Distribution offset-oriented homogeneity perception graph anomaly detection method and device

Abstract

The invention provides a distribution offset-oriented homogeneity perception graph anomaly detection method and device, and relates to the technical field of graph anomaly detection. The method comprises the following steps: acquiring an original node attribute graph, wherein the original node attribute graph comprises a node set, an edge set, node features and node tags; an anomaly detection model is constructed, the anomaly detection model comprises a decoupling encoder and an environment mixer, and the decoupling encoder is used for generating self-node embedding and neighborhood embedding respectively and calculating a prediction label of a node according to the self-node embedding and the neighborhood embedding; the environment mixer is used for adjusting the edge weight of the original node attribute graph according to self-node embedding and generating an enhanced node attribute graph; based on the original node attribute graph, training the anomaly detection model through an adversarial iterative training framework; and after the training is completed, obtaining a trained anomaly detection model, and performing anomaly detection on the to-be-detected node according to the trained anomaly detection model.

Description

Technical Field

[0001] This application relates to the field of graph anomaly detection technology, and in particular to a method and apparatus for detecting homogeneous sensing graph anomalies oriented towards distributional shift. Background Technology

[0002] Graph anomaly detection (GAD) technology is widely used in fields such as financial fraud detection, anti-money laundering, and identification of fake accounts on social media platforms. However, real-world graph data often faces structural distribution shifts, leading to a significant degrade in model performance. This problem mainly stems from the distribution difference between training and testing data. Due to sampling and labeling biases, training data often comes from easily accessible, highly homogeneous nodes, meaning that the categories (labels) of neighboring nodes are highly consistent. However, in real-world testing environments, a large number of low-homogeneity nodes exist. For example, fraudsters may deliberately impersonate others and interact with legitimate users to evade detection.

[0003] Currently, most anomaly detection methods based on graph neural networks implicitly rely on "homogeneity shortcuts" existing in the graph for learning. These methods perform well when the training and testing data have similar homogeneity, but once deployed to low-homogeneity environments with distributional shifts, their over-reliance on homogeneity assumptions no longer holds, leading to a sharp deterioration in model generalization ability and predictive failure. Therefore, developing a robust anomaly detection method that is insensitive to structural distribution shifts and can overcome homogeneity shortcuts has become a key technical problem urgently needing to be solved in this field. Summary of the Invention

[0004] In view of the above problems, embodiments of this application provide a method and apparatus for detecting anomalies in homogeneous perceptual maps oriented towards distribution offset, so as to overcome the above problems or at least partially solve the above problems.

[0005] A first aspect of this application discloses a method for detecting anomalies in homogeneous perceptual maps oriented towards distribution shift, the method comprising: Obtain the original node attribute graph, which includes a node set, an edge set, a node feature matrix, and node labels; An anomaly detection model is constructed, comprising a decoupled encoder and an environment mixer. The decoupled encoder is used to generate self-node embeddings and neighborhood embeddings respectively, and calculate the predicted label of a node based on the self-node embeddings and the neighborhood embeddings. The environment mixer is used to adjust the edge weights of the node attribute graph based on the self-node embeddings to generate an enhanced node attribute graph. Based on the original node attribute map, the anomaly detection model is trained using an adversarial iterative training framework. The adversarial iterative training framework includes an outer loop optimization step and an inner loop optimization step. The outer loop optimization step optimizes the decoupled encoder to minimize the combined classification loss of the original node attribute map and the enhanced node attribute map. The inner loop optimization step optimizes the environment mixer to generate an enhanced node attribute map that increases the combined classification loss. After training, a trained anomaly detection model is obtained, and anomaly detection is performed on the node to be detected based on the trained anomaly detection model.

[0006] Optionally, based on the original node attribute graph, the anomaly detection model is trained using an adversarial iterative training framework, including: The decoupled encoder is used to model the node features and neighborhood structure of the original node attribute graph to obtain the first self-node embedding and the first neighborhood embedding. Based on the first self-node embedding and the first neighborhood embedding, calculate the first predicted label of each node in the original node attribute graph, and calculate the first classification loss on the original node attribute graph based on the first predicted label and the node label. The environment mixer is used to adjust the edge weights of the original node attribute graph in multiple rounds based on the first self-node embedding; Based on the enhanced node attribute graph generated in each round of adjustment, the second classification loss, diversity loss, and edge ratio loss on the enhanced node attribute graph are calculated. The diversity loss is used to constrain the difference between the original node attribute graph and the enhanced node attribute graph, and the edge ratio loss is used to constrain the adjustment range of the edge weights. The comprehensive classification loss is obtained based on the first classification loss and the second classification loss, and the outer loop optimization step is performed based on the comprehensive classification loss to optimize the decoupled encoder. Based on the second classification loss, the diversity loss, and the edge ratio loss, the enhanced node attribute graph generation loss is obtained, and an inner loop optimization step is performed based on the enhanced node attribute graph generation loss to optimize the environment mixer.

[0007] Optionally, based on the enhanced node attribute graph generated in each round of adjustment, the second classification loss, diversity loss, and edge proportion loss on the enhanced node attribute graph are calculated, including: The decoupled encoder is used to model the node features and neighborhood structure of the enhanced node attribute graph to obtain the second self-node embedding and the second neighborhood embedding. Based on the second self-node embedding and the second neighborhood embedding, calculate the second predicted label of each node in the enhanced node attribute graph, and calculate the second classification loss based on the second predicted label and the node label; The diversity loss is calculated based on the first neighborhood embedding and the second neighborhood embedding. The edge ratio loss is calculated based on the edge set of the original node attribute graph, the adjusted edge weights, and the total edge retention ratio.

[0008] Optionally, the decoupling encoder generates self-node embeddings and neighborhood embeddings respectively according to the following steps: The node feature matrix of the node attribute graph is mapped to the embedding space by a projector to obtain the initial node embedding, and the initial node embedding is used as the self-node embedding. The initial node embedding and the adjacency matrix of the graph are input into a graph neural network for processing to obtain the neighborhood embedding. The adjacency matrix of the graph is determined based on the edge set of the node attribute graph. Wherein, when the node attribute graph is the original node attribute graph, the self-node embedding is the first self-node embedding, and the neighborhood embedding is the first neighborhood embedding; when the node attribute graph is the enhanced node attribute graph, the self-node embedding is the second self-node embedding, and the neighborhood embedding is the second neighborhood embedding.

