A priori guided self-walking mask reconstruction type graph node anomaly detection method

Abstract

The application relates to the technical field of graph anomaly detection, in particular to a priori guided self-step mask reconstruction type graph node anomaly detection method. The method comprises the following steps: preprocessing attribute graph data to obtain attribute graph standardized data; constructing a reconstruction type model, preheating training and obtaining a reconstruction type optimization model; calculating a priori suspicious degree based on node attributes and local structure relationships of the attribute graph standardized data; constructing a node model suspicious degree calculation mechanism according to a current parameter state of the reconstruction type optimization model, and obtaining an online bootstrap model suspicious degree; constructing a self-step mask training mechanism, and cyclically training the reconstruction type optimization model to fix model network parameters; determining a reconstruction type graph node anomaly detection model according to the model network parameters, obtaining a node anomaly score, and realizing node anomaly detection. The method does not need manual marking, can effectively relieve abnormal pollution, and improves the stability and separability of an abnormal detection result.

Description

Technical Field

[0001] This invention relates to the field of graph anomaly detection technology, and in particular to a reconstructive graph node anomaly detection method based on a priori guided self-stepping mask. Background Technology

[0002] With the increasing demand for early risk identification and anomaly localization in applications such as financial risk control, network intrusion detection, social platform governance, industrial IoT monitoring, and biological network analysis, how to conduct robust node anomaly detection in graph-structured data by simultaneously utilizing both "relationship structure" and "node attributes" has become an important research topic in graph machine learning. Node anomalies in attribute graphs often manifest in three forms: "structural anomalies," "attribute anomalies," or "structure-attribute inconsistencies." The anomaly rate is usually low and mixed with large-scale noise, posing a challenge to unsupervised modeling. Reconstructive methods typically employ an "encoder-decoder" framework, simultaneously reconstructing the adjacency matrix and node attributes, using the node-level reconstruction residual as an anomaly metric. Compared to methods relying solely on a single modality, reconstructive methods can explicitly align the structural and attribute information channels, exhibiting better interpretability and portability, and are therefore widely adopted in practical applications.

[0003] Existing reconstructive graph node anomaly detection methods typically assume all nodes participate in reconstruction with equal weight during model training. A small number of anomalies can significantly skew the representation space, causing the reconstruction target to "cater to the anomalies." This forces the model to allocate capacity to "interpret" anomalous samples, leading the latent space to treat some anomalous patterns as "normal components" that should be reconstructed, thus reducing the model's detection capability. Therefore, designing a training mechanism sensitive to anomaly contamination under unsupervised conditions and establishing a more robust reconstructive graph node anomaly detection method is an urgent problem to be solved. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a reconstructive graph node anomaly detection method based on a priori guided self-stepping masks. This method solves the problems of unsupervised node anomaly detection in attribute graphs, such as high sensitivity to "anomaly contamination" during the training phase, easy representation space shift, and decreased separability between anomalies and normal nodes during the prediction phase.

[0005] To achieve the above objectives, this invention provides a reconstructive graph node anomaly detection method based on a priori-guided self-stepping mask. The method includes the following steps: preprocessing attribute graph data to obtain standardized attribute graph data; constructing a reconstructive model based on the standardized attribute graph data, and performing preheating training on the reconstructive model to obtain a reconstructive optimized model; calculating a priori suspicion degree based on the node attributes and local structural relationships of the standardized attribute graph data; constructing a node model suspicion degree calculation mechanism based on the current parameter state of the reconstructive optimized model, and obtaining an online self-stepping model suspicion degree through the node model suspicion degree calculation mechanism; constructing a self-stepping mask training mechanism by combining the priori suspicion degree and the online self-stepping model suspicion degree, and performing cyclic training on the reconstructive optimized model to fix the model network parameters; determining a reconstructive graph node anomaly detection model based on the model network parameters; obtaining a node anomaly score based on the reconstructive graph node anomaly detection model, thereby achieving node anomaly detection. This invention establishes a detection framework that combines prior guidance and self-stepping masking. It suppresses anomaly contamination throughout the entire process from data preprocessing to final anomaly scoring, allowing the model to focus on learning the normal subspace. This effectively improves the separability of anomaly and normal nodes, while also enhancing the stability, robustness, and practical generalization ability of the detection results.

[0006] Optionally, the preprocessing of the attribute graph data to obtain standardized attribute graph data includes: the attribute graph data includes a node set, a node attribute matrix, and an adjacency matrix; and the node attribute matrix is ​​standardized column-wise to obtain the standardized attribute graph data. This invention eliminates the interference of different attribute dimensions on model training by standardizing the node attribute matrix column-wise, ensuring that the attribute data is on a uniform scale. This lays a standardized data foundation for subsequent joint modeling of the model's structure and attributes, and improves the effectiveness and accuracy of model training.

[0007] Optionally, constructing a reconstructive model based on the standardized attribute graph data includes: jointly modeling the structural information and node attribute information of the standardized attribute graph data using a graph neural network to obtain the reconstructive model. This invention, based on the joint modeling of structure and attribute information using a graph neural network, can explicitly align two information channels. Compared to single-modal modeling, this allows the model to more comprehensively capture attribute graph features, while also improving the interpretability and portability of the detection method, adapting to the needs of graph node anomaly detection in multiple scenarios.

[0008] Optionally, the pre-training of the reconstructed model to obtain the reconstructed optimized model includes: using a three-layer graph convolutional encoder as the encoding part of the reconstructed model to encode the attribute graph normalized data to obtain a graph embedding representation; based on the graph embedding representation, constructing a structure decoder to reconstruct the structural information, calculating the structure reconstruction matrix, and recording the structure reconstruction error; using a single-layer graph convolutional encoder as an attribute decoder to reconstruct the attributes of the graph embedding representation to obtain an attribute reconstruction matrix, and recording the attribute reconstruction error; combining the structure reconstruction error and the attribute reconstruction error to construct a joint reconstruction loss function, training the three-layer graph convolutional encoder through the joint reconstruction loss function, and performing gradient updates on the parameter matrix of the reconstructed model to obtain the reconstructed optimized model. This invention, through pre-training, allows the model to initially learn the overall structure and attribute distribution, obtain reasonable initialization parameters, avoid the introduction of unstable interference by subsequent masking mechanisms, and provide an initial residual statistical basis for model suspicion calculation, significantly improving the stability and robustness of the overall training process.

