An attribute graph anomaly detection method and system with high efficiency reasoning

Abstract

This invention discloses an efficient inference-based method and system for anomaly detection in attribute graphs, comprising: generating unstructure-aware MLP embeddings and structure-aware GNN embeddings using an MLP encoder and a GNN encoder respectively, with independent encoder parameters; constructing a node-level contrastive learning network, using all first-order neighbors of the target node as positive samples and non-first-order neighbors as negative samples, calculating a consistency score and constructing a node-level contrastive loss; constructing an edge-level contrastive learning network, dividing the positive edge pool into at least two sub-positive edge pools, and constructing an edge-level contrastive loss by combining it with the global negative edge pool; jointly optimizing the node-level loss, edge-level loss, and regularization loss based on GNN embedding to reconstruct the original attributes, and updating the encoder parameters; during the inference phase, only the trained MLP encoder is used to calculate the initial anomaly score, and neighborhood entropy is used for correction, outputting the final anomaly score. This invention significantly reduces inference latency while maintaining high detection accuracy and can be applied to real-time anomaly detection of large-scale attribute graphs.

Description

Technical Field

[0001] This invention relates to the field of graph data processing technology, specifically to an efficient inference method and system for detecting anomalies in attribute graphs. Background Technology

[0002] Attribute graphs are a widely existing complex data structure where nodes represent entities and carry attribute characteristics, and edges represent relationships between entities. Attribute graph anomaly detection aims to identify rare, anomalous nodes or edges that significantly deviate from normal patterns in the graph, and has significant application value in fields such as financial risk control, cybersecurity, and social analytics.

[0003] Existing attribute graph anomaly detection methods suffer from the following problems: anomalies in attribute graphs can manifest as node attribute anomalies (contextual anomalies), node connection anomalies (structural anomalies), or even a mixture of both; labeling anomaly samples is extremely costly, making it difficult to obtain large amounts of labeled anomaly data in practical applications. Therefore, unsupervised anomaly detection has become the mainstream approach. Early methods based on heuristic rules or feature engineering struggle to capture the complex nonlinear interactions and high-dimensional node attribute features in graph data, resulting in limited detection accuracy. Generative methods based on graph autoencoders reconstruct node attributes and adjacency matrices, using the reconstruction error as an anomaly score; however, the optimization goal of these methods is to reconstruct the original graph as much as possible, which is not entirely consistent with the goal of anomaly detection (accurately identifying anomaly patterns), causing the model to tend to focus on overall reconstruction accuracy while ignoring anomalies; reconstructing the complete attribute matrix and adjacency matrix requires significant time and space overhead, making it difficult to scale to large-scale graphs.

[0004] Self-supervised contrastive learning has become a cutting-edge technique for attribute graph anomaly detection. However, existing contrastive learning methods (such as CoLA) still have significant drawbacks: the inference phase still requires expensive graph neural network (GNN) neighborhood aggregation operations, and multiple rounds of detection are often needed to reduce sampling randomness, resulting in high inference latency and difficulty in meeting real-time requirements; contrastive learning strategies mainly focus on the node or subgraph level, with edges only regarded as auxiliary information, failing to fully explore the key relational structures encoded by the edges, thus limiting the model's ability to identify complex anomaly patterns. Summary of the Invention

[0005] The purpose of this invention is to provide an efficient inference-based attribute graph anomaly detection method and system to solve the problems mentioned in the background art, such as the diversity of existing anomaly patterns and lack of supervision, insufficient expressive power of shallow methods, target bias in deep generative methods, and high inference latency and insufficient utilization of side information in existing contrastive learning methods.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: According to one aspect of the present invention, an efficient inference-based attribute graph anomaly detection method is provided, the method comprising: The node attributes are encoded using an MLP encoder to obtain an MLP embedding; the MLP embedding and the graph adjacency structure are input together into a GNN encoder to obtain a GNN embedding; the parameters of the MLP encoder and the GNN encoder are independent of each other; All first-order neighbors of each target node are defined as positive samples, and non-first-order neighbors of the target node are defined as negative samples. The consistency scores between the target node and the positive and negative samples are calculated in the GNN embedding space and the MLP embedding space, respectively, and a node-level contrast loss is constructed. The embedding of each edge is represented as the average of the embeddings of the two endpoint nodes of the edge; for each target edge, the positive edge pool of the target edge is divided into at least two sub-positive edge pools, the sub-positive edge pools including the target edge and the edges that share endpoints with the target edge; the edge-level contrast loss is constructed using the edges in the global negative edge pool as negative samples. The parameters of the MLP encoder and the GNN encoder are updated by jointly optimizing the node-level contrast loss, the edge-level contrast loss, and the regularization loss based on GNN embedding to reconstruct the original attributes. During the inference phase, only the trained MLP encoder is used to calculate the consistency score between each node and its first-order neighbors as the initial anomaly score, and the neighborhood entropy on the first-order neighbors of the node is used to correct the initial anomaly score, and the final anomaly score is output.

