reconstruction of the target node;

[0084] Step S4: Combine the node anomaly score at the motif level with the feature anomaly score at the subgraph level to identify abnormal nodes in the graph.

[0085] Reference Figure 2, in step 1, sampling the target node includes the following steps:

[0086] A target node is randomly selected from the nodes of the graph to be detected, and the neighborhood of the target node is sampled using a random walk strategy with restarts, and a subgraph containing the target node and its neighborhood nodes is obtained as a positive subgraph;

[0087] The random walk strategy with restart is used to sample the neighborhood of non-target nodes, and a subgraph containing the non-target node and its neighborhood nodes is obtained as a negative subgraph.

[0088] Furthermore, in the process of neighborhood sampling using the random walk strategy with restart, the attribute vector is replaced by a zero vector to mask the attribute information of the initial node, thereby preventing the initial node of the restarted random walk from leaking information during the contrastive learning process;

[0089] refer to Figure 3 , step S2 mainly reconstructs the node motif matrix through the autoencoder to identify node anomalies at the motif level, including the following steps:

[0090] Step S201: Use the first graph neural network encoder based on the graph convolution layer to map the node motif matrix of the target node to a low-dimensional embedding space to obtain a high-order structural embedding representation of the target node.

[0091]

[0092] Where σ(·) represents the ReLU nonlinear activation function; GNN enc1 Represents the first graph neural network encoder based on graph convolutional layer; and Respectively represent the node motif matrix and adjacency matrix of the selected target node; is the adjacency matrix The normalized adjacency matrix; W enc1 is the parameter matrix of the first graph neural network encoder;

[0093] Step S202: Using the first graph neural network decoder based on the graph convolution layer, the obtained high-order structure embedding representation Decode it and restore it to the original vector space of the target node to obtain the motif reconstruction matrix

[0094]

[0095] Among them GNN dec1 represents the first graph neural network decoder based on graph convolutional layer, W dec1 is the parameter matrix of the first graph neural network decoder;

[0096] Step S203: Calculate the motif reconstruction matrix using the bi-norm The anomaly score f gen :

[0097]

[0098] where δ(·) represents the normalization function, represents the 2-norm, m i Represents the node motif matrix The motif vector in , Represents the reconstruction matrix The node motif vector in .

[0099] Step S3 is mainly used to mine abnormal features of nodes at the subgraph level, which specifically includes the following steps:

[0100] Obtain the subgraph attribute matrix of the target node according to the attribute matrix of the graph to be detected, reconstruct the subgraph attribute matrix through the autoencoder, and obtain the subgraph attribute anomaly score after the reconstruction of the subgraph attribute matrix;

[0101] Build a node-subgraph comparative learning model and obtain the subgraph comparative learning anomaly score through comparative learning;

[0102] The subgraph attribute anomaly score and the subgraph comparative learning anomaly score are weightedly summed to obtain the feature anomaly score of the node to be detected at the subgraph level.

[0103] The following describes two scoring calculation methods at the subgraph level.

[0104] First, the subgraph attribute matrix is ​​reconstructed through the autoencoder to obtain the subgraph attribute anomaly score after the subgraph attribute matrix is ​​reconstructed, specifically including:

[0105] Step S3011: Obtain the subgraph attribute matrix of the target node, and use the second graph neural network encoder based on the graph convolution layer to map the subgraph attribute matrix of the target node to the embedding space to obtain the subgraph embedding representation

[0106]

[0107] Where σ(·) represents the ReLU nonlinear activation function; GNN enc2 represents the second graph neural network encoder based on the graph convolutional layer; Represents the node attribute matrix of the selected target node; Represents the adjacency matrix of the selected target node, W enc2 represents the parameter matrix of the second graph neural network encoder;

[0108] Step S3012: The learned subgraph embedding representation is restored through a decoder based on multi-layer graph convolution so that it is in the same embedding space as the original attributes of the target node, and the subgraph attribute reconstruction matrix is ​​obtained.

