Graph anomaly detection method and system based on graph contrast learning

Abstract

The invention discloses a graph anomaly detection method and system based on graph contrast learning, and relates to the technical field of graph neural networks. The method comprises the following steps: constructing a graph encoder DP-GNN, and obtaining effective node representation in an attribute graph for a subsequent graph anomaly detection task; a cross-scale contrast learning model is constructed, and joint detection of attribute anomaly and structure anomaly is realized by maximizing semantic distances of positive and negative samples in an attribute space and a structure space; and constructing a feature screening framework of global search and local optimization, and realizing screening of key feature subsets through a hybrid genetic algorithm. According to the method, joint detection of the node attribute anomaly and the structure anomaly can be realized, and the anomaly detection accuracy is improved.

Description

Technical Field

[0001] This invention relates to the field of graph neural network technology, and in particular to a graph anomaly detection method and system based on graph contrastive learning. Background Technology

[0002] In the context of the booming digital economy, the scale of data is expanding exponentially. Among them, graph data, with its powerful relational modeling capabilities, has become a core carrier for characterizing complex systems such as social networks and financial transaction networks. However, with the surge in the dimensionality and structural complexity of graph data, the security risks caused by abnormal nodes, edges, or subgraphs are becoming increasingly prominent. This makes Graph Anomaly Detection (GAD) technology a core line of defense for maintaining data security and the healthy operation of systems, attracting widespread attention from academia and industry.

[0003] Graph anomaly detection aims to identify nodes, edges, subgraphs, or graph instances in graph data that do not conform to normal patterns. It is widely used in fields such as social network fraud detection, financial risk control, and biological network analysis. Traditional methods are difficult to apply directly due to the complex structure of graph data (such as its dynamics and heterogeneity), while the development of deep learning, especially graph neural networks (GNNs), has provided a new paradigm for solving this problem. Through message passing mechanisms, GNNs can effectively encode graph structure and node attributes, achieving deep modeling of complex relationships. However, anomaly types in real-world scenarios exhibit high diversity; structural anomalies, contextual anomalies, and global anomalies often coexist, greatly increasing the complexity of detection tasks. Furthermore, the "node homogeneity assumption" commonly relied upon by existing methods faces a fundamental challenge in anomaly detection scenarios—the outlier nature of anomalous nodes makes their topological structure and attribute features significantly different from neighboring nodes, making it difficult for models based on the homogeneity assumption to accurately identify anomaly patterns, becoming a key obstacle restricting the improvement of detection performance.

[0004] Meanwhile, the advent of the big data era has further exacerbated the technical challenges of graph anomaly detection: the heterogeneous features of multi-view data (such as cross-modal fusion of user attributes and transaction records) exceed the processing capabilities of traditional methods; the high cost of annotation forces research to shift to unsupervised or semi-supervised paradigms, but existing technologies still have many limitations—graph autoencoders are prone to information loss in high-dimensional feature reconstruction, self-supervised methods are limited by the assumption of "homogeneity of a class", and single-view models cannot make full use of the complementary information of multi-source data.

[0005] It is worth noting that providing anomaly detection results with explanations has significant practical implications: it helps gain end-user trust in the anomaly detection system, enables users to verify detection results in unsupervised scenarios, and helps users find the root causes of anomalies to take remedial or preventative measures. However, for a long time, the field of anomaly detection has tended to prioritize detection accuracy over the interpretation of decision results. For example, Micenková et al. argue that almost all existing algorithms remain at the stage of providing anomaly rankings, without providing users with the specific reasons and explanations for data points deviating from normal values; Dang et al. also point out that although there are many techniques available for discovering global and local anomaly patterns, most research focuses only on outlier identification, neglecting the equally important issue of outlier interpretation. This situation further exacerbates the difficulty of implementing graph anomaly detection technology in practical applications. Summary of the Invention

[0006] The technical problem to be solved by this invention is how to provide a graph anomaly detection method and system based on graph contrastive learning that can achieve joint detection of node attribute anomalies and structural anomalies, thereby improving the accuracy of anomaly detection.

[0007] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is: a graph anomaly detection method based on graph contrastive learning, comprising the following steps: Construct a graph encoder DP-GNN to obtain valid node representations in the attribute graph for subsequent graph anomaly detection tasks; A cross-scale contrastive learning model is constructed to achieve joint detection of attribute anomalies and structural anomalies by maximizing the semantic distance between positive and negative samples in the attribute space and the structure space. A feature selection framework combining global search and local optimization is constructed, and a hybrid genetic algorithm is used to select a subset of key features.

[0008] The present invention also discloses a computer system, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the graph anomaly detection method based on graph contrast learning.

[0009] The beneficial effects of adopting the above technical solution are as follows: The proposed method, from a multi-view, multi-scale perspective, achieves joint detection of node attribute anomalies and structural anomalies, effectively addressing the challenges of anomaly type diversity and multi-source data heterogeneity. Employing an integrated GNN graph encoder DP-GNN, it overcomes the traditional GNN's reliance on homogeneity assumptions by constructing a dual propagation mechanism of structure propagation and attribute aggregation. Simultaneously, by integrating edge-based and node-based learned node vector representations, an effective node vector representation is obtained. This design not only alleviates the oversmoothing problem of GNNs but also successfully solves the local mismatch problem in anomaly detection, enabling the model to accurately identify anomalous nodes without relying on strong structural assumptions.

[0010] Furthermore, this method can provide a scientific explanation for anomaly detection results, overcoming the poor interpretability of traditional deep anomaly detection methods. This helps improve end-user trust in the detection system and provides a basis for taking targeted remedial or preventative measures. Experimental results on multiple datasets fully demonstrate that the proposed framework performs excellently in detecting anomalies in complex attribute network graphs, exhibiting good performance and generalization ability, and providing an efficient and reliable new method for the field of graph anomaly detection. Attached Figure Description

[0011] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0012] Figure 1 This is the main flowchart of the method described in Embodiment 1 of the present invention; Figure 2 This is a schematic diagram of the dual propagation in the method described in Embodiment 1 of the present invention. Figure 3 This is a diagram of the interpretable graph anomaly detection framework based on graph contrast learning in the method described in Embodiment 1 of the present invention; Figure 4 The diagram shows the DP-GNN encoder framework in the method described in Embodiment 1 of the present invention. Figure 5 These are the AUC values ​​of each algorithm in Test Example 1 of this invention on each dataset; Figure 6 The AUPRC values ​​of each algorithm in Test Example 1 of this invention are on each dataset; Figure 7 This is an explanatory diagram of the feature subset of the node with the highest abnormal score on the CiteSeer dataset in Test Example 1 of this invention; Figure 8 This is a graph showing the model performance on various datasets under different α values ​​in Test Example 1 of this invention; Figures 9a-9d To demonstrate the model performance on various datasets under different γ values ​​in Test Example 1 of this invention Figure 10This is a schematic diagram of the computer system described in Embodiment 2 of the present invention. Detailed Implementation

[0013] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0014] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0015] Example 1: Overall, such as Figure 1 As shown in the figure, this invention discloses a graph anomaly detection method based on graph contrastive learning, the method comprising the following steps: S1: Construct a graph encoder DP-GNN to obtain valid node representations in the attribute graph for subsequent graph anomaly detection tasks; S2: Construct a cross-scale contrastive learning model to achieve joint detection of attribute anomalies and structural anomalies by maximizing the semantic distance between positive and negative samples in the attribute space and the structure space; S3: Construct a feature selection framework that combines global search and local optimization, and use a hybrid genetic algorithm to select a subset of key features.