[0009] Optionally, the calculation of prior suspicion based on the node attributes and local structural relationships of the attribute graph standardized data includes: performing graph-structure-based smoothing on the node attributes to obtain smoothed node attributes; obtaining attribute residual scores by quantifying the deviation between the smoothed node attributes and the original node attributes; and performing rank-based quantile normalization on the attribute residual scores to obtain the prior suspicion. This invention can characterize potential anomaly tendencies at the node attribute level, providing stable and low-noise external guidance signals for self-synchronized mask training, and solving the problem of insufficient anomaly judgment criteria during early model convergence.

[0010] Optionally, the step of constructing a node model suspicion calculation mechanism based on the current parameter state of the reconstructive optimization model, and obtaining the online bootstrap model suspicion through the node model suspicion calculation mechanism, includes: based on the current parameter state, obtaining the structural reconstruction result and attribute reconstruction result obtained in the most recent forward propagation to calculate the instantaneous residual score of the node; performing time smoothing on the instantaneous residual score using exponential moving average to calculate the steady-state residual score; and performing rank-based quantile normalization on the steady-state residual score within a preset update period to obtain the online bootstrap model suspicion. This invention can dynamically reflect the degree of node anomaly from the model's perspective. Time smoothing weakens the impact of single-round residual fluctuations, and periodic updates avoid training oscillations caused by frequent mask adjustments, enabling the model to gradually and adaptively identify anomalous nodes and improving the smoothness of training.

[0011] Optionally, the step of constructing a self-tracking mask training mechanism by combining the prior suspicion and the online bootstrap model suspicion to perform cyclic training on the reconstructive optimization model to fix the model network parameters includes: calculating the comprehensive suspicion of nodes based on the prior suspicion and the online bootstrap model suspicion; setting a retention rate that is gradually scheduled with each training phase, and determining a dynamic threshold based on quantiles; calculating mask soft weights based on the comprehensive suspicion of nodes; constructing a mask weight matrix based on the mask soft weights; calculating a masked joint reconstruction loss function through the mask weight matrix; and updating the model network parameters using gradients; and setting a maximum number of training epochs, fixing the model network parameters when the maximum number of training epochs is reached. This invention achieves the fusion of prior and model information, gradually suppressing abnormal node interference through dynamic thresholds and mask soft weights, and adjusting the training strategy with each stage, ensuring stability in early training while enhancing anomaly suppression in later stages, allowing the model to continuously focus on learning the normal subspace.

[0012] Optionally, calculating the comprehensive suspiciousness of a node based on the prior suspiciousness and the online bootstrap model suspiciousness includes: introducing a fusion coefficient, which dynamically changes with training rounds; and weighting and fusing the prior suspiciousness and the online bootstrap model suspiciousness using the fusion coefficient to obtain the comprehensive suspiciousness of the node. This invention obtains the comprehensive suspiciousness by dynamically weighting the two types of suspiciousness using a fusion coefficient, allowing anomaly detection to neither rely on fixed initial rules nor be limited to unstable outputs in the early stages of the model. This enables the node anomaly identification capability to gradually evolve and self-correct during training, improving the accuracy and dynamic adaptability of anomaly detection.

[0013] Optionally, the step of determining a reconstructive graph node anomaly detection model based on the model network parameters, obtaining node anomaly scores based on the reconstructive graph node anomaly detection model, and realizing node anomaly detection includes: obtaining a maskless joint reconstruction residual loss for nodes based on the reconstructive graph node anomaly detection model; obtaining a set of joint reconstruction residual scores based on the maskless joint reconstruction residual loss for nodes, and calculating the robust center and robust scale of the set of joint reconstruction residual scores; calculating robust anomaly scores by combining the robust center and the robust scale, using the robust anomaly scores as the node anomaly scores, and realizing node anomaly detection based on the node anomaly scores. This invention employs maskless reconstruction residuals combined with a robust normalization mechanism, reducing the impact of extreme anomalies on the scores, allowing the reconstruction residuals to be mapped to more robust anomaly scores, improving the separability of anomaly and normal nodes in the scoring space, and enhancing the stability of anomaly detection.

[0014] Optionally, the step of detecting node anomalies based on the node anomaly scores includes: sorting the nodes in descending order according to the node anomaly scores to obtain a node anomaly list; setting a node anomaly threshold; and using the node anomaly threshold to determine the anomalies in the node anomaly list to identify abnormal nodes. This invention achieves anomaly detection by combining descending order of anomaly scores with threshold determination, making the degree of node anomaly quantifiable and rankable, improving the interpretability of the detection results, accurately locating abnormal nodes, and meeting the detection needs of real-world scenarios.

[0015] This invention, within an encoder-decoder reconstruction framework, suppresses the interference of anomalous samples on the training target through prior guidance and self-synchronizing masking without relying on annotations. This allows the model to focus on learning the "normal subspace," thereby improving the separability between anomalous and normal samples and threshold stability. The beneficial effects of this invention include, but are not limited to:

[0016] (1) In view of the problem that existing reconstructive node anomaly detection methods are easily affected by abnormal nodes during the training phase, this invention introduces a priori guidance and self-stepping mask mechanism to gradually reduce the impact of abnormal nodes on the reconstruction target without any manual annotation, thereby fundamentally alleviating the anomaly pollution phenomenon and improving the stability and robustness of the model training process.

[0017] (2) This invention utilizes both the prior suspicion based on attribute-structure consistency and the online model suspicion based on reconstruction residuals to construct a comprehensive suspicion through a dynamic fusion mechanism, so that the anomaly judgment does not completely depend on the initial rules or the early unstable model output, thereby realizing that the node anomaly recognition capability gradually evolves and self-corrects with the training process.