[0009] Optionally, calculating the predicted label of a node based on the self-node embedding and the neighborhood embedding includes: The self-node embedding and the neighborhood embedding are fused and calculated using a bilinear function to obtain the anomaly probability of each node, and the anomaly probability represents the predicted label of the node. Wherein, when the self-node embedding is a first self-node embedding and the neighborhood embedding is a first neighborhood embedding, the predicted label represents the first predicted label of each node in the original node attribute graph; when the self-node embedding is a second self-node embedding and the neighborhood embedding is a second neighborhood embedding, the predicted label represents the second predicted label of each node in the enhanced node attribute graph.

[0010] Optionally, the environment mixer is used to adjust the edge weights of the original node attribute graph in multiple rounds based on the first self-node embedding, including: For any edge in the original node attribute graph, the embedding vectors of the corresponding two nodes are extracted from the first self-node embedding, and the embedding vectors of the two nodes are concatenated. The concatenated embedding vectors are then processed according to the learnable weight matrix to obtain the processing result. The learnable weight matrix is ​​updated in the inner loop optimization step. The processing result is used to calculate the adjusted edge weights using an activation function.

[0011] Optionally, the diversity loss is calculated based on the first neighborhood embedding and the second neighborhood embedding, including: The similarity between the first neighborhood embedding and the second neighborhood embedding is calculated as the diversity loss.

[0012] Optionally, the outer loop optimization step and the inner loop optimization step are performed alternately.

[0013] Optionally, the original node attribute graph can be any one of the following: a node attribute graph from a financial anti-fraud monitoring system, a node attribute graph from a bank anti-money laundering platform, a node attribute graph from a social media fake user identification system, or a node attribute graph from an e-commerce fake review identification system.

[0014] A second aspect of this application discloses a homogeneity-sensing map anomaly detection device for distribution shift, the device comprising: The acquisition module is used to acquire the original node attribute graph, which includes a node set, an edge set, a node feature matrix, and node labels. A construction module is used to construct an anomaly detection model, which includes a decoupled encoder and an environment mixer. The decoupled encoder is used to generate self-node embeddings and neighborhood embeddings respectively, and calculate the predicted label of the node based on the self-node embeddings and the neighborhood embeddings. The environment mixer is used to adjust the edge weights of the node attribute graph based on the self-node embeddings to generate an enhanced node attribute graph. The training module is used to train the anomaly detection model based on the original node attribute map using an adversarial iterative training framework. The adversarial iterative training framework includes an outer loop optimization step and an inner loop optimization step. The outer loop optimization step optimizes the decoupled encoder with the goal of minimizing the combined classification loss of the original node attribute map and the enhanced node attribute map. The inner loop optimization step optimizes the environment mixer with the goal of generating an enhanced node attribute map that increases the combined classification loss. The detection module is used to obtain a trained anomaly detection model after training is completed, and to perform anomaly detection on the node to be detected based on the trained anomaly detection model.

[0015] The embodiments of this application have the following advantages: In this embodiment, the constructed anomaly detection model includes a decoupled encoder and an environment mixer. The decoupled encoder separates and fuses the node's own features with the features of its neighborhood structure, thus reducing the simplistic reliance on the homogeneity shortcut of "highly consistent neighbor node labels." This guides the anomaly detection model to explore the essential attributes of the node itself and its more complex relationship patterns with its neighbors, thereby enhancing its ability to identify deliberately disguised (i.e., low-homogeneity) anomaly nodes.

[0016] By leveraging an environment mixer to dynamically adjust edge weights and generate augmented environments (augmented node attribute graphs), this method improves model training performance under varying homogeneity conditions. Unlike traditional methods that require storing multiple complete adjacency matrices for different environments, this approach only performs parameterized perturbations on the original node attribute graph, significantly reducing storage requirements while maintaining computational efficiency. This makes the solution suitable for processing large-scale graph data. Furthermore, the environment mixer automatically and implicitly constructs challenging augmented environments based on the model's learning state, reducing reliance on domain knowledge and enhancing the method's versatility and automation, making it easier to deploy and apply in real-world industrial systems.

[0017] The anomaly detection model is trained using an adversarial iterative training framework, forcing the decoupled encoder to learn in diverse augmented environments dynamically generated by an environment mixer, gradually discovering stable invariant patterns across environments. This mechanism simulates the distribution shift between the training and testing environments, preventing the anomaly detection model from overfitting to a single, highly homogeneous data distribution during training. Instead, it actively learns invariant features that remain stable under various structural changes, thus exhibiting significantly improved robustness and generalization ability when facing unknown test data with distribution shifts. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of the steps of a homogeneity-sensing map anomaly detection method for distribution offset provided in an embodiment of this application; Figure 2 This is an overall architecture diagram of a homogeneity-aware graph anomaly detection method oriented towards distribution offset provided in an embodiment of this application; Figure 3This is a schematic diagram of a homogeneity sensing map anomaly detection device for distribution offset provided in an embodiment of this application. Detailed Implementation

[0020] To make the above-mentioned objectives, features, and advantages of this application more apparent and understandable, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] In related technologies, graph anomaly detection methods are mostly based on graph neural networks (GNNs), and can be mainly divided into the following categories: 1) Spatial domain-based methods, such as PCGNN which alleviates data imbalance through neighbor sampling, and CARE-GNN which uses selective aggregation to reduce heterogeneous noise. 2) Spectral domain-based methods, such as BernNet and BWGNN which use multinomial filters to enhance the representation of high-frequency information and improve detection performance on heterogeneous graphs. 3) Invariant learning and out-of-distribution methods, including methods based on variance risk extrapolation (V-REx) and group-based DRO, which attempt to improve the model's generalization ability under distribution shifts.

