Graph data anomaly detection method, system and equipment and medium

Abstract

The invention provides a graph data anomaly detection method, system and device and a medium, and belongs to the field of anomaly detection.The method comprises the following steps that a to-be-purified anomaly graph and a reference anomaly graph are input into an anomaly detection model at the same time, and the anomaly detection model is trained; obtaining a node comparison score by using the trained anomaly detection model; calculating edge interference scores of the to-be-purified abnormal graph according to the node comparison scores, sorting the edge interference scores, determining the sorted first K edges as interference edges, and deleting the interference edges to obtain a rough clean graph; inputting the rough clean graph and the reference abnormal graph into an abnormal detection model at the same time, and performing repeated iteration operation on a training process of the abnormal detection model, a node comparison scoring process and an interference edge deletion process until the number of deleted interference edges reaches a set threshold value, thereby obtaining a target clean graph; according to the invention, the interference edge detection precision and the anomaly detection precision can be improved.

Description

Technical Field

[0001] This invention belongs to the field of anomaly detection, specifically relating to a method, system, device, and medium for anomaly detection of graph data. Background Technology

[0002] With the rapid increase in the number of academic papers, citation relationships have become an important basis for measuring academic influence, characterizing the knowledge dissemination process, and supporting academic evaluation and recommendation systems. However, citation behavior is not always driven entirely by academic relevance; unnatural or strategic citation behaviors may exist in reality, resulting in abnormal structural patterns in citation networks. These abnormal citation relationships can distort the objective reflection of a paper's influence, thereby affecting key decisions such as academic evaluation, journal and institutional assessment, and the allocation of research resources. Therefore, anomaly detection in citation relationships is of great significance for maintaining the fairness, credibility, and healthy development of the academic ecosystem.

[0003] Graphs, a fundamental data structure composed of nodes and edges, play a crucial role in representing relationships across various disciplines, such as recommender systems, social network analysis, and financial risk assessment. In graph analysis, graph anomaly detection (GAD) has become a key research area. It aims to identify patterns that differ significantly from the majority of data. This anomaly detection reveals potential irregularities in the data, facilitating proactive intervention to protect data integrity. This capability has far-reaching applications, particularly in fraud detection, the discovery of brain pathology mechanisms, and network intrusion prevention.

[0004] Early methods employed shallow mechanisms such as self-network analysis, residual analysis, and CUR decomposition to detect anomalies. However, these methods failed to capture the inherent complex relationships within graph data, limiting their ability to detect complex anomalies. With the rise of deep learning, some studies have utilized graph neural networks (GNNs) to reconstruct structural and node features, using reconstruction errors as the basis for anomaly identification. While these methods have made progress, they require explosive memory resources. Furthermore, convolutional operations in GNNs can smooth out anomalous signals, reducing the uniqueness of anomalous nodes and thus affecting detection accuracy. Recently, researchers have employed contrastive learning for anomaly detection. This method utilizes restarted random walks (RWR) for subgraph sampling, generating positive instance pairs between nodes and their local subgraphs, as well as negative instance pairs from different subgraphs. The degree of anomalousness of a node is assessed by examining the similarity differences between positive and negative instance pairs.

[0005] However, existing academic paper citation graphs contain interfering edges with abnormal citation relationships, which reduces the accuracy of graph anomaly detection. The model has difficulty accurately identifying abnormal paper citation relationships and their corresponding abnormal papers, thus affecting the reliability of academic anomaly detection results. Summary of the Invention

[0006] To overcome the shortcomings of the existing technology, the present invention provides a graph data anomaly detection method, comprising the following steps: Obtain the anomaly graph to be cleaned and the baseline anomaly graph from the academic paper citation relationship graph data; where each node in the academic paper citation relationship graph data represents a paper, the edges represent the citation relationship between papers, the citation relationship in the anomaly graph contains abnormal citation relationships, and the nodes in the anomaly graph contain abnormal paper characteristics; The anomaly detection model is trained by simultaneously inputting the anomaly graph to be cleaned and the benchmark anomaly graph. Specifically, the anomaly detection model performs random walks on both the anomaly graph to be cleaned and the benchmark anomaly graph, extracting subgraphs of nodes from both graphs. A node and its own subgraph form a first positive instance pair, and the subgraphs of other nodes form a first negative instance pair. A node and its updated node representation in a subgraph form a second positive instance pair, and the updated node representations of other subgraphs form a second negative instance pair. The anomaly detection model is trained based on the similarity scores of the first positive instance pair, the first negative instance pair, the second positive instance pair, and the second negative instance pair between the anomaly graph to be cleaned and the benchmark anomaly graph. The trained anomaly detection model is used to obtain the difference between the similarity scores of the first negative instance pair and the first positive instance pair in the benchmark anomaly graph, and the difference between the similarity scores of the second negative instance pair and the second positive instance pair. The node comparison score is calculated based on the difference. The edge interference score of the abnormal graph to be cleaned is calculated by comparing the node scores. The edge interference scores are sorted, and the top K edges after sorting are identified as interference edges and deleted to obtain a rough clean graph. The rough clean graph and the baseline anomaly graph are simultaneously input into the anomaly detection model. The training process of the anomaly detection model, the node comparison score calculation process, and the interference edge deletion process are repeatedly iterated until the number of deleted interference edges reaches a set threshold, thus obtaining a clean graph of the target academic paper citation relationship.

