A Subgraph-Level Supervised Node Anomaly Estimation Method and System Based on Multi-Instance Learning

Abstract

This invention discloses a method and system for node anomaly estimation under subgraph-level supervision based on multi-instance learning. The invention includes: converting nodes in the input graph into information embeddings and performing feature processing on the embedded information; performing local convolution on the neighborhood surrounding a specified node and preserving the node's attributes and topological semantics by maximizing graph mutual information; defining a score estimator to calculate the anomaly score for each node; guiding the score estimator to generate correct anomaly scores through a designed loss function, including inter-bag loss, intra-bag loss, sparsity constraint, and homogeneity constraint; analyzing the node scores of normal and anomalous subgraphs during training, selecting subgraphs more likely to contain anomalies from the unlabeled node space to generate pseudo-labels, obtaining more coarse-grained subgraph-level labels; and modeling the score difference between normal and anomalous instances through learning, using this model to identify node-level anomalies.

Description

Technical Field

[0001] This invention belongs to the field of anomaly estimation technology under imprecise subgraph-level supervision, and specifically relates to a method and system for node anomaly estimation under subgraph-level supervision based on multi-instance learning. Background Technology

[0002] Preventing harmful incidents in network activities is a fundamental task of network security management, a key prerequisite for improving the intelligence level of cyberspace governance and promoting the construction of information security systems, and an important support for conducting network risk monitoring, early warning, analysis, and implementing precise security protection. In detection scenarios, regulatory agencies need to analyze data and provide risk warnings as quickly as possible. Due to the diversity and complexity of anomalies, accurate node-level labeling requires sufficient prior knowledge and detailed, step-by-step analysis, which is inevitably time-consuming and labor-intensive. In contrast, regulatory agencies can more easily and with less effort screen out areas that may cover anomalies. Existing methods cannot capture the topological structure between instances and cannot directly detect fine-grained node anomalies. With the continuous growth of network data types and the increasing complexity of data, how to mitigate the negative impact of coarse-grained labels and convert subgraph labels into node-level constraints to capture underlying anomaly patterns by modeling differences between subgraphs has become an urgent problem to be solved. This is of great significance for quickly identifying and stopping harmful behaviors in the network in a timely manner, while accurately locating anomalous nodes.

[0003] Currently, there are no relevant studies that propose solutions for node anomaly estimation based on multi-instance learning under subgraph-level supervision of graph data. The main invention patents related to weakly supervised anomaly detection include: Reference 1: A weakly supervised anomaly detection method combining multi-scale feature fusion and multiple attention methods (202210902622.8) Reference 2: A weakly supervised anomaly detection method and system based on knowledge data alignment (202410748493.0) Reference 1 proposes a weakly supervised anomaly detection method that combines multi-scale feature fusion and multiple attention mechanisms. It utilizes the multi-scale features of the video and an attention mechanism to obtain information between video segments, uses a fully connected layer to output anomaly scores, constructs a loss function based on the anomaly scores, and detects anomalies in segments under video tags through the anomaly scores.

[0004] Reference 2 designs a weakly supervised anomaly detection method and system based on knowledge data alignment. It uses optimal transmission technology to calculate the optimal transmission distance between data representation and knowledge representation and determines the additional loss. It combines regression loss to form a target loss function to obtain a target anomaly detection model, and uses this model to detect anomalies in the data to be detected.

[0005] None of the aforementioned technical solutions can capture the topological relationships between instances in graph data. Furthermore, most solutions focus on packet-level prediction rather than intra-packet instance prediction. However, in reality, regulatory agencies need to analyze data and react quickly, but due to the complexity and diversity of anomalous instances, they can spend less time and effort marking potentially anomalous areas to avoid wasting time and resources. Therefore, how to accurately identify node-level anomalies using only imprecise subgraph-level supervision has become a pressing problem. Summary of the Invention

[0006] This invention proposes a node anomaly estimation method and system based on multi-instance learning and subgraph-level supervision. First, the nodes in the input graph are mapped to low-dimensional information embedding representations, and the embedded features are subjected to unified feature transformation and processing. Then, graph convolution operations are performed on the local neighborhood structure of the target nodes, and the attribute information and topological semantic relationships of the nodes are fully preserved by maximizing graph mutual information. Based on this, a node anomaly score estimator is constructed to quantitatively evaluate the anomaly degree of each node in the graph. To guide the score estimator in learning reasonable anomaly representations, a comprehensive loss function is designed, including inter-bag loss and intra-bag loss, to characterize the discriminativeness of node anomaly distributions between different subgraphs and within subgraphs. Simultaneously, sparsity constraints and homogeneity constraints are introduced to enhance the discriminativeness and structural consistency of anomaly node distributions. Furthermore, by analyzing the statistical characteristics of node scores in normal and anomaly subgraphs during training, subgraphs more likely to contain anomalies are selected from the unlabeled node space and pseudo-labels are generated, thereby obtaining more coarse-grained subgraph-level supervision information. Ultimately, by modeling the score differences between normal and abnormal instances, accurate identification of node-level anomalies is achieved.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: Subgraph-level supervised node anomaly estimation methods based on multi-instance learning include: 1) Processing node information in the graph A general graph neural network is used as a graph encoder to learn the representation of nodes in the input graph and map the nodes into information embedding representations to support quantitative anomaly assessment. The information embedding is projected to another feature space through a nonlinear mapping layer to obtain the node feature vectors. 2) Maximizing graph mutual information Graph mutual information is obtained by calculating the mutual information between the transformed feature vector and the node vector, the mutual information between the feature vector and the neighbor node vector, and the mutual information between the similarity weight of the node and the corresponding adjacency value. Semantic information in the graph is captured to obtain node representation, and the graph mutual information is maximized to guide node feature training. 3) Calculation of node anomaly scores Define a nonlinear layer as a score estimator. Input the node representation into the score estimator to obtain the abnormal score of the node. Abnormal nodes score higher than normal nodes. 4) Construction of loss function An anomaly detection model is constructed, comprising three parts: graph node information processing, maximizing graph mutual information, and calculating node anomaly scores. Multiple constraints are established to guide the training of the anomaly detection model by ranking the anomaly scores of nodes in normal and abnormal subgraphs: an inter-bag loss is formed by widening the score gap between the highest-scoring nodes in normal and abnormal subgraphs; an intra-bag loss is formed by widening the anomaly score difference between high-scoring and low-scoring nodes within the abnormal subgraph; a sparsity constraint is imposed on the overall scale of node anomaly scores in the abnormal subgraph to limit the proportion of abnormal nodes in the subgraph; a homogeneity constraint is introduced by minimizing the difference in anomaly scores between adjacent nodes to maintain consistency in the local structure; and the inter-bag loss, intra-bag loss, sparsity constraint, homogeneity constraint, and objective function that maximizes graph mutual information are jointly optimized to form the final training loss function, which guides the parameter updates of the anomaly detection model. 5) Pseudo-tag generation A candidate subgraph set is constructed by sampling subgraphs that are similar in size to the abnormal subgraph, and the maximum, minimum and average values ​​are used as statistical indicators to perform a coarse-grained evaluation of the difference in node anomaly score distribution between the candidate subgraphs and the abnormal subgraphs. Subgraphs with smaller differences in score distribution from the candidate subgraph set are selected and given pseudo-labels and included in the subsequent training process. 6) Node anomaly identification The trained anomaly detection model is used as a node anomaly detection network to estimate node anomalies in graphs with only subgraph-level labels, and outputs the anomaly scores of nodes in the graph to achieve node anomaly identification.

