A global spatial correlation-aware self-supervised graph anomaly detection method

Abstract

The application discloses a global space correlation perception self-supervised graph anomaly detection method, and relates to the fields of financial safety, network safety and the like. The method comprises the following steps: sampling global and local subgraphs based on graph diffusion and random walk; encoding local and global information through double-view contrast learning; learning and utilizing node attribute consistency features based on attribute reconstruction; and jointly training contrast learning and reconstruction learning modules and fusing scores to realize anomaly detection. Through the integration of local and global structure information and node attribute features, the application effectively alleviates the influence of graph neural network signal smoothing on anomaly detection, improves the accuracy of anomaly node detection in attribute networks, and is suitable for anomaly detection in social network, transaction network and the like.

Description

TECHNICAL FIELD

[0001] The application provides a global space correlation perception self-supervised graph anomaly detection method, relates to the fields of financial security, network security and the like. The method is mainly used for detecting abnormal users in social networks and transaction networks, and has important significance in the Internet big data era. BACKGROUND

[0002] Attribute networks are ubiquitous in the real world, such as social networks and citation networks. In recent years, attribute network anomaly detection has important significance in security-related applications such as social spam identification, financial fraud detection, and network intrusion detection, and has triggered growing research interest. Although this field has been extensively studied, anomaly detection in attribute networks is still a challenging task. The core challenge lies in the fact that the abnormal patterns of nodes are not only related to their interactions with other nodes in the topology structure, but also closely related to the inconsistency shown in the node attribute level.

[0003] Early anomaly detection techniques (such as matrix factorization and OC-SVM) have been widely used in numerous applications. The main limitation of this type of method is its high dependence on feature engineering constructed by domain experts. In recent years, deep learning techniques (especially graph neural networks (GNN)) have achieved significant performance improvement in graph mining tasks such as link prediction and node classification. GNN-based techniques have also been introduced into the field of anomaly detection, aiming to learn node representations with anomaly perception capabilities. Due to the high cost of obtaining abnormal samples, anomaly detection is usually performed in an unsupervised manner. Therefore, scholars first proposed a graph anomaly detection framework based on contrastive learning, which uses local context information as a supervision signal to learn representation features from node-subgraph instance pairs, and finally detects abnormal nodes through a discriminative score.

[0004] Although there have been a large number of studies on this issue in recent years, the existing methods still have the following shortcomings: first, the local and global structure information cannot be effectively utilized and integrated. Although the current most advanced scheme focuses on local information for anomaly detection by constructing node-subgraph contrastive instances, it can only extract the local structure information of the first-order neighborhood of the node by using a single-layer GCN, and cannot effectively capture higher-order global structure information. Existing research has shown that high-order neighborhood information is also valuable for graph mining tasks. In addition, GCN is essentially a special form of low-pass filter, and its signal smoothing characteristics will intensify with the number of layers, which may weaken the abnormal signal. Therefore, it is necessary to develop a more effective and decoupled local-global structure information extraction and fusion method to provide high-quality structure features. Second, how to effectively integrate node attributes and network topology to improve detection performance has not been fully explored. Although GCN can handle topology and node attributes at the same time, the learned representation is not completely suitable for anomaly detection in an unsupervised scenario. Abnormal nodes usually have inconsistencies with adjacent nodes in the attribute level, which can provide additional self-supervised signals. However, how to fully utilize such signals and build an attribute reconstruction model based on the attribute consistency principle to improve the performance of anomaly detection has not been thoroughly studied. SUMMARY

[0005] The purpose of the present application is to overcome the shortcomings of the prior art and provide a global spatial correlation perception self-supervised graph anomaly detection method. The method uses graph diffusion and subgraph sampling techniques to first perform data augmentation, and then introduces the concept of global correlation alignment during model training to solve the problems pointed out in the background art. The method disclosed in the present application can flexibly realize node anomaly detection in the case of multiple coupling of structure and attribute.

[0006] Technical scheme: A global spatial correlation perception self-supervised graph anomaly detection method, the specific steps are as follows:

[0007] S1, global and local subgraph sampling: taking the original graph network as input, for each node, based on graph diffusion technology and random walk technology, a subgraph is sampled under given hyperparameters.

[0008] S2, anomaly perception dual-view contrastive learning: in the global and local perspectives, for each node, the subgraph sampled based on itself is regarded as a positive sample, and the subgraphs of other nodes are regarded as negative samples. Based on this, contrastive learning is performed within the view, aiming to maximize the consistency between the target node and its two-view subgraph-level representations. The consistency here can be quantified as an anomaly score. Contrastive learning is performed between views to make the discrimination scores of the two views closer, so that the model can encode local and global information.

