A label-aware walk-enhanced class imbalance dynamic graph node classification method

Abstract

The application discloses a label-aware walk-enhanced category imbalance dynamic graph node classification method, and aims to solve the technical problems of low minority class node recognition recall rate, insufficient long-range dependence capture and poor model generalization caused by label category imbalance in the dynamic graph node classification task. The method first constructs a label distribution-aware spatio-temporal walk sampling strategy for a continuous-time dynamic graph to generate a time-series walk path set; secondly, a semantic-enhanced anonymous coding module is constructed based on the time-series walk path to extract spatio-temporal dependence features and generate node initial embedding; then, a time-series energy propagation layer with self-supervised regularization is constructed to realize long-range information diffusion through iterative optimization and generate the final node representation; finally, the node representation is input into a classifier to complete the graph node classification prediction. The application improves the node classification performance of the category imbalance dynamic graph, especially strengthens the recognition ability of the minority class nodes, and can be widely applied in the fields of financial anti-money laundering, social network anomaly detection, bioinformatics, traffic network anomaly recognition and the like.

Description

Technical Field

[0001] This invention relates to the fields of graph neural networks and dynamic graph node classification technology, and in particular to a node classification method for class-imbalanced temporal dynamic graphs, which can be applied to illegal / abnormal node identification tasks in scenarios such as financial transactions, social networks, and enterprise intranet security. Background Technology

[0002] With the rapid development of digital finance, social networks, and enterprise intranet security, behaviors such as transactions, interactions, and authentication can all be modeled as temporal dynamic graph structures. Graph Neural Networks (GNNs), with their ability to jointly model structure and features, have become a core technology for node classification and anomaly detection tasks. However, in real-world scenarios, the class imbalance caused by the low proportion of abnormal / illegal nodes, coupled with the scarcity of high-quality labeled samples, weakens the effective signals of supervised learning. This makes it difficult for the model to fully learn complex evolving anomaly patterns, limiting the practical application performance of existing methods.

[0003] Chinese invention patent CN119204096A proposes a graph representation learning method based on sparse and distant neighbor node enhancement. It improves the information aggregation capability of sparse nodes and distant neighbor nodes through feature enhancement and node fusion techniques, which alleviates the performance shortcomings of traditional GNN in sparse scenarios. However, this method is designed for static graph structures and does not consider the continuous time dynamic evolution characteristics of the network. It cannot capture abnormal patterns of temporal coupling and has insufficient generalization ability in dynamic graph scenarios.

[0004] Chinese invention patent CN120145231A proposes a class imbalance node classification method based on graph contrastive learning enhancement strategy. It identifies key nodes through graph contrastive learning, enhances minority class representation by generating new nodes through intra-class feature mixing, and optimizes topology modeling by combining a personalized PageRank algorithm, thereby improving classification performance in imbalanced scenarios. However, this method does not design a dedicated sampling and propagation mechanism for the temporal dependencies of dynamic graphs, and cannot achieve long-term temporal diffusion of abnormal signals. At the same time, it does not fully utilize label distribution information to optimize the sampling strategy. In dynamic scenarios with class imbalance, the recall rate of minority class abnormal nodes still has shortcomings. Summary of the Invention

[0005] The purpose of this invention is to provide a label-aware walking-enhanced method for classifying imbalanced dynamic graph nodes. It systematically solves the core problems of difficult sampling, difficult representation, and difficult propagation of abnormal patterns in time-series dynamic graphs by coordinating the design of sampling, representation, and propagation.

[0006] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0007] like Figure 1As shown, the dynamic graph node classification method of the present invention includes four core steps: label-aware spatiotemporal walk sampling, semantically enhanced anonymized encoding representation, long-range modeling of temporal energy propagation, node classification prediction and model training.

[0008] Label-aware spatiotemporal walk sampling: For continuous-time dynamic graphs, a label distribution-aware spatiotemporal walk sampling strategy is constructed. This strategy integrates temporal constraints, topological features, and label distribution information to optimize node sampling weights, generating a set of temporal walk paths that conform to temporal causality. In practice, a continuous-time dynamic graph and spatiotemporal walk paths satisfying temporal reverse order constraints are first defined. Then, label-aware weights are set using resampling multipliers and label preference strength to differentially increase the sampling priority of labeled nodes, especially minority-class anomaly nodes. Finally, temporal proximity, node degree centrality, and label preference are integrated to calculate the sampling transition probability, completing the temporal walk sampling.

