Graph anomaly detection method based on low-rank contrastive learning and reconstruction

Abstract

The application discloses an abnormality detection method based on low-rank contrast and reconstruction, comprising the following steps: 1) performing SVD dimension reduction on original graph data to generate a low-rank view, performing subgraph sampling on the original view and the low-rank view, and obtaining original and low-rank subgraphs; 2) constructing positive and negative sample pairs on the two views respectively, and performing contrast learning; 3) performing reconstruction learning on the two views respectively; 4) integrating contrast learning and reconstruction learning to train a model; and 5) using the trained model to perform abnormality discrimination on nodes. The application proposes a graph abnormality detection method based on low-rank contrast learning and reconstruction, low-rank approximation is performed on node attributes and topological structures to generate a low-rank view, and on the basis of retaining the original structure of the graph, the interference of abnormal nodes and noises is effectively filtered.

Description

Technical Field

[0001] This invention relates to the technical field of graph anomaly detection and graph contrastive learning, and in particular to a graph anomaly detection method based on low-rank contrastive learning and reconstruction. Background Technology

[0002] Graph anomaly detection (GAD) aims to identify patterns that significantly deviate from normal patterns in graph-structured data. Node-level detection is the most common approach because it is suitable for entity-based anomaly assessment. Due to the unstructured and complex nature of graphs, node anomalies can be categorized into topological anomalies and attribute anomalies: topological anomalies refer to errors in node connections, while attribute anomalies indicate damage to the intrinsic features of nodes. Early unsupervised GAD methods, such as residual analysis and CUR decomposition, provided metric-based anomaly quantification but often neglected the interdependencies between nodes. The emergence of graph neural networks has facilitated the development of self-supervised methods, where graph autoencoders utilize reconstruction errors to detect anomalies.

[0003] Contrastive learning is employed to improve discriminative power by measuring the consistency between nodes and their contextual neighborhoods. Extensions such as multi-scale contrastive learning further enrich representation learning using graph diffusion or edge modification. While graph contrastive learning-based GAD methods are effective, they also have inherent limitations: i) Inherent anomalies in the graph can cause some GAD methods to inadvertently select anomalous nodes, resulting in unreliable pairs that propagate anomalies during GCN encoding. This undermines the effectiveness of GAD, as it heavily relies on high-quality positive-negative pairs. ii) Random augmentations used for view generation introduce external noise and often fail to preserve the semantic structure of the graph, further degrading GAD performance. Low-rank approximation, a core technique in signal processing for dimensionality reduction and noise suppression, has been applied to GNNs to handle graph-structured data. However, the potential of GAD has not been fully explored. To mitigate these drawbacks, we shift from local and random contrastive learning to global and semantically aware learning, proposing a low-rank contrastive learning and reconstruction method for GAD. In this method, low-rank approximations are performed on node attributes and topology to generate a global low-rank view. This effectively filters out anomalies and noise while incorporating global information into the graph contrastive learning process. Furthermore, the multi-view comparison learning and reconstruction module is designed based on low-rank prior knowledge. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings and deficiencies of existing graph contrastive learning anomaly detection schemes. It proposes a graph anomaly detection method based on low-rank contrastive learning and reconstruction. By performing low-rank approximation on node attributes and topology to generate a low-rank view, it effectively filters out abnormal nodes and noise interference while preserving the original graph structure.

[0005] To achieve the above objectives, the technical solution provided by this invention is: a graph anomaly detection method based on low-rank contrastive learning and reconstruction, comprising the following steps:

[0006] 1) Low-rank view generation and subgraph sampling: Obtain graph data, generate a low-rank view by dimensionality reduction through SVD singular value decomposition, and then perform RWR random walk for subgraph sampling.

[0007] 2) Low-rank contrastive learning: Contrast pairs are constructed on the original subgraph and the low-rank subgraph for contrastive learning.

[0008] 3) Low-rank attribute reconstruction: Low-rank attribute reconstruction is performed on the original subgraph and the low-rank subgraph.

[0009] 4) Model training: Train the graph neural network model by combining contrastive loss and reconstruction loss.

[0010] 5) Anomaly score discrimination: Based on the trained graph model, nodes are discriminated against to identify potential abnormal nodes.

