Abnormal user detection method and system based on topology awareness and hub node guidance

Abstract

The invention provides an abnormal user detection method and system based on topology awareness and hub node guidance. The method comprises the steps of obtaining graph structure data; fusing the topological relation in the graph structure data and the initial features of the nodes by using a topological adaptive label evolution mechanism, and predicting and optimizing labels of unlabeled nodes to generate an optimized label distribution matrix; based on the node initial features, taking the optimized label distribution matrix as a supervision signal, and generating semantic hub node features through a double-layer multi-scale contrast learning mechanism; dynamically screening neighbors of each target node by adopting a strategy gradient driven neighbor aggregation mechanism based on semantic hub node features; performing message passing through a multilayer graph neural network based on the screened neighbor set, and fusing node representations of different layers by using an attention mechanism to obtain a final node representation; and inputting the final node representation into a classifier, and outputting an abnormal user detection result.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer technology, and in particular to an abnormal user detection method and system based on topology awareness and hub node guidance. BACKGROUND

[0002] The widespread application of information technology has directly led to an explosive increase in data volume and an increasingly complex data structure. Massive data depicts the basic features of the world, which makes anomaly detection a crucial task to ensure data quality and information system security. For example, in the financial field, banks can effectively intercept suspicious transactions such as fraud by monitoring transaction behavior in real time to identify abnormal patterns (such as high-frequency large-value transfers in a short period of time). In industrial production, anomaly detection of equipment operation data by sensors (such as sudden temperature rise or vibration anomaly) can provide early warning of faults and avoid production line shutdown. In the medical and health field, by analyzing the abnormal fluctuations of patient vital signs (such as ECG mutations), critical conditions can be quickly discovered and rescue can be implemented. Online shopping platforms can maintain user trust by identifying non-real reviews (such as a large number of similar content in a short period of time). The above application scenarios confirm that anomaly detection is a key technology to deal with the risks of the data explosion era, and is directly related to economic security, public health, and social stability.

[0003] With the rapid development of social network platforms (such as microblogging, Reddit, etc.), user-generated content has increased exponentially, but at the same time, a large number of fraudulent accounts and abnormal behaviors have also emerged, such as non-real marketing and rumor spreading. These abnormal activities not only disrupt the platform ecosystem and harm user experience, but also can be used for online fraud, public opinion manipulation, etc. Therefore, the detection of fraudulent accounts and abnormal behaviors has become a key to platform governance.

[0004] Traditional anomaly detection methods (such as Isolation Forest, LOF, SVM, etc.) are usually based on two key assumptions: 1. Data samples are independent and identically distributed; 2. Anomalies can be effectively separated by statistical deviation or low-dimensional feature space. Although these methods perform well in detecting independent data points, they have obvious limitations when dealing with real-world scenarios with complex relationship structures. For example, in the detection of fraudulent groups in social networks or the identification of suspicious transaction chains in finance, the anomalies in these scenarios are often not attribute anomalies of individual nodes, but abnormal connection patterns or special group behavior characteristics between multiple nodes. These structural characteristics are difficult to effectively capture by traditional data statistical methods. Specifically, the limitations of traditional methods mainly lie in the inability to model the dependency between nodes, lack of sensitivity to network topology, and difficulty in capturing multi-node collaborative anomaly patterns. These missing capabilities significantly reduce the effectiveness of traditional methods in anomaly detection in relational networks.

[0005] As a deep learning framework specialized in non-Euclidean data, Graph Neural Network (GNN) achieves implicit modeling of node relationships through a message passing mechanism. Its core advantages are: 1. automatically aggregate multi-hop neighborhood information through graph convolution operations; 2. capture topological structure patterns without manual feature design. For example, when identifying fraudulent groups in social networks, GNN can automatically detect abnormal attention patterns (such as intensive bidirectional connections between new accounts and dormant accounts), while traditional methods require pre-defined node in-degree and other manual features. For example, in a social platform, fraudulent users form a "star" structure by mass following normal users, or a "group" structure by mutually following a large number of normal users. As shown in FIG. 1, in "(a) Star Structure Example Graph", the fraudulent user Figure 1 actively establishes mass following with other users, forming a "star" structure; in "(b) Group Structure Example Graph", the fraudulent user mutually follows other users to form a closely connected "group" structure.

[0006] Existing GNN-based anomaly detection tasks face the following three challenges: First, label missing and class imbalance. Label missing refers to the fact that only a small number of nodes in the graph are manually labeled, and most nodes are unlabeled, resulting in insufficient supervision information. Since abnormal labeling often relies on manual review, the labeling cost is high, for example, a social platform with millions of daily interactions and comments can only sample a small number of suspicious users for labeling. The class imbalance problem refers to the fact that in the labeled samples, normal samples are much more than abnormal samples, causing the model to bias towards the majority class and making it difficult to identify abnormal behavior. In real-world scenarios, the proportion of anomalies is usually extremely low, much less than normal samples.

[0007] Second, feature inconsistency. Feature inconsistency refers to the fact that in anomaly detection scenarios, abnormal users (such as non-real user accounts, batch-controlled accounts, etc.) deliberately mimic the behavior characteristics of normal users (such as posting frequency, like interaction patterns, friend relationship distribution, etc.), making their node features highly similar to those of normal users, making it difficult to effectively distinguish between the two types of users based solely on these features.

[0008] Third, structural inconsistency. Structural inconsistency refers to the fact that in GNN-based fraud detection, abnormal users (such as non-real user accounts, fake group accounts, etc.) actively construct non-real social relationships or interaction behaviors (such as following, trading, commenting, etc.), resulting in a large number of noise links (i.e. edges that do not reflect real relationships) in the graph structure. These noise links interfere with the representation learning of normal nodes during the message passing process of GNN, making it difficult for the model to accurately distinguish between abnormal users and normal users.

[0009] ​As Figure 2 shown, Figure 2 is an abnormal account behavior example graph of an embodiment of the present application, which shows that a large number of nodes lack annotations and the number of positive and negative samples is greatly different, and there is a class imbalance problem. Some abnormal users (such as ) imitate the behavior patterns of normal users, disguise their initial features, and have inconsistent features; some abnormal users (such as , ) actively interact with normal users, adding a large amount of edge noise to the graph structure, which indicates inconsistent structure. SUMMARY

[0010] The purpose of the present application is to provide an abnormal user detection method and system based on topology awareness and hub node guidance, aiming to solve the above problems in the prior art.

