Unsupervised graph anomaly detection method, device and equipment and storage medium

Abstract

The application discloses an unsupervised graph anomaly detection method and device, equipment and storage medium, including the following steps: obtaining the to-be-detected graph data, using a heterogeneous edge pruning module to perform probabilistic edge pruning processing on the to-be-detected graph data, and generating N*K subgraphs; for each subgraph, a graph attention network containing a low-pass filter and a high-pass filter path is constructed, a gating mechanism is used to learn the fusion weight of different frequency information, and a node representation is generated; taking the maximization of local node affinity as an objective function, the graph attention network corresponding to each subgraph is unsupervisedly trained; the abnormal score of the node in each subgraph is calculated, the abnormal score mean of all subgraphs is aggregated, and the final abnormal detection result is determined. The application reduces the influence of noise on the node representation, balances the high-frequency filter output and the low-frequency filter output by using the attention mechanism, retains the abnormal features, and trains under the guidance of the maximization of local affinity, so that the model has strong abnormal distinguishing ability under the condition of no label.

Description

Technical Field

[0001] This invention belongs to the field of graph data mining and deep learning technology, specifically relating to unsupervised graph anomaly detection methods, devices, equipment, and storage media. Background Technology

[0002] In recent years, with the rapid development of fields such as social networks, financial transactions, and bioinformatics, graph-structured data has become a major form of information storage and interaction. In these complex networks, identifying abnormal nodes such as fake accounts is crucial for maintaining system security and protecting user interests.

[0003] In graph-structured data, nodes typically represent entities, and edges represent the interactions between entities. Node anomalies are usually manifested by significant deviations in their attribute features or connection structures from those of most normal nodes. Existing graph anomaly detection methods largely rely on the low-pass filtering properties of graph convolutional networks, modeling by smoothing neighbor features. However, this approach tends to over-smooth the discriminative features of anomalous nodes, leading to the loss of anomalous information. Furthermore, existing graph anomaly detection techniques face several challenges. Firstly, there is a severe class imbalance problem; anomalous samples constitute a very small percentage of massive datasets, making it difficult for models to effectively learn their features. Existing graph anomaly detection methods can be mainly categorized into three technical approaches: shallow methods based on traditional machine learning, supervised / semi-supervised methods based on deep learning, and unsupervised learning methods.

[0004] Shallow methods primarily employ traditional techniques such as statistical analysis and linear models. These methods suffer from significant performance bottlenecks due to their difficulty in capturing the nonlinear structure and complex features of graph data, making them unsuitable for complex anomaly detection tasks. While supervised learning methods based on deep learning can achieve high detection accuracy, their reliance on large amounts of labeled data limits their practical application. To alleviate this problem, semi-supervised learning methods, through pseudo-labeling mechanisms, have made significant progress compared to unsupervised learning under limited labeling conditions, but still have considerable limitations. Although semi-supervised methods reduce labeling requirements, in scenarios with few samples, the model is highly dependent on specific anomaly types and struggles to generalize to unseen anomaly patterns. In the unsupervised learning paradigm based on deep learning, mainstream methods can be further subdivided into two categories: graph autoencoders based on reconstruction error learn low-dimensional representations by minimizing the difference between input and output, but are prone to overfitting; contrastive learning methods enhance feature discriminative power by constructing positive and negative samples, but suffer from negative sample sampling bias: randomly sampled negative samples may contain potential anomaly nodes, causing the model to misclassify anomalies as normal.

[0005] Most critically, existing graph neural network (GNN)-based models largely adhere to the homogeneity assumption, using low-pass filters to smooth node features. This often erases the high-frequency discriminative information inherent in anomalous nodes. According to the principle of single-class homogeneity, normal nodes have strong affinity with each other, while anomalous nodes have significantly weaker affinity with their neighbors. How to effectively utilize this characteristic while preserving anomalous features under unsupervised conditions is a problem that current technology urgently needs to solve. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides an unsupervised graph anomaly detection method based on local affinity, which aims to improve the accuracy of anomaly node identification by enhancing heterogeneous information and maximizing local affinity without the need for manual annotation.