[0109]

[0110] Among them GNN dec2 represents the first graph neural network decoder based on graph convolutional layer, W dec2 is the parameter matrix of the first graph neural network decoder;

[0111] Step S3013: Use the bi-norm to calculate the abnormality score f of the subgraph attribute reconstruction matrix sub1 :

[0112]

[0113] where δ(·) represents the normalization function, represents the 2-norm, x i Represents the subgraph attribute matrix The attribute vector in , Represents the subgraph attribute matrix The node attribute vector in .

[0114] Secondly, reference Figure 4 ,Abnormality discrimination at the subgraph level also includes,building a node-subgraph comparative learning model,and obtaining the subgraph comparative learning anomaly score through comparative learning,specifically including:

[0115] Step S3021: Use the average readout function to read the target node v i The embedded representation is obtained from the subgraph attribute matrix

[0116]

[0117] Where N is the number of nodes in the subgraph, is the sub-graph attribute matrix obtained by the encoder, represents the sub-graph embedding after average readout;

[0118] Step 3022: Select the subgraph embedding containing the target node as the positive subgraph embedding Select the subgraph embedding that does not contain the target node as the negative subgraph embedding

[0119] Step S3023: Obtain the target node embedding h using the parameters of the learned subgraph embedding i , the node embedding and the subgraph embedding are in the same attribute space;

[0120] h i =σ(x i W enc2 )

[0121] Step S3024: Construct a node-subgraph comparison learning module, use a discriminator to compare the target node embedding with the positive and negative subgraph embeddings, and obtain a preliminary score for the comparison of the positive and negative subgraphs. The specific operation is as follows:

[0122]

[0123] where h i is the node-target node embedding, W (d) is the decision parameter matrix, s p and s n are the preliminary scores obtained by comparing the target node with the positive and negative subgraphs, respectively;

[0124] Step S3024: Measure the similarity between the node and the subgraph to obtain multiple rounds of positive and negative scores And finally obtain the contrast anomaly score f sub2 (v i ), calculated as follows:

[0125]

[0126] Where R training represents the number of rounds, The two are s p and s n The specific representation of the score of the target node in round r compared with the positive and negative subgraphs respectively.

[0127] Finally, the subgraph attribute anomaly score and the subgraph comparative learning anomaly score are weighted and summed to obtain the feature anomaly score of the node to be detected at the subgraph level. The formula is as follows:

[0128] f sub1 (v i )=αf sub1 +(1-α)f sub2

[0129] where α is the balance parameter between the scores.

[0130] Reference Figure 5 (Below) After obtaining the anomaly scores for different patterns, the final score for identifying anomaly nodes in the graph is obtained by combining the anomaly scores at the motif and subgraph levels. This is done in the following steps:

[0131] Normalize each score and perform weighted summation to obtain the final anomaly score f(v i ), as shown below

[0132] f(v i )=(1-β)f con (v i )+βf gen (v i )

[0133] where β represents the balance parameter among the three scores.

[0134] The method of the present invention finally realizes the identification of abnormal nodes in graph data through the above-mentioned processes such as data acquisition, high-order structure extraction, motif reconstruction, node-subgraph comparison, subgraph attribute reconstruction, and anomaly scoring. During the model training process, the parameters of generative learning and contrastive learning are optimized through a hybrid self-supervised learning strategy to fully integrate the two high-order structural features. In the prediction stage, the data preparation, high-order structure extraction and encoding steps are repeated for new data, and the anomaly score is calculated using the trained model to finally identify abnormal nodes in the graph structure data. It should be pointed out that this process can be implemented using a similar graph structure learning method.