[0022] The relevant technologies have the following main drawbacks: First, they rely on highly homogeneous training data, and the model's performance drops significantly in low-homogeneity environments; second, node features and neighborhood structures are often coupled during the encoding process, making it impossible to distinguish between stable invariant information and distribution-related information; third, some methods rely on manually divided environment labels or require maintaining multiple adjacency matrices, resulting in excessive computational and storage overhead; fourth, existing invariant learning methods fail to fully consider the differences in local structures and are difficult to cope with distribution shifts caused by selection bias or attack behavior.

[0023] To overcome the limitations of related technologies, this application provides a method for anomaly detection in homogeneous perceptual maps oriented towards distribution shift. This method takes into account the distribution of training maps in real-world scenarios. Distribution of test plots They are different. The anomaly detection task is modeled as out-of-distribution learning, that is, the objective function is expressed as:

[0024] in, This represents the k-hop subgraph of node v. The 'e' represents the node label, and the 'e' represents the edge. express The predicted labels for each node. (Through...) To generate an augmented node attribute map (in a diverse training environment), the classification difference between this augmented node attribute map and the original node attribute map is maximized. This approach optimizes the classification differences between the enhanced node attribute graph and the original node attribute graph, enabling the model to perform well on data of varying difficulty. This achieves graph anomaly detection that maintains stable predictive ability across structural distribution differences, and can be applied to products such as financial anti-fraud monitoring systems, bank anti-money laundering platforms, social media fake user identification systems, and e-commerce fake review identification systems, improving the detection accuracy and robustness of these systems in complex environments.

[0025] Reference Figure 1 As shown, Figure 1 This is a flowchart illustrating the steps of a homogeneity-aware map anomaly detection method based on distribution offset provided in an embodiment of this application. Figure 1 As shown, an anomaly detection method for homogeneity-aware maps oriented towards distribution shift provided in this application embodiment may include steps S110 to S140: Step S110: Obtain the original node attribute graph, which includes a node set, an edge set, a node feature matrix, and node labels.

[0026] In this embodiment, the original node attribute graph can be obtained from the target application system as initial training data for training the anomaly detection model. The original node attribute graph is a graph-structured data, which can be represented as... Let V be a set of nodes, representing entities in the system. For example, in a financial anti-fraud monitoring system, each node could be a user account. E is a set representing relationships between entities, such as transaction behavior between accounts. X is a node feature matrix, where each node possesses a set of feature vectors, such as account age, transaction frequency, login location, etc. Y is a node label, representing the node's true category (e.g., "normal" or "abnormal"). The k-hop subgraph of node v is denoted as […]. .

[0027] Optionally, the original node attribute graph can be any one of the following: a node attribute graph from a financial anti-fraud monitoring system, a node attribute graph from a bank anti-money laundering platform, a node attribute graph from a social media fake user identification system, or a node attribute graph from an e-commerce fake review identification system.

[0028] The method implemented in this application can be applied to scenarios such as financial anti-fraud monitoring systems, bank anti-money laundering platforms, social media fake user identification systems, and e-commerce fake review identification systems. It is understood that the meanings of the node set, edge set, node feature matrix, and node labels in the original node attribute graph will differ in different application scenarios.

[0029] For example, if the original node attribute graph comes from a financial anti-fraud monitoring system, then the nodes are user accounts (e.g., personal bank accounts, credit card accounts), the edges are transaction relationships between accounts (e.g., account A transferring money to account B), the node feature matrix is ​​the account behavior characteristics (e.g., account age, average daily transaction amount, transaction time distribution, number of logged-in devices), and the node labels are the account types (e.g., 0-normal account, 1-fraudulent account).

[0030] For example, if the original node attribute graph comes from a bank's anti-money laundering platform, then the nodes are entities (e.g., personal accounts, corporate accounts, merchants), the edges are fund flow relationships (e.g., account A made a large cross-border remittance to account B), the node feature matrix is ​​account and transaction characteristics (e.g., account registration location, historical transaction frequency, number of counterparties, fund inflow and outflow patterns), and the node label is risk level (e.g., 0 - low-risk normal account, 1 - high-risk suspected money laundering account).

[0031] For example, if the original node attribute graph comes from a social media fake user identification system, then the nodes can be user accounts (e.g., Weibo, WeChat accounts), the edges are social relationships (e.g., user A "follows" user B; user A and user B are "friends"), the node feature matrix is ​​user information and behavioral characteristics (e.g., account registration time, number of followers, posting frequency, randomness of nickname), and the node label risk level (e.g., 0 - real user, 1 - fake / water army account).

[0032] For example, if the original node attribute graph comes from e-commerce fake review identification, then the nodes can be entities (e.g., users, products, merchants), the edges are behavioral relationships (e.g., user A "reviewed" product B; user A "purchased" product B), the node feature matrix is ​​the entity attribute features (user: registration time, reputation level; product: price, category; merchant: store opening time, complaint rate), and the node labels are the entity properties (user: 0 - real user, 1 - fake reviewer; review: 0 - real review, 1 - fake review).

[0033] Step S120: Construct an anomaly detection model, which includes a decoupled encoder and an environment mixer. The decoupled encoder is used to generate self-node embeddings and neighborhood embeddings respectively, and calculate the predicted label of the node based on the self-node embeddings and the neighborhood embeddings. The environment mixer is used to adjust the edge weights of the original node attribute graph based on the self-node embeddings to generate an enhanced node attribute graph.

[0034] The decoupled encoder can be composed of a projector consisting of a two-layer perceptron (MLP) and a two-layer graph convolutional network. By decoupling the encoder, the node features and neighborhood structure in the node attribute graph can be modeled separately to generate self-node embeddings (i.e., node's own attributes) and neighborhood embeddings (structural information of neighboring nodes), and then fused through an interaction function to avoid the overfitting problem caused by the "homogeneity shortcut" in traditional methods.

[0035] An environment mixer can be composed of a single-layer neural network. By adjusting the edge weights of the node attribute graph based on the self-node embeddings, the environment mixer implicitly constructs diverse training environments (enhanced node attribute graphs) within the graph structure to simulate potential structural distribution shifts, thereby improving the model's training performance under different homogeneity conditions. Structurally, the enhanced node attribute graph represents a new, and potentially more challenging, "training environment" compared to the original node attribute graph.