[0009] S3, Attribute-based reconstruction learning: One part, reconstruct the original feature of the current node by taking the features of the neighbor nodes on the subgraph as the input of the decoder. Another part, divide the feature of the node into two parts, calculate the similarity between each node and all other nodes under the two parts of the feature, and subtract the two as the reconstruction learning of global spatial correlation perception.

[0010] S4, Joint training and anomaly score fusion: By designing a balance parameter to make the joint training optimization of contrast learning and reconstruction learning, and fuse the scores of the two in the test to perform anomaly detection.

[0011] Preferred: In the S1, first realize the global diffusion of the graph based on the PageRank algorithm:

[0012] ;

[0013] Wherein represents the transmission probability in random walk, is the adjacency matrix of the original graph is the degree matrix of is the unit matrix, is the adjacency matrix under the global perspective of the generated graph. Then, the subgraph sampling is performed based on the restart random walk algorithm. For each node , the subgraph under the global and local perspectives is and .

[0014] Preferred: In the S2, in each view, taking the local view as an example, for each node , if the self-representation is , the positive sample representation obtained by the encoder modeling can be defined as:

[0015] ;

[0016] Wherein, is the subgraph representation of the node, is the number of nodes in the subgraph. The corresponding negative sample subgraph representation can be defined as . Then, the loss function of the contrast learning between views can be defined as:

[0017] ;

[0018] Wherein and are the contrast scores of the node and its positive and negative sample subgraphs, which can be defined as:

[0019] ;

[0020]

[0021] where is the activation function, is the learnable parameter matrix. Similarly, the loss function in the global view can be defined as: , and after fusion:

[0022] .

[0023] The contrastive learning between views aims to make the discriminative scores of two views closer, so that the model can encode local and global information. If the scores in the global and local views are , this process can be defined as follows: , the loss function of this module can be defined as:

[0024] .

[0025] Preferably: in the S3, part, for each node , if the original feature is , the features of the neighbor nodes on the subgraph are spliced as the input of the decoder to reconstruct the original feature of the current node:

[0026] .

[0027] Another part, the feature of the node is divided into two parts and . Based on this, the cosine similarity vector with all other nodes is , and , the reconstruction loss of global space correlation perception can be defined as: .

[0028] Then the final loss function of this module can be defined as:

[0029] .

[0030] Preferably: in the S4, during the model training process, a balance parameter (take 0.01) is designed to make the joint training and optimization of contrastive learning and reconstruction learning:

[0031] .

[0032] In testing, the score exported in the contrastive learning module is the difference between the discriminative scores of the positive and negative pairs:

[0033] .

[0034] The scores exported by the reconstruction module are:

[0035] .

[0036] The scores from both tests are then combined for final anomaly detection.

[0037] .

[0038] Beneficial Effects: The self-supervised graph anomaly detection method based on global spatial correlation awareness of this invention, in which a contrastive learning-based module, through two carefully designed contrastive perspectives, more effectively captures local and global structural information related to anomaly patterns. The attribute reconstruction module employs subgraph-based neighborhood representation to reconstruct the original attributes of target nodes from both perspectives. Finally, these two complementary modules are integrated to achieve more efficient anomaly detection. Compared to existing methods, this scheme can fully model the global dependencies between nodes, effectively mitigating the side effects of graph neural networks acting as low-pass filters on anomaly data. Attached Figure Description

[0039] Figure 1 This is a flowchart of a self-supervised graph anomaly detection method based on global spatial correlation awareness.

[0040] Figure 2 This is a model structure diagram of a self-supervised graph anomaly detection method based on global spatial correlation awareness. Detailed Implementation

[0041] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0042] Example

[0043] Please see Figure 1 This invention provides a technical solution: a self-supervised graph anomaly detection method based on global spatial correlation awareness, comprising the following steps:

[0044] S1. Global and Local Subgraph Sampling: Using the original graph network as input, for each node, a subgraph is sampled under given hyperparameters based on graph diffusion and random walk techniques.

[0045] S2. Anomaly-Aware Dual-View Contrastive Learning: From both global and local perspectives, for each node, its own sampled subgraph is considered a positive sample, while the subgraphs of other nodes are considered negative samples. Based on this, contrastive learning is performed within the view to maximize the consistency between the target node and its subgraph-level representations in both views; this consistency can be quantified as anomaly scores. Contrastive learning is performed between views to make the discrimination scores of the two views closer, thereby enabling the model to encode both local and global information.