[0008] A further improvement of this invention is that, in step 1), the node information processing in the graph specifically includes the following steps: Step 1: Create a subgraph Select k real anomalies from the input graph as center nodes, and generate an anomaly subgraph using the RWR algorithm. The random walk and restart probabilities are 15 and 0.2, respectively. Similarly, apply RWR to the unlabeled node set to create a normal subgraph. Step 2: Node Feature Conversion A vanilla 2-layer image encoder is used to transform nodes into informative embeddings, specifically by converting the adjacency matrix of the subgraph. A and attribute matrix X As input, information embedding is obtained. H =GNN( A,X Then the hidden vectorH Characterization is obtained through nonlinear transformation. ,in It is the parameter matrix learned. This represents the ReLU(PReLU) function.

[0009] A further improvement of this invention is that, in step 2), maximizing the mutual information of the graph specifically includes: The mutual information is calculated using the Jensen-Shannon MI estimator, and the steps are as follows: Step 1: Calculate the mutual information of the graphs.

[0010] in, It is a node A computation graph that specifies the computation for a particular node. Perform local convolution on the surrounding area. Representation of node representation Middle node The representation, Representing attribute characteristics X Middle node The attributes, Represents a node Representation and nodes The mutual information values ​​between attribute features, Represents a node The set of neighboring nodes, Represents a node The representation of and its neighboring nodes The mutual information values ​​between attribute features, Represents a node and neighboring nodes The similarity weights, where and They are nodes and nodes In hidden layer vectors H Features on Indicates the inner product. It is the sigmoid activation function. Represents a node and neighboring nodes The adjacency value between nodes, if nodes and If a direct connection exists, then ,otherwise , Represents a node and nodes Similarity weight and Adjacency Value Mutual information values ​​between them; Step 2: Maximize graph mutual information By minimizing on all nodes The learned representation Z preserves the corresponding attributes and topological semantics of the nodes.

[0011] A further improvement of this invention is that, in step 3), the calculation of the node anomaly score specifically includes the following steps: Step 1: Constructing the score estimator Define a score estimator to calculate the true outlier score for each node:

[0012] in, It is a trainable score vector. It is a sigmoid activation function, designed to derive reasonable outlier scores within the range (0,1); Step 2: Obtaining Abnormal Scores Represent the obtained nodes The score is fed into the score estimator to obtain the abnormal score of the node, and the abnormal node score should be higher than the normal node score.

[0013] A further improvement of this invention is that, in step 4), the loss function construction specifically includes: training the model by encouraging abnormal scores to be higher than normal node scores, specifically through the following method: Step 1: Bag Loss Design The following loss ranking is designed for the node with the highest score in the subgraph:

[0014] in For the first Group of abnormal subgraphs, For the first Group normal subgraphs, This represents the maximum value operation. Indicates the first The first group of abnormal subgraphs 1 node Indicates its abnormal score, Indicates the first The first normal subgraph of the group 1 node This indicates its abnormal score; Step 2: In-bag loss design The following ranking loss is introduced to further optimize anomaly detection accuracy.

[0015] in Indicates the first Group of abnormal subgraphs, Indicates from A group of scores selected from those below The set of nodes with average anomaly scores. express The 1 node Indicates its abnormal score, express The 1 node This indicates its abnormal score; Step 3: Sparsity Constraints Design for each anomaly subgraph To ensure the sparsity of abnormal nodes; Step 4: Homogeneity Constraints By minimizing the difference in outlier scores between neighboring nodes, i.e. To apply forced constraints to each subgraph, where Subgraph A column vector consisting of the anomaly scores of all nodes in the array. express and The Laplacian matrix; Step 5: Final Loss Function Design By integrating the loss functions from steps 2) and 4), the complete objective function is obtained.

[0016] in The representation loss, i.e., the objective function corresponding to maximizing graph mutual information, is used to optimize the quality of node feature embedding and ensure that node representation can accurately capture the local structure and semantic information of the graph. The balance weight parameter represents the inter-bag loss and is used to measure... The importance of inter-bag loss in the total loss function. Indicates the inter-bag loss, used to quantify the first... The score difference between the highest abnormal score node in the abnormal subgraph and the normal subgraph guides the model to widen the difference between the two types of subgraphs; The balance weight parameter represents the in-bag loss and is used to measure the in-bag loss. The importance of [the factor] in the total loss function This represents the in-bag loss, used to quantify the difference between high-abnormality score nodes and below-average abnormality score nodes within the abnormal subgraph, thereby optimizing the differentiation effect of abnormal nodes within the abnormal subgraph. The balance weight parameter represents the sparsity constraint and is used to measure the sparsity loss. The importance of [the factor] in the total loss function This represents the sparsity loss, used to constrain the overall scale of the outlier scores of nodes within the outlier subgraph, ensuring the sparsity of outlier nodes. The balance weight parameter represents the homogeneity constraint and is used to measure the homogeneity constraint. The importance of [the factor] in the total loss function The loss function represents the homogeneity constraint, used to quantify the difference in outlier scores between adjacent nodes within a subgraph, ensuring the consistency of the subgraph's local structure; the final objective function... Under the guidance of subgraph-level weak supervision, the score gap between normal and abnormal instances is modeled to identify node-level anomalies.

[0017] A further improvement of this invention is that, in step 5), the pseudo-label generation includes: selecting anomaly subgraphs from a space containing huge unlabeled nodes to generate pseudo-labels, specifically through the following steps: Step 1: Sampling candidate sub-map sets By analyzing the node scores of normal and abnormal subgraphs during the evaluation training process, and based on the significant distribution differences between normal and abnormal subgraphs, a candidate subgraph set is formed by first sampling subgraphs of similar scale to the labeled abnormal subgraphs from the unlabeled subgraph set. ,in This represents a similar scale subgraph sampled from the pseudo-labeled subgraph set; Step 2: Select appropriate sub-images and add pseudo-labels. The maximum, minimum, and average values ​​are used as indicators to roughly test the difference in score distribution between candidate subplots and labeled samples, as shown in the following formula:

[0018] express The size of the label set; in three statistical indicators. The smaller the differences between samples, the higher the probability that it contains anomalies; select the r candidate subplots with the smallest scores and label them with pseudo-labels to expand the range. Then proceed with the next training; through multiple rounds of iteration, high-confidence training samples are automatically mined from unlabeled data, and then fine-tuned with a set of labeled and pseudo-labeled data to achieve accurate node anomaly detection at a low labeling rate.

[0019] A further improvement of this invention is that, in step 6), the specific steps for node anomaly identification are as follows: Step 1: Generate node scores For an input graph G, its information is processed and then input into a general graph neural network. The trained general graph neural network obtains the predicted score for each node. Step 2: Node Anomaly Detection The node scores input to the general graph neural network are analyzed. For abnormal nodes, the network will output higher scores to predict abnormal nodes in the subgraph.