[0007] Based on the aforementioned scheme, the MLP encoder is a two-layer fully connected network, with each layer followed by a ReLU activation function; the GNN encoder is a one-layer graph convolutional network, with the input features of the graph convolutional network being the MLP embedding, and the output dimension being the same as the MLP embedding.

[0008] Based on the aforementioned scheme, the consistency score is calculated using cosine similarity; the node-level contrast loss is constructed based on Jensen-Shannon divergence. ; in, For the current batch of nodes, For the sigmoid function, The mean cosine similarity between the target node and the positive sample. denoted as the mean cosine similarity between the target node and the negative sample.

[0009] Based on the aforementioned scheme, the sub-positive edge pool includes three sub-pools: the first sub-pool contains only the target edge itself, the second sub-pool contains all other edges that share a first endpoint with the target edge, and the third sub-pool contains all other edges that share a second endpoint with the target edge; wherein the first endpoint and the second endpoint are the two endpoints of the target edge.

[0010] Based on the aforementioned scheme, the edge-level comparison loss for each target edge is: ; in, Embedding of the target edge, For the average pooling embedding of the k-th sub-positive edge pool, For global negative edge pooling, For temperature parameters, Let be the cosine similarity.

[0011] Based on the aforementioned scheme, the global negative edge pool is constructed by randomly sampling a fixed number of edges from the edge set of the graph.

[0012] Based on the aforementioned scheme, the regularization loss is: ; in, For nodes The original properties, For nodes GNN embedding, It is a non-linear decoder.

[0013] Based on the aforementioned scheme, the neighborhood entropy is calculated as follows: ; The corrected outlier score is: ; in, The initial abnormal score, Let the set of first-order neighbors of the target node be . It is a linear mapping function.

[0014] Based on the aforementioned scheme, the total loss function in the joint optimization is: ; in, The value range is {0.1, 0.5, 1.0, 2.0, 4.0}. The value range is {0.0, 0.5, 1.0, 2.0, 4.0} × 10 -4 .

[0015] According to another aspect of the present invention, an efficient inference-based attribute graph anomaly detection system is provided, the system comprising: The graph encoding module is used to encode node attributes using an MLP encoder to obtain MLP embeddings, and inputs the MLP embeddings and graph adjacency structure into a GNN encoder to obtain GNN embeddings; the parameters of the MLP encoder and the GNN encoder are independent of each other; The node comparison module is used to define all first-order neighbors of each target node as positive samples and non-first-order neighbors of the target node as negative samples; calculate the consistency scores of the target node with positive samples and negative samples in the GNN embedding space and MLP embedding space respectively, and construct the node-level comparison loss. An edge comparison module is used to represent the embedding of each edge as the average of the embeddings of the two endpoint nodes of the edge; for each target edge, the positive edge pool of the target edge is divided into at least two sub-positive edge pools, the sub-positive edge pools include the target edge and the edges that share endpoints with the target edge; and an edge-level comparison loss is constructed using the edges in the global negative edge pool as negative samples. The joint training and inference module is used to jointly optimize the node-level contrastive loss, the edge-level contrastive loss, and the regularization loss based on GNN embedding to reconstruct the original attributes, and update the parameters of the MLP encoder and the GNN encoder. During the inference phase, only the trained MLP encoder is used to calculate the consistency score between each node and its first-order neighbors as the initial anomaly score, and the neighborhood entropy on the first-order neighbors of the node is used to correct the initial anomaly score, and the final anomaly score is output.

[0016] As can be seen from the above technical solutions, this invention has at least the following advantages and positive effects compared with the prior art: Through the MLP and GNN collaborative learning framework, the structural knowledge captured by the GNN is distilled into the MLP encoder during the training phase, and only a lightweight MLP encoder is used during the inference phase, avoiding GNN neighborhood aggregation operations, significantly reducing inference latency, and achieving efficient detection. Through a refined edge-level contrastive learning network, the positive edge pool is divided into semantically clear sub-pools (self-edges, edges sharing a source end, and edges sharing a target end), and combined with global negative edge pool sampling, effectively mining edge-level anomaly patterns (such as self-abnormal edges, radiating abnormal edges, and converging abnormal edges); this design complements node-level contrastive analysis, significantly enhancing the model's ability to identify complex structural anomalies. The introduction of a neighborhood entropy-based correction function can adaptively adjust anomaly scores; for anomaly nodes with skewed neighbor similarity distributions, their anomaly scores are appropriately increased; for evenly distributed normal nodes, the scores remain unchanged; this mechanism improves the quality of anomaly ranking, especially improving the detection effect of contextual anomalies, and avoiding over-correction. The method of this invention employs batch processing and negative sampling strategies during training, which can adapt to graph data of different scales; the inference stage only requires forward propagation of MLP, and the computational complexity is linearly related to the number of nodes, making it easy to deploy in real-time detection systems and with broad industrial application prospects.