[0007] Preferably, the step of using the trained anomaly detection model to obtain the difference between the similarity scores of the first negative instance pair and the first positive instance pair in the benchmark anomaly graph, and the difference between the similarity scores of the second negative instance pair and the second positive instance pair, and calculating the node comparison score based on the differences, specifically involves: determining the anomaly score of the subgraph and node comparison scale based on the difference between the similarity scores of the first negative instance pair and the first positive instance pair in the benchmark anomaly graph; determining the anomaly score of the node-to-node comparison scale based on the difference between the similarity scores of the second negative instance pair and the second positive instance pair in the benchmark anomaly graph; and calculating the node comparison score using the anomaly scores of the subgraph-to-node comparison scale and the node-to-node comparison scale.

[0008] Preferably, the step of calculating the node comparison score by comparing the subgraph with the node scale and the node with the node scale specifically involves: performing a weighted summation of the abnormal scores of the subgraph with the node scale and the node with the node scale to obtain the node comparison score.

[0009] Preferably, the node comparison score is obtained using the following formula: , In the formula, Indicates the first r The comparison scores of the round nodes, This represents the mean of the comparison scores for each node. R Represents the total number of rounds.

[0010] Preferably, the step of simultaneously inputting the anomaly image to be cleaned and the baseline anomaly image into the anomaly detection model to train the anomaly detection model uses the following loss function: , In the formula, This represents the comparison loss between nodes in the baseline anomaly graph and the subgraph. This represents the comparison loss between nodes and subgraphs in the roughly clean graph. This represents the comparison loss between nodes in the baseline anomaly graph. This represents the comparison loss between nodes in a roughly clean graph. α and β These represent the balance parameters for different views and scales, respectively.

[0011] This invention also provides a graph data processing system, comprising: The model training module is used to obtain the anomaly graph to be cleaned and the baseline anomaly graph from the academic paper citation relationship graph data. Each node in the academic paper citation relationship graph data represents a paper, and the edges represent the citation relationships between papers. The anomaly graph shows abnormal citation relationships, and the nodes in the anomaly graph contain features of abnormal papers. The anomaly detection model is trained by simultaneously inputting the anomaly graph to be cleaned and the baseline anomaly graph. Specifically, the anomaly detection model performs random walks on both the anomaly graph to be cleaned and the baseline anomaly graph, extracting subgraphs of nodes from both graphs. A node and its own subgraph form a first positive instance pair, and the subgraphs of other nodes form a first negative instance pair. A node and the updated node representation in its subgraph form a second positive instance pair, and the updated node representations of other subgraphs form a second negative instance pair. The anomaly detection model is trained based on the similarity scores of the first positive instance pair, the first negative instance pair, the second positive instance pair, and the second negative instance pair between the anomaly graph to be cleaned and the baseline anomaly graph. The node comparison score acquisition module is used to obtain the difference between the similarity score of the first negative instance pair and the similarity score of the first positive instance pair and the similarity score of the second negative instance pair and the similarity score of the second positive instance pair in the benchmark anomaly map using the trained anomaly detection model, and to calculate the node comparison score based on the difference. The interference edge removal module is used to calculate the edge interference score of the abnormal graph to be cleaned by comparing the node scores, sort the edge interference scores, identify the top K edges after sorting as interference edges, and delete the interference edges to obtain a rough clean graph. The target clean graph acquisition module is used to simultaneously input the coarse clean graph and the baseline anomaly graph into the anomaly detection model, and repeatedly iterate the training process of the anomaly detection model, the node comparison score calculation process, and the interference edge deletion process until the number of deleted interference edges reaches a set threshold, thereby obtaining a clean graph of the target academic paper citation relationship.

[0012] The present invention also provides a computer device, including a memory and a processor; the memory stores a computer program, and the processor is used to run the computer program in the memory to execute the graph data anomaly detection method.

[0013] The present invention also provides a computer-readable storage medium storing a computer program adapted for loading by a processor to execute the graph data anomaly detection method.