[0020] A subgraph-level supervised node anomaly estimation system based on multi-instance learning includes: The node information processing unit in the graph uses a general graph neural network as a graph encoder to learn the representation of nodes in the input graph, mapping the nodes into information embedding representations to support quantitative anomaly assessment; the information embedding is projected to another feature space through a nonlinear mapping layer to obtain node feature vectors. The graph mutual information maximization unit obtains graph mutual information by calculating the mutual information between the transformed feature vector and the node vector, the mutual information between the feature vector and the neighbor node vector, and the mutual information between the inner product of the node embedding vector and the node adjacency value. It captures the semantic information in the graph to obtain node representation and maximizes the graph mutual information to guide node feature training. Node anomaly score calculation unit: Define a nonlinear layer as a score estimator. Input the node representation into the score estimator to obtain the anomaly score of the node. The score of anomaly nodes is higher than that of normal nodes. Loss Function Construction Unit: This unit constructs an anomaly detection model comprising three parts: graph node information processing, maximizing graph mutual information, and calculating node anomaly scores. It then ranks the anomaly scores of nodes in normal and abnormal subgraphs and constructs multiple constraints to guide the model's training: In-bag loss is formed by widening the score gap between the highest-scoring nodes in normal and abnormal subgraphs; In-bag loss is formed by widening the anomaly score difference between high-scoring and low-scoring nodes within the abnormal subgraph; Sparsity constraints are applied to the overall scale of anomaly scores in the abnormal subgraphs to limit the proportion of abnormal nodes; Homogeneity constraints are introduced by minimizing the difference in anomaly scores between adjacent nodes to maintain consistency in the local structure; Finally, the in-bag loss, intra-bag loss, sparsity constraints, homogeneity constraints, and the objective function that maximizes graph mutual information are jointly optimized to form the final training loss function, guiding the parameter updates of the anomaly detection model. Pseudo-label generation unit: Constructs a candidate subgraph set by sampling subgraphs that are similar in size to the abnormal subgraph, and simultaneously uses the maximum, minimum and average values ​​as statistical indicators to perform a coarse-grained evaluation of the difference in node anomaly score distribution between the candidate subgraphs and the abnormal subgraphs; Selects subgraphs with small differences in score distribution from the candidate subgraph set and assigns them pseudo-labels, which are then included in the subsequent training process. Node anomaly identification unit: The trained anomaly detection model is used as a node anomaly detection network to estimate node anomalies in graphs with only subgraph-level labels, and outputs the anomaly scores of nodes in the graph to achieve node anomaly identification.

[0021] A further improvement of this invention is that, in the node information processing unit shown in the figure, the node information processing specifically includes the following steps: Step 1: Create a subgraph Select k real anomalies from the input graph as center nodes, and generate an anomaly subgraph using the RWR algorithm. The random walk and restart probabilities are 15 and 0.2, respectively. Similarly, apply RWR to the unlabeled node set to create a normal subgraph. Step 2: Node Feature Conversion A vanilla 2-layer image encoder is used to transform nodes into informative embeddings, specifically by converting the adjacency matrix of the subgraph. A and attribute matrix X As input, information embedding is obtained. H =GNN( A,X Then the hidden vector H Characterization is obtained through nonlinear transformation. ,in It is the parameter matrix learned. This represents the ReLU(PReLU) function.

[0022] A computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the subgraph-level supervised node anomaly estimation method based on multi-instance learning.

[0023] Compared with the prior art, the present invention has at least the following beneficial technical effects: This invention provides a method and system for node anomaly estimation based on subgraph-level supervision using multi-instance learning. It fully utilizes the graph's topological structure and improves upon existing graph node anomaly detection methods by constructing a node-level anomaly detection model based solely on imprecise subgraph-level supervision. Compared to existing technologies, the advantages of this invention are: (1) This invention summarizes the classic multi-instance learning as node anomaly detection on graph data. Unlike existing technologies that are almost entirely guided by grid-like image data and cannot capture the topological relationship between instances and focus on bag-level prediction, this invention can capture the topological relationship between instances and detect node-level anomalies based on only subgraph-level labels.

[0024] (2) The present invention obtains the score of each node in the subgraph by performing node-level modeling on the subgraph, and uses the difference between abnormal subgraph and normal subgraph and the abnormal features to construct inter-bag loss, intra-bag loss, sparsity constraint and homogeneity constraint to deduce the score between abnormal nodes and normal nodes.

[0025] (3) This invention captures basic semantic information from the input graph by maximizing graph mutual information to obtain high-quality node features. The learned features can well preserve the corresponding attributes and topological semantics of the nodes, laying the foundation for accurate anomaly estimation.

[0026] (4) This invention improves the evaluation and detection performance when the labeling rate is low by constructing an adaptive module to generate pseudo-labels. Based on the maximum, minimum and average values ​​as indicators, it selects subgraphs that are more likely to be abnormal from the unlabeled node space, thereby increasing the number of abnormal subgraphs and achieving accurate node anomaly detection under low labeling rate. Attached Figure Description

[0027] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0028] Figure 1 This is a flowchart of the overall framework. Figure 2 This is a flowchart of the node information processing in the diagram; Figure 3 Flowchart for maximizing mutual information; Figure 4 Flowchart for calculating node anomaly scores; Figure 5 Build a flowchart for the loss function; Figure 6 Flowchart for generating pseudo-tags; Figure 7 Flowchart for node anomaly identification; Figure 8 This is a schematic diagram of a learning network for node anomaly scores. Detailed Implementation

[0029] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of the invention. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0030] In the description of this invention, it should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0031] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0032] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0033] The accompanying drawings illustrate various structural schematic diagrams according to embodiments disclosed in this invention. These drawings are not to scale, and some details have been enlarged for clarity, and some details may have been omitted. The shapes of the various regions and layers shown in the drawings, as well as their relative sizes and positional relationships, are merely exemplary and may deviate from reality due to manufacturing tolerances or technical limitations. Furthermore, those skilled in the art can design regions / layers with different shapes, sizes, and relative positions as needed.

[0034] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0035] Example 1 The present invention provides a subgraph-level supervised node anomaly estimation method based on multi-instance learning, including... First, nodes in the input graph are mapped to low-dimensional information embedding representations, and the embedded features undergo unified feature transformation and processing. Then, graph convolution operations are performed on the local neighborhood structure of the target nodes, and graph mutual information is maximized to fully preserve node attribute information and topological semantic relationships. Based on this, a node anomaly score estimator is constructed to quantitatively evaluate the anomaly degree of each node in the graph. To guide the score estimator in learning reasonable anomaly representations, a comprehensive loss function is designed, including inter-bag loss and intra-bag loss, to characterize the discriminativeness of node anomaly distributions between different subgraphs and within subgraphs. Sparsity constraints and homogeneity constraints are also introduced to enhance the discriminativeness and structural consistency of anomaly node distributions. Furthermore, by analyzing the statistical characteristics of node scores in normal and anomaly subgraphs during training, subgraphs more likely to contain anomalies are selected from the unlabeled node space, and pseudo-labels are generated, thereby obtaining more coarse-grained subgraph-level supervision information. Finally, by modeling the score differences between normal and anomaly instances, accurate identification of node-level anomalies is achieved.