[0007] To achieve the above objectives, a specific embodiment of the present invention provides an unsupervised graph anomaly detection method, the method comprising: Obtain the graph data to be detected, wherein the graph data to be detected includes nodes and edges between nodes, nodes represent entities to be analyzed, and edges represent the relationships between nodes; Probabilistic edge pruning is performed on the graph data to be detected. By randomly thresholding the node feature distance, edges with large differences in connection attributes are pruned to generate N×K subgraphs. For each subgraph, a graph attention network containing low-pass and high-pass filtering paths is constructed. The gating mechanism is used to learn the fusion weights of different frequency information to generate node representations. With the optimization objective of maximizing the affinity of local nodes, the graph attention network corresponding to each subgraph is trained unsupervised. Based on the trained graph attention network, the anomaly score of each node in each subgraph is calculated, and the anomaly scores corresponding to N×K subgraphs are aggregated to determine the final anomaly detection result.

[0008] This invention employs probabilistic edge pruning on the graph data to be detected. Based on a random threshold judgment of node feature distance, edges with significantly different connection attributes are pruned, effectively removing irrelevant or noisy edges and reducing unnecessary complexity in the graph. This processing method allows subsequent subgraph generation and graph attention network training to focus more on important structural relationships, improving the accuracy of anomaly detection. Furthermore, by utilizing N×K subgraphs for multiple graph structure evolutions and continuously updating the subgraphs, the network's adaptability to complex graph structures is ensured, thereby enhancing the robustness of anomaly detection.

[0009] In one or more embodiments of the present invention, the specific process of the probabilistic edge pruning process includes: For the edge e in the graph ij Calculate edge eij The corresponding node v i With node v j The characteristic Euclidean distance r between them ij , where v i Represents the target node, v j This represents neighboring nodes that are connected to the target node. From node v respectively i The statistical interval of Euclidean distance between it and all its neighboring nodes [r] i mean, r i [max] and node v j The statistical interval of Euclidean distance between it and all its neighboring nodes [r] j mean, r j The threshold r is obtained by random sampling from [max]. i and r j ; When r ij At the same time greater than r i and r j When deleting node v i With node v j The edge e between ij .

[0010] This invention dynamically adjusts the edge connectivity in a graph by calculating the characteristic Euclidean distances between nodes and randomly sampling thresholds from the statistical interval of Euclidean distances between neighboring nodes. Pruning is only performed when the characteristic distances of edges simultaneously exceed the threshold. This process accurately removes edges that do not meet the threshold, effectively reducing redundant information and ensuring that the edge relationships in the graph more closely reflect the actual node relationships, thereby improving the quality of the graph structure and reducing interference factors during anomaly detection.

[0011] In one or more embodiments of the present invention, the process of generating N×K subgraphs includes: A truncation operation is performed on the graph to be detected. The truncation operation is a probabilistic edge pruning process performed on the edge set in the graph structure to generate N pruned subgraphs. Based on the above, continue to execute K. The process involves one iteration of truncation. In each iteration, new edge pruning is performed based on the subgraph structure generated in the previous round of truncation. The Euclidean distance statistical intervals corresponding to the nodes are dynamically updated according to the updated subgraph structure, ultimately generating N×K evolutionary subgraphs.

[0012] In generating N×K subgraphs, this invention first performs probabilistic edge pruning on the original graph structure through a single truncation operation, generating N pruned subgraphs. Then, through K iterative truncation operations, the subgraph structure is continuously optimized. This multiple iterations gradually focus on information at different frequencies. By updating the Euclidean distance statistical interval of nodes, each generated subgraph more accurately captures local heterogeneity features in the graph, thereby improving the graph structure's performance in anomaly detection and ensuring the accuracy of the final anomaly detection results.

[0013] In one or more embodiments of the present invention, the aggregation formula for the node representation is: ; in, Original features For nodes Post-polymerization characterization, For hyperparameters, express The degree, express The degree, and These represent the weights for the low-pass filter and the high-pass filter, respectively. It is a node The neighborhood group, It is a low-pass filter. Here, H represents the feature matrix of all nodes in the graph, which is a high-pass filter. set up + =1, and the weight coefficient - and ∈[ 1,1]; when When >0, the updated Will to Near; when When <0, the updated It will deviate .