[0018] (3) The present invention generates continuous mask soft weights by using quantile thresholds and nonlinear mapping, and applies them to both structural reconstruction error and attribute reconstruction error. Compared with directly removing abnormal samples or using hard masks, this invention can ensure the effect of anomaly suppression while avoiding violent oscillations during training and improving the smoothness of the optimization process.

[0019] (4) By guiding the model to focus on the low-noise subspace composed of normal nodes during the training phase, this invention enables abnormal nodes and normal nodes to present a clearer separation structure in the scoring space when performing anomaly scoring based on maskless reconstruction error during the inference phase, thereby improving the stability of the anomaly detection threshold and its interpretability in practical applications. Attached Figure Description

[0020] Figure 1 This is a flowchart of a reconstructive graph node anomaly detection method based on a priori guided self-stepping mask according to an embodiment of the present invention.

[0021] Figure 2 This is a schematic diagram of the preheating training of the reconstructed model according to an embodiment of the present invention;

[0022] Figure 3 This is a schematic diagram illustrating the online bootstrapping model suspiciousness calculation according to an embodiment of the present invention;

[0023] Figure 4 This is a schematic diagram of the self-synchronizing mask training mechanism according to an embodiment of the present invention;

[0024] Figure 5 This is a schematic diagram comparing the anomaly detection performance of the method according to an embodiment of the present invention. Detailed Implementation

[0025] Specific embodiments of the present invention will now be described in detail. It should be noted that the embodiments described herein are for illustrative purposes only and are not intended to limit the invention. In the following description, numerous specific details are set forth in order to provide a thorough understanding of the invention. However, it will be apparent to those skilled in the art that these specific details are not necessary to practice the invention. In other instances, well-known circuits, software, or methods have not been specifically described to avoid obscuring the invention.

[0026] Throughout this specification, references to "an embodiment," "an embodiment," "an example," or "an example" mean that a particular feature, structure, or characteristic described in connection with that embodiment or example is included in at least one embodiment of the invention. Therefore, the phrases "in an embodiment," "in an embodiment," "an example," or "an example" appearing in various places throughout the specification do not necessarily refer to the same embodiment or example. Furthermore, specific features, structures, or characteristics can be combined in one or more embodiments or examples in any suitable combination and / or sub-combination. Moreover, those skilled in the art will understand that the illustrations provided herein are for illustrative purposes and are not necessarily drawn to scale.

[0027] Please see Figure 1 An embodiment of the present invention provides a reconstructive graph node anomaly detection method based on a priori guided self-synchronizing mask, the method comprising the following steps:

[0028] S1. Preprocess the attribute graph data to obtain standardized attribute graph data.

[0029] In this embodiment, the attribute graph data satisfies the following relationship:

[0030]

[0031] in, For attribute graphs, For the node set of the attribute graph, This is a matrix of node attributes. It is an adjacency matrix.

[0032] It should be noted that the first node in the node attribute matrix... Rows represent nodes The attribute vector.

[0033] Specifically, regarding the preprocessing of attribute graph data, the standard deviation normalization method (Z-score normalization, or Z-score for short) is used to standardize the node attribute matrix column by column to obtain standardized attribute graph data, so as to eliminate the impact of differences in the scale of different attributes on model training.

[0034] S2. Construct a reconstructed model based on the standardized data of the attribute graph, and perform preheating training on the reconstructed model to obtain a reconstructed optimized model.

[0035] In this embodiment, a graph neural network is used to jointly model the structural information and node attribute information of the attribute graph to obtain a reconstructed model.

[0036] Furthermore, the reconstructed model is pre-trained without introducing any mask constraints.

[0037] In this embodiment, the joint reconstruction objective of graph structure and node attributes is performed. Unconstrained optimization is performed to allow the model to initially learn the overall structural patterns and attribute distribution characteristics in the attribute graph, avoiding the introduction of unstable interference by the subsequent self-stepping masking mechanism before the model converges. Simultaneously, the structural reconstruction error and attribute reconstruction error of each node are recorded during the pre-training process, providing an initial statistical basis for the subsequent online bootstrapping model suspicion calculation. This step serves as the starting point for subsequent prior guidance and self-stepping masking training, ensuring that the model parameters are in a reasonably initialized state, thereby improving the stability and robustness of the overall training process.

[0038] Please see Figure 2 The diagram illustrates the pre-training of a reconstructed model; firstly, the input adjacency matrix... Perform symmetric normalization processing and compare it with the node attribute matrix. The graph embeddings are fed into the graph convolutional network encoder to obtain the graph embedding representation; then, the graph embedding representation is fed into the structure decoder and attribute decoder respectively to output the structure reconstruction matrix. With attribute reconstruction matrix The corresponding structural reconstruction error and attribute reconstruction error are recorded separately. The two types of errors are fused into a joint reconstruction loss. Finally, the parameters are updated through the Adaptive Moment Estimation Optimization Algorithm (Adam) to achieve joint reconstruction learning of graph structure and node attributes.

[0039] Specifically, S2 includes the following steps:

[0040] S21. Using a three-layer graph convolutional encoder as the encoding part of the reconstructed model, the attribute graph normalization data is encoded to obtain a graph embedding representation.

[0041] In this embodiment, a three-layer graph convolutional encoder is used as the graph convolutional network encoder to encode the attribute graph. The graph convolutional network encoder serves as the encoding part of the reconstructive model, and the hidden dimension is denoted as . ,in These represent the node embedding dimensions (i.e., the hidden layer feature dimensions) of the output of the first, second, and third layer graph convolutions, respectively.

[0042] First, the attribute graph After the first layer of graph convolution, we get The first layer of graph convolution satisfies the following relationship:

[0043]

[0044] in, This is the output of the first layer of graph convolution. It is a non-linear activation function. Adjacency matrix Symmetric normalization, This is a matrix of node attributes. is a trainable weight matrix.