[0014] The image data anomaly detection method, system, device, and medium provided by this invention have the following beneficial effects: This invention simultaneously inputs the anomaly graph to be cleaned and the baseline anomaly graph from academic paper citation relationship graph data into an anomaly detection model. By performing random walks on both graphs simultaneously, the anomaly detection model can extract subgraphs of nodes from each graph. Extracting subgraphs from the graph to be cleaned avoids the anomaly detection model being affected by interfering edges, increasing its ability to identify and remove interfering edges more accurately. Extracting subgraphs from the baseline anomaly graph allows the model to learn richer information, enhancing its robustness. The connection between nodes and subgraphs... The first positive instance pair (the target paper node and its local citation subgraph obtained through neighborhood sampling in the citation network) is formed, and the subgraphs obtained from other nodes form the first negative instance pair (the target paper node and other local citation subgraphs obtained through neighborhood sampling in the citation network). The node and the updated node representation in the subgraph form the second positive instance pair, and the updated node representation in other subgraphs form the second negative instance pair. The anomaly detection model is trained using the similarity scores of the first positive instance pair, the first negative instance pair, the second positive instance pair, and the second negative instance pair between the anomaly graph to be cleaned and the benchmark anomaly graph. This allows the model to utilize the similarity scores of the first positive instance pair, the first negative instance pair, the second positive instance pair, and the second negative instance pair between the anomaly graph to be cleaned and the benchmark anomaly graph. By comparing points with subgraphs and nodes with each other, the model can simultaneously capture both feature anomalies (such as attribute anomalies in paper topic and author information) and structural anomalies (such as abnormal citation links and spurious collaborations) in academic papers, significantly improving the model's detection accuracy for interfering edges. Calculating node comparison scores by using the differences between the similarity scores of the first negative instance pair and the first positive instance pair, and the differences between the similarity scores of the second negative instance pair and the second positive instance pair, improves the accuracy of node comparison score calculation. Finally, the model calculates the edge interference score of the abnormal graph to be cleaned using the node comparison score, thus improving edge interference. The edges are sorted by their perturbation scores, and the top K edges are then deleted, removing the most disruptive edges. By using a multi-iterative approach to delete these edges, the parameters of the anomaly detection model are reset after each set of edges is deleted to prevent bias in previously deleted edges. Simultaneously, recalculating the node comparison scores enhances the identification of highly disruptive edges, making the detection and deletion processes increasingly accurate. This approach maximizes the preservation of genuine citation relationships between academic papers and the core characteristics of the papers themselves, significantly improving the accuracy and reliability of anomaly detection in academic paper citation networks. Attached Figure Description

[0015] To more clearly illustrate the embodiments and design schemes of the present invention, the accompanying drawings required for this embodiment will be briefly described below. The drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1This is a flowchart of the graph data anomaly detection method according to an embodiment of the present invention; Figure 2 A graph showing the balance parameters between scale and view, where, Figure 2 (a) and Figure 2 (b) are the balance parameter analysis plots of scale and view in the datasets Citeseer and Citation, respectively; Figure 3 Images showing the effects of different margin removal ratios; Figure 4 The graph shows the accuracy analysis of interference edge removal for different models. Figure 4 (a) and Figure 4 (b) shows the edge removal accuracy analysis graphs on the Cora and ACM datasets, respectively. Detailed Implementation

[0017] To enable those skilled in the art to better understand and implement the technical solutions of the present invention, the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and should not be construed as limiting the scope of protection of the present invention.

[0018] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "axial," "radial," and "circumferential" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing the technical solution of this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0019] Furthermore, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. In the description of this invention, it should be noted that, unless otherwise explicitly specified or limited, the terms "connected" or "linked" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances. In the description of this invention, unless otherwise stated, "a plurality of" means two or more, which will not be elaborated further here.

[0020] Example This invention provides a method for detecting anomalies in graph data, specifically as follows: Figure 1As shown, it includes the following steps: Step 1: Obtain the anomaly graph to be cleaned and the baseline anomaly graph from the academic paper citation relationship graph data. Each node in the academic paper citation relationship graph data represents a paper, and edges represent citation relationships between papers. The anomaly graph shows abnormal citation relationships, and the nodes in the anomaly graph contain features of abnormal papers. Simultaneously input the anomaly graph to be cleaned and the baseline anomaly graph into the anomaly detection model for training. Specifically, the anomaly detection model performs random walks on both the anomaly graph to be cleaned and the baseline anomaly graph, extracting subgraphs of nodes from both graphs. A node and its own subgraph form a first positive instance pair, and the subgraphs obtained from other nodes form a first negative instance pair. A node and the updated node representation in its subgraph form a second positive instance pair, and the updated node representations from other subgraphs form a second negative instance pair. The anomaly detection model is trained based on the similarity scores of the first positive instance pair, the first negative instance pair, the second positive instance pair, and the second negative instance pair between the anomaly graph to be cleaned and the baseline anomaly graph.

[0021] In this invention, the anomaly detection model used is ANEMONE, and its training process is as follows: (7) Subgraph sampling.

