Self-supervised graph anomaly detection method based on global space correlation perception

Abstract

The invention discloses a self-supervised graph anomaly detection method based on global space correlation perception, and relates to the fields of financial security, network security and the like. The method comprises the following steps: sampling global and local sub-graphs based on graph diffusion and random walk; local and global information of coding is learned through double-view comparison; utilizing node attribute consistency characteristics based on attribute reconstruction learning; and training the contrast learning module and the reconstruction learning module in a combined manner and fusing scores to realize anomaly detection. According to the method, local and global structure information and node attribute features are integrated, so that the influence of graph neural network signal smoothing on anomaly detection is effectively relieved, the detection accuracy of abnormal nodes in an attribute network is improved, and the method is suitable for anomaly detection of scenes such as social networks and transaction networks.

Description

Technical Field

[0001] This invention presents a self-supervised graph anomaly detection method based on global spatial correlation awareness, applicable to fields such as financial security and cybersecurity. It is primarily used for detecting anomalous users in social and transaction networks, and holds significant importance in the era of big data on the internet. Background Technology

[0002] Attribute networks are ubiquitous in the real world, appearing in scenarios such as social networks and citation networks. In recent years, anomaly detection in attribute networks has played a significant role in security-related applications such as social media spam detection, financial fraud detection, and network intrusion detection, sparking growing research interest. Despite extensive research in this field, anomaly detection in attribute networks remains a challenging task. The core challenge lies in the fact that a node's anomalous patterns are not only related to its interactions with other nodes in the topology but also closely related to inconsistencies exhibited at the node's attribute level.

[0003] Early anomaly detection techniques (such as matrix factorization and OC-SVM) have been widely used in numerous applications. A major limitation of these methods is their heavy reliance on feature engineering constructed by domain experts. In recent years, deep learning techniques (especially graph neural networks (GNNs)) have achieved significant performance improvements in graph mining tasks such as link prediction and node classification. GNN-based techniques have also been introduced into the field of anomaly detection, aiming to learn node representations with anomaly-aware capabilities. Due to the high cost of acquiring anomaly samples, anomaly detection is usually performed unsupervised. Therefore, researchers have first proposed a graph anomaly detection framework based on contrastive learning. This model uses local contextual information as a supervisory signal, learns representational features from node-subgraph instance pairs, and ultimately detects anomalous nodes through discriminative scores.

[0004] Despite recent extensive research addressing this issue, existing methods still suffer from the following shortcomings: First, local and global structural information is not effectively utilized and integrated. While state-of-the-art solutions utilize node-subgraph comparison instances to focus on local information for anomaly detection, their single-layer GCNs can only extract local structural information from the first-order neighborhood of nodes, failing to effectively capture higher-order global structural information. Existing research indicates that higher-order neighborhood information is equally valuable for graph mining tasks. Furthermore, GCNs are essentially a special form of low-pass filters, and their signal smoothing characteristics intensify with increasing layers, potentially weakening anomalous signals. Therefore, more effective and decoupled methods for extracting and fusing local and global structural information are needed to provide high-quality structural features. Second, how to effectively fuse node attributes and network topology to improve detection performance has not been fully explored. Although GCNs can handle both topology and node attributes simultaneously, the learned representations are not entirely suitable for anomaly detection in unsupervised scenarios. Anomalous nodes often exhibit inconsistencies with their neighboring nodes at the attribute level; this characteristic can provide additional self-supervised signals. However, how to make full use of such signals and build an attribute reconstruction model based on the attribute consistency principle to improve anomaly detection performance still lacks in-depth research. Summary of the Invention

[0005] Purpose of the Invention: The purpose of this invention is to address the shortcomings of existing technologies by proposing a self-supervised graph anomaly detection method based on global spatial correlation awareness. This method first augments the data using graph diffusion and subgraph sampling techniques, and then introduces the concept of global correlation alignment during model training to solve the deficiencies pointed out in the background section. Using the method disclosed in this invention, node anomaly detection can be flexibly implemented in situations involving multiple couplings of structure and attributes.

[0006] Technical solution: A self-supervised graph anomaly detection method based on global spatial correlation awareness, the specific steps of which are as follows:

[0007] S1. Global and Local Subgraph Sampling: Using the original graph network as input, for each node, a subgraph is sampled under given hyperparameters based on graph diffusion and random walk techniques.

[0008] S2. Anomaly-Aware Dual-View Contrastive Learning: From both global and local perspectives, for each node, its own sampled subgraph is considered a positive sample, while the subgraphs of other nodes are considered negative samples. Based on this, contrastive learning is performed within the view to maximize the consistency between the target node and its subgraph-level representations in both views; this consistency can be quantified as anomaly scores. Contrastive learning is performed between views to make the discrimination scores of the two views closer, thereby enabling the model to encode both local and global information.