[0036] Specifically, the following steps are included: 1) Processing node information in the graph A general graph neural network (GNN) is used as a graph encoder to learn the representation of nodes in the input graph, mapping the nodes into information embedding representations to support quantitative anomaly assessment; then, the information embedding is projected to another feature space through a nonlinear mapping layer to obtain node feature vectors. 2) Maximizing graph mutual information Graph mutual information is obtained by calculating the mutual information between the transformed feature vector and the node vector, the mutual information between the feature vector and the neighbor node vector, and the mutual information between the inner product of the node embedding vector and the node adjacency value. This captures the semantic information in the graph to obtain high-quality node representations. Maximizing the graph mutual information guides node feature training. This node representation will then be used as input to the score estimator for calculating outlier scores. 3) Calculation of node anomaly scores Define a nonlinear layer as a score estimator. Input the node representation into the score estimator to obtain the abnormal score of the node. The score of the abnormal node should be higher than that of the normal node. 4) Construction of loss function An anomaly detection model is constructed, comprising three parts: graph node information processing, maximizing graph mutual information, and calculating node anomaly scores. Several constraints are established to guide model training by ranking the anomaly scores of nodes in normal and anomaly subgraphs: First, an inter-bag loss is formed by widening the score gap between the highest-scoring nodes in normal and anomaly subgraphs; second, an intra-bag loss is formed by widening the anomaly score difference between high-scoring and low-scoring nodes within the anomaly subgraph. Simultaneously, a sparsity constraint is imposed on the overall scale of anomaly scores in anomaly subgraphs to limit the proportion of anomaly nodes in the subgraph; furthermore, a homogeneity constraint is introduced by minimizing the difference in anomaly scores between adjacent nodes to maintain consistency in local structure. Finally, the above losses are jointly optimized with the objective function of maximizing graph mutual information to form the final training loss function, guiding the parameter updates of the anomaly detection model.

[0037] 5) Pseudo-tag generation A candidate subgraph set is constructed by sampling subgraphs that are similar in size to the abnormal subgraph. The maximum, minimum and average values ​​are used as statistical indicators to coarsely evaluate the difference in node anomaly score distribution between the candidate subgraphs and the abnormal subgraphs. Then, subgraphs with smaller differences in score distribution from the candidate subgraph set are selected and given pseudo-labels for inclusion in the subsequent training process.

[0038] 6) Node anomaly identification The trained anomaly detection model is used as a node anomaly detection network to estimate node anomalies in graphs with only subgraph-level labels, and outputs the anomaly scores of nodes in the graph to achieve node anomaly identification.

[0039] In step 1) of this embodiment, the node information processing in the graph specifically includes the following steps: Step 1: Create a subgraph Select k real anomalies from the input graph as center nodes, and generate an anomaly subgraph using the RWR algorithm. The random walk and restart probabilities are 15 and 0.2, respectively. Similarly, apply RWR to the unlabeled node set to create a normal subgraph. Step 2: Node Feature Conversion A vanilla 2-layer image encoder is used to transform nodes into informative embeddings, specifically by converting the adjacency matrix of the subgraph. A and attribute matrix X As input, information embedding is obtained. H =GNN( A,X Then the hidden vector H Characterization is obtained through nonlinear transformation. ,in It is the parameter matrix learned. This represents the ReLU(PReLU) function.

[0040] In step 2) of this embodiment, mutual information is calculated using the Jensen-Shannon MI estimator (JSD). The detailed steps are as follows: Step 1: Calculate the mutual information of the graphs.

[0041] in, It is a node A computation graph that specifies the computation for a particular node. Perform local convolution on the surrounding area. Representation of node representation Middle node The representation, Representing attribute characteristics X Middle node The attributes, Represents a node Representation and nodes The mutual information values ​​between attribute features, Represents a node The set of neighboring nodes, Represents a node The representation of and its neighboring nodes The mutual information values ​​between attribute features, Represents a node and neighboring nodes The similarity weights, where and They are nodes and nodes In hidden layer vectors H Features on Indicates the inner product. It is the sigmoid activation function. Represents a node and neighboring nodes The adjacency value between nodes, if nodes and If a direct connection exists, then ,otherwise , Represents a node and nodes Similarity weight and Adjacency Value Mutual information values ​​between them; Step 2: Maximize graph mutual information By minimizing on all nodes The learned representation Z can well preserve the corresponding attributes and topological semantics of the nodes, thus laying the foundation for accurate anomaly estimation.

[0042] A further improvement of the present invention is that, in step 3), calculating the node anomaly score specifically includes the following steps: Step 1: Constructing the score estimator Define a score estimator to calculate the true outlier score for each node:

[0043] in, It is a trainable score vector. It is a sigmoid activation function, designed to derive reasonable outlier scores within the range (0,1); Step 2: Obtaining Abnormal Scores The node representation obtained in step 1) is used as a final node representation. The score is fed into the score estimator to obtain the abnormal score of the node, and the abnormal node score should be higher than the normal node score.

[0044] In step 4) of this embodiment, considering that node-level anomaly labels are unknown during training, the model cannot be trained solely by encouraging anomaly scores to be higher than normal node scores. The specific method is as follows: Step 1: Bag Loss Design The following loss ranking is designed for the node with the highest score in the subgraph:

[0045] in For the first Group of abnormal subgraphs, For the first Group normal subgraphs, This represents the maximum value operation. Indicates the first The first group of abnormal subgraphs 1 node Indicates its abnormal score, Indicates the first The first normal subgraph of the group 1 node This represents the outlier score, and the loss is applied only to the outlier subgraph. and normal subgraph Rank the two nodes, in The node with the highest score is most likely an anomalous node, while... The node with the highest score is more likely to be a hard sample, which appears abnormal but is actually a normal node. Pushing away nodes of the above two types helps to achieve high anomaly detection accuracy. Step 2: In-bag loss design Due to abnormal subgraphs The data may contain not only one anomalous node, but also nodes with a high probability of being normal. Therefore, the following ranking loss needs to be introduced to further optimize the accuracy of anomaly detection.

[0046] in Indicates the first Group of abnormal subgraphs, Indicates from A set of scores selected from the abnormal subgraphs The set of nodes with average anomaly scores. express The 1 node Indicates its abnormal score, express The 1 node This represents the abnormal scores. Specifically, a set of scores lower than the abnormal subgraph is selected. The node with the average anomaly score is denoted as Nodes with scores above average are more likely to be anomalous nodes, while The nodes in the model are more likely to be normal. By pushing away the two types of nodes mentioned above, the detection model can be enhanced. Step 3: Sparsity Constraints Because anomalies are usually rare in the real world, The anomaly scores of the nodes in the graph should be sparse, meaning that most of them tend to be 0, and only a finite number of nodes may be anomalous. For each anomalous subgraph, a design should be developed. To ensure the sparsity of abnormal nodes; Step 4: Homogeneity Constraints For the topological properties of a graph, the required scoring scheme should adhere to the homogeneity assumption and keep the scores of topologically connected nodes as close as possible. Therefore, we minimize the difference in outlier scores between adjacent nodes, i.e. To apply forced constraints to each subgraph, where Subgraph A column vector consisting of the anomaly scores of all nodes in the array. express and The Laplacian matrix; Step 5: Final Loss Function Design By integrating the loss functions from steps 2) and 4), the complete objective function is obtained.