[0045] The symmetric normalization of the adjacency matrix satisfies the following relationship:

[0046]

[0047] in, Adjacency matrix Symmetric normalization, Let be the degree matrix of the attribute graph. It is an adjacency matrix. It is an identity matrix.

[0048] Secondly, after the second layer of graph convolution, we obtain... It satisfies the following relationship:

[0049]

[0050] in, This is the output of the second layer graph convolution. It is a non-linear activation function. Adjacency matrix Symmetric normalization, This is the output of the first layer of graph convolution. is a trainable weight matrix.

[0051] Finally, after the third layer of graph convolution, the graph embedding representation is obtained. It satisfies the following relationship:

[0052]

[0053] in, For graph embedding representation, It is a non-linear activation function. Adjacency matrix Symmetric normalization, This is the output of the second layer graph convolution. is a trainable weight matrix.

[0054] S22. Based on the graph embedding representation, construct a structure decoder to reconstruct the structure information, calculate the structure reconstruction matrix, and record the structure reconstruction error.

[0055] In this embodiment, the graph embedding representation obtained in step S21 A structure decoder is constructed to reconstruct the structural information of the graph, and the structure reconstruction matrix is ​​calculated, satisfying the following relationship:

[0056]

[0057] in, For structural reconstruction matrix, It is a non-linear activation function. For graph embedding representation, Let be the transpose of the graph embedding representation.

[0058] S23. Using a single-layer graph convolution as an attribute decoder, the graph embedding representation is reconstructed to obtain an attribute reconstruction matrix, and the attribute reconstruction error is recorded.

[0059] In this embodiment, a single-layer graph convolution is used as an attribute decoder to reconstruct the attributes of the node embedding representation, resulting in an attribute reconstruction matrix that satisfies the following relationship:

[0060]

[0061] in, Reconstruct the matrix for attributes. It is a non-linear activation function. Adjacency matrix Symmetric normalization, For graph embedding representation, is a trainable weight matrix.

[0062] S24. Construct a joint reconstruction loss function by combining the structural reconstruction error and the attribute reconstruction error, train the three-layer graph convolutional encoder through the joint reconstruction loss function, and perform gradient update on the parameter matrix of the reconstruction model to obtain the reconstruction optimization model.

[0063] In this embodiment, a three-layer graph convolutional encoder is trained using a joint reconstruction loss function, which satisfies the following relationship:

[0064]

[0065] in, For joint reconstruction loss function, For hyperparameters, It is an adjacency matrix. For structural reconstruction matrix, Denotes the Frobenius norm of a matrix. This is a matrix of node attributes. Reconstruct the matrix for the attributes.

[0066] Furthermore, the Adam optimization method is used to optimize the weight matrix in the reconstructed model. , , , Perform gradient updates until the training epochs reach the target. Or the relative decrease in the loss function value of the most recent 3 rounds of joint reconstruction is less than the threshold. .

[0067] S3. Calculate the prior doubt degree based on the node attributes and local structural relationships of the attribute graph standardized data.

[0068] In this embodiment, without relying on model reconstruction results or manual rules, an unsupervised prior suspicion calculation method is constructed based on the consistency relationship between node attributes and their local structure in the attribute graph.

[0069] Specifically, by performing graph-based smoothing on node attributes and comparing the deviation between the original attributes and smoothed attributes, the attribute anomalies of nodes in their local neighborhoods are characterized. Subsequently, the obtained attribute residuals are normalized using rank-based quantiles to map the anomaly levels of different nodes to a unified relative scale range, thereby obtaining the prior suspicion of the nodes. This is used to characterize the potential anomaly tendency of nodes at the attribute level and can serve as an external guiding signal in the subsequent self-synchronizing mask training process, providing a stable and low-noise basis for anomaly judgment when the model has not yet fully converged.

[0070] Specifically, S3 includes the following steps:

[0071] S31. Perform graph-based smoothing processing on the node attributes to obtain node smoothing attributes.

[0072] In this embodiment, the node smoothing attribute of each node is obtained by calculating the weighted average of the attributes of the node itself and its neighboring nodes in the attribute graph.

[0073] Specifically, the method for calculating the node smoothing attribute matrix satisfies the following relationship:

[0074]

[0075] in, For the node smoothing attribute matrix, Adjacency matrix Symmetric normalization, This is a matrix of node attributes.

[0076] S32. Obtain the attribute residual score by quantifying the degree of deviation between the node smoothing attribute and the node original attribute.

[0077] In this embodiment, each node in the computed property graph The attribute residuals satisfy the following relationship:

[0078]

[0079] in, For attribute residuals, The L2 norm of a vector. Node attribute matrix The OK, Smooth the attribute matrix of nodes The OK.

[0080] S33. Perform rank-based quantile normalization on the attribute residual scores to obtain the prior doubt score.

[0081] In this embodiment, for each node The attribute residual scores are normalized using rank-based quantile normalization to obtain the prior suspicion of the nodes. The prior doubt level satisfies the following relationship:

[0082]

[0083] in, Let represent the prior suspicion level of the node. For all nodes Ranking from smallest to largest The number of nodes.

[0084] S4. Construct a node model suspicion calculation mechanism based on the current parameter state of the reconstructive optimization model, and obtain the online bootstrap model suspicion through the node model suspicion calculation mechanism.

[0085] In this embodiment, an online bootstrapping node model suspicion calculation mechanism is constructed based on the parameter state of the current reconstructed model.

[0086] Specifically, by utilizing the structural and attribute reconstruction results obtained from the most recent forward propagation of the reconstructive optimization model, the instantaneous residual score of the node in the current training round is calculated. Then, an exponential moving average is used to smooth the residual over time to calculate the steady-state residual score, thereby reducing the impact of single-round fluctuations on anomaly detection. Subsequently, to avoid frequent mask updates that could lead to instability in the training process, the steady-state residual score is normalized based on rank quantiles only within a preset update period to obtain the online bootstrapping model suspiciousness of the node. This reflects the relative degree of anomaly of the node from the current model's perspective and can be dynamically updated during the training process for subsequent auto-scheduling of mask weights, thereby enabling the model to gradually and adaptively identify anomalous nodes.