[0135] On the other hand, reference Figure 6 The embodiment of the present invention further discloses a graph anomaly detection system based on high-order structure self-supervised learning, comprising:

[0136] Graph data acquisition module, which obtains graph structure data and constructs adjacency matrix and node attribute matrix;

[0137] The high-order structure sampling module samples two high-order structures based on the motif subgraph;

[0138] A motif-based generative learning module reconstructs the node motif matrix through an autoencoder to identify node anomalies at the motif level;

[0139] The subgraph-based contrastive learning module uses a graph convolutional network to encode the target node and its corresponding subgraph, and combines node-subgraph contrastive learning and subgraph attribute reconstruction to mine abnormal features of nodes at the subgraph level;

[0140] The anomaly scoring module identifies abnormal nodes in the graph by combining the anomaly scores of the motif and subgraph levels.

[0141] The technical effects of the present invention are verified by a specific embodiment below, and compared with the existing similar methods. The specific steps are as follows:

[0142] (1) Four real anomaly datasets are used for experimental verification. These datasets cover four citation network datasets (ACM, Cora, Citeseer, and Pubmed). The anomaly injection method is used to generate graph anomalies in these real datasets.

[0143] (2) The dataset is randomly divided into a training set (30%) and a test set (70%), and the anomaly labels are uniformly processed using one-hot encoding. The Adam optimizer is used to optimize the model training process until the iteration stopping condition is reached and the optimal anomaly recognition model is obtained;

[0144] (3) The test data is fed into the trained graph anomaly detection model to detect abnormal nodes, and the results are evaluated using AUC and AUPR as evaluation metrics. The results are compared with existing technologies, including one autoencoder-based method (DOMINANT), two contrast-based methods (CoLA and GCAD), and three methods that combine contrast and autoencoders (SL-GAD, ComGA, and GRADATE). The comparison results are shown in Tables 1 and 2.

[0145] Comparison revealed that the method provided by the present invention significantly outperforms other methods. Across six anomaly-injected graph datasets, the method surpassed all baseline methods in terms of the AUC metric. Specifically, the method achieved significant AUC improvements of 8.56%, 4.30%, 3.30%, 3.24%, and 1.0% on the ACM, Cora, Citeseer, and Pubmed datasets, respectively. Furthermore, the AUPR results further demonstrated that the method significantly improved the detection rate of positive samples compared to the baseline methods on most datasets, particularly on the Pubmed dataset, where the AUPR improved by approximately 22.09%. These findings reveal the advantages of the method in terms of comprehensive performance and its ability to effectively adapt to the needs of diverse application scenarios. This performance improvement is attributed, in part, to its hybrid self-supervised learning anomaly detection model, which pre-defines multiple tasks. Furthermore, by utilizing motif matrix reconstruction, it better captures high-order structural information. Furthermore, hyperparameters can be used to control the emphasis on local and global anomaly detection, enabling flexible adaptation to different types of data and achieving better results.

[0146] Table 1 Performance comparison of the proposed method and other methods on 5 real data sets

[0147]

[0148] The following are system embodiments of the present invention, which can be used to implement the method embodiments of the present invention. For details not described in the system embodiments, please refer to the method embodiments of the present invention.

[0149] In one embodiment of the present invention, a graph anomaly detection system based on self-supervised learning of high-order structures is provided. The system is used to implement the above-mentioned graph anomaly detection method based on self-supervised learning of high-order structures. Among them, the graph data acquisition module is used to obtain graph structure data and construct an adjacency matrix and a node attribute matrix; the high-order structure extraction module is used to extract two high-order structures, motifs and subgraphs, for subsequent learning. The motif-based generative learning module uses an autoencoder architecture to reconstruct and learn the motif matrix to identify node anomalies at the motif level; the subgraph-based contrastive learning module implements contrastive learning by constructing a node-subgraph comparison to mine the abnormal representation of the node in topology, and identifies anomalies at the attribute level by reconstructing the subgraph attributes; the anomaly scoring module obtains a comprehensive anomaly score of the target node in combination with different preset tasks, thereby identifying abnormal nodes.