[0009] S3. Attribute-based Reconstruction Learning: Partly, the features of neighboring nodes in the subgraph are used as input to the decoder to reconstruct the original features of the current node. Partly, the node's features are divided into two parts, and the similarity between each node and the features of all other nodes under both parts is calculated. The difference between the two parts is used as the reconstruction learning for global spatial association awareness.

[0010] S4. Joint Training and Anomaly Score Fusion: By designing balancing parameters, the contrastive learning and reconstruction learning are jointly trained and optimized, and the scores of the two are fused at the time of testing for anomaly detection.

[0011] Preferably, in step S1, global graph diffusion is first implemented based on the PageRank algorithm: ; in This represents the probability of teleportation during a random walk. The adjacency matrix of the original graph The degree matrix, It is the identity matrix. This is the adjacency matrix from a global perspective of the generated graph. Next, subgraph sampling is performed based on a restarted random walk algorithm. For each node... Subgraphs from global and local perspectives are and .

[0012] Preferably: In S2, within each view, taking a partial view as an example, for each node If its own characteristics are The positive sample representation, obtained after encoder modeling, can be defined as: ; in, The subgraph representation of the nodes. Let be the number of nodes in the subgraph. The corresponding negative sample subgraph representation can be defined as... Subsequently, the loss function for contrastive learning between views can be defined as: ; in and They are nodes The comparison score with its positive and negative sample subplots can be defined as: ;

[0013] in For activation function, Let be the learnable parameter matrix. Similarly, the loss function from a global perspective can be defined as: After fusion, it becomes: .

[0014] Comparative learning of scores between views aims to bring the discrimination scores of two views closer together, thereby enabling the model to encode both local and global information. If the scores from the global and local perspectives are... This process can be defined as follows: Then the loss function of this module can be defined as: .

[0015] Preferably: In S3, a portion, for each node If the original feature is After concatenating the features of neighboring nodes on the subgraph This serves as input to the decoder to reconstruct the original features of the current node: .

[0016] The other part divides the node's features into two parts. and Based on this, the cosine similarity vector with all other nodes is calculated as follows: for Then the reconstruction loss of global spatial correlation perception can be defined as: .

[0017] The final loss function of this module can then be defined as: .

[0018] Preferably, in step S4, during model training, a balancing parameter is designed. (A value of 0.01 can be used) to optimize the joint training of contrastive learning and reconstruction learning: .

[0019] During testing, the scores exported from the contrast learning module are the differences in the discrimination scores between positive and negative pairs: .

[0020] The scores exported by the reconstruction module are: .

[0021] The scores from both tests are then combined for final anomaly detection. .

[0022] Beneficial Effects: The self-supervised graph anomaly detection method based on global spatial correlation awareness of this invention, in which a contrastive learning-based module, through two carefully designed contrastive perspectives, more effectively captures local and global structural information related to anomaly patterns. The attribute reconstruction module employs subgraph-based neighborhood representation to reconstruct the original attributes of target nodes from both perspectives. Finally, these two complementary modules are integrated to achieve more efficient anomaly detection. Compared to existing methods, this scheme can fully model the global dependencies between nodes, effectively mitigating the side effects of graph neural networks acting as low-pass filters on anomaly data. Attached Figure Description

[0023] Figure 1 This is a flowchart of a self-supervised graph anomaly detection method based on global spatial correlation awareness.

[0024] Figure 2 This is a model structure diagram of a self-supervised graph anomaly detection method based on global spatial correlation awareness. Detailed Implementation

[0025] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0026] Example

[0027] Please see Figure 1 This invention provides a technical solution: a self-supervised graph anomaly detection method based on global spatial correlation awareness, comprising the following steps:

[0028] S1. Global and Local Subgraph Sampling: Using the original graph network as input, for each node, a subgraph is sampled under given hyperparameters based on graph diffusion and random walk techniques.

[0029] S2. Anomaly-Aware Dual-View Contrastive Learning: From both global and local perspectives, for each node, its own sampled subgraph is considered a positive sample, while the subgraphs of other nodes are considered negative samples. Based on this, contrastive learning is performed within the view to maximize the consistency between the target node and its subgraph-level representations in both views; this consistency can be quantified as anomaly scores. Contrastive learning is performed between views to make the discrimination scores of the two views closer, thereby enabling the model to encode both local and global information.