[0036] Step S130: Based on the original node attribute map, train the anomaly detection model using an adversarial iterative training framework; wherein the adversarial iterative training framework includes an outer loop optimization step and an inner loop optimization step, the outer loop optimization step being: optimizing the decoupled encoder with the goal of minimizing the combined classification loss of the original node attribute map and the enhanced node attribute map; the inner loop optimization step being: optimizing the environment mixer with the goal of generating an enhanced node attribute map that increases the combined classification loss.

[0037] The outer loop optimization step and the inner loop optimization step are performed alternately. Specifically, the original node attribute graph is input into the anomaly detection model, and the decoupled encoder and environment mixer are trained iteratively and alternately through the outer loop optimization step and the inner loop optimization step.

[0038] An enhanced node attribute graph is generated by adjusting the edge weights of the original node attribute graph through an environment mixer. The node features and neighborhood structure of the original and enhanced node attribute graphs are modeled by a decoupled encoder to obtain the self-node embeddings and neighborhood embeddings of the original and enhanced node attribute graphs respectively. The classification results (predicted labels) of the original and enhanced node attribute graphs are then calculated.

[0039] During the outer loop optimization step, the environment mixer is fixed and the decoupled encoder is optimized. The goal of this step is to minimize the combined classification loss of the original node attribute map and the augmented node attribute map, aiming to train a "robust fake detector" that performs consistently in both the original node attribute map and the augmented node attribute map.

[0040] During the inner loop optimization step, the decoupled encoder is fixed and the environment mixer is optimized. This step aims to generate an augmented node attribute map that increases the overall classification loss. The goal is for the environment mixer to generate an augmented node attribute map that makes the current decoupled encoder perform the worst, thereby improving the training effect of the model under different homogeneity conditions.

[0041] Step S140: After training is completed, an anomaly detection model is obtained, and anomaly detection is performed on the node to be detected based on the trained anomaly detection model.

[0042] Once the resistive iterative training reaches the preset number of rounds or converges, training is complete, resulting in a trained anomaly detection model. At this point, the decoupled encoder of the anomaly detection model has learned to ignore spurious associations that change with the environment (such as "homogeneity" shortcuts) and has mastered anomaly patterns that are stable across environments. Therefore, anomaly detection is performed on the nodes to be detected based on the trained anomaly detection model. Specifically, the node to be detected and its central subgraph can be input into the decoupled encoder of the anomaly detection model to output the node's anomaly probability (i.e., the node's predicted label).

[0043] The technical solution adopted in this application utilizes a decoupled encoder to separate and fuse the node's own features with the features of its neighborhood structure, thereby reducing the simple reliance on the homogeneity shortcut of "high consistency of neighbor node labels" in the model structure. This guides the anomaly detection model to explore the essential attributes of the node itself and its more complex relationship patterns with its neighbors, thus providing a stronger ability to identify deliberately disguised abnormal nodes. An environment mixer is used to dynamically adjust edge weights to generate augmented environments, improving the model's training performance under different homogeneity conditions. Furthermore, this method does not require storing multiple complete adjacency matrices for different environments as in traditional methods; it only performs parameterized perturbations on the original node attribute graph, greatly reducing the need for additional storage space while ensuring the efficiency of the computation process. This makes the technical solution applicable to large-scale graph data processing scenarios. In addition, the environment mixer can automatically and implicitly construct challenging augmented environments based on the model's learning state, reducing reliance on domain knowledge, improving the method's versatility and automation, and making it easier to deploy and apply in real-world industrial systems.

[0044] The anomaly detection model is trained using an adversarial iterative training framework, forcing the decoupled encoder to learn in diverse augmented environments dynamically generated by an environment mixer, gradually discovering stable invariant patterns across environments. This mechanism simulates the distribution shift between the training and testing environments, preventing the anomaly detection model from overfitting to a single, highly homogeneous data distribution during training. Instead, it actively learns invariant features that remain stable under various structural changes, thus exhibiting significantly improved robustness and generalization ability when facing unknown test data with distribution shifts.

[0045] In one optional embodiment, the decoupling encoder generates self-node embeddings and neighborhood embeddings respectively according to the following steps: Step A1: Map the node feature matrix of the node attribute graph to the embedding space using a projector to obtain the initial node embedding, and use the initial node embedding as the self-node embedding.

[0046] Step A2: Input the initial node embedding and the adjacency matrix of the graph into the graph neural network for processing to obtain the neighborhood embedding. The adjacency matrix of the graph is determined based on the edge set of the node attribute graph.

[0047] Wherein, when the node attribute graph is the original node attribute graph, the self-node embedding is the first self-node embedding, and the neighborhood embedding is the first neighborhood embedding; when the node attribute graph is the enhanced node attribute graph, the self-node embedding is the second self-node embedding, and the neighborhood embedding is the second neighborhood embedding.

[0048] In this embodiment, by decoupling the encoder to model the node features and neighborhood structure of the node attribute graph separately, self-node embedding and neighborhood embedding can be obtained. Specifically, the node feature matrix of the node attribute graph is mapped to the embedding space by a projector, and the initial node embedding is obtained. It can be represented as:

[0049] in, This indicates a projection operation. This represents a node attribute graph, which can be the original node attribute graph or an enhanced node attribute graph. The initial node is then embedded... As a self-node embedding, i.e. .

[0050] Using graph neural networks Generate neighborhood embedding ,Right now

[0051] in, A is the adjacency matrix of the graph, used to represent the connection relationships between the nodes, and D is the degree matrix, which is a diagonal matrix used to represent the number of connections for each node.

[0052] During the adversarial iterative training process, the node features and neighborhood structure of the original node attribute graph are modeled using steps A1 to A2, and the node features and neighborhood structure of the enhanced node attribute graph are also modeled. Specifically, when the node attribute graph is the original node attribute graph, the resulting self-node embedding is denoted as the first self-node embedding. The neighborhood embedding is denoted as the first neighborhood embedding. When the node attribute graph is an enhanced node attribute graph, the resulting self-node embedding is denoted as the second self-node embedding. The neighborhood embedding is denoted as the second neighborhood embedding. This distinction ensures accurate tracking of feature representations in different environments (original node attribute graph and enhanced node attribute graph) during adversarial training.