[0011] 6) Aggregation result verification and mask removal: Each requester verifies the correctness of the masked aggregation result received from the perception platform, removes the mask, and obtains the task result.

[0012] In step 1), the detailed process of low-rank view generation and subgraph sampling is as follows:

[0013] 1.1) Obtaining Graph Data: The graph is represented in the following form: , including nodes ,in It is a node attribute matrix, where It is the set of real numbers. It is the number of nodes in the graph. It is a data dimension. It is an adjacency matrix. Represents a node and nodes There is a connecting edge between them. This indicates a node. and nodes There are no connecting edges between them.

[0014] 1.2) SVD Decomposition: First, during the pre-training phase of the graph, random SVD decomposition is applied to the graph. and ,in and It corresponds to a matrix and The left singular matrix, and These are diagonal matrices, with their main diagonal elements representing and The singular values, and and It corresponds to a matrix and The right singular matrix is ​​obtained; then, the first r singular values ​​are retained to obtain the reconstructed node attributes. and adjacency matrix ,Right now and ,here and These represent the number of singular values, and yes and The low-rank approximation of , where and .

[0015] 1.3) Subgraph Sampling: The Restarted Random Walk (RWR) method is used to extract subgraphs from the original view and the low-rank view respectively. For each node... Sample a size of The subgraph, i.e., the original subgraph and low-rank subgraphs .

[0016] In step 2), the detailed process of low-rank contrastive learning is as follows:

[0017] 2.1) Constructing the inter-view contrast loss: First, the target node... Corresponding original subgraph and low-rank subgraphs The input is fed into a single GCN layer to obtain the embedding: and ,here It is a learnable weight matrix. and Represents the target node in the two subgraphs. The feature attributes are masked, i.e., their values ​​are set to zero; then, the average is read out to obtain the final representation of the two subgraphs. and ,here and These represent the subgraph embeddings of the original subgraph and the low-rank subgraph, respectively. This represents the number of nodes in the subgraph; next, the nodes are mapped to the same space embedded in the subgraph using an MLP, i.e. and ,here and Representing the target node respectively The attributes of the original subgraph and the low-rank subgraph are analyzed; then, the sigmoid function is used in the discriminator to obtain the similarity score between the target node and its corresponding subgraph embeddings in the two views: and ,here It is the sigmoid function. The weight parameters corresponding to the discriminator; following the concept of contrastive learning, the similarity scores between the two views. and It should be a better match, which can be expressed as: ,here This is represented as the Frobenius paradigm.

[0018] 2.2) Constructing In-View Contrast Loss: First, construct the contrast pairs needed for contrastive learning, i.e., the target nodes. The target node and its sampled subgraphs constitute positive sample pairs, while the target node and another node in the same batch... The sampled subgraphs form negative sample pairs; then, the similarity scores of the positive and negative pairs are calculated separately in the low-rank view, i.e.: and ,here, It should be close to 1. Approaching 0, we then use BCE loss to train this contrastive module, i.e. Similarly, a similarity score can also be obtained from the original view. and Thus, the BCE loss of the original view is obtained, i.e. Next, calculate the final node-subgraph contrast loss: ,here It is a parameter that controls the weights of the two views.

[0019] 2.3) Integrating Contrast Learning Loss: Integrating the contrast losses between views and within views, summing them up, i.e.: .

[0020] In step 3), the detailed process of low-rank attribute reconstruction is as follows:

[0021] 3.1) Calculate the reconstruction loss of the original view and the reconstruction loss of the low-rank view, i.e. and ,here and They are and The series combination of adjacent nodes embedded in the middle It is an MLP.

[0022] 3.2) Obtain the final dual-view reconstruction loss. .

[0023] In step 4), the detailed process of model training is as follows:

[0024] 4.1) First, by combining the reconstruction loss and the contrastive loss, the final loss function is obtained. , among which is Balance the parameters of these two parts; finally, use this part of the loss to train the graph neural network model.

[0025] In step 5), the detailed process of anomaly score discrimination is as follows:

[0026] 5.1) First, calculate the anomaly score for low-rank contrastive learning, which is the similarity difference between negative and positive sample pairs. ,here The higher the score, the more abnormal the node is, and then the same abnormality score is obtained from the original view comparison learning. Finally, the outlier scores for the contrastive learning component were obtained. .