[0017] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention. It is obvious that the drawings described below are merely some embodiments of the invention, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings: Figure 1 This is a schematic diagram of an efficient inference-based attribute graph anomaly detection method according to the present invention; Figure 2 This is a flowchart illustrating an efficient inference-based attribute graph anomaly detection method of the present invention. Detailed Implementation

[0019] To more clearly illustrate the purpose, technical solutions, and advantages of the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein. On the contrary, these embodiments are provided so that the present invention will be more comprehensive and complete, and fully convey the concept of the exemplary embodiments to those skilled in the art.

[0020] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a full understanding of embodiments of the invention. However, those skilled in the art will recognize that the technical solutions of the invention can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of the invention.

[0021] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0022] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0023] The present invention will now be described in detail with reference to specific embodiments.

[0024] Example 1

[0025] like Figure 1 , 2 As shown in the figure, this embodiment provides an efficient inference-based attribute graph anomaly detection method. The specific steps of the method are as follows: S1: Encode node attributes using an MLP encoder to obtain an MLP embedding; input the MLP embedding and the graph adjacency structure into a GNN encoder to obtain a GNN embedding; the parameters of the MLP encoder and the GNN encoder are independent of each other.

[0026] A dual-branch graph encoder is constructed, consisting of a multilayer perceptron (MLP) encoder and a graph neural network (GNN) encoder. The parameters of the two encoders are independent of each other, and they undertake different feature extraction tasks: the MLP encoder is used to extract unstructured attribute embeddings from the original attributes of nodes; the GNN encoder further extracts structure-aware embeddings that fuse structural information based on the MLP embeddings and the graph adjacency structure.

[0027] The MLP encoder is a fully connected feedforward neural network whose input is a property map. Node attribute matrix Where |V| is the number of nodes and d is the original attribute dimension. The MLP encoder consists of two linear layers, each followed by a ReLU activation function. The first linear layer maps the original attribute dimension d to the hidden layer dimension h (h=128 in this embodiment), and the second linear layer keeps the dimension unchanged and outputs the MLP embedding matrix. Using node attribute information, through a parameter... The MLP encoder obtains MLP embeddings without structured information: ; MLP encoders rely solely on node attributes and do not involve any graph structure information; therefore, their output embedding... It is essentially an unstructured perception.

[0028] GNN encoder with MLP embedding Taking the adjacency matrix A of the graph as input, a structure-aware embedding is generated by aggregating neighbor information. This embodiment uses a single-layer graph convolutional network (GCN) as the GNN encoder. Let... To add the adjacency matrix after adding self-loops, For the corresponding degree matrix (diagonal elements) The forward propagation of a single-layer GCN is defined as follows: ; in It is a trainable weight matrix (the output dimension is kept at h=128). The ReLU activation function is used. The parameters of the GNN encoder are independent of those of the MLP encoder, i.e., W and No parameters are shared. The GNN encoder uses MLP embeddings. As input features, GNNs can focus on learning structural information without having to undertake the task of attribute encoding, thus avoiding the entanglement of the two types of information in shallow networks, which is beneficial for subsequent comparative learning.

[0029] During the training phase, both the MLP encoder and the GNN encoder participate in loss calculation and parameter update. The MLP encoder learns the attribute distribution, while the GNN encoder learns structure-aware neighborhood patterns. Structural knowledge is then distilled from the GNN to the MLP through a two-layer contrastive learning network (step S2). During the inference phase, only the MLP encoder is used, eliminating the latency overhead caused by neighborhood aggregation and achieving efficient anomaly detection.

[0030] S2: Define all first-order neighbors of each target node as positive samples and define the non-first-order neighbors of the target node as negative samples; calculate the consistency scores of the target node with the positive samples and negative samples in the GNN embedding space and MLP embedding space respectively, and construct the node-level contrast loss.

[0031] Set attribute graph For any target node , positive neighborhood Define as a node The set of all first-order neighbor nodes, i.e.: ; negative neighborhood Defined as the current training batch All that does not belong to The set of first-order neighbors, i.e.: ; in express First-order neighbors (including) ), This represents the set of nodes in the current batch. Positive neighborhoods use all first-order neighbors instead of sampling subgraphs to ensure the integrity of local structural information; negative neighborhoods are defined within the batch to ensure the diversity of negative samples while controlling computational overhead. The batch size can be dynamically adjusted based on GPU memory.

[0032] To quantify the matching degree between a target node and its positive / negative neighbors, this invention introduces cosine similarity as a metric function. Let... For nodes In GNN embedding space The representation vector in the vector (dimension h, h=128 in this embodiment). Positive consistency score. The average cosine similarity between the target node and all nodes in its positive neighborhood: ; Negative consistency score The average cosine similarity between the target node and all nodes in its negative neighborhood: ; Intuitively, normal nodes should have a higher positive consistency score (similar to their neighbors) and a lower negative consistency score (unsimilar to their non-neighbors); abnormal nodes are the opposite.