[0011] An embodiment of the present application provides an abnormal user detection method based on topology awareness and hub node guidance, comprising: obtaining graph structure data including nodes, edges, node initial features, and known labels of part of the nodes; fusing the topology relationship and the node initial features in the graph structure data by using a topology adaptive label evolution mechanism, and predicting and optimizing the labels of unannotated nodes to generate an optimized label distribution matrix; based on the node initial features, and taking the optimized label distribution matrix as a supervision signal, generating semantic hub node features through a double-layer multi-scale contrastive learning mechanism; based on the semantic hub node features, using a neighbor aggregation mechanism driven by a policy gradient to dynamically screen neighbors of each target node; based on the screened neighbor set, performing message passing through a multi-layer graph neural network, and fusing node representations of different layers by using an attention mechanism to obtain a final node representation; inputting the final node representation into a classifier, determining the node category according to the probability output by the classifier, and outputting an abnormal user detection result.

[0012] An embodiment of the present application provides an abnormal user detection system based on topology awareness and hub node guidance, comprising: a data acquisition module for acquiring graph structure data including nodes, edges, node initial features, and known labels of part of the nodes; a label optimization module for fusing the topology relationship and the node initial features in the graph structure data by using a topology adaptive label evolution mechanism, and predicting and optimizing the labels of unannotated nodes to generate an optimized label distribution matrix; A feature enhancement module is configured to generate semantic hub node features based on initial features of the nodes and the optimized label distribution matrix as a supervision signal through a double-layer multi-scale contrast learning mechanism. A neighbor screening module is configured to dynamically screen neighbors of each target node based on the semantic hub node features through a strategy gradient driven neighbor aggregation mechanism. A representation fusion module is configured to perform message passing through a multi-layer graph neural network based on the screened neighbor set and fuse node representations of different layers through an attention mechanism to obtain final node representations. An anomaly classification module is configured to input the final node representations into a classifier, determine a node category according to a probability output by the classifier, and output an abnormal user detection result.

[0013] The embodiment of the present application also provides an electronic device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, and the computer program implements the steps of the abnormal user detection method based on topology awareness and hub node guidance when executed by the processor.

[0014] The embodiment of the present application also provides a computer readable storage medium, and the computer readable storage medium stores an implementation program of information transmission, and the program implements the steps of the abnormal user detection method based on topology awareness and hub node guidance when executed by a processor.

[0015] The embodiment of the present application can have the following beneficial effects: the embodiment of the present application can effectively identify hidden abnormal behaviors and accurately determine abnormal accounts in a real social network with label scarcity, feature camouflage and structure disturbance, and improve the detection accuracy of abnormal users in graph data. Through optimization of label distribution, selection of high-quality negative samples and dynamic neighbor screening, the adaptability and stability of the model under complex network structure are improved, and the robustness and generalization ability of the model are enhanced, so as to realize a complete algorithm system covering label prediction, feature enhancement, structure optimization and final classification, and the algorithm system is suitable for various graph structure scenes such as social networking, e-commerce and finance. BRIEF DESCRIPTION OF DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the one or more embodiments of the present application or the prior art, the drawings needed in the embodiment or prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments described in the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0017] Figure 1 is a fraud user interaction mode schematic diagram of the embodiment of the present application; Figure 2 is an example diagram of abnormal account behavior of an embodiment of the present application; Figure 3 is a flowchart of an abnormal user detection method based on topology awareness and hub node guidance of an embodiment of the present application; FIG. 4(a) is a framework diagram of abnormal user detection of an embodiment of the present application; FIG. 4(b) is a multi-scale contrast learning framework diagram of an embodiment of the present application; Figure 5 is a schematic diagram of an abnormal user detection system based on topology awareness and hub node guidance of an embodiment of the present application. DETAILED DESCRIPTION

[0018] In order to make the technical personnel in the art better understand the technical solutions in the one or more embodiments of the present specification, the technical solutions in the one or more embodiments of the present specification will be clearly and completely described below in conjunction with the drawings in the one or more embodiments of the present specification. Obviously, the described embodiments are only a part of the embodiments of the present specification, not all. Based on the one or more embodiments of the present specification, all other embodiments obtained by those skilled in the art without creative labor should belong to the protection scope of the present document.

[0019] Method embodiments According to an embodiment of the present application, a method for detecting abnormal users based on topology awareness and hub node guidance is provided, Figure 3 is a flowchart of an abnormal user detection method based on topology awareness and hub node guidance of an embodiment of the present application, as Figure 3 shown, the abnormal user detection method based on topology awareness and hub node guidance according to an embodiment of the present application specifically includes: Step S301, acquiring graph structure data including nodes, edges, node initial features and part of node known labels; Step S302, fusing the topology relationship and node initial features in the graph structure data by using a topology adaptive label evolution mechanism, and predicting and optimizing the labels of unlabeled nodes to generate an optimized label distribution matrix, specifically including: constructing an initial label distribution matrix of the nodes according to the graph structure data; wherein the labeled nodes in the initial label distribution matrix are one-hot encoded with their true labels, and the labels of the unlabeled nodes are initialized to zero vectors; performing multi-layer message passing on the node initial features by a graph convolution network to extract high-order feature representations of the nodes; training a classifier using the high-order feature representations corresponding to the labeled nodes, and preliminarily predicting the labels of all nodes by the trained classifier to obtain a predicted label probability distribution; fuse the initial label distribution matrix with the predicted label probability distribution to form a joint initialization label matrix; perform multi-round iterative propagation on the joint initialization label matrix based on a normalized Laplacian matrix of the graph structure data, fuse topological structure information and initial label information in each round of iteration until convergence, and output an optimized label distribution matrix as a supervision signal.

[0020] Step S303, based on the node initial features and taking the optimized label distribution matrix as a supervision signal, generate semantic hub node features through a double-layer multi-scale contrastive learning mechanism; wherein the double-layer multi-scale contrastive learning mechanism includes context-level contrastive learning and local-level contrastive learning; specifically including: based on the node initial features and the neighbor features of each target node in the graph, perform information aggregation through a graph neural network to generate initial semantic hub node features corresponding to the target node; In the context-level contrastive learning, based on the nodes within a batch and their optimized label distribution matrices, respectively aggregate node features with the same pseudo-label to construct a positive sample representation of the target node, and node features with different pseudo-labels to construct a negative sample representation of the target node; wherein the pseudo-label is the pseudo-label indicated by the optimized label distribution matrix; by calculating the similarity and maximizing the loss function, the similarity between the initial semantic hub node features and the positive sample representation is maximized, and the similarity between the initial semantic hub node features and the negative sample representation is minimized, to obtain a context-level contrastive loss; In the local-level contrastive learning, the initial semantic hub node features are masked, and a local environment representation is reconstructed based on the neighbor node features of the target node through a graph neural network; by calculating the similarity between the initial semantic hub node features and the local environment representation, and constructing a contrastive loss based on the node pseudo-label, the normal node features are similar to the local environment representation, and the abnormal node features are dissimilar to the local environment representation, to obtain a local-level contrastive loss; weight the sum of the context-level contrastive loss and the local-level contrastive loss to obtain a joint contrastive loss, and optimize the parameters of the graph neural network by back-propagating the joint contrastive loss to generate the final optimized semantic hub node features of each node.