[0009] Semantic Enhanced Anonymous Encoding Representation: A semantically enhanced anonymized encoding module is constructed based on the temporal walk path to complete node anonymization and fuse multi-dimensional feature encoding. After extracting spatiotemporal dependent features, the initial node embedding is generated. In specific implementation, the original identity of the node is first replaced with the relative position index to complete path anonymization. At the same time, learnable label embeddings are introduced to inject category semantic information and generate an anonymized path representation. Then, a temporal encoding function is constructed based on Bochner's theorem to adapt to interactive events with irregular time intervals and to construct an entity-time feature matrix. Finally, neighborhood information is aggregated through a multi-head attention mechanism, and the initial node embedding is obtained through pooling and feedforward neural network transformation.

[0010] Long-range modeling of temporal energy propagation: A self-supervised regularized temporal energy propagation layer is constructed. Taking the initial node embedding as input, long-range information diffusion is achieved and the final node representation is generated through iterative optimization of a multi-constraint energy function. In specific implementation, an energy function integrating feature consistency, graph smoothness, and self-supervised contrastive constraints is constructed. A robust penalty function is used to suppress the dilution of anomalous signals, and a self-supervised contrastive loss is used to avoid over-smoothing of the representation. Then, proximal gradient updates are used to iteratively optimize the energy function to ensure iterative convergence. After multi-layer propagation, the final node representation is output.

[0011] Node classification prediction and model training: The final node representation is input into the classifier to complete the classification prediction of graph nodes. In specific implementation, the final node representation is input into the fully connected layer, and the classification probability is output after passing through the sigmoid activation function. A threshold is set to complete the binary classification prediction of legal / illegal transaction nodes. The model training uses the AdamW optimizer, performs early stopping based on the F1 score on the validation set, and uses recall rate as the core indicator to evaluate the performance of illegal node identification.

[0012] In summary, compared with existing technologies, this invention has the following advantages: The invention improves the sampling coverage of minority-class anomaly nodes while ensuring temporal causality through a label-aware spatiotemporal walk sampling strategy; the semantically enhanced anonymized encoding module reduces the model's dependence on specific node identities and improves generalization ability, while also strengthening the semantic representation ability of anomaly patterns through multi-dimensional encoding fusion; the temporal energy propagation layer with self-supervised regularization achieves long-range diffusion of anomaly signals, effectively capturing multi-hop, long-term anomaly associations, while avoiding the over-smoothing problem of traditional message passing and ensuring iterative convergence; this invention completes a full-link collaborative design to address the dual constraints of class imbalance and label sparsity, maintaining good detection performance and robustness even in class imbalance scenarios. Attached Figure Description

[0013] Figure 1 This is a flowchart illustrating the overall process of the class imbalance dynamic graph node classification method based on label-aware walking augmented graph neural network (LWGNN) of this invention. Detailed Implementation

[0014] The specific embodiments of the present invention will now be described with reference to the accompanying drawings to enable those skilled in the art to better understand the invention. It should be particularly noted that in the following description, detailed descriptions of known functions and designs that might obscure the main content of the invention will be omitted here.

[0015] The class-imbalanced dynamic graph node classification method based on Label-aware Walk-enhanced Graph Neural Network (LWGNN) disclosed in this embodiment can be applied to node classification and anomaly detection tasks in continuous-time dynamic graphs in scenarios such as anti-money laundering in financial transactions, malicious account detection on social networks, and anomaly identification in enterprise intranet security. The overall process framework of this invention is as follows: Figure 1 As shown, the LWGNN model consists of a label distribution-aware spatiotemporal walk sampling module, a semantically enhanced anonymized coding module, a temporal energy propagation layer with self-supervised regularization, and a classifier connected sequentially. The method specifically includes the following steps:

[0016] Step S1: Construct a label distribution-aware spatiotemporal walk sampling strategy to generate a set of temporal walk paths.