[0033] Similarly, in the MLP embedding space In, MLP embedding is used Calculate the same positive / negative consistency score, denoted as and This provides the MLP encoder with a supervisory signal for structural comparison, enabling the MLP to mimic the behavior of the GNN, thereby achieving structural knowledge distillation.

[0034] Jensen-Shannon divergence (JS divergence) is used as the objective function for node-level contrastive learning. JS divergence measures the difference between two probability distributions and is symmetric, making it suitable for contrastive learning scenarios. For the GNN embedding space, the node-level contrastive loss is defined as: ; in For the sigmoid function, For the current batch of nodes, This represents the number of nodes in the current batch. (First item) Encourage positive consistency scores to approach 1 (i.e., the target node is highly similar to its positive neighbors); the second term We encourage negative consistency scores to approach 0 (i.e., the target node is not similar to its negative neighbors). Similarly, we calculate the loss for the MLP embedding space. .

[0035] We obtain the overall node-level contrastive loss by weighted summation of the node-level losses in the GNN and MLP spaces: ; in This is a hyperparameter used to balance the loss contributions from the two spaces. In this embodiment, The range of values ​​is The preferred value is 0.5. This enables the GNN encoder to learn high-quality structure-aware embeddings. This allows the MLP encoder to simulate the contrastive behavior of GNNs without relying on graph structure, thereby distilling structural knowledge into the MLP.

[0036] By employing a full first-order neighborhood contrastive learning network, all first-order neighbors are directly used as positive samples, eliminating the need for random walk sampling and avoiding performance fluctuations and multi-round detection overhead caused by sampling. Since the MLP has learned to simulate the contrastive behavior of the GNN during training, the consistency score can be directly calculated using the MLP during inference without any graph structure aggregation operations. The JS divergence loss function directly optimizes the discrimination boundary between positive and negative consistency scores, clearly separating the score distributions of normal and abnormal nodes, which is beneficial for subsequent anomaly scoring. Through the joint loss of the MLP space and the GNN space, structural knowledge is efficiently transferred from the GNN to the MLP, ensuring the detection accuracy when only the MLP is used during the inference stage.

[0037] S3: Represent the embedding of each edge as the average of the embeddings of the two endpoint nodes of the edge; For each target edge, divide the positive edge pool of the target edge into at least two sub-positive edge pools, the sub-positive edge pools including the target edge and the edges that share endpoints with the target edge; Construct an edge-level contrast loss using the edges in the global negative edge pool as negative samples.

[0038] In this embodiment, an edge-level contrastive learning network based on positive and negative edge pooling is proposed. This network provides the model with rich edge-level contrastive signals by constructing a positive edge sample pool and a global negative edge sample pool, thereby fully exploring the contribution of edge information to anomaly detection.

[0039] Edge embedding is constructed based on node embedding; edges are... (Connecting nodes) and The embedding of a node is defined as the average of the embeddings of its two endpoint nodes. In the GNN embedding space... In the equation, the formula for calculating edge embedding is: ; in For nodes exist The embedding vectors in the graph, where E is the edge set of the graph. Since In this embodiment, undirected edges are treated as a single entity.

[0040] To perform edge-level contrastive learning, positive samples (edges similar to the target edge) and negative samples (edges dissimilar to the target edge) need to be defined for each target edge; a construction strategy of a multi-sub-pooling positive edge pool and a global negative edge pool is proposed. For the target edge... Its right side pool Defined as all and A set of edges that share at least one endpoint. To capture edge-level anomaly patterns at different granularities, the positive edge pool is further subdivided into three mutually exclusive sub-pools, including: Sub-pool 1 (from the edge pool) It only contains the target edge itself, used to enhance the learning of the edge's own representation: ; Sub-pool 2 (Source-side shared pool) Includes nodes shared with the target edge. (Source node) but excluding all edges of the target edge itself: ; in For nodes The set of first-order neighbors; Sub-pool 3 (Target-side shared pool) Includes nodes shared with the target edge (Target node) but excluding all edges of the target edge itself: ; The three sub-pools correspond to three edge-level anomaly patterns: Sub-pool 1 focuses on anomalies in the target edge itself (such as self-loops or anomaly weights); Sub-pool 2 focuses on edge group anomalies originating from the same source node (such as a node emitting a large number of anomaly edges); Sub-pool 3 focuses on edge group anomalies converging to the same target node (such as multiple anomaly edges pointing to the same node). This fine-grained division enables the model to learn richer edge-level contrast signals.