[0016] The method described in this invention first proposes a graph encoder DP-GNN, thereby breaking through the dependence of traditional GNNs on the homogeneity assumption. This encoder constructs a dynamic aggregation mechanism that integrates local structure awareness and attribute association, achieving dual propagation of structure and attribute propagation through node importance and node-feature similarity (see schematic diagram). Figure 2 As shown, it can more accurately capture the unique features of abnormal nodes; secondly, by using multi-view graph comparative learning, it can jointly detect attribute anomalies and structural anomalies of nodes, effectively addressing the challenges brought by the diversity of anomaly types and the heterogeneity of multi-view data; finally, through an improved hybrid genetic algorithm, it can efficiently search for key feature subsets, thereby generating convincing explanations for abnormal nodes and making up for the shortcomings of traditional depth map anomaly detection methods in terms of result interpretability.

[0017] The above steps will be explained in detail below with specific methods: Attribute Networks: This application primarily focuses on the anomaly detection problem of attribute graphs, which can be represented as follows:G =( V, E )=( A, X ),in, V ={ v 1， v 2 ···v n}and E ={ e 1， e 2 ···e m} represent the number of nodes in the graph respectively. n The set of nodes and the number of edges are m The set of edges. Represents the adjacency matrix of a graph, where if the nodes v i and nodes v j If there is a connection, then A i，j =1, otherwise A i，j =0. The attribute matrix representing the graph indicates that each node has d Each attribute.

[0018] Graph anomaly detection: For a given node as v 1， v 2 ···v n Attribute diagram G We need to learn an anomaly scoring function. f This function takes a graph as input data and outputs an anomaly score vector. This is used to measure the degree of anomaly at each point. Specifically, the output subvector... The first in i element s (i) Represents a node v i The degree of abnormality is determined by a score, where a higher score indicates a higher degree of abnormality. All nodes are then sorted according to the scores to detect abnormal nodes.

[0019] Feature selection: Graph data, besides its topological structure, also includes high-dimensional content information (such as node features), which is often noisy. Therefore, feature selection is an effective technique to alleviate this problem. Utilizing node importance to select important features can not only improve model performance but also provide clearer interpretations of anomaly detection results. Feature importance is measured based on the frequency or magnitude of feature dimensions in highly central nodes. Feature dimensions that frequently appear in influential nodes should be considered important. The weights of feature dimensions are defined as follows: Feature Dimension i The weight is the sum of the products of the number of times that dimension appears in all nodes and the node centrality.

[0020] For sparse one-hot node features, for any node u and the i 3D features x ui ∈{0,1}, calculate the first... i Dimension weights: (1) in It is a node centrality metric, used to quantify the importance of nodes. (First item) x ui ∈{0,1} represents a node u The number of occurrences of the i-th dimension feature, the second term This measures the importance of each node that appears. The weights are then normalized to obtain probabilities representing the importance of the features. The first should reflect the characteristics of the node. i The importance of dimensions: (2) in and They are The maximum and mean values ​​of the features are considered. Typically, in a citation network, each feature dimension of a node corresponds to a keyword. Therefore, keywords that frequently appear in a highly influential paper should be considered information-rich and important. First, the average importance weights of all features are calculated, and then features with weights higher than the average are selected as important features. Feature selection algorithms based on node centrality measures quantify the correlation between features and anomalous patterns, achieving data dimensionality reduction while preserving key information. Feature selection methods effectively reduce the number of features describing an object, thus facilitating the interpretation of anomalies. Feature selection methods retain the original feature subset containing the most important information, significantly improving interpretability and effectively mitigating the curse of dimensionality in high-dimensional data.

[0021] The framework for implementing the method described in this application is as follows: Figure 3As shown, it is mainly divided into five parts: integrated GNN graph encoder DP-GNN (Dual Propagation GNN), attribute anomaly detection module, structural anomaly detection module, anomaly fusion module, and interpretability module. Through the collaboration of multiple modules, this framework realizes anomaly detection from both attribute and structural perspectives, providing a more comprehensive solution for attribute network anomaly identification.

[0022] Integrated GNN graph encoder DP-GNN: After feature selection, extracting effective node vector representations based on node structure and attribute information is a crucial step in graph anomaly detection. While GCNs can handle the structure and attributes of attribute networks, the learned representations are not suitable for graph anomaly detection in unsupervised scenarios. In conventional GCN algorithms, the aggregation is mean aggregation, meaning it doesn't distinguish the characteristics of different neighboring nodes of the target node. Furthermore, conventional GCN algorithms typically use only 2-3 graph convolutional layers, failing to learn deep structural information within the network. Simply stacking graph convolutional layers leads to uniformity in node feature representations, a problem known as oversmoothing. Therefore, this application fully utilizes the graph structure and attribute information of graph data, integrating node embedding representations from both edge and node perspectives to obtain effective node embedding representations. This achieves a dual propagation mechanism of structure propagation and feature propagation. The innovative GNN graph encoder DP-GNN module proposed in this application is as follows: Figure 4 As shown.

[0023] 1) Edge-based perspective: Introducing the Personalized PageRank (PPR) algorithm for random walk modeling of graph topology accurately captures structural reachability and path dependencies between nodes, effectively preserving local topological features. This characteristic makes the feature propagation process based on PPR less prone to oversmoothing, providing strong support for the model to more accurately identify and distinguish different categories of nodes. Simultaneously, with the help of the PPR algorithm, features at different levels naturally incorporate node importance considerations during propagation, achieving more efficient feature fusion. This hierarchical feature fusion mechanism helps to deeply capture complex structural information in the graph, enhancing the model's ability to understand graph data. 2) Node-based perspective: Anomaly nodes often exhibit significant differences in attributes compared to their neighbors, a characteristic that provides crucial additional information for anomaly detection. Weighting the adjacency matrix based on node feature similarity significantly improves the discriminative power between nodes. In scenarios with prominent local mismatches, edges between feature-similar nodes more accurately reflect node relationships, effectively mitigating noise interference. Furthermore, strengthening connections between similar nodes reduces the noise impact introduced by irrelevant nodes, improving the clarity of feature representations. Therefore, a dynamic weighting strategy based on node attribute similarity is designed to accurately identify and weaken the influence of nodes with mismatched attributes, allowing the message aggregation process to focus more on effective neighbors with matching structures and attributes, ultimately achieving effective suppression of noise propagation. 3) Integration of bidirectional propagation: Finally, the node vector representations learned based on edges and nodes are integrated to achieve a dual propagation mechanism of structure propagation and feature propagation. This can effectively alleviate the problems of oversmoothing in GNN and local mismatch in anomaly detection, thereby obtaining a distinguishable representation of nodes for better anomaly detection tasks.