[0014] In the node representation aggregation process, this invention combines low-pass and high-pass filtering paths, and the adjustment of weights helps to fully integrate different frequency information of nodes in the graph. By using a gating mechanism, the network can automatically adjust weights according to different frequency information, thereby affecting the updating of node representations. Low-pass filtering can preserve the homogeneity of nodes, while high-pass filtering can capture the heterogeneity of nodes. This improves the learning ability of graph attention networks in diverse graph data, accurately identifies complex relationships between nodes, and effectively improves the sensitivity of anomaly detection.

[0015] In one or more embodiments of the present invention, the weights of the low-pass filter path Weights of the high-pass filter path The weight parameter for fusion is a ij The weight parameters Calculated using the following gating mechanism: ; in, This indicates a cascade operation. It is a learnable weight vector, and tanh(·) is the hyperbolic tangent function; when When >0, the filter exhibits low-pass characteristics, enhancing homogeneity; when When the value is less than 0, the filter exhibits high-pass characteristics and captures heterogeneous features.

[0016] The gating mechanism of this invention calculates the weight parameter a. i This is used to adjust the fusion of the low-pass and high-pass filters. Specifically, when parameter a... i When a is greater than 0, the filter exhibits low-pass characteristics, enhancing the homogeneity of the nodes; when a i When the value is less than 0, the filter exhibits high-pass characteristics, capturing heterogeneous features. In this way, the network can flexibly adjust the fusion weights of different frequency information according to the different needs of the graph data, thereby more accurately identifying the correlations and anomalies between nodes during training, effectively improving the accuracy and interpretability of anomaly detection.

[0017] In one or more embodiments of the present invention, the optimization objective function for unsupervised training is defined as: ; in, yes The cosine similarity, where V represents the total set of nodes in the graph structure, λ is the regularization hyperparameter, and the first term... The second term is used to maximize the cosine similarity of local neighbor nodes. This is a regularization term used to constrain the representation discriminability of non-neighbor nodes.

[0018] The optimization objective function in this invention defines the core objective of unsupervised training: maximizing the cosine similarity of local neighbor nodes while constraining the representational discriminative power of non-neighbor nodes. This optimization objective ensures that the network can automatically learn node similarity from the graph structure in an unsupervised manner and effectively distinguish between normal and abnormal nodes. This optimization strategy makes the training process more consistent with the characteristics of the graph structure itself, enabling efficient detection of abnormal nodes and avoiding the limitations of traditional methods that rely on manually labeled data.

[0019] In one or more embodiments of the present invention, during the anomaly detection phase, node v i The abnormal score is calculated as follows: node Normal score under a single subgraph The normal score is the average cosine similarity between its representation and that of its neighboring nodes.

[0020] ;in, It is a node The neighborhood group, yes The cosine similarity, where They are Attribute vectors, The normal score represents the node's affinity: the higher the normal score, the greater the affinity of the node, the stronger the homogeneity of the node, and the more likely the node is to be a normal node. The anomaly score representing the node; The final score is the arithmetic mean of the outputs of the N×K graph attention network.

[0021] In the anomaly detection phase of this invention, node v i The anomaly score is assessed by calculating the mean cosine similarity between a node and its neighboring nodes to determine whether it is an anomalous node. This method utilizes the arithmetic mean of the outputs of a graph attention network across N×K subgraphs, comprehensively considering the node affinity in each subgraph and enhancing sensitivity to local anomalies. In this way, the network can combine the results from multiple subgraphs to more accurately assess the degree of node anomality, improving the accuracy of anomaly detection results and effectively reducing false positives.