[0030] S3. Attribute-based Reconstruction Learning: Partly, the features of neighboring nodes in the subgraph are used as input to the decoder to reconstruct the original features of the current node. Partly, the node's features are divided into two parts, and the similarity between each node and the features of all other nodes under both parts is calculated. The difference between the two parts is used as the reconstruction learning for global spatial association awareness.

[0031] S4. Joint Training and Anomaly Score Fusion: By designing balancing parameters, the contrastive learning and reconstruction learning are jointly trained and optimized, and the scores of the two are fused at the time of testing for anomaly detection.

[0032] In this embodiment, specifically: in step S1, global graph diffusion is first implemented based on the PageRank algorithm: ;

[0033] in This represents the probability of teleportation during a random walk. The adjacency matrix of the original graph The degree matrix, It is the identity matrix. This is the adjacency matrix from a global perspective of the generated graph. Next, subgraph sampling is performed based on a restarted random walk algorithm. For each node... Subgraphs from global and local perspectives are and .

[0034] In this embodiment, specifically: in S2, within each view, taking a partial view as an example, for each node If its own characteristics are The positive sample representation, obtained after encoder modeling, can be defined as: ;

[0035] in, The subgraph representation of the nodes. Let be the number of nodes in the subgraph. The corresponding negative sample subgraph representation can be defined as... Subsequently, the loss function for contrastive learning between views can be defined as: ;

[0036] in and They are nodes The comparison score with its positive and negative sample subplots can be defined as: ;

[0037] in For activation function, Let be the learnable parameter matrix. Similarly, the loss function from a global perspective can be defined as: After fusion, it becomes: .

[0038] Comparative learning of scores between views aims to bring the discrimination scores of two views closer together, thereby enabling the model to encode both local and global information. If the scores from the global and local perspectives are... This process can be defined as follows: Then the loss function of this module can be defined as: .

[0039] In this embodiment, specifically: in S3, a portion, for each node If the original feature is After concatenating the features of neighboring nodes on the subgraph This serves as input to the decoder to reconstruct the original features of the nodes. ;

[0040] The other part divides the node's features into two parts. and Based on this, the similarity vector with all other nodes is calculated as follows: for Then the reconstruction loss of global spatial correlation perception can be defined as: .

[0041] The final loss function of this module can then be defined as: .

[0042] In this embodiment, specifically: in step S4, during model training, balancing parameters are designed. This enables joint training and optimization of contrastive learning and reconstruction learning: .

[0043] During testing, the scores exported from the contrast learning module are the differences in the discrimination scores between positive and negative pairs: .

[0044] The scores exported by the reconstruction module are: .

[0045] The scores from both tests are then combined for final anomaly detection. .

[0046] In terms of working principle or structural principle, this invention proposes a self-supervised graph anomaly detection method based on global spatial correlation awareness. First, the original graph is double-augmented through graph diffusion and subgraph sampling, generating local and global subgraphs for each node. Then, a dual-view contrastive learning module is proposed: intra-view contrastive learning aims to maximize the consistency between the target node and its representations in its two view subgraphs; inter-view contrastive learning promotes the convergence of the discrimination scores of the two views, enabling the model to simultaneously encode local and global information. To further utilize the self-supervised signal of attribute consistency between adjacent nodes, a masked autoencoder is introduced to reconstruct the original attributes of the target node based on the neighboring nodes of the two views. Finally, anomaly node detection is achieved by integrating these two complementary modules.

[0047] Figure 2 This demonstrates the overall model architecture of the method, which includes two core processing stages:

[0048] (a) Graph diffusion and subgraph sampling stage

[0049] First, the original graph structure data is received as input. A global perspective diffusion graph is generated using graph diffusion technology (based on the PageRank algorithm), which captures high-order relationships between nodes. Then, a random walk strategy is employed to sample two subgraphs for each node in the graph:

[0050] Global subgraph: Sampled from the diffusion graph, reflecting the associated neighborhood of a node in the global topology.

[0051] Local subgraph: Sample from the original graph and preserve the local structure of the nodes' direct neighbors.

[0052] This stage generates a pair of global and local subgraphs for each node, forming the dual-view data foundation for subsequent learning.

[0053] (b) Dual-module joint learning and anomaly detection phase

[0054] Left branch: Dual-view comparison learning module

[0055] In-view comparison:

[0056] Within the global and local views, the subgraph of the target node itself is used as a positive sample, while the subgraphs of other random nodes are used as negative samples. By measuring the similarity between the target node representation and the representations of its positive and negative sample subgraphs, the model distinguishes between normal association patterns and abnormal deviation patterns.