[0024] (3) (4) The node is calculated via Power Iteration. v The PPR vector is approximately: (5) A norm It is a normalized adjacency matrix. e v It is a node v The unit vector, where α is the restart probability. The original adjacency matrix A In and nodes v Enhanced edge weights, which closely correlated elements, capture local communities and semantically related paths within the graph structure, enabling personalized information dissemination. Similarity matrix. : 。

[0025] Enhanced adjacency matrix This combines structural connectivity and feature similarity to achieve dual information transmission. It utilizes the cosine similarity matrix of node features. The adjacency matrix is ​​dynamically adjusted to enhance information propagation between nodes with similar characteristics.

[0026] Generating an adjacency matrix that considers both structural paths and feature similarity, and using the fused adjacency matrix for information propagation, can enhance the model's ability to capture heterogeneous information. β It is a tradeoff parameter that controls the relative importance of the PPR path and feature similarity. σ is a non-linear activation function, and Dropout is a random deactivation operation. This indicates element-wise multiplication, where I is the identity matrix.

[0027] The DP-GNN graph encoder implements a dual propagation mechanism of structure propagation and feature propagation, making full use of the rich information provided by node anomaly detection. By dynamically adjusting the adjacency matrix with dual weighting, it breaks the feature convergence dilemma caused by multi-layer iteration in traditional GNNs without relying on the assumption of graph homogeneity, and significantly alleviates the oversmoothing problem.

[0028] Attribute anomaly detection module: The core mechanism of contrastive learning networks is to optimize node representations by continuously bringing positive sample pairs closer together and pushing negative sample pairs further apart, with the construction of positive and negative sample pairs being a crucial step in this process. In node-subgraph level contrastive networks, for the target node... v i It forms a positive sample pair with its subgraph and a negative sample pair with the subgraph containing another random node; in a node-to-node level contrastive network, negative samples are generated from other nodes. v j ( i≠j The negative samples for a node are obtained from the subgraph centered on the node. Since the contrastive learning model uses mini-batch training, negative samples for a node can be directly obtained from other target nodes in the same batch, greatly simplifying the sample construction process.

[0029] Multi-view contrastive learning improves detection efficiency by mining inconsistencies in pairs of anomalous node instances from multiple dimensions. It not only extracts local and global information of nodes in the original and enhanced graphs respectively, but also performs multi-scale comparisons in each view. Node-subgraph comparison identifies anomalies by capturing information about the node's neighborhood, while node-node comparison focuses on detecting anomalies based on the node's own attributes. By generating subgraphs at different scales and performing contrastive learning at two levels, it can comprehensively capture local and global anomaly patterns: node-node comparison accurately identifies the differences between local anomalous samples and normal samples, capturing subtle anomalous features; node-subgraph level comparison focuses on the matching degree between samples and the global context, helping to discover anomalies that do not conform to the overall pattern. The synergistic effect of both achieves comprehensive detection of node attribute anomalies in the graph, significantly improving detection accuracy.

[0030] In the subgraph generation stage, the Random Walk Restart (RWR) algorithm is used to generate two subgraphs of fixed size K centered on the target node.G p (i) =( A p (i) ，X p (i) ) and G c (i) =( A c (i) ，X c (i) These are used for node-to-node and node-to-subgraph level comparisons, respectively. To avoid information leakage during the comparison learning process, the target node mask needs to be preprocessed before the subgraph is input into the comparison network: the target node... v i The attribute vector is replaced with the zero vector, that is, the matrix is ​​replaced with the zero vector. X p (i) and X c (i) The i All rows are set to 0, which forces the model to infer the features of the target node through neighbor information, thereby enhancing the model's feature learning ability. 1) Node-to-node comparison: Node-to-node contrastive learning is for use in subgraphs. G p (i) The consistency between the embedding of the masked target node and the embedding of the original target node is learned in the middle. Binary cross-entropy loss is used to train the contrast by utilizing the representation of the target node and the corresponding subgraph.

[0031] First, node embeddings in the subgraph are learned using DP-GNN. H p (i) 。

[0032] (6) θ is the parameter set of the GNN, and Θ is the weight matrix of the DP-GCN layer. σ (·) is the PReLU activation function. For node-to-node contrastive learning, through h p (i) = H p (i) [1,:] is used to select the embedding of the mask target node. It is worth noting that although the corresponding input... X p(i) [1,:] is a zero vector, but by aggregating the attributes of other nodes in the subgraph through DP-GNN, the embedding... H p (i) [1,:] becomes an informative vector. Then, the target node is calculated using the MLP module. v i Embedded, node v i Feature matrix x (i) = X [ i Embedding of the target node: (7) The weights here are shared with the GNN weights in the formula, in order to ensure h p (i) With z p (i) They are mapped to the same embedding space. Finally, h is learned through a contrastive learning module. p (i) With z p (i) Consistency between them. Specifically, through a bilinear layer. To calculate the similarity score between them: (8) W p It is a trainable parameter matrix. σ (·) is the Sigmoid function. Node-to-node contrastive learning networks are trained using cross-entropy loss as the objective function. (9) 2) Node-subgraph comparison: Node-subgraph level contrastive networks have a similar structure to node-node level networks. First, similar to equation (6), a parameter set is used... The GNN graph encoder DP-GNN is used to generate subgraphs G c (i) Node embedding.

[0033] (10) Node-to-subgraph level contrastive networks use different parameter sets than node-to-node level networks because the contrast at the two scales should be performed in different embedding spaces. The main difference is that node-to-subgraph level contrastive networks attempt to learn the consistency between the target node embedding and the subgraph embedding, which is obtained through a readout module. (11) Average pooling is used as the readout function. To map the features of the target nodes to the same embedding space, an MLP module similar to Equation (7) is used (sharing the same parameter set). To calculate the embedding of the target node z c (i) Then, the node-subgraph level similarity score. s c (i) via parameter matrix W c The bilinear function is calculated. Finally, the node-subgraph level network is trained using the following objective function: (12) 3) Attribute anomaly score: During the training phase, the two contrast networks are jointly trained, and the overall objective function of the attribute anomaly detection module is: (13) Here, α∈[0,1] is a trade-off parameter used to balance the importance between the two components.

