Graph node behavior characterization and abnormal graph node detection method based on prior knowledge

Abstract

The invention discloses a priori knowledge-based graph node behavior representation and abnormal graph node detection method. The method comprises the steps of constructing and training a graph node anomaly detection model; taking the attribute graph containing the to-be-detected node as the input of the trained graph node anomaly detection model, and obtaining an anomaly probability value that the to-be-detected node belongs to an abnormal node; and comparing the abnormal probability value of the to-be-detected node with a preset threshold value, and obtaining a judgment result of whether the to-be-detected node belongs to an abnormal node or not according to a size relationship between the preset threshold value and the abnormal probability value of the to-be-detected node. According to the method, the generated simulated abnormal sample is trained, so that the model fully learns the difference between the attribute characteristics and the connection behavior characteristics of the normal node and the abnormal node, the node representation learned by the model is more sensitive to a wider abnormal mode, the behavior expression characteristics of the abnormal behavior node are enriched, and the abnormal behavior of the abnormal node is improved. The method achieves the detection of unknown abnormity or brand new abnormity, and has greater advantages under the condition that the abnormity changes continuously in an actual scene.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a graph node behavior representation and abnormal graph node detection method based on prior knowledge. BACKGROUND

[0002] Attribute graph anomaly node detection is an important research content in the fields of network security, social network analysis, financial fraud detection, etc. Graph structure data widely exists in these systems, and the abnormal nodes in the graph usually correspond to entities with abnormal behaviors. When detecting abnormal nodes in the attribute graph, the properties of the nodes can be directly analyzed, or deeper features can be extracted in combination with the association between the nodes. Since the nodes of the attribute graph usually have high attribute dimensions and complex internal behavior patterns, it is necessary to construct a machine learning model to complete the abnormal node detection task in actual scenarios, so as to timely discover abnormal behaviors and promptly handle them, so as to reduce or avoid potential losses.

[0003] Existing systems are usually based on supervised methods or unsupervised methods, wherein the system based on the supervised method usually requires more abnormal labels, and in actual scenarios, abnormal behaviors are relatively rare. Comprehensive labeling of all potential abnormalities not only consumes resources but also has technical challenges, resulting in a sharp decline in performance with only a small number of labeled abnormal nodes. The system based on the unsupervised method only learns normal nodes, and detects abnormal nodes according to the difference between the features of the to-be-detected nodes and the normal nodes, and fails to fully utilize known labeled abnormal samples. In recent years, self-supervised feature learning methods have been applied to graph anomaly detection, such as reconstruction-based methods and contrast learning strategies. However, the feature learning strategies of these methods are not specifically designed for the unique needs of graph anomaly detection, so there are limitations in feature representation learning. For graph anomaly detection under weak supervision (only a small number of labeled abnormal samples but a large number of unlabeled data), how to balance the self-supervised training target and the supervised training target is also a problem to be solved.

[0004] Current supervised learning methods rely on a small number of labeled abnormal nodes to extract their behavior patterns. However, due to the very limited number of labeled abnormal nodes, this can easily lead to overfitting of these nodes during the learning process, thereby affecting the detection effect and leading to unsatisfactory performance. Weakly supervised anomaly detection aims to train an abnormal graph node anomaly detection model only with a small amount of labeled abnormal data and most unlabeled data. Current methods mostly rely on pseudo-labeling or data augmentation techniques, however, the feature learning strategies of these methods are not specifically designed for limited labeled data in graph anomaly detection, so there is a certain limitation in detection performance. Unsupervised learning methods mainly focus on modeling normal nodes to capture the behavior pattern expression of normal nodes. Then, the difference between the behavior of the node to be tested and the normal nodes is analyzed to perform anomaly detection. However, due to the lack of label information, the performance of this kind of method is often limited when dealing with actual anomaly detection datasets. SUMMARY

[0005] In view of the above problems in the prior art, the graph node behavior representation and abnormal graph node detection method based on prior knowledge provided by the present application solves the problems of relying on a large number of labels, insufficient detection accuracy, and low compatibility of existing self-supervised methods with anomaly detection tasks.