[0041] Since the actual graph has a huge number of edges, directly using all negative edges would lead to excessive computational overhead and GPU memory overflow. Therefore, a random sampling strategy is adopted to uniformly and randomly sample a fixed number K edges from the edge set E to form a global negative edge pool. Negative samples are used for all target edges to replace the negative edge pooling in the original definition. .Right now: ; In this embodiment, the number of samples K=60. This global pool is dynamically updated in each round of training to ensure the diversity of negative samples and the efficiency of computation.

[0042] For each positron pool This requires aggregating multiple edges into a unified representation vector for comparison with the target edge. Average pooling is used to calculate the average of all edge embeddings within a sub-pool, which is then used as the representative embedding for that sub-pool. ; The average pooling embedding of the k-th positive sub-edge pool; For the target side The k-th positive sub-edge pool; For the edge The embedding vector in the GNN embedding space is obtained by averaging the embeddings at both endpoints. Average pooling is simple, differentiable, and does not introduce additional parameters, thus avoiding the risk of overfitting.

[0043] Define target edge The edge contrast loss is: ; in, Let be the sum of the similarities between the target edge and the embeddings represented by the three positive sub-pools; This is the sum of the similarities between the target edge and all negative sample edges. The cosine similarity function is used. Temperature parameter (in this embodiment) This loss encourages the target edge to have the highest possible similarity to its positive sub-pool (especially edges sharing endpoints) and the lowest possible similarity to its negative sample edges, thereby learning a discriminative edge embedding representation.

[0044] The sizes of positive sub-pools for different target edges may vary significantly (sub-pools 2 and 3 for nodes with higher heights are larger), leading to inconsistent loss scales. To address this issue, the loss for each edge is normalized based on the total number of positive samples: ; in and They are nodes and The degree of the fraction. Denominator It is exactly equal to the total number of positive samples of the target edge (the number of edges shared by the source and the target), thus making the edge loss of different degrees comparable.

[0045] The average of the normalized losses across all edges yields the final edge-level contrast loss: ; S4: Jointly optimize the node-level contrast loss, the edge-level contrast loss, and the regularization loss based on GNN embedding to reconstruct the original attributes, and update the parameters of the MLP encoder and the GNN encoder; during the inference phase, only the trained MLP encoder is used to calculate the consistency score between each node and its first-order neighbors as the initial anomaly score, and the neighborhood entropy on the first-order neighbors of the node is used to correct the initial anomaly score, and the final anomaly score is output.

[0046] During the training phase, three objectives are optimized simultaneously: node-level contrastive loss, edge-level contrastive loss, and reconstruction regularization loss. Through joint training, the GNN encoder learns high-quality structure-aware embeddings, while the MLP encoder acquires the ability to simulate GNN behavior through knowledge distillation, ultimately enabling accurate anomaly detection during the inference phase without the need for a GNN.

[0047] The overall loss function is defined as the weighted sum of the three loss terms mentioned above: ; in, The node-level contrast loss is used (step S2). This is the edge-level contrast loss (step S3). To reconstruct the regularization loss, and To balance the hyperparameters, in this embodiment, the hyperparameter values ​​are set as follows (determined through grid search): The preferred value is 1.0; The preferred value is .

[0048] Node-level and edge-level contrastives operate on the GNN and MLP embedding spaces, respectively, potentially introducing distribution shifts between the two representations. To mitigate this issue and enhance the structural supervision signal during MLP training, a reconstruction regularization term is introduced. This term forces the GNN embedding to reconstruct the original attributes of the nodes, thus preserving attribute information and indirectly aligning the distributions of the MLP and GNN embeddings. The reconstruction regularization loss is defined as: ; in, For nodes The original attribute vector, For nodes GNN embedding, It is a non-linear decoder (in this embodiment, a two-layer MLP is used, and the output dimension is the same as the original attribute dimension). For the current training batch node set, The squared Euclidean distance (i.e., mean squared error) is used. The reconstruction term provides additional self-supervised signals, ensuring that the GNN embeddings not only contain structural information but also retain attribute reconstructibility. This helps stabilize joint training and prevents the MLP embeddings from deviating from the distribution of the GNN embeddings during distillation.

[0049] In each training iteration, the MLP encoder calculates... ; Calculated via GNN encoder ; calculate separately , , ; Calculate the total loss This process is then backpropagated to update the parameters of the MLP encoder, GNN encoder, and decoder D. MLP encoder parameters The parameters W of the GNN encoder are updated simultaneously, but independently. During training, the MLP gradually acquires structure awareness, meaning that even without graph structure input, its embeddings can simulate the behavior of GNN embeddings in contrastive learning.

[0050] The inference phase uses only the trained MLP encoder to avoid expensive neighborhood aggregation operations, thus significantly improving detection efficiency.

[0051] For each node First, the embedding is obtained using an MLP encoder. Then, the average cosine similarity between it and its first-order neighbors (positive neighborhood) is calculated as the positive consistency score: ; Since anomalous nodes are often inconsistent with their neighborhood, their positive consistency scores are low. Therefore, the initial anomalous score is defined as: ; The larger the value, the more likely the node is to be abnormal.