[0034] The attribute anomaly scoring module obtains the similarity between the embedding of each target node and the contrasting subgraph, and calculates the node attribute anomaly based on the similarity information. After the multi-scale contrastive learning module under multiple views is trained, a statistical anomaly estimator is used to calculate the node attribute anomaly score during the inference phase. Given a target node, R subnetworks are generated for node-to-node level contrast and node-to-subgraph level contrast, and then input into the contrast network, resulting in a total of 4R scores. For a normal node, its embedding should be similar to the subgraph in a positive instance pair, so the score should be close to 1; conversely, in a negative instance pair, the node embedding is dissimilar to its subgraph embedding, and the score should be close to 0. For an anomalous node, whether in a positive or negative instance pair, its node embedding is dissimilar to the subgraph embedding, and the score is close to 0. Therefore, the attribute anomaly score of a node is defined as the difference between the anomaly scores of positive and negative instance pairs: (14) Abnormal nodes should have lower positive similarity, thus resulting in higher base scores. (Subscript "") view "represent" p "or" c " This represents the score for abnormal node attributes in a pair of negative instances. This represents the score of abnormal node attributes in a pair of positive instances. j ∈[1, ..., R].

[0035] To enhance the robustness of attribute anomaly scores and improve the model's detection accuracy, this application employs a statistical anomaly estimator to calculate the attribute anomaly scores of nodes. Statistical Anomaly Scoring , It is the sum of the mean and standard deviation of the base scores.

[0036] (15) (16) subscript " view "represent" p "or" c The mean of the baseline score reflects the average degree of anomalies, while the standard deviation reflects stability over multiple rounds of sampling. Combining the mean and standard deviation of the baseline score yields the node. v i Final attribute anomaly score: (17) Structural anomaly detection module: In reality, there are often close relationships between normal samples, such as frequent email exchanges between a manager and secretary. Conversely, frequent email exchanges between an assembly line worker and a secretary are considered anomalous. Therefore, some suspicious regions may contain normal nodes but exhibit structural anomalies. To detect structural anomalies in nodes, we first utilize... k -core method find k The graph is then divided into dense substructures based on node connectivity. Nodes with significantly different attributes have a higher probability of being anomalous, hence the dense substructures containing anomalous nodes. C 0, ... C b There is a possibility that this area may become a suspicious area.

[0037] Since the average node-pair similarity is negatively correlated with the degree of anomalousness of nodes in the substructure, the reciprocal of the average node-pair similarity is used to represent their anomalousness. To obtain more accurate similarity, the embedding of node attributes is used instead of the original attribute values. Specifically, cosine distance is chosen as the method for measuring node-pair similarity. (18) z k and z q Represents a node v k and v q The embedding is used. The average node pair similarity for each substructure is calculated using an averaging function: (19) n j Substructure C j The number of node pairs in the node v k and v q Substructure C j Calculate the structural anomaly score for each node in the substructure using the following formula: (20) d j Substructure C j Similarity between internal nodes t i Indicates belonging to a substructure C j Internal target nodes v i The structural anomaly score. It is currently unclear which substructure the structural anomaly belongs to, therefore a gradually increasing score is used. k The value is tested in multiple rounds. To avoid unnecessary calculations, we start from a specific value. k The value is being detected. k The value is equal to the average node degree δ. The substructure discovery algorithm will stop when NULL is returned. In each detection, the structural anomaly estimate of the node detected in any substructure is calculated using formulas (18), (19), and (20). Other nodes not detected in any substructure will be assigned a topology anomaly score of 0.

[0038] Based on the characteristics of anomalous node detection, a topology anomaly scoring method is designed by combining average node pair similarity and substructure size. A multi-scale substructure scoring strategy is typically employed for topology anomaly detection. In practice, the number of nodes in the substructure is used to measure this influence. Therefore, the final topology anomaly score for each node is determined by averaging the anomaly scores from multiple rounds of detection. Thus, the formula for calculating the final structural anomaly score of the target node is as follows: (twenty one) | C j | Represents a node v i Substructure C j The number of nodes in the middle, Indicates the number of rounds of structural anomaly detection. Represents the target node vi The final structural anomaly score.

[0039] Anomaly fusion module: After determining the attribute anomaly score and structural anomaly score for each node, a fusion mechanism is used to determine the degree of anomaly of the node. First, each score is normalized to unify its magnitude. Then, the two scores are summed according to their weights to obtain the final anomaly score for each node. ∈[0,1] is a parameter that weighs the two scores.

[0040] (twenty two) Interpretable modules: This module aims to solve the dimensionality reduction problem faced by anomaly detection in high-dimensional data. It first receives high-dimensional anomaly data obtained from the previous module, and then uses an improved hybrid genetic algorithm to train and find a subset of key features that are significantly different from neighboring nodes. This subset of features can provide a basis for the analysis of the causes of node anomalies.

[0041] Before feature encoding, this application first constructs a multi-dimensional feature pool to comprehensively capture abnormal node patterns. The feature pool integrates original node attribute features and five types of graph structure features. This design simultaneously covers both node attributes (local semantics) and graph topology (global structure), providing a rich information foundation for subsequent model interpretation. Specifically, graph structure features include topological features: clustering coefficient and degree centrality, reflecting the tightness of local connections and direct influence of nodes; influence features: PageRank value and eigenvector centrality, measuring the importance and propagation ability of nodes in the global network; and connectivity features: betweenness centrality, characterizing the control ability of nodes as network bridges.

[0042] The hybrid genetic algorithm is characterized by performing multiple hill-climbing operations on the best individual in each generation of the population obtained through genetic operations, and then replacing the original individual with the individual obtained through the hill-climbing operation, thereby enhancing the algorithm's local search capability. This algorithm only requires adding a hill-climbing operator to the genetic algorithm.

[0043] (1) Determining the encoding method: Analysis of the characteristics of anomalous features reveals that their feature components exist in only two states (i.e., selected key subsets or not selected). Therefore, a binary encoding rule is used to construct a mapping relationship between key feature subsets and encoded strings. Specifically, feature subsets are represented by binary bit strings, where "1" indicates that the corresponding feature is selected as a key feature, and "0" indicates that it is not selected. Through this encoding method, the problem of finding anomalous key feature subsets is transformed into a genetic algorithm's search process for the optimal binary individual (chromosome).

[0044] (2) Determination of the initial population: Randomly generate an initial population containing N individuals, each individual being a binary bit string (representing a subset of features), and the number of features does not exceed max.

[0045] (3) Fitness function: The fitness function is designed with a subset of features as input and a quantitative index is constructed through multi-dimensional analysis. The goal is to maximize this index to select the feature subset with the best discriminative power.

[0046] Let the feature subset be S The fitness function is F ( S I(S): The set of selected feature indices corresponding to the feature subset S, i.e., I( S )={ i | S i =1}. x~ : The feature vector of the target node, with dimensions equal to the total number of features of the node after constructing the feature pool. X~ This is the feature matrix of the neighboring nodes, with the dimension being the number of neighbors. .