[0022] The anomaly level of a node is closely related to the structure and features of its local subgraph. Normal nodes are typically highly similar to their neighboring nodes, while anomalous nodes exhibit the opposite behavior. Therefore, this invention employs a random walk (RWR) to sample subgraphs Ga and Gc from the anomalous and clean graphs, respectively. Each subgraph includes the target node and its neighboring nodes, with a fixed size of N. To prevent the anomaly detection model from easily identifying the target node in the subgraph, this invention initializes the feature embedding of the target node in the subgraph as a zero vector to hide information.

[0023] (2) Node-Subgraph Comparison. The purpose of node-subgraph comparison is to learn the consistency between a node and its entire local subgraph. To this end, this invention constructs instance pairs by combining nodes with subgraphs. Specifically, the first positive instance pair consists of node ui and its subgraph Gi, while the first negative instance pair is formed by pairing node ui with a randomly selected subgraph Gj. In order to extract meaningful features from the graph, this invention employs a graph convolutional network (GCN), which uses the graph structure to aggregate information and capture local dependencies. Through this process, each node in the subgraph integrates features from its neighboring nodes:

[0024] ; in, and They are respectively the ( l +1) layer and the l Layer representation, It is the inverse square root of the subgraph degree matrix. It is a node i The adjacency matrix of the subgraph. It is the first l Layer weight matrix.

[0025] An embedding of a subgraph is generated by average pooling: ; Among them, S i This represents the multidimensional subgraph embedding obtained through GCN. p The first subgraph in the representative subgraph p Embedding of individual nodes, N Indicates the number of nodes. h i This represents the subgraph embedding after pooling.

[0026] To compare subgraph embeddings and node embeddings, this invention aligns them to the same dimension. In practice, this invention uses a multilayer perceptron (MLP) to project node features into a low-dimensional space:

[0027] ; in, and They represent the first l Layer and ( l +1) layer representation, It is the first l Layer weight matrix.

[0028] Subsequently, a discriminator is used to measure the relationship between node embeddings and subgraph embeddings. This discriminator evaluates the similarity between embeddings in positive and negative instance pairs, generating a score for each instance pair. Specifically, a bilinear function is used to quantify the similarity:

[0029] ; in, h i and h j Representing nodes respectively i and nodes j Subgraph embedding, n i This represents the node embedding of node i.

[0030] Node-subgraph comparison is trained by bringing the first positive instance pair closer together and pushing away the first negative instance pair apart based on similarity; this process can be viewed as a binary classification task. Therefore, this invention uses the binary cross-entropy (BCE) loss function for training:

[0031] ; in, y i Tags representing instance pairs s i Representative instances are pairs of fractions.

[0032] (3) Node-to-Node Comparison. Node-to-node comparison is more effective in identifying node-level anomalies. Each instance pair consists of the original feature embedding and the updated node embedding, which is aggregated from neighboring nodes within the subgraph. A second positive instance pair is constructed by combining the original feature embedding with the corresponding updated embedding. On the other hand, a second negative instance pair is generated by pairing the original node embedding with node embeddings updated from an unrelated subgraph. The aggregation of subgraphs is accomplished through a new GCN.

[0033] ; in, and They are respectively the ( l +1) layer and the l Layer representation, It is the inverse square root of the subgraph degree matrix. It is a node i The adjacency matrix of the subgraph. It is the first l Layer weight matrix.

[0034] ; in, and They represent the first l Layer and ( l +1) layer representation, It is the first l Layer weight matrix.

[0035] Step 2: Using the trained anomaly detection model, obtain the difference between the similarity scores of the first negative instance pair and the first positive instance pair in the baseline anomaly graph, and the difference between the similarity scores of the second negative instance pair and the second positive instance pair. Calculate the node comparison score based on the difference. Calculate the edge interference score of the anomaly graph to be cleaned using the node comparison score. Sort the edge interference scores, identify the top K edges as interference edges, and delete them to obtain a rough clean graph. Input the rough clean graph and the baseline anomaly graph into the anomaly detection model simultaneously. Repeat the training process of the anomaly detection model, the node comparison score calculation process, and the interference edge deletion process iteratively until the number of deleted interference edges reaches a set threshold, obtaining the target clean graph.

[0036] (1) Node Comparison Scoring. For normal nodes, the similarity of positive instance pairs approaches 1, while the similarity of negative instance pairs approaches 0. Conversely, for anomalous nodes, the scores of positive and negative instance pairs are relatively similar. Therefore, this invention assesses the degree of anomalousness of nodes by examining the similarity difference between positive and negative instance pairs. Specifically, this invention subtracts the similarity score of positive and negative instances from the negative instance pairs. Both scores are derived from the baseline anomalous map, and the greater the difference, the higher the probability of an anomalous node.

[0037] ; In the formula, The score represents the first negative instance pair in the baseline anomaly graph. The score represents the first positive instance pair of the baseline anomaly plot. The score represents the second negative instance pair of the baseline anomaly graph. The score represents the second positive instance pair score of the baseline anomaly plot. This represents the node-subgraph comparison score of the baseline anomaly map. This represents the node-to-node comparison score of the baseline anomaly map.