[0006] In order to achieve the above invention purposes, the technical scheme adopted by the present application is as follows: the graph node behavior representation and abnormal graph node detection method based on prior knowledge comprises: constructing and training a graph node anomaly detection model; the training process of the graph node anomaly detection model comprises a preheating stage and a full training stage in sequence; taking an attribute graph containing a node to be tested as the input of the graph node anomaly detection model after training to obtain an abnormal probability value of the node to be tested belonging to an abnormal node; comparing the abnormal probability value of the node to be tested with a preset threshold value, and obtaining a judgment result of whether the node to be tested belongs to an abnormal node according to the size relationship between the set threshold value and the abnormal probability value of the node to be tested.

[0007] Further, the graph node anomaly detection model comprises a graph neural network encoder and a graph node anomaly detector connected in sequence.

[0008] Further, the preheating stage in the process of training the graph node anomaly detection model comprises: obtaining an original attribute graph; introducing multiple perturbation operations to nodes in the original attribute graph by using a synthetic anomaly generation module to obtain synthetic anomaly samples; inputting the synthetic anomaly samples into a graph neural network encoder for encoding to generate first node-level embedding representations corresponding to the synthetic anomaly samples; inputting the node-level embedding representations corresponding to the synthetic anomaly samples into multiple special anomaly detection heads to obtain probabilities that the to-be-tested nodes are detected as a certain type of perturbation, wherein each special anomaly detection head corresponds to a type of perturbation; calculating a synthetic perturbation loss for distinguishing normal nodes from synthetic anomaly nodes; updating parameters of the graph neural network encoder and the multiple special anomaly detection heads using gradient descent based on the synthetic perturbation loss until the synthetic perturbation loss converges, to obtain the graph neural network encoder with updated parameters and the multiple special anomaly detection heads with updated parameters.

[0009] Further, the full training stage in the process of training the graph node anomaly detection model comprises: obtaining an attribute graph containing real anomaly nodes to obtain real anomaly samples; inputting the real anomaly samples and the synthetic anomaly samples into the graph neural network encoder with updated parameters for encoding to generate node-level embedding representations corresponding to the real anomaly samples and second node-level embedding representations corresponding to the synthetic anomaly samples, respectively; inputting the node-level embedding representations corresponding to the real anomaly samples into the graph node anomaly detector to obtain anomaly probability values that the to-be-tested nodes are detected as anomaly nodes, and calculating a real anomaly loss; inputting the second node-level embedding representations corresponding to the synthetic anomaly samples into the multiple special anomaly detection heads with updated parameters to obtain probabilities that the to-be-tested nodes are detected as a certain type of perturbation, and calculating a synthetic perturbation loss; calculating a joint loss according to the real anomaly loss and the synthetic perturbation loss; updating all parameters in the graph node anomaly detection model according to the gradient direction using gradient descent until the joint loss converges, to obtain the graph node anomaly detection model after training.

[0010] Further, the synthetic anomaly generation module is used to introduce perturbation operations to the original attribute graph to obtain synthetic anomaly samples, and the expression is:

[0011] wherein, represents a synthetic anomaly enhanced graph, i.e., a synthetic anomaly sample; represents a first type of perturbation operation, represents a perturbation operation index, represents the total number of types of perturbation operations; represents a graph obtained after introducing a first type of perturbation operation; represents a node set in the original attribute graph, represents a node set obtained after introducing a first A perturbation operation.

[0012] Further, the perturbation operation is designed based on prior knowledge of abnormal behavior patterns, including: Degree-based structural anomaly Non-similarity connection-based anomaly Structural reorganization anomaly Feature replacement anomaly And feature perturbation anomaly

[0013] Further, the process of generating the node-level embedding representation corresponding to the synthetic abnormal sample using the graph neural network encoder is represented as:

[0014] Wherein, represents the node-level embedding representation corresponding to the synthetic abnormal sample; represents the graph neural network encoding process.