[0053] The technical solution implemented in this application fundamentally avoids the premature fusion of node-specific features and neighbor features in traditional GNNs by separating the generation paths of self-node embedding and neighborhood embedding. This ensures that the model can independently learn the inherent attributes of nodes and structural context features, laying the foundation for subsequent environment mixing and adversarial training. The decoupled architecture makes the model more stable when facing distribution shifts. The inherent node features provided by self-node embedding remain relatively unchanged in different environments, while neighborhood embedding adaptively reflects local structural changes. This separation enables the model to better distinguish between stable features and environment-related features.

[0054] In an optional embodiment, calculating the predicted label of a node based on the self-node embedding and the neighborhood embedding includes: Step B1: The self-node embedding and the neighborhood embedding are fused and calculated using a bilinear function to obtain the anomaly probability of each node, whereby the anomaly probability represents the predicted label of the node. Wherein, when the self-node embedding is a first self-node embedding and the neighborhood embedding is a first neighborhood embedding, the predicted label represents the first predicted label of each node in the original node attribute graph; when the self-node embedding is a second self-node embedding and the neighborhood embedding is a second neighborhood embedding, the predicted label represents the second predicted label of each node in the enhanced node attribute graph.

[0055] For example, the anomaly probability of each node. It can be represented as:

[0056] in, This represents the self-node embedding vector of a node. This represents the vector corresponding to a row or column in the self-node embedding; This represents the neighborhood embedding vector of a node. This represents the vector corresponding to a row or column in the neighborhood embedding. Let W represent the activation function, and let W represent a learnable matrix that is updated in the outer loop optimization step. This matrix can automatically learn the interaction patterns between node features and neighborhood structure features.

[0057] During adversarial iterative training, the method in step B1 distinguishes between the first predicted label of each node in the original node attribute graph and the second predicted label of each node in the augmented node attribute graph. This clear distinction ensures that the model's performance in different environments can be accurately tracked during adversarial training.

[0058] By adopting the technical solution of this application embodiment, the bilinear function can capture all second-order interactions between node features and neighborhood features. Compared with simple splicing or addition fusion, it can more fully model the complex relationship between the two features, thereby achieving stable prediction across environments.

[0059] In an optional embodiment, step S130 above, "training the anomaly detection model based on the original node attribute graph using an adversarial iterative training framework," specifically includes the following steps S130-1 to S130-6: Step S130-1: Use the decoupled encoder to model the node features and neighborhood structure of the original node attribute graph to obtain the first self-node embedding and the first neighborhood embedding.

[0060] Among them, the first self-node embedding and the first neighborhood embedding are two node vector representations obtained by the decoupled encoder after processing the original node attribute graph. The first self-node embedding focuses on the node's own attributes (such as the user's age and transaction amount), while the first neighborhood embedding gathers the structural information of its neighboring nodes (such as the behavioral patterns of friends).

[0061] Specifically, the first self-node embedding and the first neighborhood embedding can be calculated through steps A1 to A2 in the above embodiments.

[0062] Step S130-2: Calculate the first predicted label of each node in the original node attribute graph based on the first self-node embedding and the first neighborhood embedding, and calculate the first classification loss on the original node attribute graph based on the first predicted label and the node label.

[0063] The first self-node embedding and the first neighborhood embedding of each node are fused, and the first predicted label of the node is calculated based on the fused embedding; wherein, the first predicted label of the node can be characterized by the anomaly probability. Specifically, the first predicted label of each node in the original node attribute graph can be calculated by the method in step B1 of the above embodiment, that is: the first self-node embedding and the first neighborhood embedding are fused by a bilinear function to obtain the anomaly probability of each node, and the anomaly probability represents the first predicted label of the node.

[0064] The first classification loss is calculated by comparing the first predicted label of each node with the true node label. The first classification loss measures the basic performance of the anomaly detection model on the original node attribute graph.

[0065] Step S130-3: Use the environment mixer to adjust the edge weights of the original node attribute graph in multiple rounds based on the first self-node embedding.

[0066] In each round of adjustment, the environment mixer adjusts the edge weights of the original node attribute graph based on the first self-node embedding, generating an enhanced node attribute graph.

[0067] Specifically, step S130-3 above may include sub-steps S130-3-1 to S130-3-2: Step S130-3-1: For any edge in the original node attribute graph, extract the embedding vectors of the corresponding two nodes from the first self-node embedding, and concatenate the embedding vectors of the two nodes. Process the concatenated embedding vectors according to the learnable weight matrix to obtain the processing result. The learnable weight matrix is ​​updated in the inner loop optimization step. Step S130-3-2: Calculate the adjusted edge weights by using the activation function to obtain the processing results.

[0068] In this embodiment, the learnable weight matrix is ​​the core parameter matrix in the environment mixer, which is updated in the inner loop optimization step. The learnable weight matrix can automatically learn from the training data how to adjust the edge weights according to the semantic similarity of nodes, without the need for manual rule setting.

[0069] For example, any edge in the original node attribute graph Adjusted edge weights It can be represented as:

[0070] in, and Indicates embedding from the first self-node Extract the embedding vectors of nodes u and v. This indicates a splicing operation. Represents the learnable weight matrix; This represents an activation function that ensures the output edge weights are probabilistically interpretable, smooth, and differentiable, facilitating gradient propagation. This represents an activation function used to introduce nonlinearity.

[0071] Step S130-4: Based on the enhanced node attribute graph generated in each round of adjustment, calculate the second classification loss, diversity loss, and edge ratio loss on the enhanced node attribute graph. The diversity loss is used to constrain the difference between the original node attribute graph and the enhanced node attribute graph, and the edge ratio loss is used to constrain the adjustment range of the edge weights.

[0072] The second classification loss measures the basic performance of the anomaly detection model on the augmented node attribute graph.

[0073] The diversity loss acts as a constraint to ensure that the generated augmented node attribute graph is structurally sufficiently different from the original node attribute graph. Without this constraint, the environment mixer may generate a large number of similar, invalid augmented graphs, failing to effectively simulate distribution shifts.