[0047] When the target node has neighboring nodes, (twenty three) in, (twenty four) (25) (26) When the target node has no neighboring nodes, (27) (4) Select operation: The selection operator employs a combined strategy of "tournament selection and elite retention": from the locally optimized population, the top n individuals with the highest fitness are directly retained to ensure the stable transmission of high-fitness genes. For the remaining individuals to be added, tournament selection is used; specifically, several individuals are randomly selected from the population to form a candidate set, and the individual with the highest fitness is selected to enter the next generation. Combined with the non-replacement remainder rule, N chromosomes are ultimately selected to complete the population update.

[0048] This strategy preserves the best individuals for the next generation while maintaining population diversity, providing richer basic solutions for local optimization.

[0049] (5) Cross operations: For the new population obtained after the selection operation, the best individual with the highest fitness ranking is retained without crossover; the remaining N-1 individuals are paired up according to the set crossover probability Pc and crossover and recombination operations are performed to generate new individual fragments. The crossover operator adopts a uniform crossover strategy, and the specific operation is as follows.

[0050] Randomly select an even number of unique parent chromosomes from the selected population; according to the crossover probability P... c For each pair of parent chromosomes, each binary bit is randomly swapped (i.e., each bit has an equal probability of coming from parent 1 or parent 2); the generated offspring chromosomes are temporarily stored, awaiting subsequent local optimization.

[0051] (6) Mutation operation: Since an elite retention mechanism was chosen in the selection mechanism, in order to preserve the diversity of individuals within the population, the mutation operator in this application adopts a single-point mutation strategy, and the specific operation method is as follows.

[0052] For the offspring chromosomes generated after crossing over, according to the mutation probability P m Randomly select a subset of individuals; randomly select one binary bit from the selected individuals and flip it ("0" becomes "1" or "1" becomes "0") to introduce a new direction of gene mutation; the mutated individuals then enter the local optimization phase.

[0053] (7) Climbing operation: In each generation of the genetic algorithm iteration, a hill-climbing algorithm for local optimization is embedded to achieve "search and optimization at the same time". In each generation, the fitness of all individuals is calculated first, and the top k% of individuals are selected to perform hill-climbing optimization: neighborhood solutions are generated by "adding, removing and replacing features", and the original individuals are replaced with the neighborhood optimal solutions (this operation is repeated until the maximum number of hill-climbing iterations).

[0054] (8) Termination Criterion: The termination criterion of specifying the number of generations in the evolution is adopted.

[0055] Explanation generation: Based on the final selected key feature subset, the feature value difference and standardized difference between the abnormal node and its neighboring nodes are calculated. The feature with the largest difference is identified as the main cause of the anomaly, thus realizing the interpretability analysis of the abnormal node.

[0056] This combined strategy utilizes the global search capability of genetic algorithms to find a better subset of features, while also employing hill-climbing algorithms for local refinement optimization. This improves the accuracy of key feature identification and thus more effectively explains the causes of anomalies in abnormal nodes.

[0057] Test Example 1 To verify the effectiveness of the model, this application conducted experiments on four benchmark datasets and evaluated the model using two metrics.

[0058] 1) Dataset: This application conducted experiments on four common datasets for node anomaly detection, with details of each dataset shown in Table 1. The datasets include Cora, CiteSeer, ACM, and PubMed. These datasets are all publication network datasets, composed of scientific publications, where each article can be considered a node, and citation relationships are represented by edges in the network. Since these citation datasets do not contain anomalies by default, anomaly injection is necessary for the experiments to proceed smoothly. To evaluate the ability of the proposed method to detect different types of anomalies, the same number of attribute and structurally anomalous nodes were manually injected, following existing techniques.

[0059] Table 1 Dataset Details

[0060] 2) Comparison Model: This application selects seven well-known node anomaly detection algorithms as comparative experiments for the proposed model framework, namely DOMINANT, CoLA, ANEMONE, SL-GAD, HCM, Sub-CR, and ARISE, all of which use deep learning methods for anomaly node detection.

[0061] 3) Evaluation indicators: The experiment uses two common evaluation metrics, AUC and AUPRC, to comprehensively evaluate the proposed model.

[0062] AUC: The ROC curve is a graph plotting the relationship between the True Positive Rate (TPR) and the False Positive Rate (FPR) based on the true labels and outlier scores of nodes. AUC (Area Under the Curve) is the area under the ROC curve; a larger AUC value indicates a stronger ability of the scoring function to assign higher scores to randomly selected outlier samples rather than normal samples.

[0063] AUPRC: The PR curve is a graph plotting the relationship between precision and recall based on the true labels and outlier scores of a node. AUPRC (Area Under the Precision-Recall Curve) is the area under the PR curve, reflecting the model's performance in detecting positive samples (i.e., outliers). In practical applications, the AUPRC value is obtained by calculating the average precision.

[0064] 4) Experimental environment and parameter settings: The software environment used in this experiment is Python 12.0, PyTorch 2.1.0, CUDA 11.8, and the hardware environment is an NVIDIA GeForce RTX 3060 8GB GPU and a 12th Gen Intel(R) Core(TM) i7-12700H CPU (2.30 GHz) with 16GB RAM.

[0065] To ensure fairness in the comparative experiments, all models were trained using the same settings: in the attribute anomaly detection module, the subgraph size for both positive and negative sample pairs was set to 4; the DP-GNN model employed a single-layer structure; the embedding dimension was 64 on all datasets; and the batch size was set to 128. Specific parameter settings are shown in Table 2. The comparative method used in the experiments will be implemented using the source code provided by the authors. Except for the aforementioned common parameters, all other specific parameters will remain as set in the original paper.

[0066] Table 2 Parameter Settings

[0067] Experimental Results and Analysis: 1) Analysis of anomaly detection results: The proposed method was compared with the seven baseline methods mentioned above on the same dataset. Ten experiments were conducted on four datasets, and the average value was used as the final result to evaluate the performance of the model in anomaly detection. The comparison of AUC and AUPRC values ​​of each method on the four datasets are shown in Tables 3 and 4, respectively. The best results are marked in bold, and the best results in the comparison models are marked with an underline. OOM indicates insufficient memory during training.

[0068] Table 3. Comparison of AUC values ​​for each method on the four datasets.

[0069] Table 4 compares the AUPRC values ​​of each method on the four datasets.

[0070] Specifically, the closer the AUC value is to 1, the better the method's performance, and the more effectively it can distinguish between positive and negative examples. The "Proposed" method shows high AUC values ​​on all four datasets, demonstrating outstanding overall performance and outperforming other comparative methods, indicating its strong discriminative ability in tasks such as anomaly detection. The "Proposed" method outperforms the best comparative model, ARISE, by 1.90% and 3.41% on the CiteSeer and ACM datasets, respectively. Furthermore, the AUPRC results show that the "Proposed" method significantly improves positive sample detection on most datasets compared to the comparative model, achieving an AUPRC improvement of approximately 17.79% on the ACM dataset. These data demonstrate that the "Proposed" method offers more comprehensive performance and can adapt to the needs of different scenarios.