[0087] Please see Figure 3 The diagram illustrates the calculation of suspiciousness in an online bootstrap model. First, the model obtains the structural reconstruction matrix through forward propagation. and attribute reconstruction matrix Next, compute the nodes. Instant residual fraction and calculate the nodes of Wheel steady-state residual fraction Then determine whether the update cycle has been reached. If the target is reached, update the node. Suspicion of online bootstrapping model Otherwise keep The process remains unchanged; finally, the updated online bootstrap model suspicion score is used for recurrent training of the masked reconstruction loss.

[0088] Specifically, S4 includes the following steps:

[0089] S41. Based on the current parameter state, obtain the structural reconstruction result and attribute reconstruction result obtained from the most recent forward propagation, so as to calculate the instantaneous residual score of the node.

[0090] In this embodiment, the structural reconstruction matrix obtained from the most recent forward propagation is based on the current parameter state of the reconstruction optimization model. and attribute reconstruction matrix Calculate each node Instant residual fraction It satisfies the following relationship:

[0091]

[0092] in, For instantaneous residual fractions, For hyperparameters, It is the square L2 norm. Adjacency matrix The OK, Reconstructing the matrix for structure The OK, Node attribute matrix The OK, Smooth the attribute matrix of nodes The OK.

[0093] It should be noted that the training rounds During the first calculation of step S41, the round Set the value to 1, and then use the parameters calculated at the end of the warm-up training in step S2.

[0094] S42. The instantaneous residual fraction is smoothed over time by exponential moving average to calculate the steady-state residual fraction.

[0095] In this embodiment, an exponential moving average is used to calculate the average value for each node. exist steady-state residual fraction of the wheel It satisfies the following relationship:

[0096]

[0097] in, For nodes exist The steady-state residual fraction of the wheel, As a smoothing factor, For nodes exist The steady-state residual fraction of the wheel, This represents the instantaneous residual fraction.

[0098] It should be noted that, and Based on the current round node Instant residual fraction and the steady-state residual score of the previous round Update the steady-state residual score of the node in this round. .

[0099] S43. Within a preset update period, the steady-state residual fraction is normalized based on rank quantiles to obtain the online bootstrap model's suspicion level.

[0100] In this embodiment, for each node steady-state residual fraction Perform rank-based quantile normalization to obtain the suspiciousness of the node's online bootstrapping model. The suspiciousness of the online bootstrap model satisfies the following relationship:

[0101]

[0102] in, To assess the suspiciousness of the online bootstrap model, For all nodes Ranking from smallest to largest The number of nodes.

[0103] To avoid training instability caused by frequent mask adjustments, a set update interval is defined. Each time, the node model suspicion level is updated, that is, in [the following round]. The online bootstrap model's suspiciousness is updated in round 1; other rounds only update the suspiciousness. Without updating Preferably, .

[0104] S5. Combine the prior suspicion level and the online bootstrap model suspicion level to construct a self-stepping mask training mechanism, and perform iterative training on the reconstructive optimization model to fix the model network parameters.

[0105] In this embodiment, a self-stepping mask training mechanism that integrates prior information and model feedback is constructed based on the prior suspicion of nodes and the online bootstrap model suspicion obtained from online bootstrap.

[0106] Specifically, by introducing a fusion coefficient that dynamically changes with each training round, the two types of suspiciousness are weighted and fused to obtain the comprehensive suspiciousness of a node. Then, by setting a retention rate that is progressively adjusted with each training phase and determining a dynamic threshold based on quantiles, the comprehensive suspiciousness is mapped to continuous masked soft weights to characterize the credibility of a node's participation in model reconstruction training at the current stage. These masked soft weights are applied simultaneously to both structural reconstruction error and attribute reconstruction error to construct a masked joint reconstruction loss function, which is then used to update the model parameters using gradients. This process is executed cyclically, employing a conservative strategy to ensure training stability in the early stages and gradually enhancing the suppression of anomalous nodes in the later stages, thereby achieving self-synchronous identification and robust training of the model for anomalous nodes.

[0107] Please see Figure 4The diagram illustrates the self-synchronized mask training mechanism. First, the prior suspicion of the input node and the suspicion of the online bootstrap model are used to calculate the overall suspicion of the node. Then, the dynamic threshold is calculated to determine the mask soft weights of each node and construct the mask weight matrix. Subsequently, the masked joint reconstruction loss function is calculated using this matrix, and the parameters are updated using Adam. Finally, the round update operation is performed to achieve iterative training.

[0108] Specifically, S5 includes the following steps:

[0109] S51. Calculate the comprehensive suspicion of the node based on the prior suspicion and the online bootstrap model suspicion.

[0110] In this embodiment, the prior suspicion and the online bootstrap model suspicion are weighted and fused using a fusion coefficient that dynamically changes with the training rounds to obtain the overall node suspicion, satisfying the following relationship:

[0111]

[0112] in, To assess the overall suspiciousness of the nodes, The fusion coefficient is... For prior suspicion, The suspicion level of the online bootstrap model.

[0113] It should be noted that the fusion coefficient satisfies the following relationship:

[0114]

[0115] in, The fusion coefficient is... The initial fusion coefficient, For the first The fusion coefficient of the round, For the current training round, This is the preset maximum number of rounds.

[0116] Preferably, , .

[0117] S52. Set the retention rate that is gradually scheduled during the training phase, and determine the dynamic threshold based on the quantile, and calculate the mask soft weight in combination with the comprehensive suspicion of the node.

[0118] In this embodiment, a retention rate is set. , The number of training sessions should be gradually reduced, preferably... Use 0.99 in the early stages of training, 0.97 in the middle stages, and 0.95 in the later stages. Based on retention rate. Calculate dynamic threshold In order to be in In Quantile values.