[0052] Some anomalous nodes (especially those with contextual anomalies) not only exhibit low similarity to their neighbors, but the similarity distribution among their neighbors may also be highly skewed (e.g., most neighbor similarity is concentrated on a few nodes). Simply using... The inability to capture such skew anomalies may lead to misjudgments. To enhance the robustness of anomalous scores, normalized neighborhood entropy is introduced as a correction factor for score correction. Specifically, this includes: For nodes In its positive neighborhood Calculate a probability distribution (neighborhood similarity distribution): ; Calculate the neighborhood entropy based on this distribution: ; Entropy Entropy measures the uniformity of the distribution of similarity between a node and its neighbors. The smaller the entropy, the more concentrated (skewed) the distribution; the larger the entropy, the more uniform the distribution.

[0053] Since different nodes have different degrees (positive neighborhood sizes), the neighborhood entropy needs to be normalized. The maximum possible entropy is... (When uniformly distributed). The normalized neighborhood entropy is defined as: ; The closer the value is to 0, the more skewed the distribution is; the closer the value is to 1, the more uniform the distribution is.

[0054] Correction function It should satisfy the condition that the neighborhood distribution is skewed ( When the distribution is small, increase the outlier score; when the distribution is uniform ( When the value is large, no adjustment is made. This invention uses a linear mapping function: ; in, For linear mapping functions, in this embodiment, it is defined as follows: That is, the maximum correction amplitude is 0.2 (when hour, The upper limit of the correction range is set to 0.2 to ensure that the correction item does not dominate the original score, but only plays a role in fine-tuning.

[0055] The final corrected outlier score is: ; For normal nodes, usually When the value is close to 1, the correction factor is close to 1, and the score remains essentially unchanged. For structurally anomalous nodes, typically... For nodes with relatively low neighbor similarity (concentrated similarity among neighbors), a correction factor > 1 is used to moderately increase the score and rank them higher. The correction range should not exceed 20% to avoid over-correcting normal nodes.

[0056] Calculate the final anomaly score for all nodes. Then, the nodes can be sorted in descending order, and the nodes with the highest scores can be selected as the detected abnormal nodes; these scores can also be directly used for downstream tasks such as anomaly ranking and threshold filtering.

[0057] Example 2 This embodiment exemplifies an efficient inference-based attribute graph anomaly detection system, including a graph encoding module, a node comparison module, an edge comparison module, and a joint training and inference module.

[0058] The graph encoding module encodes node attributes using an MLP encoder to obtain MLP embeddings, and then inputs the MLP embeddings and graph adjacency structure into a GNN encoder to obtain GNN embeddings. The parameters of the MLP encoder and the GNN encoder are independent. Initial embedding encoding is performed on the input attribute graph, generating two representation spaces: MLP embeddings and GNN embeddings. This module internally contains a multilayer perceptron (MLP) encoder and a graph neural network (GNN) encoder, with independent parameters. The MLP encoder receives the original attribute matrix of the nodes. As input, the MLP embedding is output through a two-layer fully connected network (each layer followed by a ReLU activation function). This encoder only utilizes attribute information and does not involve graph structure; therefore, its output representation lacks structure awareness. The GNN encoder receives the graph adjacency matrix A and the output of the MLP encoder. As input, a single-layer graph convolutional network (GCN) is used for neighborhood aggregation, and the output is a GNN embedding. The propagation rules of GCN are as follows: ; in, To add the adjacency matrix after adding self-loops, This is the corresponding degree matrix. For trainable weights, It uses the ReLU activation function. During the training phase, the graph encoding module simultaneously outputs... and This module is used for subsequent comparative learning; during the inference phase, only the MLP encoder is enabled, while the GNN encoder is completely bypassed, thus achieving efficient inference.

[0059] The node contrast module defines all first-order neighbors of each target node as positive samples and non-first-order neighbors as negative samples. It calculates the consistency scores between the target node and the positive and negative samples in both the GNN and MLP embedding spaces, and constructs a node-level contrastive loss. It also calculates the structural consistency between each target node and its local neighborhood, constructing a node-level contrastive loss to drive the model to learn discriminative node representations. This module performs the same contrast operation in both the GNN and MLP embedding spaces.

[0060] For each target node All of its first-order neighbors Define a positive sample as a set of nodes that are not first-order neighbors in the current training batch, and define a negative sample as the set of nodes that are not first-order neighbors in the current training batch. Cosine similarity is used as the metric function to calculate the average similarity between the target node and its positive samples. and its average similarity to negative samples : , ; in Can be or .

[0061] Based on the Jensen-Shannon divergence, the node-level contrastive loss is defined as: ; The loss for each space is: ; For the sigmoid function, To balance the hyperparameter (preferably 0.5).