[0046] S3. Attribute-based Reconstruction Learning: Partly, the features of neighboring nodes in the subgraph are used as input to the decoder to reconstruct the original features of the current node. Partly, the node's features are divided into two parts, and the similarity between each node and the features of all other nodes under both parts is calculated. The difference between the two parts is used as the reconstruction learning for global spatial association awareness.

[0047] S4. Joint Training and Anomaly Score Fusion: By designing balancing parameters, the contrastive learning and reconstruction learning are jointly trained and optimized, and the scores of the two are fused at the time of testing for anomaly detection.

[0048] In this embodiment, specifically: in step S1, global graph diffusion is first implemented based on the PageRank algorithm:

[0049] ;

[0050] in This represents the probability of teleportation during a random walk. The adjacency matrix of the original graph The degree matrix, It is the identity matrix. This is the adjacency matrix from a global perspective of the generated graph. Next, subgraph sampling is performed based on a restarted random walk algorithm. For each node... Subgraphs from global and local perspectives are and .

[0051] In this embodiment, specifically: in S2, within each view, taking a partial view as an example, for each node If its own characteristics are The positive sample representation, obtained after encoder modeling, can be defined as:

[0052] ;

[0053] in, The subgraph representation of the nodes. Let be the number of nodes in the subgraph. The corresponding negative sample subgraph representation can be defined as... . Then, the loss function of the contrastive learning between views can be defined as:

[0054] ;

[0055] where and are the contrastive scores of node and its positive and negative sample subgraphs, which can be defined as:

[0056] ;

[0057] where is an activation function, is a learnable parameter matrix. Similarly, the loss function under the global perspective can be defined as: , and after fusion:

[0058] .

[0059] The score contrastive learning between views aims to make the discriminative scores of the two views closer, so that the model can encode local and global information. If the scores under the global and local perspectives are , this process can be defined as follows: , then the loss function of this module can be defined as:

[0060] .

[0061] In this embodiment, specifically: in the S3, part, for each node , if the original feature is , the features of the neighbor nodes on the subgraph are spliced as the input of the decoder to reconstruct the original feature of the node:

[0062] ;

[0063] Another part, the feature of the node is divided into two parts and . Based on this, the similarity vector with all other nodes is calculated as is , then the reconstruction loss of global space correlation perception can be defined as: .

[0064] Then the final loss function of this module can be defined as:

[0065] .

[0066] In this embodiment, specifically: in the S4, during the model training process, a balance parameter Joint training of contrastive learning and reconstruction learning is optimized:

[0067] .

[0068] At the time of testing, the score exported in the contrastive learning module is the difference between the discrimination scores between the positive and negative pairs:

[0069] .

[0070] The score exported by the reconstruction module is:

[0071] .

[0072] After fusing the scores of the two at the time of testing, the final anomaly detection is carried out:

[0073] .

[0074] Working principle or structural principle, when in use, the present application proposes a global spatial correlation perception self-supervised graph anomaly detection method, in which: firstly, through graph diffusion and subgraph sampling, the original graph is doubly augmented to generate a local perspective and a global perspective subgraph for each node. Subsequently, a dual-perspective contrastive learning module is proposed: intra-view contrastive learning aims to maximize the consistency between the target node and the representations of its two perspective subgraphs; inter-view contrastive learning tends to make the discrimination scores of the two perspectives approach each other, so that the model can encode both local and global information. To further utilize the attribute consistency self-supervised signal between adjacent nodes, a mask autoencoder is introduced to reconstruct the original attributes of the target node based on the neighborhood nodes of the two perspectives. Finally, anomaly node detection is realized by integrating the two complementary modules.

[0075] Figure 2 The overall model architecture of the present method is shown, which includes two core processing stages:

[0076] (a) Graph diffusion and subgraph sampling stage

[0077] Firstly, the original graph structure data is received as input. A diffusion graph of global perspective is generated through graph diffusion technology (based on PageRank algorithm), which can capture the high-order correlation relationship between nodes. Then, a random walk strategy is used to sample two kinds of subgraphs for each node in the graph:

[0078] Global subgraph: sampled from the diffusion graph, reflecting the associated neighborhood of the node in the global topology.

[0079] Local subgraph: sampled from the original graph, preserving the local structure of the direct neighbors of the node.

[0080] This stage generates a pair of global and local subgraphs for each node, constituting the dual-perspective data basis for subsequent learning.

[0081] (b) Dual-module joint learning and anomaly detection phase

[0082] Left branch: Dual-view contrastive learning module

[0083] Intra-view contrast:

[0084] Within the global view and local view, the subgraph of the target node itself is taken as the positive sample, and the subgraph of other random nodes is taken as the negative sample. By measuring the similarity between the representation of the target node and the representation of its positive and negative sample subgraphs, the model can distinguish between normal association patterns and abnormal deviation patterns.