[0074] The edge scaling loss is also a constraint used to limit the adjustment range of edge weights. It can prevent the environment mixer from adjusting the edge weights too extreme (such as setting all edge weights to 0 or 1, thereby completely destroying or preserving the original graph structure), and ensure that the generated enhanced node attribute graph is structurally reasonable.

[0075] Specifically, step S130-4 above may include sub-steps S130-4-1 to S130-4-4: Step S130-4-1: Use the decoupled encoder to model the node features and neighborhood structure of the enhanced node attribute graph to obtain the second self-node embedding and the second neighborhood embedding.

[0076] Among them, the second self-node embedding and the second neighborhood embedding are two node vector representations obtained by the decoupled encoder after processing the enhanced node attribute graph. Compared with the first self-node embedding and the first neighborhood embedding, the second self-node embedding and the second neighborhood embedding contain the structural information of the enhanced node attribute graph and are used to evaluate the performance of the model in a perturbed environment.

[0077] Specifically, the second self-node embedding and the second neighborhood embedding can be calculated through steps A1 to A2 in the above embodiments.

[0078] Step S130-4-2: Calculate the second predicted label of each node in the enhanced node attribute graph based on the second self-node embedding and the second neighborhood embedding, and calculate the second classification loss based on the second predicted label and the node label.

[0079] The second self-node embedding and the second neighborhood embedding of each node are fused, and the second predicted label of the node is calculated based on the fused embedding; wherein, the first predicted label of the node can be characterized by the anomaly probability. Specifically, the second predicted label of each node in the enhanced node attribute graph can be calculated by the method in step B1 of the above embodiment, that is: the second self-node embedding and the second neighborhood embedding are fused by a bilinear function to obtain the anomaly probability of each node, and the anomaly probability represents the second predicted label of the node.

[0080] The second classification loss is calculated by comparing the second predicted label of each node with the true node label.

[0081] For example, second classification loss It can be represented as:

[0082] in, Indicates node label, Indicates embedding based on the second self-node Second Neighborhood Embedding The second predicted label is calculated.

[0083] Step S130-4-3: Calculate the diversity loss based on the first neighborhood embedding and the second neighborhood embedding.

[0084] Specifically, the similarity between the first neighborhood embedding and the second neighborhood embedding is calculated as the diversity loss.

[0085] The similarity can be cosine similarity, used to calculate the diversity loss. It can be represented as:

[0086] in, Indicates the second neighborhood embedding, Indicates the first neighborhood embedding, Let represent cosine similarity. Minimizing cosine similarity is equivalent to maximizing the dissimilarity between the two embedding spaces. That is, diversity loss can ensure that the generated enhanced node attribute graph is structurally sufficiently different from the original node attribute graph.

[0087] Step S130-4-4: Calculate the edge ratio loss based on the edge set of the original node attribute graph, the adjusted edge weights, and the total edge retention ratio.

[0088] To ensure the structural rationality of the enhanced node attribute graph, it is necessary to constrain the overall adjustment range of edge weights. For example, edge proportional loss... The calculation formula can be expressed as:

[0089] in, The weight is the edge e after adjustment, and |E| is the total number of edges. This is a preset total edge retention ratio. The edge ratio loss ensures that the generated enhanced node attribute graph is altered without completely destroying the structural information of the original node attribute graph.

[0090] Step S130-5: Obtain the comprehensive classification loss based on the first classification loss and the second classification loss, and perform an outer loop optimization step based on the comprehensive classification loss to optimize the decoupled encoder.

[0091] The comprehensive classification loss is used to ensure consistent anomaly detection performance across the original and enhanced node attribute maps. The first classification loss... and the second category loss Add them together to get the overall classification loss. ,Right now:

[0092] In the outer loop optimization step, the parameters of the environment mixer are fixed, and the parameters of the decoupled encoder are updated using the comprehensive classification loss. For example, this can be minimized using gradient descent. This step optimizes the decoupled encoder. It forces the decoupled encoder to make accurate predictions in both the original node attribute graph and the enhanced node attribute graph, thereby learning more robust feature representations that are unaffected by changes in specific graph structures.

[0093] Step S130-6: Based on the second classification loss, the diversity loss, and the edge ratio loss, obtain the enhanced node attribute graph generation loss, and perform an inner loop optimization step based on the enhanced node attribute graph generation loss to optimize the environment mixer.

[0094] Among them, the augmented node attribute graph generation loss is used to ensure the generation of augmented node attribute graphs that increase the comprehensive classification loss, so that the environment generator can generate more difficult and diverse training environments (augmented node attribute graphs).

[0095] For example, the enhanced node attribute graph generation loss It can be represented as:

[0096] in, This represents the second category loss. Indicating a loss of diversity, This represents the edge ratio loss.

[0097] In the inner loop optimization step, the parameters of the decoupled encoder are fixed, and the parameters of the environment mixer are updated using the loss generated by the enhanced node attribute graph. For example, this can be minimized using gradient descent. This process optimizes the environment mixer. This step forces the environment mixer to be trained to generate augmented node attribute graphs that are both capable of causing model errors and possess diversity and a reasonable structure.

[0098] Repeat steps S130-1 to S130-6 until the anomaly detection model converges, or the number of training epochs meets the preset number of epochs. After training is complete, save the decoupled encoder for actual anomaly detection tasks.

[0099] The technical solution adopted in this application, through a "multi-round adjustment mechanism," generates multiple node attribute maps in a single training iteration, greatly enriching the diversity of training data distribution. Combining the constraints of "diversity loss" and "edge proportion loss," it ensures that these enhanced node attribute maps are both challenging and structurally sound, thus more effectively simulating real distribution shifts. Furthermore, the decoupled encoder needs to simultaneously address the challenges of the original node attribute map and multiple different enhanced node attribute maps in each training round. This is equivalent to a more intensive and comprehensive robustness exercise, resulting in a stronger generalization ability and stability in the final learned feature representation. In the inner loop optimization step, by integrating multiple loss functions, the environment mixer is finely guided, avoiding the extreme case of generating meaningless or destructive graph structures. This makes the entire adversarial training process more stable and efficient, helping the model converge to an optimal solution more quickly.