[0071] DOMINANT and COLA, as classic deep learning anomaly detection models based on reconstruction and contrast, respectively, have achieved significant progress compared to shallower methods. ANEMONE, with its contrast-based anomaly detection scheme, considers multiple perspectives and further improves anomaly detection performance; however, due to a lack of global information or insufficient focus on anomaly detection, the results are not ideal. Compared to the autoencoder-based deep method DOMINANT, the "Proposed" method significantly improves performance on the four referenced network datasets. This is mainly because the "Proposed" method fully utilizes network data by constructing instance pairs, rather than simply reconstructing the original data. Furthermore, the "Proposed" method's objective aligns with the anomaly detection objective, enabling the learned model to generate discriminative scores for final anomaly ranking. Compared to contrast-based learning methods CoLA, ANEMONE, SL-GAD, Sub-CR, and ARISE, the "Proposed" method shows improved performance. This is primarily because the "Proposed" method implements a novel GNN graph encoder, DP-GNN, which combines the characteristics of node anomaly detection. DP-GNN achieves a dual propagation mechanism of structure propagation and feature propagation, obtaining effective node representations, making it more suitable for graph anomaly detection tasks. Furthermore, compared to the ARISE method, the "Proposed" method introduces a multi-view comparison learning module in the node attribute anomaly detection module, rather than just a node-subgraph level comparison. It not only mines the local and global information of nodes in the original and enhanced graphs respectively, but also performs multi-scale comparisons in each view, namely node-subgraph comparison and node-node comparison, which realizes comprehensive detection of node attribute anomalies in the graph and significantly improves the accuracy of node attribute anomaly detection.

[0072] Figure 5 and Figure 6 Specifically, the AUC and AUPRC values ​​of the proposed model on four datasets compared to seven competing baseline models are presented. Based on these tabular data and visualizations, the following observations and conclusions can be drawn: except for a slightly lower AUC value on the PubMed dataset compared to the ARISE model, the proposed model outperforms other models on all four benchmark datasets, demonstrating the effectiveness of the proposed model.

[0073] 2) Analysis of interpretable results: After the anomaly detection algorithm identifies anomalous nodes, this application introduces a hybrid genetic algorithm to select the subset of key features that have the strongest explanatory power for the anomaly scores. To ensure the comprehensiveness and multidimensionality of the explanatory information, the node feature system adopts a fusion design of "original node attribute features and five types of graph structure features". The original node attribute features focus on local semantic information, while the five types of graph structure features cover global topological relationships. Together, they lay a rich and comprehensive information foundation for the interpretability analysis of the anomaly detection results.

[0074] The interpretability verification experiment uses the Citeseer dataset as the test environment. After the anomaly detection phase, the node with the highest anomaly score is extracted as the analysis object. Then, a subset of its key features is mined through a hybrid genetic algorithm. Finally, this subset is used as the core explanation basis for the anomaly judgment result of the node. Figure 6 The experiment presents a comparison of the feature distributions of a typical anomalous node (node ​​3256) and its neighboring nodes. The experimental results clearly show that different features contribute significantly to the anomaly detection, and the strength of this contribution can be directly mapped to the discriminative power of each feature in the anomaly identification process of node 3256. Features with higher contribution have a stronger ability to distinguish between "abnormal nodes and normal nodes." The following section will provide a detailed interpretability analysis of the anomalous behavior of node 3256 from the perspectives of attributes and structure.

[0075] From an attribute perspective, the distribution of key original attributes of the abnormal node deviates from that of normal nodes. The abnormality of node 3256 is primarily manifested at the level of original attribute characteristics. Figure 6 The distribution comparison reveals that this node exhibits a significant deviation from its neighboring nodes in terms of the three key raw attribute features: raw_208, raw_268, and raw_637. Its feature values ​​not only exceed the mainstream distribution range of neighboring node feature values ​​but also show a clear difference in their central tendency. This deviation is not a random occurrence but a direct reflection of differences in statistical regularities at the attribute level. It is precisely this "inconsistency in attribute distribution with normal neighboring nodes" that becomes the core attribute basis for the anomaly detection algorithm to determine that node 3256 is abnormal. This finding provides an intuitive visual explanation of "why node 3256 is abnormal": from an attribute perspective, it is identified as abnormal because it does not conform to the attribute distribution patterns of neighboring nodes, completely escaping the black box dilemma of "knowing it is abnormal but not knowing why it is abnormal."

[0076] From a structural perspective, the clustering coefficient reflects the unique local topology of a node. Structurally, the clustering coefficient is a key feature explaining the anomalies of node 3256. The core physical meaning of the clustering coefficient is to "measure the density of clustering in the local network where a node resides." A higher coefficient value indicates a denser connection between surrounding nodes and a more compact local network structure. Figure 7 Data shows that the clustering coefficient of the anomalous node 3256 is 0.7583, while the average clustering coefficient of all its neighboring nodes is only 0.6269. The former is about 21% higher than the latter, and the difference is statistically significant. This data difference reveals the structural anomaly of node 3256: its local network structure is more compact than that of its neighbors, and the connections between nodes exhibit a clear "centralized" characteristic. This peculiarity of local topology, in stark contrast to the "normal structural state" of most neighboring nodes, becomes an important basis for the anomaly detection algorithm to determine its anomaly at the structural level.

[0077] Analysis of both attributes and structure reveals that the anomalous behavior of node 3256 is not caused by a single factor, but rather by the combined effect of attribute deviation and structural peculiarity: Attribute-wise, its anomaly is highlighted by the deviation of the distribution of its three features (raw_208, raw_268, and raw_637) from its neighbors; structurally, it exhibits local topological peculiarity due to its significantly higher clustering coefficient compared to its neighbors. These two factors together constitute the complete interpretability basis for the anomaly determination of node 3256, further validating the effectiveness of the "attribute and structure" fusion feature system in the interpretability analysis of anomaly detection.

[0078] 3) Parameter sensitivity analysis This section performs a model sensitivity analysis on the hyperparameters of the model, mainly analyzing the impact of the weighting coefficient α for the fusion of local and global attribute anomaly scores and the weighting coefficient γ for the fusion of the two anomaly scores on the model performance.