[0047] in The representation loss, i.e., the objective function corresponding to maximizing graph mutual information in step 2), is used to optimize the quality of node feature embedding and ensure that node representation can accurately capture the local structure and semantic information of the graph. The balance weight parameter represents the inter-bag loss and is used to measure... The importance of inter-bag loss in the total loss function. Indicates the inter-bag loss, used to quantify the first... The score difference between the highest abnormal score node in the abnormal subgraph and the normal subgraph guides the model to widen the difference between the two types of subgraphs. The balance weight parameter represents the in-bag loss and is used to measure the in-bag loss. The importance of [the factor] in the total loss function This represents the in-bag loss, used to quantify the difference between high-abnormality score nodes and below-average abnormality score nodes within the abnormal subgraph, thereby optimizing the differentiation effect of abnormal nodes within the abnormal subgraph. The balance weight parameter represents the sparsity constraint and is used to measure the sparsity loss. The importance of [the factor] in the total loss function This represents the sparsity loss, used to constrain the overall scale of the outlier scores of nodes within the outlier subgraph, ensuring the sparsity of outlier nodes. The balance weight parameter represents the homogeneity constraint and is used to measure the homogeneity constraint. The importance of [the factor] in the total loss function The loss function representing the homogeneity constraint is used to quantify the difference in outlier scores between adjacent nodes within a subgraph, ensuring the consistency of the subgraph's local structure. This final objective function... Guided by subgraph-level weak supervision, we learn to model the score gap between normal and abnormal instances to identify node-level anomalies.

[0048] In step 5) of this embodiment, in order to improve the adaptability of the evaluation when the labeling rate is low in actual situations, it is necessary to select anomaly subgraphs from the space containing huge unlabeled nodes to generate pseudo-labels. The specific steps are as follows: Step 1: Sampling candidate sub-map sets Within a limited timeframe, prior knowledge and labor costs may still prevent us from obtaining sufficient subgraph-level labels, thus necessitating the creation of pseudo-labels. By analyzing the node scores of normal and anomalous subgraphs during the evaluation training process, and based on the significant distributional differences between normal and anomalous subgraphs, we first sample subgraphs from the unlabeled subgraph set that are similar in scale to the labeled anomalous subgraphs to form a candidate subgraph set. ,in This represents a similar-scale subgraph sampled from an unlabeled subgraph set; Step 2: Select appropriate sub-images and add pseudo-labels. The maximum, minimum, and average values ​​are used as indicators to roughly test the difference in score distribution between candidate subplots and labeled samples, as shown in the following formula:

[0049] express The size of the label set. Regarding the three statistical indicators mentioned above, the label set... The smaller the differences between samples in a dataset, the higher the likelihood that it contains anomalies. The r candidate subplots with the smallest scores are selected and labeled with pseudo-labels to expand the dataset. Then proceed to the next training iteration. Through multiple rounds of iteration, high-confidence training samples are automatically mined from the unlabeled data, and then fine-tuned with a set of labeled and pseudo-labeled data to achieve accurate node anomaly detection at a low labeling rate.

[0050] In step 6) of this embodiment, node anomaly estimation is performed using the network trained above. The specific steps are as follows: Step 1: Generate node scores For the input image The information is processed through step 1) and then input into the network. The trained network obtains the predicted score for each node. Step 2: Node Anomaly Detection The network analyzes the node scores output by the network and outputs higher scores for abnormal nodes in order to predict abnormal nodes in the subgraph.

[0051] Example 2 The Reddit dataset is selected; this dataset is a graphical dataset of Reddit posts published in September 2014, containing posts published by users on subreddits within one month. The invention will be further described in detail below with reference to the accompanying drawings, experimental examples, and specific implementation methods. All technologies implemented based on the content of this invention fall within the scope of this invention.

[0052] like Figure 1 As shown, in a specific implementation of the present invention, the subgraph-level supervised node anomaly estimation based on multi-instance learning includes the following steps: Step 1. Processing node information in the graph Normal and abnormal subgraphs were created from the Reddit dataset. Then, GNN was used to convert the node vectors in the abnormal and normal subgraphs into information embeddings, and node features were generated through nonlinear transformation.

[0053] Specifically, in this embodiment, the Reddit dataset contains a user-subforum graph, where nodes represent posts shared between subforums, edges between two posts indicate that they were commented on by the same user, the text of each post is converted into a feature vector representing its language query and word count category, and banned users are marked as anomalies.

[0054] The dataset contains 10,984 nodes and 168,016 edges, with each node having a vector dimension of 64 and an anomalous node rate of 3.3%. First, k=10 true anomalies are selected from the input graph as center nodes. The Random Walk-Restart (RWR) algorithm is then used to generate an anomalous subgraph with random walk and restart probabilities of 15 and 0.2, respectively. Similarly, RWR is applied to the unlabeled node set to create a normal subgraph. The number of anomalous subgraphs is significantly less than that of normal subgraphs. Figure 2 (S101); then, a vanilla 2-layer image encoder is used to transform the nodes into informative embeddings, specifically by converting the adjacency matrix of the subgraph. and attribute matrix As input, where n is the number of nodes in the subgraph and d=64 is the dimension of the node vector, the information embedding is obtained. Then the hidden vector H Characterization is obtained through nonlinear transformation. ,in It is the parameter matrix learned. Represents the ReLU(PReLU) function ( Figure 2 S102).

[0055] Step 2. Maximize graph mutual information The Jensen-Shannon MI estimator is used to compute graph mutual information. By maximizing graph mutual information, the underlying semantic information in the input graph is fully captured, resulting in high-quality node representations.

[0056] Specifically, in this embodiment, JS-MI is used to calculate the mutual information between node features and the original node vectors for each subgraph. Mean mutual information between node features and neighboring node vectors The mutual information between the embedded vector dot product and the adjacency matrix of nodes and their adjacent nodes. The mutual information between nodes in the computational graph is obtained by adding them together. ,in Used to specify the neighborhood around a node for local convolution. Figure 3 S201); by minimizing the vectors of all nodes This allows the learned representation Z to finely preserve the individual attributes and topological semantics of the nodes, laying the foundation for accurate anomaly estimation. Figure 3 S202).

[0057] Step 3. Calculate Node Anomaly Score The node features Z are used to generate anomaly scores for each node through a score estimator.

[0058] Specifically, in this embodiment, a nonlinear layer is constructed as a score estimator, with node features as input and node scores as output. Figure 4 S301); specifically, node features The input is fed into the score estimator and multiplied by a trainable score vector. Then, the sigmoid activation function is used to obtain the abnormal score of the node. The score ranges from (0,1). When the node is an abnormal node, the score should be as high as possible, and conversely, when the node is a normal node, the score should be as low as possible. Figure 4 (S302), therefore, the status of a node can be known through its abnormal score.