[0022] In another aspect of the present invention, an unsupervised graph anomaly detection apparatus is provided, the apparatus comprising: The subgraph generation module is used to acquire the graph data to be detected, and to perform probabilistic edge pruning on the graph data to be detected using the heterogeneous edge pruning module to generate N×K subgraphs. The node representation module is used to construct a graph attention network containing low-pass and high-pass filtering paths for each subgraph, and to learn the fusion weights of different frequency information using a gating mechanism to generate node representations. The unsupervised training module is used to perform unsupervised training on the graph attention network corresponding to each subgraph with the objective function of maximizing the local node affinity. The calculation and detection module is used to calculate the anomaly score of each node in each subgraph. By aggregating the average anomaly scores of all subgraphs, the final anomaly detection result is determined.

[0023] In another aspect of the invention, an electronic device is provided, comprising: at least one processor; and a memory storing instructions that, when executed by the at least one processor, cause the at least one processor to perform an unsupervised graph anomaly detection method.

[0024] In another aspect of the invention, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of an unsupervised graph anomaly detection method. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a flowchart of the steps of an unsupervised graph anomaly detection method according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the overall architecture of an unsupervised graph anomaly detection method according to one embodiment of the present invention; Figure 3 This is a flowchart of a probabilistic edge pruning strategy in one embodiment of the present invention; Figure 4 This is a comparison chart of the experimental results of this invention with other datasets; Figure 5 This is a hardware structure diagram of an unsupervised graph anomaly detection device according to an embodiment of the present invention; Figure 6 This is a hardware structure diagram of an electronic device according to one embodiment of the present invention. Detailed Implementation

[0027] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0028] As described in the background section, existing graph anomaly detection techniques suffer from the following technical problems: ignoring single-class homogeneity, traditional methods do not fully utilize the statistical characteristics of strong affinity between normal nodes and weak affinity between abnormal nodes; smoothing high-frequency information, the low-pass filtering characteristics of GNNs easily lead to the smoothing of anomaly discriminative features, making it difficult to effectively identify anomaly patterns in complex scenarios; and limiting data dependence, semi-supervised methods require a large amount of manual annotation and are difficult to generalize to unseen anomalies with few samples.

[0029] In response to the above technical problems, such as Figures 1-2 As shown, this invention introduces an unsupervised graph anomaly detection method. The following uses the anomaly user detection scenario in a social network as an example for illustration. In this method, nodes represent users in the social network, node features represent user behavior feature vectors (such as posting frequency, distribution of interaction objects, content preferences, etc.), and edges represent the attention relationship or interaction relationship between users. Anomaly nodes include accounts such as malicious marketing accounts.

[0030] Step 1: Obtain the graph data to be detected, wherein the graph data to be detected includes nodes and edges between nodes, nodes represent entities to be analyzed, and edges represent the relationships between nodes; In social network applications, the system first acquires the social relationship graph data to be detected. In this graph, each node corresponds to a user entity, and each edge corresponds to a follow relationship or historical interaction relationship between two users. Each node is also associated with corresponding attribute features, such as the user's active time distribution, content posting characteristics, or interactive behavior statistics, thus forming the graph data to be detected that contains both structural and attribute information. By uniformly modeling the objects to be analyzed as a graph structure, subsequent anomaly detection is not only based on the attribute information of individual users but also on the structural relationships between users, providing a foundation for subsequent identification of structural and behavioral anomalies.

[0031] Step 2: Perform probabilistic edge pruning on the graph data to be detected. By randomly thresholding the node feature distance, prune edges with large differences in connection attributes to generate N×K subgraphs. In social networks, normal users tend to connect with users who share similar interests and behaviors, while abnormal users often have unnatural connections with a large number of normal users. Therefore, this step performs probabilistic pruning on the edges between users: by calculating the behavioral feature distance between connected users and combining it with a randomly sampled threshold, user relationships with significantly different connection attributes are probabilistically pruned. For example, abnormal follow relationships between accounts with clearly abnormal behavior and normal users are pruned. By executing this pruning process multiple times, multiple subgraphs with different structures but consistent statistical properties are generated, resulting in N×K subgraphs.