[0085] Inter-view alignment:

[0086] The discriminant scores of the same node in the global view and the local view are forced to be consistent, which promotes the mutual coordination of local structure and global association information.

[0087] Right branch: Attribute reconstruction learning module

[0088] Neighborhood feature reconstruction:

[0089] The features of all neighbor nodes in the subgraph of the target node are used to reconstruct the original features of the node through the decoder. Abnormal nodes will produce high reconstruction error due to inconsistent attributes with neighbors.

[0090] Feature decoupling consistency verification:

[0091] The node features are split into two parts, and the feature similarity between the node and all other nodes in the graph is calculated. By constraining the consistency of the similarity results of the two parts, the attribute association rule of the node in the global space is perceived.

[0092] Output and integration

[0093] During training, the contrastive learning and reconstruction learning losses are jointly optimized. During testing, the output scores of the two modules are fused: the contrastive score reflects structural consistency anomalies, the reconstruction score reflects attribute consistency anomalies, and the final weighted fusion obtains a comprehensive anomaly score.

[0094] Although embodiments of the present application have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made therein without departing from the principles and spirit of the application, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A self-supervised graph anomaly detection method based on global spatial correlation awareness, characterized in that, Includes the following steps: Step 1: Using the original graph network as input, for each node, based on graph diffusion and random walk techniques, sample the global view subgraph and the local view subgraph under the given hyperparameters. Step 2: Based on the global and local view subgraphs obtained in Step 1, each node's own sampled subgraph is taken as a positive sample and the subgraphs of other nodes are taken as negative samples in both global and local views. The consistency between the target node and its corresponding subgraph representation is maximized through intra-view contrastive learning, and the discrimination scores of the two views are made closer through inter-view contrastive learning, so as to encode local and global information. Step 3: Based on the subgraph obtained from step 1, one part uses the features of the neighboring nodes on the subgraph as input to the decoder to reconstruct the original features of the current node; the other part divides the node's features into two parts, calculates the similarity vector of each node under the two parts of features with all other nodes and calculates the difference, thereby realizing global spatial association perception reconstruction learning. Step 4: Design balancing parameters to jointly train and optimize the contrastive learning in Step 2 and the reconstruction learning in Step 3. During testing, fuse the scores output from Step 2 and Step 3 to complete anomaly detection. Step 3 specifically includes: Concatenate the features of neighboring nodes on the subgraph. Through the decoder Rebuild Node original features The loss is defined as: ； Node and Calculate the similarity vector with other nodes. and The loss is defined as: ; The total learning loss during reconstruction is: ； Step 4 specifically includes: By balancing parameters Construct the total loss function Joint training of the models; During testing, compare the scores exported from the learning module. The difference between the discrimination scores of positive and negative samples: ； and They are nodes The score compared to its positive and negative sample subplots; The scores exported by the reconstruction module are: ； The scores from both tests are combined for final anomaly detection, using the following formula: 。 2. The self-supervised graph anomaly detection method based on global spatial correlation perception according to claim 1, characterized in that: Step 1 specifically includes: firstly, implementing global graph diffusion based on the PageRank algorithm to generate an adjacency matrix from a global graph perspective. The calculation formula is: ； in This represents the probability of teleportation during a random walk. The adjacency matrix of the original graph The degree matrix, The identity matrix is ​​then used; next, based on the restart random walk algorithm, for each node... Using adjacency matrix Sampling global view subgraph And based on the original graph adjacency matrix Sampling yields local viewpoint sub-images .

3. The self-supervised graph anomaly detection method based on global spatial correlation perception according to claim 1, characterized in that: Step 2 specifically includes: In-view comparative learning: Taking a partial view as an example, for each node Its positive sample characterization Subgraph representation The mean pooling is used to obtain the result, i.e.: ； in, The number of nodes in the subgraph is denoted by , and the negative sample subgraph is the subgraph of any other node. Define the loss function for local viewpoints within the view. and from a global perspective , fusion ; Inter-view comparative learning: The discrimination scores of nodes and their positive samples in both global and local views are as follows. Define the loss function between views as follows: ; The total learning loss is .

4. The self-supervised graph anomaly detection method based on global spatial correlation perception according to claim 1, characterized in that, In the in-view comparison learning, nodes The score compared with its positive and negative sample subplots and Defined as: and ,in For activation function, For a learnable parameter matrix, For nodes Its own representation, To represent the analogy to positive samples, the loss function for contrastive learning within the view is defined as: 。

Images