[0100] For example, Figure 2 This is an overall architecture diagram of a homogeneity-aware graph anomaly detection method for distribution offset provided in this application embodiment. Specifically, the constructed anomaly detection model includes a decoupled encoder and an environment mixer, and the anomaly detection model is trained in multiple rounds using an adversarial iterative training framework. Each round of training includes the following steps: Step 1: Use a decoupled encoder to model the node features and neighborhood structure of the original node attribute graph to obtain the first self-node embedding and the first neighborhood embedding.

[0101] Step 2: Calculate the first predicted label of each node in the original node attribute graph based on the first self-node embedding and the first neighborhood embedding, and calculate the first classification loss on the original node attribute graph based on the first predicted label and the node label.

[0102] Step 3: Use the environment mixer to adjust the edge weights of the original node attribute graph in multiple rounds based on the first self-node embedding to generate an enhanced node attribute graph. Then, use the decoupled encoder to model the node features and neighborhood structure of the enhanced node attribute graph to obtain the second self-node embedding and the second neighborhood embedding.

[0103] Step 4: Calculate the second predicted label for each node in the augmented node attribute graph based on the second self-node embedding and the second neighborhood embedding; and calculate the second classification loss based on the second predicted label and the node label.

[0104] Step 5: Calculate the diversity loss based on the first and second neighborhood embeddings; and calculate the edge proportion loss based on the edge set of the original node attribute graph, the adjusted edge weights, and the total edge retention ratio.

[0105] Step 6: Obtain the comprehensive classification loss based on the first classification loss and the second classification loss, and perform the outer loop optimization step based on the comprehensive classification loss to optimize the decoupled encoder.

[0106] Step 7: Based on the second classification loss, diversity loss, and edge ratio loss, obtain the enhanced node attribute graph generation loss, and perform an inner loop optimization step based on the enhanced node attribute graph generation loss to optimize the environment mixer.

[0107] The method implemented in this application utilizes a decoupled encoder to separate and fuse the node's intrinsic features with the features of its neighborhood structure, thereby reducing the simplistic reliance on the homogeneity shortcut of "highly consistent neighbor node labels" in the model structure. This guides the anomaly detection model to explore the essential attributes of the node itself and its more complex relationship patterns with its neighbors, thus providing a stronger ability to identify deliberately disguised anomalous nodes. An environment mixer is used to dynamically adjust edge weights to generate augmented environments, improving the model's training performance under different homogeneity conditions. Furthermore, unlike traditional methods, this method does not require storing multiple complete adjacency matrices for different environments; it only performs parameterized perturbations on the original node attribute graph, significantly reducing the need for additional storage space while ensuring computational efficiency. This makes the technical solution applicable to large-scale graph data processing scenarios. In addition, the environment mixer can automatically and implicitly construct challenging augmented environments based on the model's learning state, reducing reliance on domain knowledge, improving the method's versatility and automation, and making it easier to deploy and apply in real-world industrial systems.

[0108] The anomaly detection model is trained using an adversarial iterative training framework, forcing the decoupled encoder to learn in diverse augmented environments dynamically generated by an environment mixer, gradually discovering stable invariant patterns across environments. This mechanism simulates the distribution shift between the training and testing environments, preventing the anomaly detection model from overfitting to a single, highly homogeneous data distribution during training. Instead, it actively learns invariant features that remain stable under various structural changes, thus exhibiting significantly improved robustness and generalization ability when facing unknown test data with distribution shifts.

[0109] This application also provides an anomaly detection device for homogeneity sensing maps oriented towards distributional offset, referring to... Figure 3 As shown, Figure 3 This is a schematic diagram of a homogeneity-sensing map anomaly detection device for distribution offset provided in an embodiment of this application. The device includes: The acquisition module 310 is used to acquire the original node attribute graph, which includes a node set, an edge set, a node feature matrix, and node labels. The construction module 320 is used to construct an anomaly detection model, which includes a decoupled encoder and an environment mixer. The decoupled encoder is used to generate self-node embeddings and neighborhood embeddings respectively, and calculate the predicted label of the node based on the self-node embeddings and the neighborhood embeddings. The environment mixer is used to adjust the edge weights of the node attribute graph based on the self-node embeddings to generate an enhanced node attribute graph. Training module 330 is used to train the anomaly detection model based on the original node attribute map using an adversarial iterative training framework. The adversarial iterative training framework includes an outer loop optimization step and an inner loop optimization step. The outer loop optimization step optimizes the decoupled encoder with the goal of minimizing the combined classification loss of the original node attribute map and the enhanced node attribute map. The inner loop optimization step optimizes the environment mixer with the goal of generating an enhanced node attribute map that increases the combined classification loss. The detection module 340 is used to obtain a trained anomaly detection model after training is completed, and to perform anomaly detection on the node to be detected based on the trained anomaly detection model.

[0110] It is understood that the distribution-biased homogeneous perceptual map anomaly detection device in the embodiments of this application can implement the distribution-biased homogeneous perceptual map anomaly detection method in the above embodiments. The distribution-biased homogeneous perceptual map anomaly detection device has the same advantages as the above distribution-biased homogeneous perceptual map anomaly detection method compared with the prior art, and will not be repeated here.

[0111] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0112] This application describes embodiments of methods and apparatus according to flowchart illustrations and / or block diagrams. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0113] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0114] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0115] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0116] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0117] The above provides a detailed description of the anomaly detection method and apparatus for homogeneity sensing maps oriented towards distribution offset provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and its core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for detecting anomalies in homogeneity-based perceptual maps oriented towards distribution shift, characterized in that, include: Obtain the original node attribute graph, which includes a node set, an edge set, a node feature matrix, and node labels; An anomaly detection model is constructed, which includes a decoupled encoder and an environment mixer. The decoupled encoder is used to generate self-node embeddings and neighborhood embeddings respectively, and calculate the predicted label of the node based on the self-node embeddings and the neighborhood embeddings. The environment mixer is used to adjust the edge weights of the original node attribute graph according to the self-node embedding to generate an enhanced node attribute graph; Based on the original node attribute map, the anomaly detection model is trained using an adversarial iterative training framework. The adversarial iterative training framework includes an outer loop optimization step and an inner loop optimization step. The outer loop optimization step optimizes the decoupled encoder to minimize the combined classification loss of the original node attribute map and the enhanced node attribute map. The inner loop optimization step optimizes the environment mixer to generate an enhanced node attribute map that increases the combined classification loss. After training, a trained anomaly detection model is obtained, and anomaly detection is performed on the node to be detected based on the trained anomaly detection model.