[0062] In each training round, the node comparison module receives two embedding matrices output by the graph encoding module, calculates the loss for each, and updates the encoder parameters through backpropagation. This module directly uses all first-order neighbors as positive samples, avoiding subgraph sampling and multiple rounds of detection in traditional methods, thus laying the foundation for efficient inference later.

[0063] The edge contrast module represents the embedding of each edge as the average of the embeddings of the two endpoint nodes of the edge. For each target edge, the positive edge pool of the target edge is divided into at least two sub-positive edge pools, which include the target edge and edges sharing endpoints with the target edge. Edge-level contrastive loss is constructed using edges in the global negative edge pool as negative samples. This module mines structural anomalies at the edge level in graph data, generating edge-level contrastive loss through contrastive learning by constructing positive and negative edge pools, thus complementing the node-level loss. This module operates in the GNN embedding space.

[0064] For any edge Its embedding is defined as the average of the GNN embeddings at both ends: ; For each target edge Divide its positive edge pool into three sub-pools: Sub-pool 1: Contains only the target edge itself ; Subpool 2: Contains and Shared source node All other edges ; Sub-pool 3: Contains and Shared target node All other edges .

[0065] The representative embedding for each sub-pool is obtained through average pooling: .

[0066] A fixed number of edges, K (preferably 60), are randomly sampled from the edge set of the entire graph to form a global negative edge pool. All target edges share this negative edge pool.

[0067] The loss for each target edge is: ; After normalizing the loss of all edges by the number of positive samples, the average is obtained. .

[0068] The edge comparison module works in parallel with the node comparison module, and its loss is jointly optimized with the node-level loss. This module enables the model to identify various edge-level anomaly patterns such as "self-abnormal edges", "radial abnormal edges", and "converging abnormal edges" through refined positive edge pooling.

[0069] The joint training and inference module is used to jointly optimize node-level contrastive loss, edge-level contrastive loss, and regularization loss based on GNN embedding to reconstruct the original attributes, updating the parameters of the MLP encoder and GNN encoder. During the inference phase, only the trained MLP encoder is used to calculate the consistency score between each node and its first-order neighbors as the initial anomaly score. The initial anomaly score is then corrected using the neighborhood entropy of the node's first-order neighbors, outputting the final anomaly score. This module coordinates the joint optimization of the first three modules and completes the calculation and correction of anomaly scores during the inference phase, ultimately outputting the detection results. It is divided into training and inference phases.

[0070] 1) Training Phase To prevent distribution shift between MLP embeddings and GNN embeddings, a decoder is introduced. (Two-layer MLP) reconstructs the original attributes from the GNN embeddings, with the loss being the mean squared error: ; The node comparison loss, edge comparison loss, and reconstruction regularization loss are weighted and summed: ; in and Hyperparameters (preferred) , ).

[0071] The parameters of the MLP encoder, GNN encoder, and decoder D are updated simultaneously through backpropagation. After training, the GNN encoder is discarded, and only the MLP encoder is retained for inference.

[0072] 2) Reasoning stage For each node The mean cosine similarity between the algorithm and its first-order neighbors is calculated using a trained MLP encoder. The initial anomaly score is defined as follows: .

[0073] Calculate the similarity distribution entropy of a node among its first-order neighbors: ; ; Normalized entropy The corrected outlier score is: ; in, For the target node, Let the set of first-order neighbors of the target node be . , , They are nodes , , The representation vector in the MLP embedding space, For the target node with neighboring nodes The normalized probability distribution of similarity over positive neighborhoods. For the target node The positive neighborhood entropy, The normalized neighborhood entropy, The number of first-order neighbors of the target node. The initial abnormal score, The linear mapping function is a monotonically non-decreasing function; in this embodiment, it is adopted. .

[0074] Nodes are sorted in descending order of their anomaly scores, and the top-ranked nodes are output as detected anomalies, or the anomaly scores of all nodes are directly output for use by downstream tasks. The joint training and inference module serves as the scheduling core of the system. During training, it coordinates the loss calculation and parameter updates of each module, while during inference, it only activates the lightweight MLP encoder and entropy correction process, achieving efficient and accurate anomaly detection.

[0075] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the claims. It should be understood that the invention is not limited to the precise structures described above and shown in the drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A method for attribute graph anomaly detection with efficient inference, characterized in that, The method includes: The node attributes are encoded using an MLP encoder to obtain an MLP embedding; the MLP embedding and the graph adjacency structure are input together into a GNN encoder to obtain a GNN embedding; the parameters of the MLP encoder and the GNN encoder are independent of each other; All first-order neighbors of each target node are defined as positive samples, and non-first-order neighbors of the target node are defined as negative samples. The consistency scores between the target node and the positive and negative samples are calculated in the GNN embedding space and the MLP embedding space, respectively, and a node-level contrast loss is constructed. The embedding of each edge is represented as the average of the embeddings of the two endpoint nodes of the edge; for each target edge, the positive edge pool of the target edge is divided into at least two sub-positive edge pools, the sub-positive edge pools including the target edge and the edges that share endpoints with the target edge; the edge-level contrast loss is constructed using the edges in the global negative edge pool as negative samples. The parameters of the MLP encoder and the GNN encoder are updated by jointly optimizing the node-level contrast loss, the edge-level contrast loss, and the regularization loss based on GNN embedding to reconstruct the original attributes. During the inference phase, only the trained MLP encoder is used to calculate the consistency score between each node and its first-order neighbors as the initial anomaly score, and the neighborhood entropy on the first-order neighbors of the node is used to correct the initial anomaly score, and the final anomaly score is output.