[0150] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0151] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A graph anomaly detection method based on high-order structure self-supervised learning, characterized in that: The following steps are involved: Step S1: Select a target node from the nodes of the graph to be detected, and perform sampling based on the target node to obtain a subgraph of the target node; At the same time, the node motif matrix of the target node is obtained by using the motif counting algorithm; Step S2: reconstruct the node motif matrix through the autoencoder and obtain the node anomaly score of the graph motif level to be detected; Step S3: Obtain the feature anomaly score of the node to be detected at the subgraph level through node-subgraph comparative learning and subgraph attribute reconstruction of the target node; Step S4: Combine the node anomaly score at the motif level with the feature anomaly score at the subgraph level to identify abnormal nodes in the graph.

2. The graph anomaly detection method based on high-order structure self-supervised learning according to claim 1 is characterized in that: In step S1, sampling based on the target node specifically includes the following steps: A target node is randomly selected from the nodes of the graph to be detected, and the neighborhood of the target node is sampled using a random walk strategy with restart, and a subgraph containing the target node and its neighborhood nodes is obtained as a positive subgraph; A random walk strategy with restart is used to sample the neighborhood of non-target nodes, and a subgraph including the non-target node and its neighborhood nodes is obtained as a negative subgraph.

3. The graph anomaly detection method based on high-order structure self-supervised learning according to claim 2 is characterized in that: Also includes, Replace the attribute vector corresponding to the target node as the initial node in the positive subgraph with the zero vector; Replace the attribute vectors corresponding to the non-target nodes in the negative subgraph that are the initial nodes with zero vectors.

4. The graph anomaly detection method based on high-order structure self-supervised learning according to claim 1 is characterized in that In the step of obtaining a node motif matrix of a target node using a motif counting algorithm, the motif counting algorithm includes an enumeration method.

5. The graph anomaly detection method based on high-order structure self-supervised learning according to claim 1 is characterized in that: Said S2 specifically comprises the following steps: Step S201: Use the first graph neural network encoder based on the graph convolution layer to map the node motif matrix of the target node to a low-dimensional embedding space to obtain a high-order structural embedding representation of the target node. Where σ(·) represents the ReLU nonlinear activation function; GNN enc1 Represents the first graph neural network encoder based on graph convolutional layer; and Respectively represent the node motif matrix and adjacency matrix of the selected target node; is the adjacency matrix The normalized adjacency matrix; W enc1 is the parameter matrix of the first graph neural network encoder; Step S202: Using the first graph neural network decoder based on the graph convolution layer, the obtained high-order structure embedding representation Decode it and restore it to the original vector space of the target node to obtain the motif reconstruction matrix Among them GNN dec1 represents the first graph neural network decoder based on graph convolutional layer, W dec1 is the parameter matrix of the first graph neural network decoder; Step S203: Calculate the motif reconstruction matrix using the bi-norm The anomaly score f mot (v i ): where δ(·) represents the normalization function, represents the 2-norm, m i Represents the node motif matrix The motif vector in , Represents the reconstruction matrix The node motif vector in .

6. The graph anomaly detection method based on high-order structure self-supervised learning according to claim 1 is characterized in that The step S3 specifically includes the following steps: Obtain the subgraph attribute matrix of the target node according to the attribute matrix of the graph to be detected, reconstruct the subgraph attribute matrix through the autoencoder, and obtain the subgraph attribute anomaly score after the reconstruction of the subgraph attribute matrix; Build a node-subgraph comparative learning model and obtain the subgraph comparative learning anomaly score through comparative learning; The subgraph attribute anomaly score and the subgraph comparative learning anomaly score are weightedly summed to obtain the feature anomaly score of the node to be detected at the subgraph level.