[0059] Step 4. Loss Function Construction The scores obtained by the score estimator still need to be guided by an appropriate loss function to achieve the ability to correctly separate normal nodes from abnormal nodes. Here, the inter-bag loss, intra-bag loss, sparsity constraint and homogeneity constraint are used to guide the score estimator to generate the correct abnormal scores.

[0060] Specifically, in this embodiment, for users who are muted, a higher anomaly score needs to be generated for them. Therefore, the nodes with higher scores in the anomaly subgraph are most likely to be anomaly nodes, denoted as... Conversely, for normal subgraphs, the score should be as low as possible, and the node with the highest score is the hard sample, denoted as . The anomaly detection is essentially normal. We need to differentiate between high scores in the anomaly subgraph and high scores in the normal subgraph to improve anomaly detection accuracy. Therefore, the inter-bag loss is... ( Figure 5 (S401) In an abnormal subgraph, there may be more than one muted user, while most nodes in the graph are normal users. To remove these two types of nodes, a set of nodes with scores lower than the abnormal subgraph is selected. The node with the average anomaly score is denoted as Nodes with scores above the average are more likely to be anomalous nodes. The middle node is more likely to be normal, and the node with the highest score is recorded as . The essence remains normal, therefore the loss within the bag is constructed as follows: ( Figure 5 (S402) Since most nodes in the anomaly subgraph are still normal, sparsity constraints are needed to ensure the number of anomaly nodes, thus ensuring that the anomaly situation is sparse. The loss function is... ( Figure 5 (S403) For the topological properties of a graph, the scores should follow the homogeneity assumption and keep the scores of topologically connected nodes as close as possible. Therefore, by minimizing the difference in outlier scores between adjacent nodes, i.e. To apply mandatory constraints to each subgraph ( Figure 5 S404); Finally, integrate the graph mutual information loss. The final loss is obtained by combining the above losses. Four parameters were obtained within the range of [0.01, 10] using a grid search strategy. ( Figure 5 S405) uses the above-described modeling of the score gap between normal and abnormal instances to identify node-level anomalies.

[0061] Step 5. Pseudo-tag generation While the weakly supervised setup reduces the reliance on fine-grained node-level annotations, prior knowledge and manual labor costs can still prevent us from obtaining sufficient coarse-grained secondary labels within a limited timeframe. To improve the adaptability of the evaluation in real-world scenarios with low label rates, pseudo-labels are generated by selecting subgraphs from the vast unlabeled node space that are more likely to contain anomalous nodes, thereby increasing the model's accuracy by increasing the number of labels.

[0062] Specifically, in this embodiment, based on the obvious distribution differences between normal and abnormal subgraphs, subgraphs of similar scale to labeled abnormal subgraphs are first sampled from the unlabeled subgraph set to form a candidate subgraph set. ( Figure 6 S501); simultaneously using the maximum Minimum value and average As an indicator, the r candidate subgraphs with the smallest scores are selected and labeled with pseudo-labels to expand the scope. And proceed to the next training session ( Figure 6 S502). High-confidence training samples are automatically mined from unlabeled data, and then fine-tuned with a set of labeled and pseudo-labeled samples to achieve accurate node anomaly detection at low labeling rates.

[0063] Step 6. Node Anomaly Identification like Figure 8 As shown, anomaly detection is performed by generating anomaly scores for all nodes in the input subgraph based on the trained network, which specifically includes two steps: generating node scores and estimating node anomalies.

[0064] Specifically, in this embodiment, the test set samples are input into the network to obtain the predicted score for each node. Figure 7 S601 performs node-level anomaly detection by analyzing the output scores and marking nodes with high scores as anomalies. Figure 7S602).

[0065] On the Reddit dataset, this method achieves an AUC of 67.11% and an AP of 5.92% with 50 labels. Compared to unsupervised methods, introducing external label knowledge as guidance can significantly improve model performance, even with coarse-grained supervision. Methods relying on node-level label supervision or even sample learning can only extract limited or even incorrect knowledge from coarse-grained supervision information, thus weakening performance. Furthermore, when experimenting with fewer labels, such as 10, this method achieves an AUC of 64.77% and an AP of 5.68%, almost equivalent to the results with 50 labels. This is thanks to a simple and effective self-training module that automatically creates subgraph-level pseudo-labels by measuring the distribution of node scores, enhancing the model's adaptability to real-world label rates.

[0066] Example 2 The present invention provides a subgraph-level supervised node anomaly estimation system based on multi-instance learning, comprising: The node information processing unit in the graph uses a general graph neural network as a graph encoder to learn the representation of nodes in the input graph, mapping the nodes into information embedding representations to support quantitative anomaly assessment; the information embedding is projected to another feature space through a nonlinear mapping layer to obtain node feature vectors. The graph mutual information maximization unit obtains graph mutual information by calculating the mutual information between the transformed feature vector and the node vector, the mutual information between the feature vector and the neighbor node vector, and the mutual information between the inner product of the node embedding vector and the node adjacency value. It captures the semantic information in the graph to obtain node representation and maximizes the graph mutual information to guide node feature training. Node anomaly score calculation unit: Define a nonlinear layer as a score estimator. Input the node representation into the score estimator to obtain the anomaly score of the node. The score of anomaly nodes is higher than that of normal nodes. Loss Function Construction Unit: This unit constructs an anomaly detection model comprising three parts: graph node information processing, maximizing graph mutual information, and calculating node anomaly scores. It then ranks the anomaly scores of nodes in normal and abnormal subgraphs and constructs multiple constraints to guide the model's training: In-bag loss is formed by widening the score gap between the highest-scoring nodes in normal and abnormal subgraphs; In-bag loss is formed by widening the anomaly score difference between high-scoring and low-scoring nodes within the abnormal subgraph; Sparsity constraints are applied to the overall scale of anomaly scores in the abnormal subgraphs to limit the proportion of abnormal nodes; Homogeneity constraints are introduced by minimizing the difference in anomaly scores between adjacent nodes to maintain consistency in the local structure; Finally, the in-bag loss, intra-bag loss, sparsity constraints, homogeneity constraints, and the objective function that maximizes graph mutual information are jointly optimized to form the final training loss function, guiding the parameter updates of the anomaly detection model. Pseudo-label generation unit: Constructs a candidate subgraph set by sampling subgraphs that are similar in size to the abnormal subgraph, and simultaneously uses the maximum, minimum and average values ​​as statistical indicators to perform a coarse-grained evaluation of the difference in node anomaly score distribution between the candidate subgraphs and the abnormal subgraphs; Selects subgraphs with small differences in score distribution from the candidate subgraph set and assigns them pseudo-labels, which are then included in the subsequent training process. Node anomaly identification unit: The trained anomaly detection model is used as a node anomaly detection network to estimate node anomalies in graphs with only subgraph-level labels, and outputs the anomaly scores of nodes in the graph to achieve node anomaly identification.