[0021] Step S304, based on the semantic hub node features, use a strategy gradient driven neighbor aggregation mechanism to dynamically filter the neighbors of each target node, specifically including: S51: traverse each candidate neighbor node in the original neighbor set of each target node, and construct an evaluation subgraph for each candidate neighbor node; wherein the evaluation subgraph comprises the target node, the candidate neighbor node, and the association information between the two and the semantic hub node feature; S52: input the evaluation subgraph into a value predictor, and output the predicted contribution degree of the candidate neighbor node to the target node classification task through the value predictor; S53: generate a binary screening decision of retention or discard for each candidate neighbor node based on the predicted contribution degree through a policy network, and screen out the retained neighbor nodes from the original neighbor set of the target node according to the decision result to form a current neighbor subset of the target node; S54: based on the current neighbor subset, aggregate and classify the semantic hub node feature of the target node through a graph neural network to obtain the predicted category of the target node, compare the predicted category with a supervised signal, generate a reward signal according to the comparison result, and update the parameters of the policy network through a policy gradient method using the reward signal; S55: repeat steps S51 to S54 using the updated policy network to perform multi-round optimization on the neighbor screening strategy of the target node, and output the final neighbor set of the target node according to the screening decision of the final round after optimization.

[0022] Step S305: perform message passing through a multi-layer graph neural network based on the screened neighbor set, and fuse the node representations of different layers using an attention mechanism to obtain a final node representation, specifically including: perform iterative message passing and feature transformation on the semantic hub node feature through a multi-layer graph neural network based on the screened neighbor set to obtain the node embedding representation output by each layer of the graph neural network; assign a learnable attention weight to the node embedding representation of each layer; wherein the attention weight is obtained by calculating and normalizing a content-based scoring function, and the scoring function takes the node embedding representation of the layer as input; weight and sum the node embedding representations of each layer and the corresponding attention weights to obtain the fused final node representation.

[0023] Step S306: input the final node representation into a classifier, determine the node category according to the probability output by the classifier, and output an abnormal user detection result.

[0024] The above technical solutions of the embodiments of the present application will be described in detail in combination with the specific conditions of the abnormal user detection method based on topology awareness and hub node guidance according to the embodiments of the present application.

[0025] To solve the problems existing in the prior art, the embodiment of the present application aims to solve the following problems: first, for the label missing and class imbalance problem, a topology adaptive label evolution mechanism is constructed to complete the label by combining GCN features and label propagation method, and the abnormal recognition ability is improved. Second, for the feature inconsistency problem, a semantic hub node generation and double-layer contrast learning mechanism is constructed, and enhancement training is performed at the context and local levels to improve the discrimination. Third, for the structure inconsistency problem, a neighbor aggregation module driven by policy gradient is introduced to dynamically evaluate the contribution of neighbors to classification and only keep useful neighbors to participate in message passing.

[0026] The embodiment of the present application proposes a topology adaptive and strategy driven graph anomaly user detection method, which establishes a three-layer collaborative mechanism of "label self-evolution-semantic hub generation-strategy reinforced aggregation", and significantly improves the abnormal detection performance in the environment of label scarcity, feature camouflage and structure disturbance. The method takes the joint optimization of graph structure self-learning and feature contrast signal as the core idea, breaks through the limitation of existing graph neural network relying on static neighbors and fixed label propagation, and realizes the dynamic co-evolution modeling of graph features, labels and structure.

[0027] The overall design framework of the embodiment of the present application mainly includes: 1. Topology-Adaptive Label Evolution (Topology-Adaptive Label Evolution); 2. Semantic Hub Generator (Semantic Hub Generator); 3. Policy-Gradient Neighbor Aggregation (Policy-Gradient Neighbor Aggregation); 4. Multi-Layer Attention Fusion Classifier (Multi-Layer Attention Fusion Classifier); The four parts are trained end-to-end by joint loss to form an adaptive and interpretable anomaly detection framework.

[0028] The definition of a graph is given as , wherein and represent the node set and edge set respectively, is the initial feature set of the node, is the set of partially labeled node labels. For a given graph , graph anomaly detection can be regarded as a binary classification task, and the goal of the task is to classify each node in the network as "normal" (class 0) or "abnormal" (class 1), that is, to realize the classification of the node set To the mapping of the label set Based on the supervision information of the partially labeled nodes, the focus is on constructing a model to infer the class attributes of unlabeled nodes.

[0029] Figure 4 is a framework diagram of abnormal user detection based on topology adaptation and semantic pivot node guidance according to an embodiment of the present application, which gives a method description of the framework. In Figure 4(a), the label distribution of the original graph is first optimized by a topology-aware label optimization module, making full use of known label information to predict and optimize the labels of unknown nodes; then the semantic pivot nodes of each subgraph are generated by a contrastive learning module, strong negative sample nodes are screened based on the designed sampling probability, and the optimized subgraph is put into a neighbor selection module based on reinforcement learning to dynamically screen neighbors beneficial to the target and optimize the information aggregation process; finally, the learned node features are transmitted into an abnormal node classifier through an attention weighting network to predict the node label.

[0030] The detailed description of the multi-scale contrastive learning module is given in Figure 4(b), which solves the problem of inconsistent node features through dual contrastive tasks at the context level and the local level. The context level enhances the feature discriminability through the contrast of normal and abnormal nodes, and the local level strengthens the difference between abnormal and normal nodes through mask reconstruction; the two-level losses are weighted and integrated to jointly optimize the semantic pivot node feature generation.

[0031] 1. Topology adaptive label evolution mechanism 1.1 Label distribution learning based on graph convolution Unlike traditional label propagation or static GCN prediction, the embodiment of the present application proposes an adaptive topology label evolution mechanism. This mechanism dynamically adjusts the label diffusion strength by introducing a learnable graph structure weight matrix, so that the propagation process not only depends on the topological adjacency relationship, but also automatically weights according to the feature similarity and prediction confidence between nodes.