[0032] This embodiment weakens the non-homogeneous connections between abnormal nodes and normal nodes through probabilistic edge pruning, and avoids structural deviations caused by single pruning through a multi-subgraph approach. Thus, while maintaining the overall graph structure stability, it amplifies the differential features of abnormal nodes in the local structure.

[0033] Step 3: For each subgraph, construct a graph attention network containing low-pass and high-pass filtering paths, and use a gating mechanism to learn the fusion weights of different frequency information to generate node representations; For each generated subgraph, a graph attention network is constructed to learn representations of user nodes. The low-pass filtering path aggregates information from users with similar behaviors to enhance the homogeneity among normal users; the high-pass filtering path highlights features of users whose behavior differs significantly from their neighbors to preserve information about anomalous users. Through a gating mechanism, the fusion weights of the low-pass and high-pass paths are adaptively adjusted based on the feature relationships between users and their neighbors, enabling the network to automatically select the most appropriate information propagation method for different users.

[0034] This embodiment integrates low-frequency homogeneous information and high-frequency heterogeneous information in the same network, avoiding the problem of abnormal features being submerged due to excessive smoothing in traditional graph neural networks, so that the behavioral differences of abnormal users can be preserved and enhanced in node representation.

[0035] Step 4: With maximizing the affinity of local nodes as the optimization objective, perform unsupervised training on the graph attention network corresponding to each subgraph; During the training phase, the system does not rely on any manually labeled anomalies. Instead, it optimizes based on the local behavioral similarity between a user and its neighbors. Normal users typically exhibit high consistency in behavioral patterns with their neighbors, while anomalies generally show low similarity. By maximizing the local affinity between a node and its neighbors, the model is guided to automatically learn the common behavioral patterns of normal users, thus making anomalies naturally appear as difficult-to-fit nodes during training.

[0036] This unsupervised training method eliminates the need for manually labeled data and fully utilizes the statistical properties of graph structures, enabling the model to stably learn discriminative representations that distinguish between normal and abnormal users even in complex real-world scenarios.

[0037] Step 5: Based on the trained graph attention network, calculate the anomaly score of each node in each subgraph, and aggregate the anomaly scores corresponding to the N×K subgraphs to determine the final anomaly detection result.

[0038] During the detection phase, anomaly scores for user nodes are calculated in each subgraph, for example, by evaluating their similarity to neighboring user representations. Subsequently, the anomaly scores for the same user across N×K subgraphs are aggregated to form the user's final anomaly score. For instance, if a user exhibits low affinity with neighboring users in most subgraphs, their final anomaly score is high, and they can be identified as an anomalous user. Aggregating subgraph detection results effectively reduces the risk of misjudgment caused by structural noise in a single subgraph or random pruning, improving the stability and reliability of anomaly detection results.

[0039] Through the above steps, this invention achieves the following in specific application scenarios: under unsupervised conditions, by combining probabilistic edge pruning, multi-subgraph modeling, and frequency-adaptive graph attention mechanism, it effectively amplifies the differences in the structural and feature levels of abnormal nodes, thereby improving the accuracy and robustness of anomaly detection in complex graph structure scenarios.

[0040] In a further embodiment, such as Figure 2 As shown, this method is based on the assumption of homogeneity within a single class and learns discriminative representations by maximizing local affinity. First, the node v is calculated... i Its neighbor node v j Euclidean distance r between ij Subsequently, at node v i and v j The random sampling threshold r within the distance statistical interval i and r j When r ij At the same time greater than r i and r j When the condition is met, the edge is determined to be a heterogeneous edge and is then clipped.

[0041] In this embodiment, since the edge pruning strategy is inherently probabilistic, to fully utilize this characteristic, one edge pruning operation is performed on the original graph, generating N subgraphs with distinct structures. These N edge pruning operations are defined as a single truncation operation. First, a truncation operation is performed on the original graph, generating N distinct pruned subgraphs, each derived from the original graph through a round of edge pruning. Subsequently, the model performs K-1 additional truncation operations. In each subsequent truncation, the model performs a round of edge pruning on each of the N subgraphs generated by the previous truncation operation, producing N new subgraphs in each iteration. Through this iterative process, a total of N×K subgraphs are generated, and N×K attention networks are trained based on these subgraphs. During the inference phase, the average anomaly score of all subgraphs is calculated as the final discrimination score for each node.