[0038] To comprehensively assess multi-scale anomalies, this invention summarizes these scores using a weighted summation: ; In the formula, β These are equilibrium parameters at different scales.

[0039] (2) Interference Edge Detection. Interference edges significantly reduce the similarity between the target node and its local subgraph, narrowing the score gap between positive and negative instance pairs. This hinders the contrastive loss function's ability to distinguish instances, undermining effective model training. To mitigate this problem, the first step of this invention is to accurately quantify the interference level of each edge.

[0040] Interference edges can be divided into two categories: (1) anomalous links formed between previously unconnected normal nodes; and (2) pre-existing edges connecting nodes with anomalous characteristics. Both categories represent connections between dissimilar entities. Therefore, a decrease in a node's contrast score can be attributed to its association with dissimilar nodes through interference edges. If an edge connects two nodes with high scores, it indicates that both nodes interact with different neighbors, increasing the likelihood of interference. Based on this assumption, this invention aggregates the scores of connected nodes to quantify the level of interference associated with the edge. Through this method, this invention obtains the detection matrix of interference edges:

[0041] ; Based on edge interference scores, this invention employs a ranking mechanism to prioritize edges most disruptive to the contrastive learning process. Specifically, edges with the highest scores are identified for removal. These edges typically exhibit significant deviations in feature distribution compared to their neighboring nodes, indicating their potential as interference sources. This invention iteratively removes interference edges. In each iteration, after removing a set of edges, the model's parameters are reset to prevent the influence of previously removed edges. The model then undergoes another round of anomaly detection model training, recalculating node scores to enhance the identification of highly disruptive edges. By effectively evaluating interference sources and removing interference edges, the detection process becomes increasingly accurate. By removing these target edges, this invention obtains a clean graph, reducing the impact of interference edges on subsequent training.

[0042] (3) Loss Function. This invention performs multi-scale anomaly detection on a baseline anomaly map and a coarsely clean map. The contrastive learning loss function is defined as follows:

[0043] ; In the formula, This represents the comparison loss between nodes in the baseline anomaly graph and the subgraph. This represents the comparison loss between nodes and subgraphs in the roughly clean graph. This represents the comparison loss between nodes in the baseline anomaly graph. This represents the comparison loss between nodes in a roughly clean graph. α and β These represent the balance parameters for different views and scales, respectively.

[0044] (4) Multi-scale comparative scoring. Clean maps can mask true anomalous signals and impair accurate anomaly detection. Therefore, in the score calculation process, this invention relies only on the score calculated from the baseline anomaly map. Furthermore, due to the inherent randomness in sampling, structurally anomalous nodes may occasionally connect with normal neighbors, leading to missed anomalies. To address this issue, this invention performs multiple sampling iterations to calculate the mean and variance:

[0045] ; In the formula, Indicates the first r The comparison scores of the round nodes, This represents the mean of the comparison scores for each node. R Represents the total number of rounds.

[0046] (8) After obtaining the target clean map, an anomaly detection model is used to detect the baseline anomaly map. Specifically, the detection array is initialized with all elements set to zero. For each node that is an endpoint of an interference edge, the value at the corresponding position in the array is incremented. During scoring, the detection score is calculated iteratively, and its value is proportional to the frequency of the node's connection to the interference edge. A higher score reflects a stronger correlation between the node and the anomalous behavior. Finally, the total node score is calculated by aggregating the multi-scale contrast score and the detection score, as follows:

[0047] ; In the formula, This indicates the comparison score between nodes. Indicates the test score. This represents the fractional balance parameter.

[0048] This invention also provides a graph data processing system, comprising: The model training module is used to simultaneously input the anomaly graph to be cleaned and the benchmark anomaly graph into the anomaly detection model for training. Specifically, the anomaly detection model performs random walks on both the anomaly graph to be cleaned and the benchmark anomaly graph simultaneously, extracting subgraphs of nodes from both graphs. A node and its own subgraph form a first positive instance pair, and the subgraphs of other nodes form a first negative instance pair. A node and its updated node representation in a subgraph form a second positive instance pair, and the updated node representations of other subgraphs form a second negative instance pair. The anomaly detection model is trained based on the similarity scores of the first positive instance pair, the first negative instance pair, the second positive instance pair, and the second negative instance pair between the anomaly graph to be cleaned and the benchmark anomaly graph. The node comparison score acquisition module is used to obtain the difference between the similarity score of the first negative instance pair and the similarity score of the first positive instance pair and the similarity score of the second negative instance pair and the similarity score of the second positive instance pair in the benchmark anomaly map using the trained anomaly detection model, and to calculate the node comparison score based on the difference. The interference edge removal module is used to calculate the edge interference score of the abnormal graph to be cleaned by comparing the node scores, sort the edge interference scores, identify the top K edges after sorting as interference edges, and delete the interference edges to obtain a rough clean graph. The target clean map acquisition module is used to simultaneously input the coarse clean map and the baseline anomaly map into the anomaly detection model, and repeatedly iterate the training process of the anomaly detection model, the node comparison score calculation process, and the interference edge deletion process until the number of deleted interference edges reaches a set threshold to obtain the target clean map.