[0032] In graph data, many nodes may lack label information, and directly using existing label training models often cannot fully capture the dependency relationships in the graph structure. In order to more effectively utilize known labels and improve the classification performance of unlabeled nodes, the embodiment of the present application uses a graph convolution network (GCN) to train a label prediction model, which can infer unknown labels based on node features and topology structure.

[0033] Known graph , wherein is a set of nodes, is a set of edges, is an initial feature set of nodes, is a set of labels of partially labeled nodes. Let represent the set of nodes with known labels, a set of nodes with unknown labels, and Initialize the node label distribution matrix where is the total number of classes: (1); where, is the node label distribution vector in the initial label distribution matrix, is the standard basis vector generated by the Dirac function, is the label representation of node .

[0034] Hierarchical feature propagation is performed by a graph convolutional network (GCN), and the layer node representation calculation formula is: (2); where, is the adjacency matrix of the graph, is the adjacency matrix with self-loop, and I is the identity matrix, is the corresponding degree matrix, is a trainable parameter matrix, is an activation function, denotes the node representation matrix of the l-1 layer (the output of the previous layer). Finally, the high-order feature representation is obtained, where is the number of network layers.

[0035] The feature representation of the labeled node is used to train a classifier, and the parameters are trained by cross-entropy loss. The loss function is: (3); where the probability distribution is generated by softmax: (4); where, is the output of a classifier for classifying the feature representation of node , denotes the parameters for calculating the probability distribution. This step can obtain the label probability distribution of each unlabeled node, and the highest probability is selected as the predicted label.

[0036] Label distribution learning by feature similarity can make full use of the similarity assumption of adjacent nodes in the graph structure, i.e. adjacent nodes have similar representations in the feature space and thus are more likely to share the same label. Therefore, based on the feature similarity, the label distribution of adjacent nodes can be used to predict the label of the target node: (5); wherein, represents the predicted label of the unknown label node , represents the category index, is a fusion coefficient, represents the label prediction probability based on high-order feature and parameter , represents the label distribution vector of the node after times of graph convolution propagation, is the label distribution after times of graph convolution, which enhances the node representation by aggregating the information of multi-hop neighbors, thereby better utilizing the global consistency of the graph structure.

[0037] 1.2 Label evolution The label distribution predicted by the above steps may contain certain noise, especially when the labeled data is less or the feature representation is biased, the prediction result is not accurate enough. In order to optimize the label assignment and improve the generalization ability of the model, the label propagation (LP) method can be used to smooth and correct the initial prediction with the help of the topological information of the graph structure. In order to improve the accuracy of label prediction, label propagation spreads the initial predicted label in the graph, and optimizes the label distribution by using the adjacency relationship.

[0038] The graph Laplacian regularization matrix is defined, and its construction needs to meet the smoothness constraint of the graph signal. The symmetric normalized propagation kernel matrix is adopted, and its formula is: (6); wherein, is the adjacency matrix, is the degree matrix. This construction ensures that the eigenvalue range of is .

[0039] The high-order feature representation extracted by GCN is deeply integrated with the label propagation process, and the joint initialization matrix is defined as: (7); wherein, is a fusion coefficient, The trainable classifier parameters are trained. The design simultaneously encodes the prior label distribution and the data-driven feature discriminative information.

[0040] In the first iteration, the label update rule is: (8); wherein, controls the global propagation strength, which is used to control the weight between the label propagation and the initial information in each iteration. For each node , the column where the maximum value in the corresponding row in the final label matrix is selected as the final label of the node.

[0041] Through the above steps, the unknown labels can be predicted using the data with known labels, and the label assignment is further optimized through label propagation, so that a more accurate training set is constructed for subsequent graph anomaly detection tasks.

[0042] The embodiment of the application gives a pseudo-code description of the topology adaptive label evolution algorithm in Table 1, wherein the first to sixth rows initialize the label distribution matrix, the seventh row initializes the node features, the eighth to ninth rows perform L-layer graph convolution (GCN) to calculate the node representation, the tenth to fourteenth rows represent the supervised training of the classifier C based on the labeled data, the fifteenth to sixteenth rows represent the T times of label propagation, and the seventeenth to eighteenth rows represent the fusion of the prediction results and the output of the final label.

[0043] Table 1 Algorithm 1-Topology adaptive label evolution algorithm

[0044] 2. Strong negative sample sampling strategy In the anomaly detection task, simple samples that can simply distinguish obvious normal and obvious abnormal samples often cannot make the model have sufficient discrimination ability. The traditional random negative sampling method has defects. In the training process, a large number of simple abnormal samples and normal samples with significant differences from the abnormal samples may dominate the learning of the model, making it difficult for the model to learn the fine discrimination boundary; secondly, ignoring those samples similar to the features of the abnormal samples but marked as normal will cause the model to make mistakes in these key areas. Therefore, the hard negative sample sampling optimizes the decision boundary by actively selecting the most challenging negative samples: on the one hand, it filters samples adjacent to known abnormalities in the feature space, forcing the model to learn more accurate discrimination rules; on the other hand, it focuses on sampling normal samples in the neighborhood of abnormal nodes, enhancing the model's ability to recognize "pseudo abnormalities" (i.e., normal nodes in the neighborhood of abnormalities). This strategy can significantly improve the model's ability to model fuzzy boundaries, and is especially suitable for complex distribution situations in real scenarios where abnormal and normal samples overlap to a high degree.

[0045] Specifically, if the feature representation of a negative sample node is very similar to that of a known outlier node, it can be considered a high-quality negative sample. Samples adjacent to true outlier nodes are particularly important because they help the model better distinguish easily confused boundary conditions. Based on these two principles, this embodiment of the invention designs a sampling probability, which is a normalized sampling probability distribution defined at the node. neighboring nodes It is used to determine which negative sample node to sample from the neighborhood. To participate in the training, the formula is as follows: (9); in, Indicates a given target node When selecting a node from the neighbor set The probability of being a negative sample; The distance function between two vectors can be expressed as follows: Calculate the relationship between two vectors distance, Represents the nodes obtained from the graphics encoder. The representation of is similar for the rest. Represents a node It is a member of the set of neighboring nodes. It is a hyperparameter (distance sensitivity adjustment parameter) and satisfies >0, used to adjust the sampling probability. and Sensitivity to distance between them. The larger, the more it indicates the same as The farther away a node is, the higher its sampling probability. The smaller the value, the more it indicates the relationship with... The farther away a node is, the lower its sampling probability. Represents a node The set of neighboring nodes.