[0042] In a further embodiment, such as Figure 3As shown, this invention provides a probabilistic edge pruning strategy aimed at eliminating heterogeneous edges and enhancing high-frequency information in graph structures. Since homogeneous edges connect nodes with similar properties, the distance between nodes along homogeneous edges is typically much smaller than the distance between nodes along heterogeneous edges. This statistical property provides the mathematical basis for the probabilistic edge pruning algorithm. Figure 2 As shown, this module calculates the Euclidean distance. Edge pruning is implemented using probabilistic methods, and the specific implementation process is as follows: ; in, yes and The Euclidean distance between them; From A value randomly selected from the range; express The average Euclidean distance between it and all its neighboring nodes express The maximum Euclidean distance between it and all its neighboring nodes. Similarly, From Values ​​randomly sampled within the range. If and There exists an edge between them, and the distance is... Greater than the sampled and When both are present, the module will be deleted. and The edges between them.

[0043] Meanwhile, considering the randomness in the pruning process, this module adopts an iterative pruning strategy. Each subgraph is generated based on the graph structure obtained in the previous iteration, and after each iteration, the specific distance range of the nodes is dynamically updated according to the newly generated subgraph partitions. This iterative pruning strategy effectively eliminates heteroophilic edges while significantly enhancing node homoophility.

[0044] Traditional GCNs can essentially be considered as low-pass filters. Correspondingly, there also exists a high-pass filter, denoted as... ,in, It is a hyperparameter. In terms of frequency adaptation, a basic idea is to use an attention mechanism to learn the ratio of low-frequency information to high-frequency information.

[0045] ; in, It is a node Post-polymerization characterization, express The degree; and These represent the weights for the low-pass and high-pass filters, respectively. By setting... + =1 and - ,Will ∈[ [1,1] is defined as a weightable coefficient. When When >0, the updated Will to Near; when When <0, the updated It will deviate .node and Weightable coefficients between It is calculated through a gating mechanism.

[0046] ; in, This indicates a cascade operation. Given a learnable weight vector, tanh(·) is the hyperbolic tangent function; then, the weights are computed from the first-order neighbors. To the node Message: ; In a further embodiment, regarding the training method and optimization objective, this method uses maximizing local node affinity as an anomaly metric. Compared to anomalous nodes, normal nodes exhibit significantly stronger isomorphic connections. Local node affinity is defined as the mean cosine similarity with neighboring nodes, and the anomaly score f is negatively correlated with similarity. ; in It is a node The neighborhood group, yes The cosine similarity, where They are Attribute vectors, The normal score represents the node's affinity: the higher the normal score, the stronger the homogeneity of the node, and the more likely the node is to be a normal node. The abnormal score represents the node.

[0047] Then, the loss function defined based on maximizing the local node affinity of a node is as follows: ; The first term is equivalent to maximizing the local affinity of each node based on the learned node representation, while the second term is a regularization term, and... This is the regularization hyperparameter. The regularization term adds a constraint that the representation of each node should be different from the representations of non-adjacent nodes, to force the representations of non-local nodes to be distinguishable, while maximizing the similarity of the representations of local nodes. Through the heterogeneous edge pruning module, N×K subgraphs are generated. Using these N×K subgraphs, N×K attention networks are trained, with their loss functions based on the previously defined local node affinity maximization criterion.

[0048] In a further embodiment, to verify the beneficial effects of the present invention, comprehensive experiments were conducted on six publicly available real graph anomaly detection datasets, including BlogCatalog, ACM, Amazon, Facebook, Reddit, and YelpChi. These datasets cover typical application scenarios such as e-commerce, social networks, and citation networks. The BlogCatalog and ACM datasets contain two types of injected anomalies: structural anomalies and content anomalies, while the other four datasets contain natural anomalies originating from real user behavior. This selection of datasets that simultaneously covers synthetic and real anomalies ensures the comprehensiveness of the method evaluation; and two commonly used and complementary anomaly detection evaluation metrics are employed: AUROC (Area Under the Receiver Operations Curve) and AUPRC (Area Under the Precision-Recall Curve). AUROC is suitable for scenarios with relatively balanced class distribution and can comprehensively reflect the model's performance at different thresholds; however, when the classes are highly imbalanced, AUROC may overestimate the model's performance. Unlike AUROC, AUPRC directly focuses on the identification ability of the minority class (i.e., the positive class), and therefore has higher sensitivity when the data is imbalanced. Detailed experimental results are as follows: Figure 4 As shown.