[0015] Further, the graph node anomaly detector generates the anomaly probability of each node to be tested through weakly supervised learning, and its expression is:

[0016]

[0017] Wherein, is the node-level embedding representation output by the graph neural network encoder, represents the input of the graph node anomaly detection model, represents the node is the estimated probability of being abnormal, represents the nonlinear transformation of the multilayer perceptron on to generate the probability of the node being abnormal, is the embedding representation of the node .

[0018] Further, the calculation expression of the synthetic perturbation loss is:

[0019] Wherein, is the synthetic perturbation loss, represents a batch in the training process, which contains an equal amount of specific synthetic abnormal nodes and normal nodes; represents whether the node has been perturbed using the th perturbation type, if the node has been perturbed using the th perturbation type, then , otherwise ; denotes a node is detected as the first type of disturbance; denotes the natural logarithm.

[0020] Further, the joint loss calculation expression is:

[0021] wherein, is the joint loss; is a hyperparameter for controlling the balance between the two losses; is the real anomaly loss, and its expression is:

[0022] In the above formula, denotes a batch in the training process, containing the same number of normal nodes and real anomaly nodes; denotes a node whether it is a real anomaly node, if it is a real anomaly node, then , otherwise ; denotes a node the probability of being detected as an anomaly node.

[0023] The beneficial effects of the present application are: 1. By introducing synthetic anomalies based on prior knowledge, the behavior feature expression of anomaly nodes is enriched, enabling the model to identify and distinguish different types of anomaly patterns, thereby obtaining a more effective feature representation of graph nodes, enhancing the sensitivity of the model to different deviation patterns, and on the basis of fully utilizing the label information of anomaly nodes, making the graph node anomaly detection model learn the differences between normal nodes and anomaly nodes in attribute features and connection behavior features, while assigning a dedicated detection head to each type of anomaly, ensuring that the learned features can sensitively capture potential abnormal behavior and improve detection accuracy.

[0024] 2. By training the graph node anomaly detection model in two stages, the graph node anomaly detection model can effectively learn under the condition of scarce labeled data, and through the preheating stage in the two-stage training, an anomaly-sensitive latent feature representation is constructed, significantly improving the performance of the graph node anomaly detection model, preventing performance degradation caused by overfitting, and avoiding suboptimal solutions. In the full training stage, the optimization objective of the preheating stage is used as a regularization term, further enhancing the anomaly detection ability of the model, and thus improving the accuracy of anomaly detection. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 A flowchart of a graph node behavior representation and abnormal graph node detection method based on prior knowledge provided for an embodiment; Figure 2 A schematic diagram of the graph node anomaly detection model provided in this embodiment; Figure 3 A schematic diagram of the preheating stage provided for an embodiment; Figure 4 This is a schematic diagram of the entire training phase provided for an example. Detailed Implementation

[0026] The specific embodiments of the present invention are described below to enable those skilled in the art to understand the present invention. However, it should be understood that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the present invention as defined and determined by the appended claims. All inventions utilizing the concept of the present invention are protected.

[0027] like Figure 1 As shown, in one embodiment of the present invention, the graph node behavior representation and abnormal graph node detection method based on prior knowledge includes the following steps: S1. Construct and train a graph node anomaly detection model; the training process of the graph node anomaly detection model includes a warm-up phase and a full training phase. like Figure 2 As shown, the graph node anomaly detection model includes a graph neural network encoder (GAT-Sep is used as the graph neural network encoder in this embodiment) and a graph node anomaly detector connected in sequence.

[0028] In this embodiment, the training process of the graph node anomaly detection model is a two-stage training process, including a warm-up stage and a full training stage.