[0079] This application performs parameter sensitivity analysis on the AUC performance of four datasets—Cora, CiteSeer, ACM, and PubMed—under different α values. Figure 8 This study demonstrates the impact of different α values ​​on model performance. The coefficient α was adjusted from 0.1 to 1 in the local and global attribute anomaly score fusion strategy, and its effect on AUC values ​​was observed. The results show that the AUC value of the Cora dataset gradually increases as α increases from 0.1 to 0.8, and decreases after exceeding 0.8, indicating that it is relatively sensitive to α around 0.8. The AUC value of the CiteSeer dataset fluctuates less, indicating that the model performance on this dataset is relatively insensitive to changes in α. The AUC value of the ACM dataset fluctuates significantly and shows no monotonic trend, indicating that it is highly sensitive to α values, and different α values ​​have significantly different effects on the model. The PubMed dataset shows a clear turning point around 0.8, and also has some sensitivity to changes in α. In summary, the ACM and PubMed datasets are sensitive to the α parameter, the Cora dataset is sensitive around 0.8, the CiteSeer dataset is relatively insensitive to α, and most datasets achieve optimal results when α=0.8.

[0080] We conducted a parameter sensitivity analysis on the AUC performance of the models on the Cora, CiteSeer, ACM, and PubMed datasets under different γ values. Figures 9a-9d This study demonstrates the impact of different γ values ​​on model performance. The coefficient γ was adjusted from 0 to 1 in the score fusion strategy, and its effect on the AUC value was observed. The results show that on the Cora dataset, the model's performance is sensitive to changes in γ in the initial stage, then stabilizes but remains somewhat sensitive. On the CiteSeer dataset, the model's performance shows a significant response to changes in γ in both the initial and later stages. The AUC value on the ACM dataset is insensitive to changes in γ for most of the time, only showing some sensitivity when γ is close to 1. On the PubMed dataset, the model's performance is relatively sensitive to changes in γ, and the degree of response varies at different stages. Overall, the sensitivity of model performance to the γ parameter varies across datasets, but most datasets achieve optimal results when γ = 0.8.

[0081] 4) Ablation experiment: The impact of the proposed graph encoder DP-GNN on the model was investigated through ablation experiments. The experimental results are shown in Table 5.

[0082] Table 5. Ablation experiment results (AUC and ACPRC values) of the model on four datasets.

[0083] The results show that the "Proposed-GCN encoding" method performs worse than the "Proposed" method on datasets such as CiteSeer and ACM, indicating that obtaining effective node representations is crucial in anomaly detection tasks. Self-supervised learning methods learn anomaly detection representations by designing proxy tasks (such as maximizing local node similarity), but rely on the "homogeneity of a class" assumption and cannot handle cross-class normal node connections. However, the proposed DP-GNN implements a dual propagation mechanism of structure propagation and attribute aggregation, fully utilizing the characteristics of anomaly detection tasks. Experimental results demonstrate that the node representations learned by DP-GNN are suitable for unsupervised anomaly detection tasks. The "Proposed-Unstructured Anomaly Score" method generally has low performance across all metrics, indicating the lack of a structured anomaly score component. This results in a decrease in the model's ability to predict positive samples and its overall discriminative power, highlighting the importance of the structured anomaly score module. On all datasets including Cora, CiteSeer, ACM, and PubMed, the AUC and ACPRC values ​​of the "Proposed" method are superior to those of the "Proposed-GCN encoding" and "Proposed-unstructured anomaly scoring" methods. This indicates that the "Proposed" method performs better after integrating the various modules, and the collaboration of the components can improve the performance of anomaly detection tasks. This verifies the effectiveness of the attribute graph anomaly detection scheme based on multi-view contrastive learning proposed in this application.

[0084] Example 2 In one exemplary embodiment, the present invention also provides a computer system, which may be a server or a terminal, and its internal structure diagram may be as follows. Figure 10 As shown, the computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements the graph anomaly detection method based on graph contrast learning as described in Embodiment 1.

[0085] Those skilled in the art will understand that Figure 10The structures shown are merely block diagrams of some structures related to the present application and do not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than shown in the figures, or combine certain components, or have different component arrangements. In an exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0086] In one exemplary embodiment, the present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0087] In one exemplary embodiment, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0088] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0089] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0090] The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic units, data processing logic units, etc., and are not limited to these.

[0091] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0092] This application uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. In summary, the content of this specification should not be construed as a limitation of this application.

Claims

1. A graph anomaly detection method based on graph contrastive learning, characterized in that... Includes the following steps: Construct a graph encoder DP-GNN to obtain valid node representations in the attribute graph for subsequent graph anomaly detection tasks; A cross-scale contrastive learning model is constructed to achieve joint detection of attribute anomalies and structural anomalies by maximizing the semantic distance between positive and negative samples in the attribute space and the structure space. A feature selection framework combining global search and local optimization is constructed, and a hybrid genetic algorithm is used to select a subset of key features.

2. The graph anomaly detection method based on graph contrastive learning as described in claim 1, characterized in that, The method for constructing the graph encoder DP-GNN includes the following steps: The attribute graph is processed based on the edge perspective, and the PPR algorithm is introduced to perform random walk modeling of the graph topology. The adjacency matrix is ​​weighted based on the principle of node feature similarity; By integrating node vector representations learned based on edges and nodes, dual propagation of structure and feature is achieved.

3. The graph anomaly detection method based on graph contrastive learning as described in claim 2, characterized in that, The method for constructing the graph encoder DP-GNN includes the following steps: 1) Edge-based perspective: The PPR algorithm is introduced to model the random walk structure of the graph, which is used to accurately capture the structural reachability and path dependency between nodes, thereby effectively preserving the local topological features of the graph. At the same time, with the help of the PPR algorithm, the importance of nodes is taken into account during the propagation of features at different levels, so as to achieve more efficient feature fusion. 2) Node-based perspective: By weighting the adjacency matrix based on node feature similarity, the influence of nodes with mismatched attributes is identified and weakened, making the message aggregation process more focused on effective neighbors that match both structure and attributes, and ultimately achieving effective suppression of noise propagation. 3) Two-way propagation integration: By integrating node vector representations learned based on edges and nodes, a dual propagation mechanism of structure propagation and feature propagation is achieved; For the target node v The embedding update of the l-th layer of the graph encoder DP-GNN is: The PPR vector of node v, calculated using Power Iteration, is approximately: ； It is a normalized adjacency matrix. It is a node v The unit vector, where α is the restart probability; The original adjacency matrix In and nodes v By enhancing the weights of closely related edges, we can capture local communities and semantically related paths in the graph structure, enabling personalized information dissemination.

4. The graph anomaly detection method based on graph contrastive learning as described in claim 1, characterized in that, The cross-scale contrastive learning model includes Attribute Anomaly Detection Module: It identifies the differences between local abnormal samples and normal samples through node-to-node comparison, capturing subtle abnormal features; and it focuses on the matching degree between samples and the global context through node-to-subgraph level comparison, discovering anomalies that do not conform to the overall pattern. Structural anomaly detection module: First, the k-core method is used to find the k-core graph. Then, based on the node connectivity, it is divided into dense substructures. Nodes with attribute differences greater than a set threshold have a higher probability of being an anomaly. Anomaly Fusion Module: After the attribute anomaly score and structural anomaly score of each node are determined, a fusion mechanism is used to determine the degree of anomaly of the node.