[0049] The present invention also provides a computer device, including a memory and a processor; the memory stores a computer program, and the processor is used to run the computer program in the memory to execute a graph data anomaly detection method.

[0050] The present invention also provides a computer-readable storage medium storing a computer program adapted for loading by a processor to execute a graph data anomaly detection method.

[0051] To verify the method of the present invention, experimental verification was conducted, and the specific process is as follows: (9) Datasets. This invention was tested on five benchmark datasets: Cora, Citeseer, ACM, DBLP, and Citation. Since these datasets themselves do not contain anomalous information, this invention manually injects anomalous data. This invention injects structural and feature anomalous data into each dataset. Specifically, to inject feature anomalous data, this invention randomly selects n' anomalous nodes. For each anomalous node u, this invention randomly selects 50 candidate nodes and calculates the Euclidean distance between u and each candidate node, selecting the candidate node v with the largest distance, and replacing the feature xu of node u with xv. For structural anomalous data, this invention randomly selects 15 nodes and connects them pairwise to form a clique; this process is repeated m' times. Both types of anomalous data are injected in equal numbers.

[0052] Table 1 Anomaly detection results of different models (2) In this invention, for ease of description, the graph data anomaly detection method of this invention is referred to as CVGAD. This invention selects eight state-of-the-art models as benchmarks. HCM determines anomalies based on the minimum number of hops between nodes, where nodes with a larger number of hops are more likely to be considered anomalies. CoLA, ANEMONE, GRADATE, and NLGAD are four anomaly detection models based on contrastive learning. Sub-CR and SL-GAD combine attribute reconstruction and contrastive learning to comprehensively evaluate the anomaly level of nodes. GFCN utilizes a graph convolutional network with skip connections to estimate the probability of anomalies.

[0053] (3) Evaluation index. In order to evaluate the effectiveness, the present invention uses ROC-AUC as the evaluation index.

[0054] (4) Parameter settings. This invention uses a single-layer GCN to aggregate information from the subgraph, and both subgraph embedding and node embedding are mapped to 64 dimensions. The subgraph size is set to 4, and the learning rate is kept fixed at 0.001. Furthermore, this invention will... The value is set to 0.8. Five iterations are performed on all datasets. Specifically, this invention performs 500 epochs of edge removal training on Cora and CiteSeer, and 1000 epochs on DBLP, Citation, and ACM. During the optimization training phase, this invention performs 200 epochs on Cora and CiteSeer, and 400 epochs on DBLP, Citation, and ACM. Furthermore, this invention performs 300 epochs of score calculation.

[0055] (5) Anomaly Detection Results. To evaluate the anomaly detection performance of the present invention, it was compared with eight baseline models on five datasets. Based on the results shown in Table 1, the present invention can draw the following conclusions: (1) The present invention achieves AUC gains of 1.91%, 0.31%, 1.20%, and 1.73% on Cora, Citeseer, Citation, and ACM, respectively. In addition, the present invention also achieves the second-best performance on DBLP, proving the effectiveness of the model; (2) The performance of the contrastive learning-based method surpasses that of HCM and GFCN. The main reason is the low similarity between anomalous nodes and local subgraphs. Therefore, by comparing the similarity between nodes and subgraphs, the present invention can effectively identify anomalous nodes; (3) Sub-CR shows good performance, mainly because other baseline models implement a single learning strategy, while Sub-CR combines reconstruction and contrastive learning strategies. However, by mitigating the impact on interfering edges, the present invention achieves better results than Sub-CR on four datasets.

[0056] Table 2. Anomaly detection effects of the present invention and its variants (10) Ablation Studies. To verify the effectiveness of different modules, this invention conducted three types of ablation studies. First, this invention investigated the effects of different edge removal strategies. Next, this invention tested the impact of random walks of different views. Finally, this invention compared the multi-score integration method with scores based solely on contrastive learning. The results are shown in Table 2, and the specific analysis is as follows:

[0057] (a) Edge removal and iterative strategy. CVGAD sim Edge removal is performed based on similarity scores from the original features. CVGAD oreAchieving non-iterative edge removal. Experimental results show that the performance of the present invention is superior to the other three models. First, it proves that the performance of the present invention is superior to similarity-based methods. Edges with low similarity are not necessarily interfering edges. Incorrectly deleting normal edges will destroy the original topology of the graph, thereby reducing the effectiveness of detection. In addition, the results also verify that iterative edge removal is more effective than single edge removal. This is because single edge removal methods may be susceptible to the influence of interfering edges, which hinders the identification of anomalous nodes and interfering edges. This interference continues to affect the training process of instance pairs and reduce the overall accuracy. The iterative process in the present invention allows a small portion of edges to be removed in each round, gradually refining the graph while preserving normal patterns. This method produces a synergistic effect between multi-scale anomaly detection and progressive cleanup, thereby improving the overall performance. (b) Multi-view strategy. CVGAD bano and CVGAD bcla The module performs RWR on two baseline anomaly maps and two coarse clean maps, respectively. CVGAD ocla Random walks are performed only on the coarse clean graph. Results show that random walks on both views (the coarse clean graph and the baseline anomaly graph) yield better performance. By performing random walks on the coarse clean graph, sampling of interfering edges is avoided, thus enhancing the similarity between nodes and their subgraphs. This improves the effectiveness of the contrastive learning process. On the other hand, performing random walks on the baseline anomaly graph helps the model learn diverse and informative features. (c) Multi-score integration strategy. CVGAD con The score is determined solely by the node comparison score. The results show that the combined score performs better. This is because nodes connected to interference edges are more likely to exhibit anomalies. The detection score can more finely distinguish the degree of anomaly.

[0058] (7) Parameter analysis. Equilibrium parameters α and β This invention investigates view balance parameters. α With scale balance parameters β The impact, such as Figure 2 As shown, where, Figure 2 (a) and Figure 2 (b) shows the balance parameter analysis plots for scale and view in the Citeseer and Citation datasets, respectively. As can be seen from the plots, Figure 2 (a) and Figure 2 The performance of (b) shows an initial upward trend followed by a downward trend. Other datasets exhibit the same phenomenon. This demonstrates that multi-scale learning and multi-view training outperform other methods. Based on the results, this invention will... αThe values ​​for Cora, Citeseer, DBLP, Citation, and ACM were set to 0.8, 0.4, 0.4, 0.4, and 0.6, respectively. Meanwhile, this invention was applied to these datasets... β The values ​​are set to 0.6, 0.6, 0.4, 0.6, and 0.6.

[0059] Figure 3 The curve represents the impact of the percentage K on detection performance. K ranges from 0.005 to 0.02 in increments of 0.005. As the edge removal rate increases, the curve first rises and then falls. This indicates that removing interfering edges can improve model performance, while removing too many interfering edges can disrupt the original topology of the graph, thus negatively impacting performance. Based on the results, this invention sets K to 0.01 for Cora, Citeseer, and Citation, while for DBLP and ACM, K is set to 0.015.

[0060] (8) Accuracy of different edge removal methods. RGSE detects abnormal links. This invention records the proportion of interference edges removed in each iteration. For CVGAD sim and CVGAD gcn This invention selects the edge with the lowest score and records the accuracy. For CVGAD... rgse This invention removes edges with higher scores while maintaining the same proportions as other methods. Figure 4 The graph shows the accuracy analysis of interference edge removal for different models. Figure 4 (a) and Figure 4 Figure (b) shows the edge removal accuracy analysis of this invention on the Cora and ACM datasets, respectively. As can be seen from the figures, this invention exhibits significantly superior edge removal accuracy. This is because this invention effectively integrates feature information and graph structure to identify interfering edges. In contrast, CVGAD... sim Focusing only on feature-level information, while CVGAD gcn Smoothing outlier signals. RGSE primarily identifies long-path links, hub links, and adversarial links. In the dataset of this invention, interfering edges often appear in clusters, which limits RGSE's ability to effectively identify them.

[0061] The above embodiments are merely preferred embodiments of the present invention, and the scope of protection of the present invention is not limited thereto. Any simple changes or equivalent substitutions of the technical solutions that can be obviously obtained by those skilled in the art within the scope of the technology disclosed in the present invention shall fall within the scope of protection of the present invention.

Claims

1. A method for detecting anomalies in graph data, characterized in that, Includes the following steps: Obtain the anomaly graph to be cleaned and the baseline anomaly graph from the academic paper citation relationship graph data; where each node in the academic paper citation relationship graph data represents a paper, the edges represent the citation relationship between papers, the citation relationship in the anomaly graph contains abnormal citation relationships, and the nodes in the anomaly graph contain abnormal paper characteristics; The anomaly detection model is trained by simultaneously inputting the anomaly graph to be cleaned and the benchmark anomaly graph. Specifically, the anomaly detection model performs random walks on both the anomaly graph to be cleaned and the benchmark anomaly graph, extracting subgraphs of nodes from both graphs. A node and its own subgraph form a first positive instance pair, and the subgraphs of other nodes form a first negative instance pair. A node and its updated node representation in a subgraph form a second positive instance pair, and the updated node representations of other subgraphs form a second negative instance pair. The anomaly detection model is trained based on the similarity scores of the first positive instance pair, the first negative instance pair, the second positive instance pair, and the second negative instance pair between the anomaly graph to be cleaned and the benchmark anomaly graph. The trained anomaly detection model is used to obtain the difference between the similarity scores of the first negative instance pair and the first positive instance pair in the benchmark anomaly graph, and the difference between the similarity scores of the second negative instance pair and the second positive instance pair. The node comparison score is calculated based on the difference. The edge interference score of the abnormal graph to be cleaned is calculated by comparing the node scores. The edge interference scores are sorted, and the top K edges after sorting are identified as interference edges and deleted to obtain a rough clean graph. The rough clean graph and the baseline anomaly graph are simultaneously input into the anomaly detection model. The training process of the anomaly detection model, the node comparison score calculation process, and the interference edge deletion process are repeatedly iterated until the number of deleted interference edges reaches a set threshold, thus obtaining a clean graph of the target academic paper citation relationship.