[0029] The first stage of model training is the warm-up stage, such as... Figure 3 As shown, it includes: A1. Obtain the original attribute map; A2. By using a synthetic anomaly generation module to introduce various perturbation operations into the nodes of the original attribute graph, a rich set of synthetic anomaly samples is constructed. This enables the model to identify and distinguish different types of anomaly patterns, thereby obtaining a more effective feature representation for the graph nodes. The expression is as follows:

[0030] in, This represents the synthesized anomaly enhancement map, i.e., the synthesized anomalous sample; Indicates the first Such perturbation operations. Indicates the index of the perturbation operation. represents the total number of types of perturbation operations; represents the graph obtained after introducing the first kind of perturbation operation; represents the node set in the original attribute graph, represents the graph obtained after introducing the first kind of perturbation operation.

[0031] A3, inputting the synthetic abnormal sample into a graph neural network encoder to encode and generate a first node-level embedding representation corresponding to the synthetic abnormal sample, and the expression is:

[0032] wherein, represents the node-level embedding representation corresponding to the synthetic abnormal sample; represents the graph neural network processing; A4, inputting the node-level embedding representation corresponding to the synthetic abnormal sample into a plurality of special abnormality detection heads to obtain a probability that the to-be-tested node is detected as a certain type of perturbation, wherein each special abnormality detection head corresponds to a type of perturbation.

[0033] Each special abnormality detection head adopts a two-layer perceptron structure for performing a binary classification task, and the expression is:

[0034] wherein, represents the probability that the node is detected as the first type of perturbation; is a sigmoid activation function; is the embedding representation of the node ; represents that the multi-layer perceptron performs a nonlinear transformation on to generate the probability that the node is the first type of perturbation.

[0035] The perturbation operation is designed based on prior knowledge of abnormal behavior patterns, and in this embodiment, five types of perturbation operations are included to effectively introduce the influence of abnormalities on node features or graph structures, including: degree-based structural anomaly , abnormality based on dissimilarity connection , structural reorganization anomaly , feature replacement anomaly , and feature perturbation anomaly .

[0036] Degree-based structural anomaly This anomaly exhibits unusual connection patterns, especially when the degree of the target node is much greater than that of other nodes; specifically, this perturbation can generate additional edges to increase the degree of the target node. Anomalies based on dissimilarity-based connections. This anomaly type aims to connect highly dissimilar nodes, violating the homogeneity principle prevalent in real-world networks. Specifically, it identifies the least dissimilar nodes for connection by calculating the feature distance between the target node and random nodes in the candidate set as a dissimilarity score. (Structural Reorganization Anomaly) This anomaly occurs when the local neighborhood structure is completely reorganized while maintaining the degree of a node; specifically, all existing edges of the target node are removed, and then a new number of edges equal to the original number of edges are randomly generated. Feature replacement anomaly. This anomaly, while maximizing feature bias, effectively preserves the overall structural pattern. This means that despite significant changes in node features, their connectivity and local structure within the network remain unchanged. Specifically, the features of the target node are replaced with the features of the least similar node extracted from the candidate set, while maintaining all local structural connections. Feature perturbation anomaly This anomaly is generated by perturbing a subset of the feature dimensions to produce subtle feature anomalies; specifically, a controlled perturbation is introduced into a small subset of the feature dimensions while keeping the rest unchanged.

[0037] These perturbation operations are designed to systematically simulate various anomalies targeting specific aspects of node characteristics, thereby enhancing the model's sensitivity to different deviation patterns.

[0038] A5. Calculate the synthetic perturbation loss used to distinguish between normal nodes and synthetic anomalous nodes. The expression is as follows:

[0039] in, For the synthetic disturbance loss, This represents a batch during the training process, which contains an equal number of specific synthetic anomalous nodes and normal nodes. Represents a node Should the first one be used? The perturbation type was perturbed, if the node Use the If a perturbation of a certain type is applied, then... ,otherwise ; Represents a node Detected as the first The probability of the type of disturbance; It represents the natural logarithm.

[0040] The purpose of the synthetic perturbation loss is to help the model learn a latent feature representation that can distinguish normal samples from any type of synthetic perturbation. Through this design, it is expected that the latent representation learned by the model has sensitivity to diverse perturbation patterns and robust recognition ability.