[0067] In the graph node information processing unit of this embodiment, the graph node information processing specifically includes the following steps: Step 1: Create a subgraph Select k real anomalies from the input graph as center nodes, and generate an anomaly subgraph using the RWR algorithm. The random walk and restart probabilities are 15 and 0.2, respectively. Similarly, apply RWR to the unlabeled node set to create a normal subgraph. Step 2: Node Feature Conversion A vanilla 2-layer image encoder is used to transform nodes into informative embeddings, specifically by converting the adjacency matrix of the subgraph. A and attribute matrix X As input, information embedding is obtained. H =GNN( A,X Then the hidden vector H Characterization is obtained through nonlinear transformation. ,in It is the parameter matrix learned. This represents the ReLU(PReLU) function.

[0068] Example 3 The present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the subgraph-level supervised node anomaly estimation method based on multi-instance learning.

[0069] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0070] This application is described with reference to flowchart illustrations and / or block diagrams of methods, systems, and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A system that specifies functions in one or more boxes.

[0071] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0072] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0073] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered illustrative and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the scope of the invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

[0074] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can be appropriately combined to form other embodiments that can be understood by those skilled in the art. The above content is only for illustrating the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. Any modifications made based on the technical concept proposed in this invention shall fall within the scope of protection of the claims of this invention.

Claims

1. A node anomaly estimation method based on multi-instance learning under subgraph-level supervision, characterized in that, include: 1) Processing of node information in the graph A general graph neural network is used as a graph encoder to learn the representation of nodes in the input graph and map the nodes into information embedding representations to support quantitative anomaly assessment. The information embedding is projected to another feature space through a nonlinear mapping layer to obtain the node feature vectors. 2) Maximizing graph mutual information Graph mutual information is obtained by calculating the mutual information between the transformed feature vector and the node vector, the mutual information between the feature vector and the neighbor node vector, and the mutual information between the similarity weight of the node and the corresponding adjacency value. Semantic information in the graph is captured to obtain node representation, and the graph mutual information is maximized to guide node feature training. 3) Calculation of node anomaly scores Define a nonlinear layer as a score estimator. Input the node representation into the score estimator to obtain the abnormal score of the node. Abnormal nodes score higher than normal nodes. 4) Construction of loss function An anomaly detection model is constructed, which includes three parts: processing node information in the graph, maximizing graph mutual information, and calculating node anomaly scores. By ranking the node anomaly scores in normal and abnormal subgraphs, multiple constraints are constructed to guide the training of the anomaly detection model: by widening the score gap between the highest-scoring nodes in normal and abnormal subgraphs, a pocket loss is formed. Within the anomaly subgraph, an intra-bag loss is constructed by widening the difference in anomaly scores between high-scoring and low-scoring nodes. Sparsity constraints are imposed on the overall scale of anomaly scores in the anomaly subgraph to limit the proportion of anomaly nodes in the subgraph. Homogeneity constraints are introduced by minimizing the difference in anomaly scores between adjacent nodes to maintain consistency in the local structure. The inter-bag loss, intra-bag loss, sparsity constraints, homogeneity constraints, and the objective function that maximizes graph mutual information are jointly optimized to form the final training loss function, which guides the parameter updates of the anomaly detection model. 5) Pseudo-tag generation A candidate subgraph set is constructed by sampling subgraphs that are similar in size to the abnormal subgraph, and the maximum, minimum and average values ​​are used as statistical indicators to perform a coarse-grained evaluation of the difference in node anomaly score distribution between the candidate subgraphs and the abnormal subgraphs. Subgraphs with smaller differences in score distribution from the candidate subgraph set are selected and given pseudo-labels and included in the subsequent training process. 6) Node anomaly identification The trained anomaly detection model is used as a node anomaly detection network to estimate node anomalies in graphs with only subgraph-level labels, and outputs the anomaly scores of nodes in the graph to achieve node anomaly identification.

2. The subgraph-level supervised node anomaly estimation method based on multi-instance learning according to claim 1, characterized in that, Step 1) involves processing node information in the graph, specifically including the following steps: Step 1: Create a subgraph Select k real anomalies from the input graph as center nodes, and generate an anomaly subgraph using the RWR algorithm. The random walk and restart probabilities are 15 and 0.2, respectively. Similarly, apply RWR to the unlabeled node set to create a normal subgraph. Step 2: Node Feature Conversion A vanilla 2-layer image encoder is used to transform nodes into informative embeddings, specifically by converting the adjacency matrix of the subgraph. A and attribute matrix X As input, information embedding is obtained. H =GNN( A,X Then the hidden vector H Characterization is obtained through nonlinear transformation. ,in It is the parameter matrix learned. This represents the ReLU(PReLU) function.

3. The subgraph-level supervised node anomaly estimation method based on multi-instance learning according to claim 2, characterized in that, In step 2), maximizing graph mutual information specifically includes: The mutual information is calculated using the Jensen-Shannon MI estimator, and the steps are as follows: Step 1: Calculate the mutual information of the graphs. in, It is a node A computation graph that specifies the computation for a particular node. Perform local convolution on the surrounding area. Representation of node representation Middle node The representation, Representing attribute characteristics X Middle node The attributes, Represents a node Representation and nodes The mutual information values ​​between attribute features, Represents a node The set of neighboring nodes, Represents a node The representation of and its neighboring nodes The mutual information values ​​between attribute features, Represents a node and neighboring nodes The similarity weights, where and They are nodes and nodes In hidden layer vectors H Features on Indicates the inner product. It is the sigmoid activation function. Represents a node and neighboring nodes The adjacency value between nodes, if nodes and If a direct connection exists, then ,otherwise , Represents a node and nodes Similarity weight and Adjacency Value Mutual information values ​​between them; Step 2: Maximize graph mutual information By minimizing on all nodes The learned representation Z preserves the corresponding attributes and topological semantics of the nodes.

4. The subgraph-level supervised node anomaly estimation method based on multi-instance learning according to claim 3, characterized in that, Step 3) involves the following steps in calculating the node anomaly score: Step 1: Constructing the score estimator Define a score estimator to calculate the true outlier score for each node: in, It is a trainable score vector. It is a sigmoid activation function, designed to derive a reasonable outlier score within the range (0,1); Step 2: Obtaining Abnormal Scores Represent the obtained nodes The score is fed into the score estimator to obtain the abnormal score of the node, and the abnormal node score should be higher than the normal node score.