2. The graph data anomaly detection method according to claim 1, characterized in that, The method of using the trained anomaly detection model to obtain the difference between the similarity scores of the first negative instance pair and the first positive instance pair in the benchmark anomaly graph, and the difference between the similarity scores of the second negative instance pair and the second positive instance pair, and calculating the node comparison score based on the differences, specifically: determining the anomaly score of the subgraph and node comparison scale based on the difference between the similarity scores of the first negative instance pair and the first positive instance pair in the benchmark anomaly graph; determining the anomaly score of the node-to-node comparison scale based on the difference between the similarity scores of the second negative instance pair and the second positive instance pair in the benchmark anomaly graph; and calculating the node comparison score using the anomaly scores of the subgraph-to-node comparison scale and the node-to-node comparison scale.

3. The graph data anomaly detection method according to claim 2, characterized in that, The calculation of the node comparison score by comparing the subgraph with the node scale and the abnormal scores of comparing nodes with each other specifically involves: weighting and summing the abnormal scores of comparing the subgraph with the node scale and the abnormal scores of comparing nodes with each other to obtain the node comparison score.

4. The graph data anomaly detection method according to claim 1, characterized in that, The node comparison score is obtained using the following formula: ， In the formula, Indicates the first r The comparison scores of the round nodes, This represents the mean of the comparison scores for each node. R Represents the total number of rounds.

5. The graph data anomaly detection method according to claim 1, characterized in that, The process involves simultaneously inputting the anomaly image to be cleaned and the baseline anomaly image into the anomaly detection model for training. The loss function used in training the anomaly detection model is as follows: ， In the formula, This represents the comparison loss between nodes in the baseline anomaly graph and the subgraph. This represents the comparison loss between nodes and subgraphs in the roughly clean graph. This represents the comparison loss between nodes in the baseline anomaly graph. This represents the comparison loss between nodes in a roughly clean graph. α and β These represent the balance parameters for different views and scales, respectively.

6. A graph data processing system, characterized in that, include: The model training module is used to obtain the anomaly graph to be cleaned and the baseline anomaly graph from the academic paper citation relationship graph data. Each node in the academic paper citation relationship graph data represents a paper, and the edges represent the citation relationships between papers. The anomaly graph shows abnormal citation relationships, and the nodes in the anomaly graph contain features of abnormal papers. The anomaly detection model is trained by simultaneously inputting the anomaly graph to be cleaned and the baseline anomaly graph. Specifically, the anomaly detection model performs random walks on both the anomaly graph to be cleaned and the baseline anomaly graph, extracting subgraphs of nodes from both graphs. A node and its own subgraph form a first positive instance pair, and the subgraphs of other nodes form a first negative instance pair. A node and the updated node representation in its subgraph form a second positive instance pair, and the updated node representations of other subgraphs form a second negative instance pair. The anomaly detection model is trained based on the similarity scores of the first positive instance pair, the first negative instance pair, the second positive instance pair, and the second negative instance pair between the anomaly graph to be cleaned and the baseline anomaly graph. The node comparison score acquisition module is used to obtain the difference between the similarity score of the first negative instance pair and the similarity score of the first positive instance pair and the similarity score of the second negative instance pair and the similarity score of the second positive instance pair in the benchmark anomaly map using the trained anomaly detection model, and to calculate the node comparison score based on the difference. The interference edge removal module is used to calculate the edge interference score of the abnormal graph to be cleaned by comparing the node scores, sort the edge interference scores, identify the top K edges after sorting as interference edges, and delete the interference edges to obtain a rough clean graph. The target clean graph acquisition module is used to simultaneously input the coarse clean graph and the baseline anomaly graph into the anomaly detection model, and repeatedly iterate the training process of the anomaly detection model, the node comparison score calculation process, and the interference edge deletion process until the number of deleted interference edges reaches a set threshold, thereby obtaining a clean graph of the target academic paper citation relationship.

7. A computer device, characterized in that, It includes a memory and a processor; the memory stores a computer program, and the processor is used to run the computer program in the memory to perform the graph data anomaly detection method according to any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted for loading by a processor to execute the graph data anomaly detection method according to any one of claims 1-5.

Images