[0119] Furthermore, based on the overall suspiciousness of the nodes... and dynamic threshold compute nodes Mask soft weight It satisfies the following relationship:

[0120]

[0121] in, For nodes Mask soft weights, It is a non-linear activation function. For the slope parameter, For dynamic thresholds, The overall suspicion level of the node.

[0122] Preferably, .

[0123] S53. Construct a mask weight matrix based on the mask soft weights, calculate the masked joint reconstruction loss function through the mask weight matrix, and perform gradient updates on the model network parameters.

[0124] In this embodiment, the constructed mask weight matrix satisfies the following relationship:

[0125]

[0126] in, For the corresponding node in the mask weight matrix and nodes elements, For nodes Mask soft weights, For nodes The mask has soft weights.

[0127] Furthermore, the masked joint reconstruction loss function is calculated based on the mask weight matrix, satisfying the following relationship:

[0128]

[0129] in, For the joint reconstruction loss function with mask, For hyperparameters, For the corresponding node in the mask weight matrix and nodes elements, For nodes in the adjacency matrix and nodes Boundary values ​​between For the nodes in the structure reconstruction matrix and nodes The predicted value of the edge between them For nodes Mask soft weights, For nodes The original attribute vector, For nodes Reconstruct the attribute vector, It is the squared L2 norm.

[0130] Furthermore, the model network parameters are updated using gradients based on the masked joint reconstruction loss function.

[0131] S54. Preset the maximum number of training rounds. When the maximum number of training rounds is reached, fix the model network parameters.

[0132] In this embodiment, the current training round is determined. Has the preset maximum number of rounds been reached? If it is not achieved, then proceed to the next round. Updated to Then return to step S4, recalculate the online bootstrapping model suspicion of the node based on the updated model parameters, and repeat steps S4 to S5 in sequence. If the preset maximum number of rounds is reached... Then the training process ends.

[0133] S6. Determine the reconstructed graph node anomaly detection model based on the model network parameters, obtain the node anomaly score based on the reconstructed graph node anomaly detection model, and realize node anomaly detection.

[0134] In this embodiment, after the model is completed After training and fixing the model network parameters, the inference phase begins.

[0135] In this step, based on the trained reconstructed graph node anomaly detection model, anomaly scores are calculated for each node in the graph without introducing mask weights. To improve the robustness of anomaly scores to heavy-tailed distributions and extreme anomalies during the inference phase, after obtaining the joint node reconstruction residuals, a robust normalization mechanism based on the median and median absolute deviation (MAD) is further introduced. This maps the node reconstruction residuals into continuously quantifiable robust anomaly scores, thereby improving the separability of anomalies and normal nodes in the scoring space and the stability of the threshold.

[0136] Specifically, S6 includes the following steps:

[0137] S61. Obtain the unmasked joint reconstruction residual loss of nodes based on the reconstructed graph node anomaly detection model.

[0138] In this embodiment, the attribute graph is input into the reconstructed graph node anomaly detection model that has been trained and has fixed parameters to obtain the structure reconstruction matrix. and attribute reconstruction matrix For each node Compute the maskless joint reconstruction residual loss of the nodes It satisfies the following relationship:

[0139]

[0140] in, For maskless joint reconstruction residual loss, For hyperparameters, Adjacency matrix The OK, Reconstructing the matrix for structure The OK, For nodes The original attribute vector, For nodes Reconstruct the attribute vector, It is the squared L2 norm.

[0141] S62. Based on the node-free joint reconstruction residual loss, obtain the joint reconstruction residual score set, and calculate the robust center and robust scale of the joint reconstruction residual score set.

[0142] In this embodiment, based on all nodes The node-unmasked joint reconstruction residual loss is used to construct a set of joint reconstruction residual scores. Calculate its robust center With robust scale It satisfies the following relationship:

[0143]

[0144]

[0145] in, For a stable center, This represents median operations. For maskless joint reconstruction residual loss, For robust standards, This represents absolute value operations.

[0146] It should be noted that using the median and absolute median difference as statistics can reduce the impact of extreme outliers on the estimation of central location and scale, thereby improving the robustness of the scoring in the reasoning stage.

[0147] S63. Calculate a robust anomaly score by combining the robust center and the robust scale, use the robust anomaly score as the node anomaly score, and realize node anomaly detection based on the node anomaly score.

[0148] In this embodiment, for each node Based on robust center With robust scale Calculate robust anomaly score It satisfies the following relationship:

[0149]

[0150] in, For robust outlier scores, For maskless joint reconstruction residual loss, For a stable center, For robust standards, To prevent extremely small positive numbers with a denominator of zero.

[0151] It should be noted that the preferred option is... Pick ; The larger the value, the more likely it is to be a node The more significant the deviation from the normal center, the more likely it is to be an abnormal node.

[0152] Furthermore, the robust anomaly score is used as the node anomaly score, and the nodes are sorted in descending order according to the node anomaly score to obtain the node anomaly list; a node anomaly threshold is preset, and the nodes in the node anomaly list are judged to be abnormal by the node anomaly threshold to identify abnormal nodes.

[0153] In an optional embodiment, the method of the present invention is experimentally verified in order to better examine the technical effects of the present invention.

[0154] Unsupervised node anomaly detection experiments were conducted on public datasets Yelp, PubMed, and Reddit. The Yelp dataset, derived from a restaurant review platform, uses nodes to represent reviewing users. Based on Yelp's anti-fraud filtering algorithm, reviewing users are categorized as either anomalous or legitimate. The experiment selected a subset of reviews and constructed a network. If two users reviewed the same restaurant, an edge was established between them. Node attributes were extracted from the review text using a bag-of-words model to characterize user behavior. The PubMed dataset is a medical literature citation network. Nodes represent medical papers, and edges represent citation relationships between papers. Node attributes are composed of the TF-ID feature vectors of the paper text, representing the paper's topic content. The Reddit dataset comes from an online forum. Nodes represent posts. If two posts were reviewed by the same user, an edge was established between them. Node attributes are composed of the average of the word embedding vectors. Since the PubMed and Reddit datasets do not contain true anomalous node labels, a classic approach was followed: node anomaly injection was performed on the original graph, randomly selecting nodes from the graph. A cluster of nodes, with full connections between them, is repeated. Next, forming Structural anomaly nodes. Attribute anomaly nodes are constructed by swapping node attributes. The number of structural and attribute anomaly nodes constructed is kept equal in each dataset. Approximately 7% of the total number of anomaly nodes are injected into each dataset. Detailed statistics for the datasets are shown in Table 1.