5. The subgraph-level supervised node anomaly estimation method based on multi-instance learning according to claim 4, characterized in that, In step 4), the loss function construction specifically includes: training the model by encouraging abnormal node scores to be higher than normal node scores, specifically through the following method: Step 1: Bag Loss Design The following loss ranking is designed for the node with the highest score in the subgraph: in For the first Group of abnormal subgraphs, For the first Group normal subgraphs, This represents the maximum value operation. Indicates the first The first group of abnormal subgraphs 1 node Indicates its abnormal score, Indicates the first The first normal subgraph of the group 1 node This indicates its abnormal score; Step 2: In-bag loss design The following ranking loss is introduced to further optimize anomaly detection accuracy. in Indicates the first Group of abnormal subgraphs, Indicates from A group of scores selected from those below The set of nodes with average anomaly scores. express The 1 node Indicates its abnormal score, express The 1 node This indicates its abnormal score; Step 3: Sparsity Constraints Design for each anomaly subgraph To ensure the sparsity of abnormal nodes; Step 4: Homogeneity Constraints By minimizing the difference in outlier scores between neighboring nodes, i.e. To apply forced constraints to each subgraph, where Subgraph A column vector consisting of the anomaly scores of all nodes in the array. express and The Laplacian matrix; Step 5: Final Loss Function Design By integrating the loss functions from steps 2) and 4), the complete objective function is obtained. in The representation loss, which is the objective function corresponding to maximizing graph mutual information, is used to optimize the quality of node feature embedding and ensure that node representation can accurately capture the local structure and semantic information of the graph. The balance weight parameter represents the inter-bag loss and is used to measure... The importance of inter-bag loss in the total loss function. Indicates the inter-bag loss, used to quantify the first... The score difference between the highest abnormal score node in the abnormal subgraph and the normal subgraph guides the model to widen the difference between the two types of subgraphs; The balance weight parameter represents the in-bag loss and is used to measure the in-bag loss. The importance of [the factor] in the total loss function This represents the in-bag loss, used to quantify the difference between high-abnormality score nodes and below-average abnormality score nodes within the abnormal subgraph, thereby optimizing the differentiation effect of abnormal nodes within the abnormal subgraph. The balance weight parameter represents the sparsity constraint and is used to measure the sparsity loss. The importance of [the factor] in the total loss function This represents the sparsity loss, used to constrain the overall scale of the outlier scores of nodes within the outlier subgraph, ensuring the sparsity of outlier nodes. The balance weight parameter represents the homogeneity constraint and is used to measure the homogeneity constraint. The importance of [the factor] in the total loss function The loss function represents the homogeneity constraint, used to quantify the difference in outlier scores between adjacent nodes within a subgraph, ensuring the consistency of the subgraph's local structure; the final objective function... Under the guidance of subgraph-level weak supervision, the score gap between normal and abnormal instances is modeled to identify node-level anomalies.

6. The subgraph-level supervised node anomaly estimation method based on multi-instance learning according to claim 5, characterized in that, In step 5), pseudo-label generation includes: selecting anomalies from a subgraph containing a large space of unlabeled nodes to generate pseudo-labels. The specific steps are as follows: Step 1: Sampling candidate sub-map sets By analyzing the node scores of normal and abnormal subgraphs during the evaluation training process, and based on the significant distribution differences between normal and abnormal subgraphs, a candidate subgraph set is formed by first sampling subgraphs of similar scale to the labeled abnormal subgraphs from the unlabeled subgraph set. ,in This represents a similar-scale subgraph sampled from an unlabeled subgraph set; Step 2: Select appropriate sub-images and add pseudo-labels. The maximum, minimum, and average values ​​are used as indicators to roughly test the difference in score distribution between candidate subplots and labeled samples, as shown in the following formula: express The size of the label set; in three statistical indicators. The smaller the differences between samples, the higher the probability that it contains anomalies; select the r candidate subplots with the smallest scores and label them with pseudo-labels to expand the range. Then proceed with the next training; through multiple rounds of iteration, high-confidence training samples are automatically mined from unlabeled data, and then fine-tuned with a set of labeled and pseudo-labeled data to achieve accurate node anomaly detection at a low labeling rate.

7. The subgraph-level supervised node anomaly estimation method based on multi-instance learning according to claim 6, characterized in that, In step 6), the specific steps for node anomaly identification are as follows: Step 1: Generate node scores For the input image The information is processed and then input into a general graph neural network. After training, the general graph neural network obtains the predicted score for each node. Step 2: Node Anomaly Detection The node scores input to the general graph neural network are analyzed. For abnormal nodes, the network will output higher scores to predict abnormal nodes in the subgraph.

8. A subgraph-level supervised node anomaly estimation system based on multi-instance learning, characterized in that, include: The node information processing unit in the graph uses a general graph neural network as a graph encoder to learn the representation of nodes in the input graph, mapping the nodes into information embedding representations to support quantitative anomaly assessment; the information embedding is projected to another feature space through a nonlinear mapping layer to obtain node feature vectors. The graph mutual information maximization unit obtains graph mutual information by calculating the mutual information between the transformed feature vector of a node and the node vector, the mutual information between the feature vector and the neighbor node vector, and the mutual information between the similarity weight of a node and its neighbor nodes and their corresponding adjacency values. It captures semantic information in the graph to obtain node representations and maximizes graph mutual information to guide node feature training. Node anomaly score calculation unit: Define a nonlinear layer as a score estimator. Input the node representation into the score estimator to obtain the anomaly score of the node. The score of anomaly nodes is higher than that of normal nodes. Loss function construction unit: Construct an anomaly detection model that includes three parts: processing node information in the graph, maximizing graph mutual information, and calculating node anomaly scores. By sorting the node anomaly scores in the normal subgraph and the anomaly subgraph, multiple constraints are constructed to guide the training of the anomaly detection model: by widening the score gap between the highest-scoring nodes in the normal subgraph and the anomaly subgraph, the inter-bag loss is formed. Within the anomaly subgraph, an intra-bag loss is constructed by widening the difference in anomaly scores between high-scoring and low-scoring nodes. Sparsity constraints are imposed on the overall scale of anomaly scores in the anomaly subgraph to limit the proportion of anomaly nodes in the subgraph. Homogeneity constraints are introduced by minimizing the difference in anomaly scores between adjacent nodes to maintain consistency in the local structure. The inter-bag loss, intra-bag loss, sparsity constraints, homogeneity constraints, and the objective function that maximizes graph mutual information are jointly optimized to form the final training loss function, which guides the parameter updates of the anomaly detection model. Pseudo-label generation unit: Constructs a candidate subgraph set by sampling subgraphs that are similar in size to the abnormal subgraph, and simultaneously uses the maximum, minimum and average values ​​as statistical indicators to perform a coarse-grained evaluation of the difference in node anomaly score distribution between the candidate subgraphs and the abnormal subgraphs; Selects subgraphs with small differences in score distribution from the candidate subgraph set and assigns them pseudo-labels, which are then included in the subsequent training process. Node anomaly identification unit: The trained anomaly detection model is used as a node anomaly detection network to estimate node anomalies in graphs with only subgraph-level labels, and outputs the anomaly scores of nodes in the graph to achieve node anomaly identification.

9. The subgraph-level supervised node anomaly estimation system based on multi-instance learning according to claim 8, characterized in that, The node information processing unit in the diagram specifically includes the following steps: Step 1: Create a subgraph Select k real anomalies from the input graph as center nodes, and generate an anomaly subgraph using the RWR algorithm. The random walk and restart probabilities are 15 and 0.2, respectively. Similarly, apply RWR to the unlabeled node set to create a normal subgraph. Step 2: Node Feature Conversion A vanilla 2-layer image encoder is used to transform nodes into informative embeddings, specifically by converting the adjacency matrix of the subgraph. A and attribute matrix X As input, information embedding is obtained. H =GNN( A,X Then the hidden vector H Characterization is obtained through nonlinear transformation. ,in It is the parameter matrix learned. This represents the ReLU(PReLU) function.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the subgraph-level supervised node anomaly estimation method based on multi-instance learning as described in any one of claims 1-7.

Images