[0057] View alignment:

[0058] It forces the same node to have consistent discrimination scores in the global view and local view, thus promoting the coordination between local structure and global related information.

[0059] Right branch: Attribute Reconstruction Learning Module

[0060] Neighborhood feature reconstruction:

[0061] The original features of the target node are reconstructed using the features of all neighboring nodes in the target node's subgraph via a decoder. Abnormal nodes will produce high reconstruction errors due to inconsistencies in attributes with their neighbors.

[0062] Feature decoupling consistency verification:

[0063] The node features are split into two parts, and the feature similarity between the node and all other nodes in the graph is calculated separately. By constraining the consistency of the similarity results of the two parts, the attribute association patterns of the nodes in the global space are perceived.

[0064] Output and Integration

[0065] During training, the contrastive learning and reconstruction learning losses are jointly optimized. During testing, the output scores of the two modules are fused: the contrastive score reflects structural consistency anomalies, and the reconstruction score reflects attribute consistency anomalies. Finally, a weighted fusion is performed to obtain a comprehensive anomaly score.

[0066] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A self-supervised graph anomaly detection method based on global spatial correlation awareness, characterized in that, Includes the following steps: Step 1: Using the original graph network as input, for each node, based on graph diffusion and random walk techniques, sample the global view subgraph and the local view subgraph under the given hyperparameters. Step 2: Based on the global and local view subgraphs obtained in Step 1, each node's own sampled subgraph is taken as a positive sample and the subgraphs of other nodes are taken as negative samples in both global and local views. The consistency between the target node and its corresponding subgraph representation is maximized through intra-view contrastive learning, and the discrimination scores of the two views are made closer through inter-view contrastive learning, so as to encode local and global information. Step 3: Based on the subgraph obtained from step 1, one part uses the features of the neighboring nodes on the subgraph as input to the decoder to reconstruct the original features of the current node; the other part divides the node's features into two parts, calculates the similarity vector of each node under the two parts of features with all other nodes and calculates the difference, thereby realizing global spatial association perception reconstruction learning. Step 4: Design balancing parameters to jointly train and optimize the contrastive learning in Step 2 and the reconstruction learning in Step 3. During testing, the scores output from Step 2 and Step 3 are fused to complete anomaly detection.

2. The self-supervised graph anomaly detection method based on global spatial correlation perception according to claim 1, characterized in that: Step 1 specifically includes: firstly, implementing global graph diffusion based on the PageRank algorithm to generate an adjacency matrix from a global graph perspective. The calculation formula is: ； in This represents the probability of teleportation during a random walk. The adjacency matrix of the original graph The degree matrix, It is the identity matrix; Next, based on the restart random walk algorithm, for each node... Using adjacency matrix Sampling global view subgraph And based on the original graph adjacency matrix Sampling yields local viewpoint sub-images .

3. The self-supervised graph anomaly detection method based on global spatial correlation perception according to claim 1, characterized in that: Step 2 specifically includes: In-view comparative learning: Taking a partial view as an example, for each node Its positive sample characterization Subgraph representation The mean pooling is used to obtain the result, i.e.: ； in, The number of nodes in the subgraph is denoted by , and the negative sample subgraph is the subgraph of any other node. Define the loss function for local viewpoints within the view. and from a global perspective , fusion ; Inter-view comparative learning: The discrimination scores of nodes and their positive samples in both global and local views are as follows. Define the loss function between views as follows: ; The total learning loss is .

4. The self-supervised graph anomaly detection method based on global spatial correlation awareness according to claim 1, characterized in that: Step 3 specifically includes: Concatenate the features of neighboring nodes on the subgraph. Through the decoder Rebuild Node original features The loss is defined as: ； Node Features are divided into and Calculate the similarity vector with other nodes. and The loss is defined as: ; The total learning loss during reconstruction is: 。 5. The self-supervised graph anomaly detection method based on global spatial correlation awareness according to claim 4, characterized in that: Step 4 specifically includes: By balancing parameters Construct the total loss function Joint training of the model; During testing, compare the scores exported from the learning module. The difference between the discrimination scores of positive and negative samples: ； , They are nodes The score compared to its positive and negative sample subplots; The scores exported by the reconstruction module are: ； The scores from both tests are combined for final anomaly detection, using the following formula: 。 6. The self-supervised graph anomaly detection method based on global spatial correlation perception according to claim 5, characterized in that, In the in-view comparison learning, nodes The score compared with its positive and negative sample subplots and Defined as: and ,in For activation function, For a learnable parameter matrix, For nodes Its own representation, To represent analogous positive samples, the loss function for in-view contrastive learning is defined as: 。

Images