5. The graph anomaly detection method based on graph contrastive learning as described in claim 4, characterized in that, The processing method of the attribute anomaly detection module includes the following steps: 1) Node-to-node comparison First, node embeddings in the subgraph are learned using DP-GNN. : ； θ is the parameter set of the GNN, Θ is the weight matrix of the DP-GCN layer, and σ(·) is the PReLU activation function; for node-to-node contrastive learning, through h p (i) = [1,:] is used to select the embedding of the target node in the mask; Then the target node is calculated using the MLP module. v i Embedded, node v i Feature matrix x (i) = X [ i Embedding of the target node: ； Through a bilinear layer To calculate the similarity score between them: ； It is a trainable parameter matrix, and σ(·) is the sigmoid function; the node-to-node contrastive learning network is trained using cross-entropy loss as the objective function: ； 2) Node-subgraph comparison: First, using a parameter set The GNN graph encoder DP-GNN is used to generate subgraphs G c (i) Node embedding: The subgraph embedding is obtained through a readout module: ； An MLP module is used to compute the embedding of the target node. z c (i) Then, the node-subgraph level similarity score. s c (i) via parameter matrix W c The bilinear function was calculated. Finally, the node-subgraph level network is trained using the following objective function: ； 3) Attribute anomaly score: During the training phase, the two contrast networks are jointly trained, and the overall objective function of the attribute anomaly detection module is: ； Where α∈[0,1] is a trade-off parameter used to balance the importance of the two components; The attribute anomaly scoring module obtains the similarity between the embedding and the comparison subgraph of each target node, and calculates the node attribute anomalies based on the similarity information; The attribute anomaly score of a node is defined as the difference in anomaly scores between pairs of positive and negative instances: ; subscript view "represent" p "or" c " This represents the score for abnormal node attributes in a pair of negative instances. This represents the score of abnormal node attributes in a pair of positive instances. j ∈[1, ..., R]; The statistical anomaly estimator is used to calculate the attribute anomaly score of the node, and the statistical anomaly score is calculated. , The sum of the mean and standard deviation of the base score: Subscript view represent p or c The mean of the baseline score reflects the average degree of anomalies, while the standard deviation reflects stability over multiple rounds of sampling. Combining the mean and standard deviation of the baseline score yields the node. v i Final attribute anomaly score: 。 6. The graph anomaly detection method based on graph contrastive learning as described in claim 5, characterized in that, The processing method of the structural anomaly detection module includes the following steps: Cosine distance is chosen as the method for measuring node pair similarity: ； z k and z q Represents a node v k and v q The embedding is used to calculate the average node pair similarity for each substructure using an averaging function: ； n j Substructure C j The number of node pairs in the node v k and v q Substructure C j Calculate the structural anomaly score for each node in the substructure using the following formula: ； d j Substructure C j Similarity between internal nodes t i Indicates belonging to a substructure C j Internal target nodes v i Structural anomaly score; Use gradually increasing k The value is tested in multiple rounds, from a specific k The value is being detected. k The value is equal to the average node degree δ; When NULL is returned, the substructure detection algorithm will stop. In each detection, the estimated value of the structural anomaly of the detected nodes in any substructure is calculated; Other nodes that are not detected in any substructure will be assigned a topology anomaly score of 0; The formula for calculating the final structural anomaly score of the target node is as follows: ； | C j | Represents a node v i Substructure C j The number of nodes in the middle, Indicates the number of rounds of structural anomaly detection. Represents the target node v i The final structural anomaly score.

7. The graph anomaly detection method based on graph contrastive learning as described in claim 6, characterized in that, The handling method of the anomaly fusion module includes the following steps: After determining the attribute anomaly score and structural anomaly score for each node, a fusion mechanism is used to determine the degree of anomaly of the node. First, each score is normalized to unify its magnitude. Then, the two scores are summed according to their weights to obtain the final anomaly score for each node. ∈[0,1] is the parameter that weighs the two scores: 。 8. The graph anomaly detection method based on graph contrastive learning as described in claim 7, characterized in that, The method for processing the interpretable structure includes the following steps: First, the high-dimensional anomaly data is received, and then an improved hybrid genetic algorithm is trained to find a subset of key features that are significantly different from neighboring nodes. Based on the final selected key feature subset, the feature value differences and standardized differences between the abnormal node and its neighboring nodes are calculated, and the feature with the largest difference is identified as the main cause of the anomaly, thus realizing the interpretability analysis of the abnormal node.

9. The graph anomaly detection method based on graph contrastive learning as described in claim 7, characterized in that, The selection of key feature subsets using a hybrid genetic algorithm includes the following steps: (1) Determine the encoding method: A mapping relationship between key feature subsets and encoded strings is constructed using binary encoding rules. Feature subsets are represented by binary bit strings, where 1 indicates that the corresponding feature is selected as a key feature, and 0 indicates that it is not selected. 2) Determine the initial population: Randomly generate an initial population containing N individuals, each individual being a binary bit string, and the number of features does not exceed the set maximum number; 3) Fitness function: Let the feature subset be S The fitness function is F ( S I(S) is the set of selected feature indices corresponding to the feature subset S, i.e., I( S )={ i | S i =1}; x~ is the feature vector of the target node, and its dimension is the total number of features of the node after constructing the feature pool; X~ This is the feature matrix of the neighboring nodes, with the dimension being the number of neighbors. ; When the target node has neighboring nodes, in, When the target node has no neighboring nodes: 4) Select Operation: A candidate set is formed by randomly selecting a number of individuals from the population, and the individual with the highest fitness is selected to enter the next generation; combined with the non-replacement residual rule, N chromosomes are finally selected to complete the population update; 5) Cross operations Randomly select an even number of unique parent chromosomes from the selected population; according to the crossover probability P... c For each pair of parent chromosomes, each binary bit is randomly swapped; the generated offspring chromosomes are temporarily stored, awaiting subsequent local optimization. 6) Mutation operation: For the offspring chromosomes generated after crossing over, according to the mutation probability P m Randomly select a subset of individuals; randomly select one binary bit from the selected individuals and flip it to introduce a new direction of gene mutation; the mutated individuals then enter the local optimization phase; 7) Climbing operation In each generation, the fitness of all individuals is calculated first, and the top k% of individuals are selected for hill climbing optimization: neighborhood solutions are generated by adding, removing, and replacing features, and the original individuals are replaced with the best neighborhood solutions. 8) Termination Criteria The termination criterion for specifying the number of generations in the evolution is adopted.

10. A computer system, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the computer program to implement the graph anomaly detection method based on graph contrast learning as described in any one of claims 1-9.

Images