[0046] Based on the above sampling probability design, a dynamic hard negative sample filtering mechanism can be constructed, enabling the model to continuously focus on the sample regions with the highest discriminative value during training. At the feature space level, the distance metric function... With sensitivity coefficient The synergistic effect can adaptively adjust sample selection preferences when When the value is greater than 1, the screening intensity for boundary samples is strengthened; when 0 < When the value is less than 1, a more balanced sampling distribution is maintained. At the graph structure level, the neighborhood set... The introduction of the semantic pivot node ensures effective utilization of the topological relationship, enabling the model to capture subtle differences between normal and abnormal samples in a local area. Under this dual-constrained sampling strategy, high-quality negative samples with representativeness and discriminability are finally obtained, which can improve the model's ability to distinguish abnormal boundaries.

[0047] 3. Semantic pivot node generation module In order to overcome the problem of insufficient feature discrimination caused by the disguising behavior of fraudsters (i.e., the inconsistency of features), the embodiment of the present application proposes a feature enhancement method based on multi-scale contrastive learning. This method introduces a semantic pivot node as the pivot of feature aggregation, and constructs a hierarchical contrastive learning framework at two levels of context and locality: at the context level, the model enhances the discriminability of features by capturing the semantic association across graphs; at the local level, the model improves the fine-grained discriminability of features by analyzing the interaction mode of the node and its direct neighborhood. This two-level contrastive learning mechanism can effectively identify and weaken the disguising strategies of fraudsters, thereby generating features with higher inter-class difference and intra-class consistency. Specifically, at the context level, the present application compares abnormal nodes and normal nodes within a batch; at the local level, the present application compares abnormal nodes and their neighborhood environment within a neighborhood subgraph. The two work together to significantly improve the ability of the anomaly detection model to recognize disguising behavior, and the context level and local level modules will be described in detail below.

[0048] 3.1 Context-level contrastive learning The goal in the context-level task is to design this module to learn the distribution patterns in different neighborhood subgraphs in a global range. Specifically, the embodiment of the present application aims to enable the model to capture the potential connections between nodes in different neighborhood subgraphs, thereby improving the discriminability of features at the global level.

[0049] For each target node in a batch , first initialize the feature of its semantic pivot node as the original feature , then use a layer GNN to aggregate information in the subgraph composed of the node and its one-hop neighbors, and update the node representation layer by layer. The formula is as follows: (10); (11); where represents the intermediate representation vector of node in the layer after aggregating neighbor information and before passing through the MLP; represents the representation of node in the layer, which is initially , "AGG" denotes an aggregation operation of neighbor information, and finally in the layer output Just as the generated semantic hub node feature ; denotes the node in the layer, denotes a vector concatenation operation, denotes the node set of neighbor nodes.

[0050] In order to make the generated semantic hub node feature more discriminative, the embodiment of the present application constructs a contrastive learning task. When constructing positive samples, first, the features of all nodes in the batch with the same label as the target node are averaged to obtain the mean feature: (12); (13); Where, MEAN denotes an average pooling operation, denotes the feature representation of the node in the batch , denotes the original feature prototype vector obtained by averaging the original features of all labeled nodes of the same class as , denotes the enhanced feature prototype vector obtained by averaging the enhanced features of all labeled nodes of the same class as , then the two parts are weighted and added to construct positive samples: (14); Similarly, define negative samples , here and are the average values of those nodes with different labels from the target node.

[0051] Next, use the bilinear layer to calculate the similarity between the generated feature of the semantic hub node and the positive and negative samples: (15); (16); Where, denotes the similarity of the positive sample, denotes the similarity of the negative sample, denotes the sigmoid activation function, is a learnable training matrix.

[0052] Binary Cross Entropy (BCE) loss is used to maximize the similarity with positive samples while reducing the similarity with negative samples. In a batch , the overall contextual-level loss is defined as: (17). where is the predicted similarity score of the -th sample, is the true label of the -th sample.

[0053] 3.2 Local-level contrastive learning The local-level task focuses on the performance of the target node in its local environment. In real-world scenarios, compared with normal users, abnormal users are relatively few, resulting in normal nodes occupying the majority in graph data. Therefore, in the process of message passing, normal nodes provide the main environmental information. Based on this observation, the more dissimilar the semantic hub node is from its local neighborhood, the stronger the distinctive information that the normal neighborhood can pass on, so that the semantic hub node eventually generates features that are more likely to express abnormal information.

[0054] Local-level contrast aims to capture the abnormal deviation of the semantic hub node from its topological context. The specific implementation is divided into three steps. The first step is to mask the target node and temporarily replace the feature of the semantic hub node with a zero vector: (18). Then get the local environment representation through the same GNN: (19). where represents the node representation obtained after L-layer propagation from a certain temporary or auxiliary graph encoder / module (denoted by “tmp”). The optimization goal of local-level contrastive learning is that when the target node is a normal node, the semantic hub node feature generated by it has a higher similarity with its environment contrastive sample . Conversely, when is an abnormal node, it is intended to show a lower similarity with . Therefore, the similarity between the environment representation and the original semantic hub node is calculated using a bilinear layer: (20). where is a learnable training matrix.

[0055] For normal nodes (label 0), it is expected that The environment representation is highly similar to the ground truth for normal nodes (labeled as 0), while for fraudulent nodes (labeled as 1), it is expected to be quite different. Based on the above idea, the local-level BCE loss is designed as follows: (21); wherein, represents the predicted similarity score of the i-th node, represents the true label of the i-th node, and is used for the local-level BCE loss. 3.3 Joint optimization Finally, in order to optimize the generation of semantic hub nodes, the embodiment of the application adopts a joint optimization method which combines the context-level and local-level losses. The joint loss function is defined as follows:

[0056] (22); wherein, is a hyperparameter for balancing the contributions of the context-level and local-level losses. In order to solve the problem of inconsistent features, the semantic hub nodes are introduced in this work. The semantic hub node features are generated by multi-scale contrastive learning, which better capture the semantic information of node classes compared to the original node features. The embodiment of the application gives a pseudo-code description of the semantic hub node generation algorithm in Table 2.

[0057] Table 2 Algorithm 2 - Semantic hub node generation algorithm

[0058]

[0059] The embodiment of the application gives a detailed description of the semantic hub node generation algorithm in Table 2. The first 2 lines perform feature initialization of the nodes, the second 6 lines perform node feature aggregation, the seventh 12 lines perform context-level positive sample construction, calculate the global contrastive loss, the thirteenth 16 lines perform local contrastive learning, calculate the local contrastive loss, and the seventeenth line balances the contributions of the global context loss and the local environment loss by the hyperparameter to calculate the final optimization objective.