2. The attribute graph anomaly detection method with efficient reasoning of claim 1, wherein, The MLP encoder is a two-layer fully connected network, with each layer followed by a ReLU activation function; the GNN encoder is a one-layer graph convolutional network, with the input features of the graph convolutional network being the MLP embedding, and the output dimension being the same as the MLP embedding.

3. The attribute graph anomaly detection method of high efficiency reasoning according to claim 1, characterized in that, The consistency score is calculated using cosine similarity; the node-level contrast loss is constructed based on Jensen-Shannon divergence. ； wherein, is a node-level contrastive loss, is a current batch of nodes, is a sigmoid function, is an average cosine similarity between the target node and positive samples, is an average cosine similarity between the target node and negative samples.

4. The attribute graph anomaly detection method of high efficiency reasoning according to claim 1, characterized in that, The sub-edge pool includes three sub-pools: the first sub-pool contains only the target edge itself, the second sub-pool contains all other edges that share a first endpoint with the target edge, and the third sub-pool contains all other edges that share a second endpoint with the target edge; wherein the first endpoint and the second endpoint are the two endpoints of the target edge.

5. The efficient inference-based attribute graph anomaly detection method according to claim 1, characterized in that, The edge-level contrast loss for each target edge is: ； in, For edge-level contrast loss, Embedding of the target edge, For the average pooling embedding of the k-th sub-positive edge pool, For global negative edge pooling, For temperature parameters, Let be the cosine similarity.

6. The efficient inference-based attribute graph anomaly detection method according to claim 5, characterized in that, The global negative edge pool is constructed by randomly sampling a fixed number of edges from the edge set of the graph.

7. The efficient inference-based attribute graph anomaly detection method according to claim 1, characterized in that, The regularization loss is: ； in, For regularization loss, For the current batch of nodes, For nodes The original properties, For nodes GNN embedding, It is a non-linear decoder.

8. The efficient inference-based attribute graph anomaly detection method according to claim 1, characterized in that, The neighborhood entropy is calculated as follows: ； The corrected outlier score is: ； in, For the target node, Let the set of first-order neighbors of the target node be . , , They are nodes , , The representation vector in the MLP embedding space, For the target node with neighboring nodes The normalized probability distribution of similarity over positive neighborhoods. For the target node The positive neighborhood entropy, The normalized neighborhood entropy, The number of first-order neighbors of the target node. The initial abnormal score, It is a linear mapping function. For the target node The final abnormal score.

9. The efficient inference-based attribute graph anomaly detection method according to claim 1, characterized in that, The total loss function in the joint optimization is: ； in, For the total loss function, For node-level comparison loss, For edge-level contrast loss, To reconstruct the regularization loss, For the trade-off hyperparameters of the edge-level contrast loss, To reconstruct the trade-off hyperparameters for regularization loss.

10. An efficient inference attribute graph anomaly detection system, used to implement the method as described in any one of claims 1-9, characterized in that, include: The graph encoding module is used to encode node attributes using an MLP encoder to obtain MLP embeddings, and inputs the MLP embeddings and graph adjacency structure into a GNN encoder to obtain GNN embeddings; the parameters of the MLP encoder and the GNN encoder are independent of each other; The node comparison module is used to define all first-order neighbors of each target node as positive samples and non-first-order neighbors of the target node as negative samples; calculate the consistency scores of the target node with positive samples and negative samples in the GNN embedding space and MLP embedding space respectively, and construct the node-level comparison loss. An edge comparison module is used to represent the embedding of each edge as the average of the embeddings of the two endpoint nodes of the edge; for each target edge, the positive edge pool of the target edge is divided into at least two sub-positive edge pools, the sub-positive edge pools include the target edge and the edges that share endpoints with the target edge; and an edge-level comparison loss is constructed using the edges in the global negative edge pool as negative samples. The joint training and inference module is used to jointly optimize the node-level contrastive loss, the edge-level contrastive loss, and the regularization loss based on GNN embedding to reconstruct the original attributes, and update the parameters of the MLP encoder and the GNN encoder. During the inference phase, only the trained MLP encoder is used to calculate the consistency score between each node and its first-order neighbors as the initial anomaly score, and the neighborhood entropy on the first-order neighbors of the node is used to correct the initial anomaly score, and the final anomaly score is output.

Images