[0049] like Figure 5 As shown, the present invention also provides an apparatus for implementing the above method, comprising: The data acquisition module 201 is used to acquire the graph data to be detected, wherein the graph data to be detected includes nodes and edges between nodes, where nodes represent entities to be analyzed and edges represent the relationships between nodes; Subgraph generation module 202 is used to perform probabilistic edge pruning on the graph data to be detected. By randomly thresholding the node feature distance, it prunes some edges with large differences in connection attributes and generates N×K subgraphs. The node representation module 203 is used to construct a graph attention network containing low-pass filtering paths and high-pass filtering paths for each subgraph, and to learn the fusion weights of different frequency information using a gating mechanism to generate node representations. Unsupervised training module 204 is used to perform unsupervised training on the graph attention network corresponding to each subgraph with the optimization objective of maximizing local node affinity. The calculation and detection module 205 is used to calculate the anomaly score of each node in each subgraph based on the trained graph attention network, and to aggregate the anomaly scores corresponding to N×K subgraphs to determine the final anomaly detection result.

[0050] Figure 6 A hardware structure diagram of a computing device 30 for an unsupervised graph anomaly detection method is shown according to an embodiment of this specification. For example... Figure 6 As shown, the computing device 30 may include at least one processor 301, a memory 302 (e.g., non-volatile memory), a main memory 303, and a communication interface 304, and the at least one processor 301, memory 302, main memory 303, and communication interface 304 are connected together via a bus 305. At least one processor 301 executes at least one computer-readable instruction stored or encoded in the memory 302.

[0051] It should be understood that the computer-executable instructions stored in memory 302, when executed, cause at least one processor 301 to perform the above-described combinations in the various embodiments of this specification. Figure 1-3 The description includes various operations and functions.

[0052] In the embodiments of this specification, the computing device 30 may include, but is not limited to: personal computer, server computer, workstation, desktop computer, laptop computer, notebook computer, mobile computing device, smartphone, tablet computer, cellular phone, personal digital assistant (PDA), handheld system, messaging device, wearable computing device, consumer electronic device, etc.

[0053] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0054] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0055] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0056] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0057] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

[0058] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. An unsupervised graph anomaly detection method, characterized in that, Includes the following steps: Obtain the graph data to be detected, wherein the graph data to be detected includes nodes and edges between nodes, nodes represent entities to be analyzed, and edges represent the relationships between nodes; Probabilistic edge pruning is performed on the graph data to be detected. By randomly thresholding the node feature distance, edges with large differences in connection attributes are pruned to generate N×K subgraphs. For each subgraph, a graph attention network containing low-pass and high-pass filtering paths is constructed. The gating mechanism is used to learn the fusion weights of different frequency information to generate node representations. With the optimization objective of maximizing the affinity of local nodes, the graph attention network corresponding to each subgraph is trained unsupervised. Based on the trained graph attention network, the anomaly score of each node in each subgraph is calculated, and the anomaly scores corresponding to N×K subgraphs are aggregated to determine the final anomaly detection result. The aggregation formula for the node representation is: ； in, Original features For nodes Post-polymerization characterization, For hyperparameters, express The degree, express The degree, and These represent the weights for the low-pass filter and the high-pass filter, respectively. It is a node The neighborhood group, It is a low-pass filter. Here, H represents the feature matrix of all nodes in the graph, which is a high-pass filter. set up + =1, and the weight coefficient - and ∈[ 1,1]; when When >0, the updated Will to Near; when When <0, the updated It will deviate ; The weights of the low-pass filter path Weights of the high-pass filter path The weight parameter for fusion is a ij The weight parameters Calculated using the following gating mechanism: ; in, This indicates a cascade operation. It is a learnable weight vector, and tanh(·) is the hyperbolic tangent function; when When >0, the filter exhibits low-pass characteristics, enhancing homogeneity; when When the value is less than 0, the filter exhibits high-pass characteristics and captures heterogeneous features.