[0060] 4. Strategy gradient driven neighbor aggregation module In the message passing process of traditional graph neural networks (GNNs), indiscriminate aggregation of all neighbor nodes can lead to the propagation of noisy information, especially in the face of fraud detection tasks, fraudsters may interfere with model judgment through deliberately constructed abnormal links (such as a large number of non-real associations or cross-class interactions) (i.e. the problem of inconsistent structures). To alleviate this problem, the embodiment of the application proposes an adaptive neighbor selection mechanism based on reinforcement learning, which dynamically evaluates the contribution of neighbor nodes to the representation learning of target nodes, and realizes fine-grained information aggregation.​​

[0061] First, for each neighbor of the target node , a subgraph is constructed as: (23); where is the semantic hub node generated before, denotes the association edge between the target node and the semantic hub node , and denotes the association edge between the neighbor node and the semantic hub node .

[0062] Then an MLP is used as the value predictor (VP) with the input being the GNN processed first layer activation and the output being the predicted value . The training loss of VP is: (24); where denotes the predicted probability of the enhanced feature of the neighbor node to the target node in the th layer; denotes the set of relation-aware neighbors of node .

[0063] For each neighbor of the target node , the policy network outputs a binary action: (25); The reward is designed according to the deviation between the predicted value of the target node after selecting the neighbor and the true label. The reward function is defined as: (26); where denotes the contribution value of the current neighbor node to the target node, is the average contribution value of the neighbor in the previous round, is a tolerance parameter. Through this design, if the selected neighbor makes the predicted result closer to the true label, a positive reward is obtained; otherwise, a negative reward is obtained.

[0064] Finally, after the RL policy network decision, a finely screened set is obtained for each neighbor set of the target node for subsequent message passing.

[0065] 5. Neighbor aggregation and final classification After generating and fine-tuning the neighbors of the target node via the semantic hub node, the representation of the target node is updated using the standard GNN message passing mechanism, but the aggregation here is limited to the neighbors selected via the RL policy.

[0066] In the first layer, the target node and its selected neighbors are aggregated, and the formula is: (27); (28); where is the learnable aggregation matrix.

[0067] In a graph convolutional network (GCN), each layer generates an embedding representation of the nodes. The embodiments of the present application aim to preserve the results of each layer and use an attention mechanism to calculate the final node embedding representation, and the following describes this process.

[0068] Let be the node embedding matrix of the th layer, where each element represents the embedding vector of the th node in the th layer. Assuming there are layers of GCN, the set of node embeddings of all layers can be represented as .

[0069] Introducing an attention mechanism, the embodiments of the present application first need to calculate an attention coefficient vector , where represents the importance weight of the th layer embedding ( ). This weight can be calculated by a content-based mechanism, for example: (29); (30); where the scoring function adopts a learnable linear transformation to evaluate the importance of each layer embedding. Common implementations include but are not limited to a fully connected layer or a simple linear transformation followed by a ReLU activation function, etc. Then, the obtained attention coefficient is used to weight the sum of all layer node embeddings to obtain the final node embedding representation : ​​​ (31); Here is the final node embedding representation derived from combining the results of different layers of GCN with attention mechanism, which takes into account the importance of information at each layer, thus providing richer expressive power than a single GCN layer.

[0070] The final node representation is passed through an MLP to obtain the prediction probability: (32); and trained using Focal Loss, which aims to reduce the weight of easy-to-classify samples, so that the model pays more attention to difficult-to-classify samples during training. The basic form of Focal Loss is as follows: (33); Here is the probability of the model predicting the correct class, is a balance factor to adjust the importance of positive and negative samples; is a focus parameter to adjust the degree of weight reduction for simple samples; when increases, the contribution of easy-to-classify samples to the overall loss becomes smaller.

[0071] 6、Optimization objective The total loss also needs to combine the loss of the VP module in the RL part before, and the final overall loss is: (34); where is a weight parameter to balance the classification loss and neighbor selection loss.

[0072] According to this optimization objective, the GCN is trained, the gradient of the loss with respect to the model parameters is calculated through the backpropagation algorithm, and the model parameters are updated using the Adam optimizer. After multiple rounds of learning, the classifier converges.

[0073] For binary classification, can be calculated according to the true label and the probability output by the model.

[0074] 7、Abnormality detection steps After the model is trained, the prediction steps for abnormality detection of unlabeled nodes are as follows: (35); where is the output of the layer GNN, is the attention weight.

[0075] Dynamic neighbor set screening using trained reinforcement learning policy network , only keeping neighbors that are beneficial to classification.

[0076] The learned features are input into the classifier MLP to obtain an anomaly probability: (36); wherein, is the final embedding representation of node , and the output is a two-dimensional vector , representing the predicted probability of normal and abnormal, respectively.

[0077] The final label is determined according to the threshold (default 0.5): (37); For different data sets, adjusting the value of changes the range of prediction.

[0078] In summary, the key of the embodiment of the present application is: 1. Topology adaptive label evolution mechanism Unlike traditional label propagation (Label Propagation) or static GCN prediction, the embodiment of the present application proposes an adaptive topology label evolution mechanism. The mechanism introduces a learnable graph structure weight matrix , dynamically adjusts the label diffusion strength, so that the propagation process not only depends on the topological adjacency relationship, but also can be automatically weighted according to the feature similarity and prediction confidence between nodes.

[0079] The label update rule is: (38); wherein, denotes the node label distribution matrix at the th iteration, denotes the number of iteration steps, denotes the initial label distribution matrix, denotes the learnable graph structure weight matrix, is the adjacency matrix with self-loop, defined as , is the adjacency matrix of the original graph, is the unit matrix; is the degree matrix corresponding to , which is a diagonal matrix whose diagonal elements are , is the fusion coefficient.

[0080] The mechanism realizes the transition from fixed topology propagation to "topology-feature collaborative propagation", solves the label mis-transmission problem caused by noise edges, and generates a stable pseudo-label distribution under unsupervised conditions. Adaptive propagation weight Learning and updating rules; End-to-end label optimization mode combining graph convolution and dynamic propagation; Self-regularization constraint combining label confidence and structural consistency.

[0081] 2, semantic hub node generation and double-layer contrast learning mechanism The embodiment of the application innovatively introduces the concept of "semantic hub node" (Semantic Hub Node), which is used as an intermediary for feature aggregation and contrast learning. Multi-scale feature enhancement is achieved through a double-layer structure of global semantic contrast and local topology contrast.