[0027] 5.2) Calculate the reconstruction anomaly score of the low-rank view. ,here The higher the score, the more abnormal the node is, and the reconstruction anomaly score of the original view is obtained in the same way. Finally, the final anomaly score of the low-rank attribute reconstruction is obtained. .

[0028] 5.3) Integrate the anomaly scores from the two parts to obtain the final anomaly score for the node. Here, the higher the score, the more abnormal the node, thus detecting abnormal nodes.

[0029] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0030] 1. This invention introduces low-rank approximation into graph anomaly detection for the first time, proposes a graph anomaly detection framework, and ensures the correctness of graph anomaly detection.

[0031] 2. This invention generates a low-rank global view by reducing the rank of feature attributes and topology, and designs a low-rank attribute reconstruction module as an aid, thus ensuring the robustness of graph anomaly detection.

[0032] 3. This invention realizes low-rank-based contrastive learning and reconstruction, verifies the effectiveness of the low-rank contrastive learning and reconstruction strategy, and ensures the superiority of this method for graph anomaly detection. Attached Figure Description

[0033] Figure 1 This is a schematic diagram of the logic flow of the present invention.

[0034] Figure 2 This is a framework diagram of the present invention. Detailed Implementation

[0035] The present invention will be further described below with reference to specific embodiments.

[0036] The graph anomaly detection method based on low-rank contrastive learning and reconstruction provided in this embodiment introduces a low-rank view, avoiding the noise introduced by conventional contrastive learning random augmentation methods. While preserving the inherent information of the graph, it establishes a cleaner, lower-rank view. The low-ranked nodes guide attribute reconstruction and identify nodes with significant reconstruction errors.

[0037] like Figure 1 As shown, firstly, the required graph data is obtained, including the node feature matrix and adjacency matrix. Then, the input graph data is decomposed using SVD, and the desired features and the rank of the topology are selected to obtain a low-ranked view. Next, a random walk (RWR) is performed simultaneously on both the original view and the low-ranked view to generate subgraphs. The parameters can be adjusted here. The size of the subgraph is used as the basis for the comparison learning loss. Next, positive and negative sample pairs are constructed on both views: the sampled subgraphs of the target node and the target node form a positive sample pair, and the sampled subgraph of the other node forms a negative sample pair. Then, reconstruction learning is performed on both views, using the distance between the node's original attribute features and the concatenated adjacent embeddings after the GCN layer as the reconstruction learning loss. Finally, the comparison loss and reconstruction loss are integrated by a single parameter, and the model is trained using this loss. Finally, the fully trained model is used to predict the node's anomaly score.

[0038] Figure 2 The framework diagram of the present invention is shown. The above-mentioned graph anomaly detection method based on low-rank contrastive learning and reconstruction includes the following steps:

[0039] Step 1), the detailed process of low-rank view generation and subgraph sampling is as follows:

[0040] 1.1) Obtaining Graph Data: The graph is represented in the following form: , including nodes ,in It is a node attribute matrix, where It is the set of real numbers. It is the number of nodes in the graph. It is a data dimension. It is an adjacency matrix. Represents a node and nodes There is a connecting edge between them. This indicates a node. and nodes There are no connecting edges between them.

[0041] 1.2) SVD Decomposition: First, during the pre-training phase of the graph, random SVD decomposition is applied to the graph. and ,in and It corresponds to a matrix and The left singular matrix, and These are diagonal matrices, with their main diagonal elements representing and The singular values, and and It corresponds to a matrix and The right singular matrix is ​​obtained; then, the first r singular values ​​are retained to obtain the reconstructed node attributes. and adjacency matrix ,Right now and ,here and These represent the number of singular values, and yes and The low-rank approximation of , where and .