[0155] Table 1: Statistical Information of Experimental Dataset

[0156]

[0157] In one optional embodiment, to verify the technical effectiveness of the present invention in suppressing anomalies and improving training stability, representative comparative methods in the field of graph node anomaly detection are selected for comparative experiments, including: DOMINANT (classical structure and attribute reconstruction-based detection method), Radar (anomaly detection method based on structure and attribute consistency), SCAN (classical structure clustering and structural anomaly detection method), and BWGNN (graph filtering-based graph anomaly detection method). These methods cover reconstruction paradigms, consistency paradigms, structure clustering paradigms, and graph filtering paradigms, allowing for the verification of the effectiveness of the present invention from different technical approaches.

[0158] In terms of experimental setup, this invention employs a three-layer graph convolutional encoder with hidden dimensions set to (256, 128, 64); preheating training rounds... Set to 100; Total number of training rounds with mask Set the value to 300; use Adam as the optimizer, and set the base learning rate to... The remaining hyperparameters of this invention are set to the preferred values ​​described in the embodiments. The hyperparameters of the comparison methods all adopt the default settings recommended in their respective papers to ensure fairness in the comparison. On the Yelp, PubMed, and Reddit datasets, AUC-ROC (area under the ROC curve) and AUC-PR (area under the PR curve) were used as evaluation metrics, respectively. The experimental results of the method of this invention and each comparison method are shown in Table 2:

[0159] Table 2: Comparison of anomaly detection methods for different datasets in the graph.

[0160]

[0161] As shown in Table 2, this invention achieves the best detection performance in both AUC-ROC and AUC-PR on the three datasets. Meanwhile, DOMINANT and BWGNN also show good baseline performance on different datasets, indicating that they are representative as comparative methods.

[0162] Please see Figure 5 The figure shows a comparison of the anomaly detection performance of the method. To further examine the robustness and anti-pollution ability of the present invention when the proportion of anomalies in real data increases, AUC-ROC was used as the evaluation index. Different anomaly ratio conditions were set on the Yelp dataset to compare the detection performance of the present invention with DOMINANT and BWGNN, so as to obtain the AUC-ROC change curve of the method under different anomaly rates.

[0163] Depend on Figure 5 As can be seen, the performance degradation of the method of this invention is smaller as the proportion of anomalies increases, and it can still maintain a relatively stable detection effect under the condition of a high proportion of anomalies, which is significantly better than the comparative method overall. This result shows that the present invention can effectively suppress the interference of abnormal samples on the reconstruction training target through the collaborative mechanism of prior guidance and self-stepping mask, guide the model to learn more focusedly the low-noise representation space composed of normal nodes, thereby improving the separability of abnormal and normal nodes in the inference stage and the stability of detection results.

[0164] In summary, the present invention provides a priori-guided self-synchronizing mask-based reconstruction-based graph node anomaly detection method. This method addresses the technical problems of existing unsupervised reconstruction-based node anomaly detection methods, such as susceptibility to representation space shifts due to a small number of anomaly nodes during the training phase, reconstructed targets "catering to anomalies," and decreased separability between anomaly and normal nodes during the prediction phase. A novel framework is proposed to solve these problems. First, the attribute graph data is preprocessed, and node attributes are standardized to eliminate the influence of different attribute dimensions. A reconstruction-based model based on a graph neural network is then constructed, achieving node representation learning by jointly reconstructing the graph structure and node attributes. In the early stages of model training, maskless pre-training allows the model to fully learn the overall structural patterns and attribute distribution characteristics of the attribute graph, obtaining a stable initial parameter state. Secondly, without relying on model reconstruction results or manual rules, the prior suspicion of nodes is calculated based on the consistency relationship between node attributes and their local neighborhood structures to characterize the potential anomalous tendencies of nodes at the attribute level. Simultaneously, during model training, an online bootstrapping model suspicion calculation mechanism is introduced based on the current model parameters and reconstruction residuals. Through time smoothing and periodic updates, the degree of anomalousness of nodes from the model's perspective is dynamically reflected. Thirdly, a comprehensive suspicion of nodes is constructed by dynamically fusing prior suspicion and model suspicion. Continuous masked soft weights are generated based on quantile thresholds and nonlinear mappings. These masked weights are introduced into the joint reconstruction loss function to gradually reduce the interference of anomalous nodes on the model training objective in a self-stepping manner, allowing the model to focus on learning the structure and attribute patterns of the "normal subspace." Finally, after model training is completed and parameters are fixed, the inference phase begins. The joint reconstruction loss of nodes is calculated without introducing masked weights, and the median and absolute median difference are further used to calculate the loss. Robust standardization of the residual loss yields a continuous and quantifiable robust anomaly score as the node anomaly score, thereby enabling quantitative evaluation and ranking of node anomaly severity in the attribute graph. This invention effectively alleviates the anomaly contamination problem in unsupervised reconstruction methods by constructing a collaborative approach of prior guidance and self-stepping masking, improving the stability, separability, and generalization ability of node anomaly detection results. The method of this invention is easy to understand, computationally simple, requires minimal workload, and is convenient for engineering applications, providing a theoretical foundation and technical support for the further development of graph anomaly detection technology.

[0165] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.