[0082] A. Global semantic contrast (Contextual Contrast) By aggregating semantic hub nodes in different graph regions, "normal- abnormal" global semantic contrast pairs are constructed to learn the distribution boundary across communities.

[0083] B. Local topology contrast (Local Contrast) Based on the neighborhood subgraph masking and reconstruction mechanism, the similarity gradient between semantic hub nodes and neighborhoods is learned to capture the local disturbance features of abnormal nodes.

[0084] C. Double-layer loss joint optimization: (39); In the formula, Ltotal represents the total loss function, Lcontext represents the context-level contrast loss, Llocal represents the local-level contrast loss, , Lweight represents the loss weight coefficient.

[0085] The mechanism realizes feature semantic alignment at the context and local levels; effectively resists fraudulent node disguises, and improves feature discrimination and robustness. The key points of the mechanism are: The aggregation formula of the semantic hub node generation; The joint optimization structure of the double-layer contrast loss; The positive and negative sample dynamic reconstruction strategy.

[0086] 3, neighbor aggregation mechanism driven by policy gradient To solve the problem of "noise neighbor pollution" in GNN, the embodiment of the application introduces reinforcement learning into the graph aggregation process, and proposes a neighbor selection mechanism driven by policy gradient. A policy network outputs a binary action (select / discard) according to the predicted value of the neighbor node, a reward function dynamically adjusts according to the improvement degree of the target node prediction result, and a value predictor estimates the marginal contribution of each neighbor to guide policy update.

[0087] The reward function is defined as: (40); In the formula, represents the reward value, which is used to evaluate the good or bad of the neighbor selection action; represents the new predicted score, that is, the predicted score of the target node recalculated using the filtered neighbors after the policy network performs neighbor selection; represents the original predicted score, that is, the predicted score of the target node without neighbor selection; represents a reference threshold (which can be a hyperparameter or an adaptive value), which is used to judge whether the improvement is significant. If the improvement amount exceeds , a positive reward is given; otherwise, a negative reward is given.

[0088] This mechanism realizes fine control of information aggregation, changes GNN from "neighbor average" to "neighbor decision", and significantly improves the accuracy of abnormal node identification in the presence of non-real edges. That is, the key points of this mechanism are: The calculation method of neighbor contribution value; The joint training mechanism of policy gradient update and classification loss; The reinforcement learning reward function and the threshold dynamic adjustment strategy.

[0089] 4. Multi-layer attention fusion and anomaly discrimination mechanism After aggregation is completed, the model uses a hierarchical attention fusion mechanism to weight and integrate different depth embeddings. The node embedding of each layer is automatically assigned a weight according to the interlayer information gain to obtain the final representation: (41); In the formula, is the attention weight of the lth layer, is a learnable weight matrix, is a learnable attention vector, is a nonlinear activation function, is the node embedding representation of the lth layer, is the total number of GNN layers.

[0090] And through the focal loss (focal loss) optimization training, the sensitivity to the minority abnormal sample is improved.

[0091] The mechanism enhances the interpretability and imbalance robustness of the model in the multi-layer feature space, and can realize accurate discrimination of hidden abnormal behaviors.

[0092] 5, strong negative sample sampling strategy The embodiment of the application proposes a distance-aware sampling mechanism based on node embedding space, preferentially collects "pseudo abnormal" samples for training, so as to improve the fitting ability of the model to the discrimination boundary and strengthen the identification performance of "edge samples". That is, the key points of the mechanism are: Distance weighted sampling probability formula; Parameter control sampling bias; Sampling mechanism and integrated training of embedding space.

[0093] System embodiment According to the embodiment of the application, an abnormal user detection system based on topology awareness and hub node guidance is provided, Figure 5 is a schematic diagram of the abnormal user detection system based on topology awareness and hub node guidance of the embodiment of the application, as Figure 5 shown, the abnormal user detection system based on topology awareness and hub node guidance according to the embodiment of the application specifically comprises: A data acquisition module 50 is configured to acquire graph structure data including nodes, edges, node initial features and part of node known labels. A label optimization module 51 is configured to fuse the topology relationship and the node initial features in the graph structure data by using a topology adaptive label evolution mechanism, and to predict and optimize the label of the unlabeled node to generate an optimized label distribution matrix. A feature enhancement module 52 is configured to generate semantic hub node features based on the node initial features and taking the optimized label distribution matrix as a supervision signal through a double-layer multi-scale contrast learning mechanism; wherein the double-layer multi-scale contrast learning mechanism comprises context-level contrast learning and local-level contrast learning. A neighbor screening module 53 is configured to dynamically screen the neighbors of each target node based on the semantic hub node features by using a strategy gradient driven neighbor aggregation mechanism. A representation fusion module 54 is configured to perform message passing through a multi-layer graph neural network based on the screened neighbor set, and fuse the node representations of different layers by using an attention mechanism to obtain a final node representation. An anomaly classification module 55 is configured to input the final node representation into a classifier, determine the node category according to the probability output by the classifier, and output an abnormal user detection result.

[0094] The embodiment of the present application is a system embodiment corresponding to the above-mentioned method embodiment, and the specific operation of each module can be understood with reference to the description of the method embodiment, which will not be repeated here.

[0095] Device embodiment one The embodiment of the present application provides an electronic device, comprising a memory, a processor and a computer program stored on the memory and executable on the processor, and the computer program implements the steps as described in the method embodiment when executed by the processor.

[0096] Device embodiment two The embodiment of the present application provides a computer readable storage medium, and the computer readable storage medium stores an implementation program of information transmission, and the program implements the steps as described in the method embodiment when executed by a processor.

[0097] The computer readable storage medium described in the embodiment includes but is not limited to ROM, RAM, magnetic disk or optical disk, etc.

[0098] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. An abnormal user detection method based on topology awareness and hub node guidance, characterized in that, include: Obtain graph structure data including nodes, edges, initial node features, and some known node labels; The topological relationships and initial node features in the graph structure data are fused using a topology adaptive label evolution mechanism, and the labels of unlabeled nodes are predicted and optimized to generate an optimized label distribution matrix. Based on the initial features of the nodes and using the optimized label distribution matrix as a supervision signal, semantic hub node features are generated through a two-layer multi-scale contrastive learning mechanism. Based on the semantic hub node features, a policy gradient-driven neighbor aggregation mechanism is used to dynamically filter the neighbors of each target node. The selected neighbor set is used for message passing through a multi-layer graph neural network, and the attention mechanism is used to fuse the node representations of different layers to obtain the final node representation. The final node representation is input into the classifier, and the node category is determined based on the probability output by the classifier, thus outputting the abnormal user detection result.