[0041] A6, updating parameters of the graph neural network encoder and the plurality of special anomaly detection heads based on the synthetic perturbation loss using gradient descent method until the synthetic perturbation loss converges, to obtain the updated graph neural network encoder and the updated plurality of special anomaly detection heads.

[0042] In summary, in the preheating stage, the graph neural network encoder first extracts the high-dimensional latent representation of the nodes in the synthetic abnormal sample (node-level embedding representation), and then jointly optimizes through the carefully designed multi-loss function, which can not only capture the abnormal patterns in node features and graph structure, but also learn the internal relationship between different types of perturbations. In this way, the model can form a more discriminative feature representation of the anomaly in the latent space, so that the subsequent anomaly detector can effectively identify and distinguish a variety of complex abnormal patterns.

[0043] The preheating stage focuses on learning a perturbation-sensitive feature representation to adapt to the diverse abnormal patterns in the graph, and uses synthetic perturbations to construct an anomaly-sensitive latent feature representation. This stage only optimizes the synthetic loss function, and by accumulating the recognition errors of multiple types of synthetic perturbations, the model learns the basic ability to distinguish normal and abnormal patterns. Using prior knowledge of abnormal behavior (for example, abnormal nodes often have abnormal connections or features), a series of perturbation operations are designed to generate synthetic abnormal samples. The task of the model in this stage is to learn to distinguish normal nodes from these synthetic abnormal nodes. In this way, we guide the model to learn a feature space that is sensitive to a wide range of abnormal perturbations, rather than just fitting a small number of known abnormalities. This pre-training mechanism effectively avoids the overfitting problem that may be caused by directly using limited labeled data.

[0044] The second stage of model training is the full training stage, as shown in Figure 4 , including: B1, obtaining an attribute graph containing real abnormal nodes to obtain real abnormal samples; B2, inputting the real abnormal samples and the synthetic abnormal samples into the updated graph neural network encoder to generate node-level embedding representations corresponding to the real abnormal samples and second node-level embedding representations corresponding to the synthetic abnormal samples, respectively; B3, inputting the node-level embedding representations corresponding to the real abnormal samples into the graph node anomaly detector to obtain abnormal probability values of the nodes to be tested being detected as abnormal nodes; and calculating a real abnormal loss, which is expressed as:

[0045] In the above formula, represents a batch in the training process, containing the same number of normal nodes and real abnormal nodes; represents the node whether it is a real abnormal node, if it is a real abnormal node, then , otherwise ; represents the node the probability of being detected as an abnormal node; B4, input the second node-level embedding representation corresponding to the synthetic abnormal sample into the multiple special abnormality detection heads updated by the parameters, to obtain the probability of the to-be-tested node being detected as a certain type of disturbance; calculate the synthetic disturbance loss; B5, calculate the joint loss according to the real abnormal loss and the synthetic disturbance loss, and the calculation expression of the joint loss is:

[0046] wherein, is the joint loss; is a hyperparameter for controlling the balance between the two losses; B6, use the gradient descent method to update all parameters in the graph node anomaly detection model according to the gradient direction until the joint loss converges, to obtain the trained graph node anomaly detection model.

[0047] The whole training phase focuses on utilizing the domain knowledge from real graph anomalies to further enhance the expressive power of the latent feature representation. The synthetic anomaly recognition task learned in the pre-training phase is used as a regularization constraint, combined with the supervised learning task using a small amount of real anomaly labels for joint optimization. This ensures that the model learns to recognize real anomalies while not forgetting the sensitivity to a wide range of disturbance patterns learned in the pre-training phase, thereby avoiding overfitting to a small number of known anomalies and retaining the ability to detect unknown anomalies. At the same time, an end-to-end joint optimization strategy is adopted, considering both the synthetic anomaly self-supervised loss and the real anomaly supervised loss. Through the designed joint loss function, the model can maintain sensitivity to general abnormal patterns while further enhancing the ability to recognize real anomalies. This dual constraint mechanism ensures the discriminability and generalizability of the learned feature representation. The whole training process realizes efficient utilization of limited labeled data through carefully designed batch construction and gradient update strategies.