[0042] 1.3) Subgraph Sampling: The Restarted Random Walk (RWR) method is used to extract subgraphs from the original view and the low-rank view respectively. For each node... Sample a size of The subgraph, i.e., the original subgraph and low-rank subgraphs ;

[0043] Step 2), the detailed process of low-rank contrastive learning is as follows:

[0044] 2.1) Constructing the inter-view contrast loss: First, the target node... Corresponding original subgraph and low-rank subgraphs The input is fed into a single GCN layer to obtain the embedding: and ,here It is a learnable weight matrix. and Represents the target node in the two subgraphs. The feature attributes are masked, i.e., their values ​​are set to zero; then, the average is read out to obtain the final representation of the two subgraphs. and ,here and These represent the subgraph embeddings of the original subgraph and the low-rank subgraph, respectively. This represents the number of nodes in the subgraph; next, the nodes are mapped to the same space embedded in the subgraph using an MLP, i.e. and ,here and Representing the target node respectively The attributes of the original subgraph and the low-rank subgraph are analyzed; then, the sigmoid function is used in the discriminator to obtain the similarity score between the target node and its corresponding subgraph embeddings in the two views: and ,here It is the sigmoid function. The weight parameters corresponding to the discriminator; following the concept of contrastive learning, the similarity scores between the two views. and It should be a better match, which can be expressed as: ,here This is represented as the Frobenius paradigm.

[0045] 2.2) Constructing In-View Contrast Loss: First, construct the contrast pairs needed for contrastive learning, i.e., the target nodes. The target node and its sampled subgraphs constitute positive sample pairs, while the target node and another node in the same batch... The sampled subgraphs form negative sample pairs; then, the similarity scores of the positive and negative pairs are calculated separately in the low-rank view, i.e.: and ,here, It should be close to 1. Approaching 0, we then use BCE loss to train this contrastive module, i.e. Similarly, a similarity score can also be obtained from the original view. and Thus, the BCE loss of the original view is obtained, i.e. Next, calculate the final node-subgraph contrast loss: ,here It is a parameter that controls the weights of the two views.

[0046] 2.3) Integrating Contrast Learning Loss: Integrating the contrast losses between views and within views, summing them up, i.e.: .

[0047] Step 3), the detailed process of low-rank attribute reconstruction is as follows:

[0048] 3.1) Calculate the reconstruction loss of the original view and the reconstruction loss of the low-rank view, i.e. and ,here and They are and The series combination of adjacent nodes embedded in the middle It is an MLP.

[0049] 3.2) Obtain the final dual-view reconstruction loss. .

[0050] Step 4), the detailed process of model training is as follows:

[0051] 4.1) First, by combining the reconstruction loss and the contrastive loss, the final loss function is obtained. ,in These are the parameters that balance these two parts; finally, this part of the loss is used to train the graphical neural network model.

[0052] Step 5), the detailed process of abnormal score identification is as follows:

[0053] 5.1) First, calculate the anomaly score for low-rank contrastive learning, which is the similarity difference between negative and positive sample pairs. ,here The higher the score, the more abnormal the node is, and then the same abnormality score is obtained from the original view comparison learning. Finally, the outlier scores for the contrastive learning component were obtained. .

[0054] 5.2) Calculate the reconstruction anomaly score of the low-rank view. ,here The higher the score, the more abnormal the node is, and the reconstruction anomaly score of the original view is obtained in the same way. Finally, the final anomaly score of the low-rank attribute reconstruction is obtained. .

[0055] 5.3) Integrate the anomaly scores from the two parts to obtain the final anomaly score for the node. Here, the higher the score, the more abnormal the node, thus detecting abnormal nodes.

Claims

1. A graph anomaly detection method based on low-rank contrastive learning and reconstruction, characterized in that, Includes the following steps: 1) Low-rank view generation and subgraph sampling: Acquire graph data and generate a low-rank view through dimensionality reduction using Singular Value Decomposition (SVD), then perform RWR random walk for subgraph sampling. 2) Low-rank contrastive learning: Construct contrastive pairs on the original subgraph and the low-rank subgraph for contrastive learning. 3) Low-rank attribute reconstruction: Reconstruct low-rank attributes on the original subgraph and the low-rank subgraph. 4) Model training: Train a graph neural network model using contrastive loss and reconstruction loss. 5) Anomaly score discrimination: Distinguish potential anomalous nodes based on the trained graph model.