2. The unsupervised graph anomaly detection method according to claim 1, characterized in that, The specific process of the probabilistic edge pruning process includes: For the edge e in the graph ij Calculate edge e ij The corresponding node v i With node v j The characteristic Euclidean distance r between them ij , where v i Represents the target node, v j This represents neighboring nodes that are connected to the target node. From node v respectively i The statistical interval of Euclidean distance between it and all its neighboring nodes [r] i mean, r i [max] and node v j The statistical interval of Euclidean distance between it and all its neighboring nodes [r] j mean, r j The threshold r is obtained by random sampling from [max]. i and r j ; When r ij At the same time greater than r i and r j When deleting node v i With node v j The edge e between ij .

3. The unsupervised graph anomaly detection method according to claim 1, characterized in that, The process of generating N×K subgraphs includes: A truncation operation is performed on the graph to be detected. The truncation operation is a probabilistic edge pruning process performed on the edge set in the graph structure to generate N pruned subgraphs. Based on the above, continue to execute K. The process involves one iteration of truncation. In each iteration, new edge pruning is performed based on the subgraph structure generated in the previous round of truncation. The Euclidean distance statistical intervals corresponding to the nodes are dynamically updated according to the updated subgraph structure, ultimately generating N×K evolutionary subgraphs.

4. The unsupervised graph anomaly detection method according to claim 1, characterized in that, The optimization objective function used for unsupervised training is defined as: ； in, yes The cosine similarity, where V represents the total set of nodes in the graph structure, λ is the regularization hyperparameter, and the first term... The second term is used to maximize the cosine similarity of local neighbor nodes. This is a regularization term used to constrain the representation discriminability of non-neighbor nodes.

5. The unsupervised graph anomaly detection method according to claim 1, characterized in that, During the anomaly detection phase, node v i The abnormal score is calculated as follows: node Normal score under a single subgraph The normal score is the average cosine similarity between its representation and that of its neighboring nodes. ;in, It is a node The neighborhood group, yes The cosine similarity, where They are Attribute vectors, The normal score represents the node's affinity: the higher the normal score, the greater the affinity of the node, the stronger the homogeneity of the node, and the more likely the node is to be a normal node. The anomaly score representing the node; The final score is the arithmetic mean of the outputs of the N×K graph attention network.

6. An unsupervised graph anomaly detection device, wherein the unsupervised graph anomaly detection device is applied to the unsupervised graph anomaly detection method according to any one of claims 1 to 5, characterized in that, Unsupervised graph anomaly detection device includes: The subgraph generation module is used to acquire the graph data to be detected, and to perform probabilistic edge pruning on the graph data to be detected using the heterogeneous edge pruning module to generate N×K subgraphs. The node representation module is used to construct a graph attention network containing low-pass and high-pass filtering paths for each subgraph, and to learn the fusion weights of different frequency information using a gating mechanism to generate node representations. The unsupervised training module is used to perform unsupervised training on the graph attention network corresponding to each subgraph with the objective function of maximizing the local node affinity. The calculation and detection module is used to calculate the anomaly score of each node in each subgraph. By aggregating the average anomaly scores of all subgraphs, the final anomaly detection result is determined.

7. An electronic device, characterized in that, The method includes a processor and a memory coupled to the processor, the memory storing program instructions executable by the processor; when the processor executes the program instructions stored in the memory, it implements the unsupervised graph anomaly detection method as described in any one of claims 1 to 5.

8. A storage medium, characterized in that, The storage medium stores program instructions, which, when executed by a processor, enable the unsupervised graph anomaly detection method as described in any one of claims 1 to 5.

Images