[0048] S2, input the attribute graph containing the to-be-tested node into the trained graph node anomaly detector to obtain the abnormal probability value of the to-be-tested node belonging to an abnormal node; The abnormal probability of each to-be-tested node is generated by the graph node anomaly detector through weakly supervised learning, and its expression is:

[0049]

[0050] wherein, is a node-level embedding representation output by a graph neural network encoder, denotes a graph neural network encoding process, denotes an input of a graph node anomaly detection model, denotes a node is an estimated probability of being abnormal, denotes a multi-layer perceptron that performs a nonlinear transformation to generate a node is a probability of being abnormal, is an embedding representation of a node .

[0051] S3, compare the abnormal probability value of the to-be-tested node with a preset threshold value, and obtain a judgment result of whether the to-be-tested node belongs to an abnormal node according to the size relationship between the set threshold value and the to-be-tested node abnormal probability value.

[0052] If the abnormal probability value of the to-be-tested node is greater than the preset threshold value, the node is considered to be an abnormal node, otherwise the node is considered to be a normal node.

[0053] In the field of network security, computers, servers, routers and other devices and user network communication sessions using the network can be used as entity nodes, and attributes include IP addresses, ports, services, user names, login times, login IPs, and the like; in the field of social network analysis, individual users, social groups or organizations, posts, messages, pictures and the like in a social platform can be used as entities in a node graph, and attributes can be names, ages, interests, friend lists, group names, member quantities, group themes, publishers, publishing times, like quantities and the like; in the field of financial fraud detection, entities can include customers of financial institutions, financial transaction behaviors, banks, securities companies and the like, and attributes include transaction amounts, transaction times, transaction methods, transaction account information and the like. In these fields, graph nodes are the basic constituent units of attribute graphs, and by analyzing nodes and their attributes, abnormal behaviors or potential risks can be found.

[0054] In summary, the present application not only enriches the behavior expression characteristics of abnormal behavior nodes, but also enables the model to fully learn the differences between normal nodes and abnormal nodes in attribute characteristics and connection behavior characteristics, so that the model learns more diversified and possible abnormal situations, making the node representation learned by the model more sensitive to a wider range of abnormal patterns, fundamentally improving the model's understanding and feature representation ability of abnormal behaviors, thereby improving the accuracy of predicting abnormal nodes and achieving detection of unknown or completely new abnormalities. In the case of continuous changes in actual scenarios, there is a greater advantage.

Claims

1. A method for priori knowledge based graph node behavior characterization and abnormal graph node detection, characterized in that, The method comprises the following steps: constructing and training a graph node anomaly detection model; The training process of the graph node anomaly detection model comprises a preheating stage and a full training stage in sequence. inputting an attribute graph containing a to-be-tested node into the trained graph node anomaly detection model to obtain an anomaly probability value of the to-be-tested node belonging to an abnormal node; comparing the anomaly probability value of the to-be-tested node with a preset threshold, and obtaining a judgment result of whether the to-be-tested node belongs to an abnormal node according to the size relationship between the set threshold and the anomaly probability value of the to-be-tested node.

2. The method of claim 1, wherein, The graph node anomaly detection model comprises a graph neural network encoder and a graph node anomaly detector connected in sequence.

3. The method of claim 2, wherein, The preheating stage in the process of training the graph node anomaly detection model comprises the following steps:

4. The method of claim 3, wherein, obtaining an original attribute graph; introducing multiple perturbation operations into nodes in the original attribute graph by using a synthetic anomaly generation module to obtain synthetic anomaly samples; 5. The method of claim 4, wherein, inputting the synthetic anomaly samples into the graph neural network encoder for encoding to generate first node-level embedding representations corresponding to the synthetic anomaly samples; wherein, represents a synthesized anomaly-enhanced graph, i.e., a synthesized anomaly sample; represents a first perturbation operation, represents a perturbation operation index, represents a total number of types of perturbation operations; represents a graph obtained after introducing a first perturbation operation; represents a node set in the original attributed graph, represents a first perturbation operation.