2. The graph anomaly detection method based on low-rank contrastive learning and reconstruction according to claim 1, characterized in that: In step 1), the detailed process of low-rank view generation and subgraph sampling is as follows: a) Obtaining graph data: The graph is represented in the form of... , including nodes ,in It is a node attribute matrix, where It is the set of real numbers. It is the number of nodes in the graph. It is a data dimension. It is an adjacency matrix. Represents a node and nodes There is a connecting edge between them. This indicates a node. and nodes There are no connecting edges between them. b) SVD decomposition: First, during the pre-training phase of the graph, random SVD decomposition is applied to the graph. and ,in and It corresponds to a matrix and The left singular matrix, and These are diagonal matrices, with their main diagonal elements representing and The singular values, and and It corresponds to a matrix and The right singular matrix is ​​obtained; then, the first r singular values ​​are retained to obtain the reconstructed node attributes. and adjacency matrix ,Right now and ,here and These represent the number of singular values, and yes and The low-rank approximation of , where and c) Subgraph Sampling: A Restarted Random Walk (RWR) method is used to extract subgraphs from both the original view and the low-rank view. For each node... Sample a size of The subgraph, i.e., the original subgraph and low-rank subgraphs .

3. The graph anomaly detection method based on low-rank contrastive learning and reconstruction according to claim 1, characterized in that: In step 2), the detailed process of low-rank contrastive learning is as follows: a) Constructing the inter-view contrastive loss: First, the target node... Corresponding original subgraph and low-rank subgraphs The input is fed into a single GCN layer to obtain the embedding: and ,here It is a learnable weight matrix. and Represents the target node in the two subgraphs. The feature attributes are masked, i.e., their values ​​are set to zero; then, the average is read out to obtain the final representation of the two subgraphs. and ,here and These represent the subgraph embeddings of the original subgraph and the low-rank subgraph, respectively. This represents the number of nodes in the subgraph; next, the nodes are mapped to the same space embedded in the subgraph using an MLP, i.e. and ,here and Representing the target node respectively The attributes of the original subgraph and the low-rank subgraph are analyzed; then, the sigmoid function is used in the discriminator to obtain the similarity score between the target node and its corresponding subgraph embeddings in the two views: and ,here It is the sigmoid function. The weight parameters corresponding to the discriminator; following the concept of contrastive learning, the similarity scores between the two views. and It should be a better match, which can be expressed as: ,here This is represented by the Frobenius paradigm. b) Constructing the in-view contrastive loss: First, construct the contrast pairs needed for contrastive learning, i.e., the target nodes. The target node and its sampled subgraphs constitute positive sample pairs, while the target node and another node in the same batch... The sampled subgraphs form negative sample pairs; then, the similarity scores of the positive and negative pairs are calculated separately in the low-rank view, i.e.: and ,here, It should be close to 1. Approaching 0, we then use BCE loss to train this contrastive module, i.e. Similarly, a similarity score can also be obtained from the original view. and Thus, the BCE loss of the original view is obtained, i.e. Next, calculate the final node-subgraph contrast loss: ,here These are parameters that control the weights of the two views. c) Integrating contrastive learning loss: Integrating the contrastive losses between and within views, summing them together, i.e.: .

4. The graph anomaly detection method based on low-rank contrastive learning and reconstruction according to claim 1, characterized in that: In step 3), low-rank attribute reconstruction includes the following steps: a) calculating the reconstruction loss of the original view and the reconstruction loss of the low-rank view, i.e. and ,here and They are and The series combination of adjacent nodes embedded in the middle It is an MLP. b) Obtain the final dual-view reconstruction loss. .

5. The graph anomaly detection method based on low-rank contrastive learning and reconstruction according to claim 1, characterized in that: In step 4), model training includes the following steps: a) First, combining reconstruction loss and contrastive loss to obtain the final loss function. , among which is Balance the parameters of these two parts; finally, use this part of the loss to train the graph neural network model.

6. The graph anomaly detection method based on low-rank contrastive learning and reconstruction according to claim 1, characterized in that: In step 5), the anomaly score discrimination includes the following steps: a) First, calculate the anomaly score of low-rank contrastive learning, i.e., the similarity difference between negative sample pairs and positive sample pairs. ,here The higher the score, the more abnormal the node is, and then the same abnormality score is obtained from the original view comparison learning. Finally, the outlier scores for the contrastive learning component were obtained. b) Calculate the reconstruction anomaly score for the low-rank view. ,here The higher the score, the more abnormal the node is, and the reconstruction anomaly score of the original view is obtained in the same way. Finally, the final anomaly score of the low-rank attribute reconstruction is obtained. c) Integrate the anomaly scores from both parts to obtain the final anomaly score for each node. Here, the higher the score, the more abnormal the node, thus detecting abnormal nodes.

Images