2. The method according to claim 1, characterized in that, The topological relationships and initial node features in the graph structure data are fused using a topology adaptive label evolution mechanism, and the labels of unlabeled nodes are predicted and optimized to generate an optimized label distribution matrix. Specifically, this includes: An initial label distribution matrix of nodes is constructed based on the graph structure data; wherein, in the initial label distribution matrix, the labeled nodes are the one-hot encodings of their true labels, and the labels of unlabeled nodes are initialized to zero vectors; The initial features of the nodes are processed through a graph convolutional network to perform multi-layer message passing, thereby extracting the higher-order feature representations of the nodes. The classifier is trained using the high-order feature representations corresponding to the labeled nodes. The trained classifier is then used to make preliminary predictions of the labels of all nodes, resulting in the predicted label probability distribution. The initial label distribution matrix is ​​fused with the predicted label probability distribution to form a joint initial label matrix; Based on the normalized Laplace matrix of the graph structure data, the joint initialization label matrix is ​​propagated through multiple rounds of iteration. In each round of iteration, the topological structure information and the initial label information are fused until convergence, and the optimized label distribution matrix is ​​output as a supervision signal.

3. The method according to claim 1, characterized in that, The two-layer multi-scale contrastive learning mechanism includes context-level contrastive learning and local-level contrastive learning.

4. The method according to claim 3, characterized in that, Based on the initial node features and using the optimized label distribution matrix as a supervision signal, the semantic hub node features are generated through a two-layer multi-scale contrastive learning mechanism, specifically including: For each target node in the graph, information is aggregated using a graph neural network based on its initial node features and the features of its neighbors to generate the initial semantic hub node features corresponding to the target node. In the context-level contrastive learning, based on the nodes within the batch and their optimized label distribution matrix, node features with the same pseudo-label are aggregated to construct a positive sample representation of the target node, and node features with different pseudo-labels are aggregated to construct a negative sample representation of the target node; wherein, the pseudo-label is the pseudo-label indicated by the optimized label distribution matrix; the context-level contrastive loss is obtained by maximizing the similarity between the initial semantic hub node features and the positive sample representation and minimizing the similarity between the initial semantic hub node features and the negative sample representation through similarity calculation and loss function. In the local-level contrastive learning, the initial semantic hub node features are masked, and the local environment representation is reconstructed through a graph neural network based on the neighbor node features of the target node. By calculating the similarity between the initial semantic hub node features and the local environment representation, and constructing a contrastive loss based on node pseudo-labels, the local-level contrastive loss is obtained, making normal node features similar to the local environment representation and abnormal node features different from the local environment representation. The context-level contrast loss and the local-level contrast loss are weighted and summed to obtain the joint contrast loss. The parameters of the graph neural network are then optimized by backpropagating the joint contrast loss to generate the final optimized semantic hub node features for each node.

5. The method according to claim 1, characterized in that, Based on the semantic hub node features, a policy gradient-driven neighbor aggregation mechanism is used to dynamically filter the neighbors of each target node, specifically including: S51: For each target node, traverse each candidate neighbor node in its original neighbor set and construct an evaluation subgraph for each candidate neighbor node; wherein, the evaluation subgraph includes the target node, the candidate neighbor nodes, and the association information between the two and the semantic hub node features; S52: Input the evaluation subgraph into the value predictor, and output the predicted contribution of the candidate neighbor node to the target node classification task through the value predictor; S53: Based on the predicted contribution, a binary selection decision of retaining or discarding is generated for each candidate neighbor node through a policy network, and the retained neighbor nodes are selected from the original neighbor set of the target node according to the decision result, forming the current neighbor subset of the target node. S54: Based on the current neighbor subset, aggregate and classify the semantic hub node features of the target node through a graph neural network to obtain the predicted category of the target node. Compare the predicted category with the supervision signal, generate a reward signal according to the comparison result, and update the parameters of the policy network using the reward signal through the policy gradient method. S55: Repeat steps S51 to S54 using the updated policy network to optimize the neighbor selection strategy of the target node in multiple rounds. After optimization, output the final neighbor set for the target node based on the final round selection decision.

6. The method according to claim 1, characterized in that, Based on the selected neighbor set, message passing is performed through a multi-layer graph neural network, and an attention mechanism is used to fuse the node representations of different layers to obtain the final node representation, which specifically includes: Based on the selected neighbor set, the semantic hub node features are iteratively processed and transformed using a multi-layer graph neural network to obtain the node embedding representation output by each layer of the graph neural network. A learnable attention weight is assigned to the node embedding representation of each layer; wherein the attention weight is obtained by calculating and normalizing a content-based scoring function, the scoring function taking the node embedding representation of that layer as input; The node embeddings of each layer are weighted and summed with their corresponding attention weights to obtain the final fused node representation.

7. An abnormal user detection system based on topology awareness and hub node guidance, characterized in that, include: The data acquisition module is used to acquire graph structure data including nodes, edges, initial node features, and some known node labels; The label optimization module is used to fuse the topological relationships and initial node features in the graph structure data using a topology adaptive label evolution mechanism, and to predict and optimize the labels of unlabeled nodes to generate an optimized label distribution matrix. The feature enhancement module is used to generate semantic hub node features based on the initial features of the node and with the optimized label distribution matrix as a supervision signal, through a two-layer multi-scale contrastive learning mechanism. The neighbor filtering module is used to dynamically filter the neighbors of each target node based on the features of the semantic hub node using a policy gradient-driven neighbor aggregation mechanism. The fusion module is used to perform message passing through a multi-layer graph neural network based on the selected neighbor set, and to fuse the node representations of different layers using an attention mechanism to obtain the final node representation. The anomaly classification module is used to input the final node representation into the classifier, determine the node category based on the probability output by the classifier, and output the abnormal user detection result.

8. The system according to claim 7, characterized in that, The two-layer multi-scale contrastive learning mechanism includes context-level contrastive learning and local-level contrastive learning.

9. An electronic device, characterized in that, include: The memory, the processor, and the computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the abnormal user detection method based on topology awareness and hub node guidance as described in any one of claims 1-6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores an implementation program for information transmission, which, when executed by a processor, implements the steps of the abnormal user detection method based on topology awareness and hub node guidance as described in any one of claims 1-6.

Images