6. The method of claim 5, wherein, The perturbation operations are designed based on prior knowledge of abnormal behavior patterns, including: degree-based structural anomalies , anomalies based on dissimilar connections , structural reorganization anomalies , feature replacement anomalies , and feature perturbation anomalies .

7. The method of claim 3, wherein, inputting the node-level embedding representations corresponding to the synthetic anomaly samples into multiple special anomaly detection heads to obtain probabilities of the to-be-tested node being detected as a certain type of perturbation, wherein each special anomaly detection head corresponds to a type of perturbation; wherein, represents a node-level embedding representation corresponding to the synthetic abnormal sample; represents a graph neural network encoding process.

8. The method of claim 2, wherein, calculating a synthetic perturbation loss for distinguishing normal nodes from synthetic abnormal nodes; wherein, is a node-level embedding representation output by a graph neural network encoder, is an input to a graph node anomaly detection model, is a node is an estimated probability that a node is anomalous, is a multilayer perceptron applied to to perform a nonlinear transformation to generate a node is a probability that a node is anomalous, is a node embedding representation.

9. The method of claim 3, wherein, updating parameters of the graph neural network encoder and the multiple special anomaly detection heads by using a gradient descent method based on the synthetic perturbation loss until the synthetic perturbation loss converges, thereby obtaining the graph neural network encoder with updated parameters and the multiple special anomaly detection heads with updated parameters. in, For the synthetic disturbance loss, This represents a batch during the training process, which contains an equal number of specific synthetic anomalous nodes and normal nodes. Represents a node Should the first one be used? The perturbation type was perturbed, if the node Use the If a perturbation of a certain type is applied, then... ,otherwise ; Represents a node Detected as the first The probability of the type of disturbance; It represents the natural logarithm.

10. The method of claim 9, wherein, The full training stage in the process of training the graph node anomaly detection model comprises the following steps: obtaining an attribute graph containing real abnormal nodes to obtain real anomaly samples; inputting the real anomaly samples and the synthetic anomaly samples into the graph neural network encoder with updated parameters for encoding to generate node-level embedding representations corresponding to the real anomaly samples and second node-level embedding representations corresponding to the synthetic anomaly samples, respectively; inputting the node-level embedding representations corresponding to the real anomaly samples into the graph node anomaly detector to obtain an anomaly probability value of the to-be-tested node being detected as an abnormal node, and calculating a real anomaly loss; inputting the second node-level embedding representations corresponding to the synthetic anomaly samples into the multiple special anomaly detection heads with updated parameters to obtain probabilities of the to-be-tested node being detected as a certain type of perturbation, and calculating a synthetic perturbation loss; calculating a joint loss according to the real anomaly loss and the synthetic perturbation loss; updating all parameters in the graph node anomaly detection model according to a gradient direction by using a gradient descent method until the joint loss converges, thereby obtaining the trained graph node anomaly detection model. The synthetic anomaly generation module is used to introduce perturbation operations into the original attribute graph to obtain synthetic anomaly samples, and the expression is as follows: The process of generating the node-level embedding representations corresponding to the synthetic anomaly samples by using the graph neural network encoder is as follows: The graph node anomaly detector generates an anomaly probability of each to-be-tested node through weak supervision learning, and the expression is as follows: The calculation expression of the synthetic perturbation loss is as follows: The calculation expression of the joint loss is as follows: wherein, is the joint loss; is a hyper-parameter to control the balance between the two losses; is the real anomaly loss, whose expression is: In the above formula, represents a batch in the training process, containing the same number of normal nodes and real abnormal nodes; represents the node whether it is a real abnormal node, if it is a real abnormal node, then , otherwise ; represents the node the probability of being detected as an abnormal node.

Images