2. The method according to claim 1, characterized in that, Based on the original node attribute graph, the anomaly detection model is trained using an adversarial iterative training framework, including: The decoupled encoder is used to model the node features and neighborhood structure of the original node attribute graph to obtain the first self-node embedding and the first neighborhood embedding. Based on the first self-node embedding and the first neighborhood embedding, calculate the first predicted label of each node in the original node attribute graph, and calculate the first classification loss on the original node attribute graph based on the first predicted label and the node label. The environment mixer is used to adjust the edge weights of the original node attribute graph in multiple rounds based on the first self-node embedding; Based on the enhanced node attribute graph generated in each round of adjustment, the second classification loss, diversity loss, and edge ratio loss on the enhanced node attribute graph are calculated. The diversity loss is used to constrain the difference between the original node attribute graph and the enhanced node attribute graph, and the edge ratio loss is used to constrain the adjustment range of the edge weights. The comprehensive classification loss is obtained based on the first classification loss and the second classification loss, and the outer loop optimization step is performed based on the comprehensive classification loss to optimize the decoupled encoder. Based on the second classification loss, the diversity loss, and the edge ratio loss, the enhanced node attribute graph generation loss is obtained, and an inner loop optimization step is performed based on the enhanced node attribute graph generation loss to optimize the environment mixer.

3. The method according to claim 2, characterized in that, Based on the enhanced node attribute graph generated in each round of adjustment, the second classification loss, diversity loss, and edge proportion loss on the enhanced node attribute graph are calculated, including: The decoupled encoder is used to model the node features and neighborhood structure of the enhanced node attribute graph to obtain the second self-node embedding and the second neighborhood embedding. Based on the second self-node embedding and the second neighborhood embedding, calculate the second predicted label of each node in the enhanced node attribute graph, and calculate the second classification loss based on the second predicted label and the node label; The diversity loss is calculated based on the first neighborhood embedding and the second neighborhood embedding. The edge ratio loss is calculated based on the edge set of the original node attribute graph, the adjusted edge weights, and the total edge retention ratio.

4. The method according to any one of claims 1-3, characterized in that, The decoupled encoder generates self-node embeddings and neighborhood embeddings according to the following steps: The node feature matrix of the node attribute graph is mapped to the embedding space by a projector to obtain the initial node embedding, and the initial node embedding is used as the self-node embedding. The initial node embedding and the adjacency matrix of the graph are input into a graph neural network for processing to obtain the neighborhood embedding. The adjacency matrix of the graph is determined based on the edge set of the node attribute graph. Wherein, when the node attribute graph is the original node attribute graph, the self-node embedding is the first self-node embedding, and the neighborhood embedding is the first neighborhood embedding; when the node attribute graph is the enhanced node attribute graph, the self-node embedding is the second self-node embedding, and the neighborhood embedding is the second neighborhood embedding.

5. The method according to any one of claims 1-3, characterized in that, The predicted label of a node is calculated based on the self-node embedding and the neighborhood embedding, including: The self-node embedding and the neighborhood embedding are fused and calculated using a bilinear function to obtain the anomaly probability of each node, and the anomaly probability represents the predicted label of the node. Wherein, when the self-node embedding is a first self-node embedding and the neighborhood embedding is a first neighborhood embedding, the predicted label represents the first predicted label of each node in the original node attribute graph; when the self-node embedding is a second self-node embedding and the neighborhood embedding is a second neighborhood embedding, the predicted label represents the second predicted label of each node in the enhanced node attribute graph.

6. The method according to claim 2, characterized in that, The environment mixer is used to adjust the edge weights of the original node attribute graph in multiple rounds based on the first self-node embedding, including: For any edge in the original node attribute graph, the embedding vectors of the corresponding two nodes are extracted from the first self-node embedding, and the embedding vectors of the two nodes are concatenated. The concatenated embedding vectors are then processed according to the learnable weight matrix to obtain the processing result. The learnable weight matrix is ​​updated in the inner loop optimization step. The processing result is used to calculate the adjusted edge weights using an activation function.

7. The method according to claim 3, characterized in that, The diversity loss is calculated based on the first neighborhood embedding and the second neighborhood embedding, including: The similarity between the first neighborhood embedding and the second neighborhood embedding is calculated as the diversity loss.

8. The method according to claim 5, characterized in that, The outer loop optimization step and the inner loop optimization step are performed alternately.

9. The method according to claim 5, characterized in that, The original node attribute graph can be any one of the following: a node attribute graph from a financial anti-fraud monitoring system, a node attribute graph from a bank anti-money laundering platform, a node attribute graph from a social media fake user identification system, or a node attribute graph from an e-commerce fake review identification system.

10. A homogeneity-sensing map anomaly detection device for distributional shift, characterized in that, include: The acquisition module is used to acquire the original node attribute graph, which includes a node set, an edge set, a node feature matrix, and node labels. A construction module is used to construct an anomaly detection model, which includes a decoupled encoder and an environment mixer. The decoupled encoder is used to generate self-node embeddings and neighborhood embeddings respectively, and calculate the predicted labels of nodes based on the self-node embeddings and the neighborhood embeddings. The environment mixer is used to adjust the edge weights of the node attribute graph according to the self-node embedding to generate an enhanced node attribute graph; The training module is used to train the anomaly detection model based on the original node attribute map using an adversarial iterative training framework. The adversarial iterative training framework includes an outer loop optimization step and an inner loop optimization step. The outer loop optimization step optimizes the decoupled encoder with the goal of minimizing the combined classification loss of the original node attribute map and the enhanced node attribute map. The inner loop optimization step optimizes the environment mixer with the goal of generating an enhanced node attribute map that increases the combined classification loss. The detection module is used to obtain a trained anomaly detection model after training is completed, and to perform anomaly detection on the node to be detected based on the trained anomaly detection model.

Images