7. The graph anomaly detection method based on high-order structure self-supervised learning according to claim 6 is characterized in that: The subgraph attribute matrix of the target node is obtained according to the attribute matrix of the graph to be detected. The subgraph attribute matrix is ​​reconstructed through the autoencoder to obtain the subgraph attribute anomaly score after the subgraph attribute matrix is ​​reconstructed. Specifically, it includes: Step S3011: Obtain the subgraph attribute matrix of the target node, and use the second graph neural network encoder based on the graph convolution layer to map the subgraph attribute matrix of the target node to the embedding space to obtain the subgraph embedding representation Where σ(·) represents the ReLU nonlinear activation function; GNN enc2 represents the second graph neural network encoder based on the graph convolutional layer; Represents the node attribute matrix of the selected target node; Represents the adjacency matrix of the selected target node, W enc2 represents the parameter matrix of the second graph neural network encoder; Step S3012: The learned subgraph embedding representation is restored through a decoder based on multi-layer graph convolution so that it is in the same embedding space as the original attributes of the target node, and the subgraph attribute reconstruction matrix is ​​obtained. Among them GNN dec2 represents the first graph neural network decoder based on graph convolutional layer, W dec2 is the parameter matrix of the first graph neural network decoder; Step S3013: Use the bi-norm to calculate the abnormality score f of the subgraph attribute reconstruction matrix sub1 (v i ): where v i represents the target node, δ(·) represents the normalization function, represents the 2-norm, x i Represents the subgraph attribute matrix The attribute vector in , Represents the subgraph attribute matrix The node attribute vector in .

8. The graph anomaly detection method based on high-order structure self-supervised learning according to claim 7 is characterized in that: Build a node-subgraph comparative learning model and obtain the subgraph comparative learning anomaly score through comparative learning, including: Step S3021: Use the average readout function to read the target node v i The embedded representation is obtained from the subgraph attribute matrix Where N is the number of nodes in the subgraph, is the sub-graph attribute matrix obtained by the encoder, represents the sub-graph embedding after average readout; Step 3022: Select the subgraph embedding containing the target node as the positive subgraph embedding Select the subgraph embedding that does not contain the target node as the negative subgraph embedding Step S3023: Obtain the target node embedding h using the parameters of the learned subgraph embedding i , the node embedding and the subgraph embedding are in the same attribute space; h i =σ(x i W enc2 ) Step S3024: Construct a node-subgraph comparison learning module, use a discriminator to compare the target node embedding with the positive and negative subgraph embeddings, and obtain a preliminary score for the comparison of the positive and negative subgraphs. The specific operation is as follows: where h i is the node-target node embedding, W (d) is the decision parameter matrix, s p and s n are the preliminary scores obtained by comparing the target node with the positive and negative subgraphs, respectively; Step S3024: Measure the similarity between the node and the subgraph to obtain multiple rounds of positive and negative scores And finally obtain the contrast anomaly score f sub2 (v i ), calculated as follows: Where R training represents the number of rounds, The two are s p and s n The specific representation of the score of the target node in round r compared with the positive and negative subgraphs respectively.

9. The graph anomaly detection method based on high-order structure self-supervised learning according to claim 1, characterized in that: The step S4 specifically includes the following steps: The final anomaly score is obtained by weighted summing the anomaly scores at the motif level and the subgraph level.

10. A graph anomaly detection system based on high-order structure self-supervised learning, characterized in that: include: Graph data acquisition module, which obtains graph structure data and constructs adjacency matrix and node attribute matrix; The high-order structure sampling module samples two high-order structures based on the motif subgraph; A motif-based generative learning module reconstructs the node motif matrix through an autoencoder to identify node anomalies at the motif level; The subgraph-based contrastive learning module uses a graph convolutional network to encode the target node and its corresponding subgraph, and combines node-subgraph contrastive learning and subgraph attribute reconstruction to mine abnormal features of nodes at the subgraph level; The anomaly scoring module identifies abnormal nodes in the graph by combining the anomaly scores of the motif and subgraph levels.

Images