Claims

1. A reconstructive graph node anomaly detection method based on a priori guided self-stepping masks, characterized in that, When applied to restaurant review platforms, the following steps are included: Nodes represent reviewing users. If two users have reviewed the same restaurant, an edge is established between them. Node attributes are extracted from the review text using the bag-of-words model and are used to characterize user behavior features. Attribute graph data is preprocessed to obtain standardized attribute graph data; A reconstructed model is constructed based on the standardized data of the attribute graph, and the reconstructed model is preheated and trained to obtain a reconstructed optimized model. Calculate the prior suspicion degree based on the node attributes and local structural relationships of the standardized attribute graph data. Based on the current parameter state of the reconstructive optimization model, a node model suspicion calculation mechanism is constructed, and the online bootstrap model suspicion is obtained through the node model suspicion calculation mechanism. A self-stepping mask training mechanism is constructed by combining the prior suspicion level and the online bootstrap model suspicion level, and the reconstructive optimization model is trained cyclically to fix the model network parameters. A reconstructed graph node anomaly detection model is determined based on the model network parameters, and a node anomaly score is obtained based on the reconstructed graph node anomaly detection model to achieve node anomaly detection. The step-by-step mask training mechanism, which combines the prior suspicion level and the online bootstrap model suspicion level, is used to iteratively train the reconstructive optimization model to fix the model network parameters, including: The comprehensive suspicion of a node is calculated based on the prior suspicion level and the online bootstrap model suspicion level. Set a retention rate that is gradually scheduled during the training phase, and determine a dynamic threshold based on quantiles. Combine the node's overall suspiciousness to calculate the mask soft weight. A mask weight matrix is ​​constructed based on the mask soft weights, and the masked joint reconstruction loss function is calculated through the mask weight matrix to update the model network parameters using gradients. A maximum number of training epochs is preset, and when the maximum number of training epochs is reached, the parameters of the model network are fixed.

2. The reconstructive graph node anomaly detection method based on prior-guided self-synchronizing masks according to claim 1, characterized in that, The preprocessing of attribute graph data to obtain standardized attribute graph data includes: The attribute graph data includes a node set, a node attribute matrix, and an adjacency matrix; The attribute graph standardized data is obtained by standardizing the node attribute matrix column by column.

3. The reconstructive graph node anomaly detection method based on prior-guided self-synchronizing masks according to claim 1, characterized in that, The construction of the reconstructive model based on the attribute graph standardized data includes: The reconstructed model is obtained by jointly modeling the structural information and node attribute information of the standardized attribute graph data using a graph neural network.

4. The reconstructive graph node anomaly detection method based on prior-guided self-synchronizing masks according to claim 3, characterized in that, The step of pre-training the reconstructed model to obtain the reconstructed optimized model includes: A three-layer graph convolutional encoder is used as the encoding part of the reconstructed model to encode the attribute graph normalized data to obtain a graph embedding representation; Based on the graph embedding representation, a structure decoder is constructed to reconstruct the structure information, the structure reconstruction matrix is ​​calculated, and the structure reconstruction error is recorded. Using a single-layer graph convolution as an attribute decoder, the graph embedding representation is reconstructed to obtain an attribute reconstruction matrix, and the attribute reconstruction error is recorded. A joint reconstruction loss function is constructed by combining the structural reconstruction error and the attribute reconstruction error. The three-layer graph convolutional encoder is trained using the joint reconstruction loss function, and the parameter matrix of the reconstruction model is updated by gradient to obtain the reconstruction optimization model.

5. The reconstructive graph node anomaly detection method based on prior-guided self-synchronizing masks according to claim 1, characterized in that, The calculation of prior suspicion based on node attributes and local structural relationships in the standardized attribute graph data includes: The node attributes are smoothed using a graph structure-based smoothing process to obtain node smoothing attributes. The attribute residual score is obtained by quantifying the degree of deviation between the node smoothing attribute and the node original attribute. The prior suspicion degree is obtained by performing rank-based quantile normalization on the attribute residual scores.

6. The reconstructive graph node anomaly detection method based on prior-guided self-synchronizing masks according to claim 1, characterized in that, The step of constructing a node model suspicion calculation mechanism based on the current parameter state of the reconstructive optimization model, and obtaining the online bootstrap model suspicion through the node model suspicion calculation mechanism, includes: Based on the current parameter state, obtain the structural reconstruction result and attribute reconstruction result obtained from the most recent forward propagation, and calculate the instantaneous residual score of the node. The instantaneous residual fractions are smoothed over time using an exponential moving average to calculate the steady-state residual fractions; Within a preset update period, the online bootstrap model suspicion level is obtained by performing rank-based quantile normalization on the steady-state residual fractions.

7. The method for detecting anomalies in reconstructed graph nodes using a priori guided self-synchronizing masks according to claim 1, characterized in that, The calculation of the node's comprehensive suspicion degree based on the prior suspicion degree and the online bootstrap model suspicion degree includes: A fusion coefficient is introduced, which changes dynamically with the training rounds; The node's overall suspicion score is obtained by weighted fusion of the prior suspicion score and the online bootstrap model suspicion score using the fusion coefficient.

8. The reconstructive graph node anomaly detection method based on prior-guided self-synchronizing masks according to claim 1, characterized in that, The process of determining a reconstructed graph node anomaly detection model based on the model network parameters, obtaining node anomaly scores based on the reconstructed graph node anomaly detection model, and realizing node anomaly detection includes: The unmasked joint reconstruction residual loss of nodes is obtained based on the reconstructed graph node anomaly detection model. Based on the node-free joint reconstruction residual loss, a set of joint reconstruction residual scores is obtained, and the robust center and robust scale of the set of joint reconstruction residual scores are calculated. A robust anomaly score is calculated by combining the robust center and the robust scale. The robust anomaly score is used as the node anomaly score, and node anomaly detection is achieved based on the node anomaly score.

9. The reconstructive graph node anomaly detection method based on prior-guided self-synchronizing masks according to claim 8, characterized in that, The node anomaly detection based on the node anomaly score includes: The nodes are sorted in descending order based on the node anomaly score to obtain a list of node anomalies. A preset node anomaly threshold is used to determine the anomalies of nodes in the node anomaly list.

Images