[0017] For continuous-time dynamic graphs, a spatiotemporal walk sampling module with label distribution awareness is used to enhance the sampling weight of labeled nodes by integrating temporal constraints, topological features, and label distribution information, thereby generating a set of temporal walk paths that conform to temporal causality. The specific operation is as follows:

[0018] S11 defines a continuous-time dynamic graph as follows: ,in For a set of nodes, Given a set of directed edges with timestamps, any edge for Momentary interactive events, A set of all timestamps; for the query time The root node below The spacetime travel path is defined as follows:

[0019]

[0020] in For the travel length, the preferred option in this embodiment is... The path timestamps are strictly arranged in reverse order, satisfying the requirement that... and This ensures the integrity and causality of temporal constraints and prevents future information leaks.

[0021] S12 introduces a resampling multiplier With label preference strength Define differentiated label perception weights; in this embodiment, the preferred approach is to... The label-aware weight function is defined as follows:

[0022]

[0023] in The sampling priority of a minority of abnormal nodes is increased through differentiation, and the sampling coverage of labeled nodes is improved. For labeled root nodes, the number of walks is increased by 1.5 times to further enhance the coverage of abnormal patterns.

[0024] S13 integrates temporal proximity, node degree centrality, and label preference to calculate the sampling transition probability, completes temporal walk sampling, and generates a path set, specifically:

[0025] For nodes In time candidate neighbor set The non-normalized sampling score is defined as:

[0026]

[0027] In this embodiment, the time decay intensity The preferred value is 0.1, which represents the degree of bias suppression intensity. The preferred value is 0.05. For nodes The degree; based on the sampling score, the transition probability between nodes is:

[0028]

[0029] A single walk path is generated by iterative sampling based on the transition probability. Each root node is independently processed 20 times to generate a set of temporal walk paths.

[0030] Step S2: Construct a semantically enhanced anonymous encoding module to generate initial node embeddings.

[0031] Based on the temporal walk path, a semantically enhanced anonymization coding module is used to anonymize nodes and fuse relative position and label attribute encodings. Spatiotemporal dependency features are then extracted through temporal coding and a multi-head attention mechanism to generate initial node embeddings. The specific operations are as follows:

[0032] S21 anonymizes the nodes within the temporal walk path by replacing their original identities with relative position indices, and introduces label embedding into the pattern semantics of the injected nodes to generate an anonymized path representation:

[0033] For a single time-series walk path Generate anonymized path representation:

[0034]

[0035] in The relative position encoding of the $i$-th position in the path is achieved using trigonometric function encoding. ; Embed for node labels, This is a vector concatenation operation;

[0036] S22 constructs a temporal coding function based on Bochner's theorem, mapping irregular time intervals into learnable continuous vector representations, and constructs an entity-temporal feature matrix by combining node features:

[0037] For the path For each node, calculate its time difference with the query time. Generate 64-dimensional time codes:

[0038]

[0039] in angular frequency Sampling is performed from a geometric series to cover dependencies at different time scales; relative position encoding, label embedding, and time encoding are concatenated to construct the spatiotemporal feature matrix of the path. .

[0040] S23 calculates attention weights and aggregates neighborhood information through a multi-head attention mechanism, and generates initial node embeddings through pooling and feedforward neural network transformations.

[0041] spatiotemporal characteristic matrix Generate queries using learnable projection matrices ,key ,value Matrix, in this embodiment, is used Head attention mechanism, single-head attention uses scaled dot product form:

[0042]

[0043] in The first step is to use a single attention head dimension. The outputs of multiple attention heads are concatenated and transformed nonlinearly by a feedforward neural network to obtain an aggregated representation of a single walk path. The aggregated representations of 20 walk paths of the same root node are then averaged and transformed by another feedforward neural network to generate a 128-dimensional initial node embedding.

[0044] Step S3: Construct a time-series energy propagation layer with self-supervised regularization to generate the final node representation.

[0045] By using a temporal energy propagation layer with self-supervised regularization, and taking the initial node embedding as input, the energy function is iteratively optimized through constraints including feature consistency, graph smoothness, and self-supervised contrast to achieve long-range information diffusion and generate the final node representation. The specific operation is as follows:

[0046] S31 Constructs the energy function for optimizing node representation, with the following formula:

[0047]

[0048] in The initial embedding matrix for the nodes, For the node embedding matrix after propagation, Let this be the set of edges at the current time. A robust penalty function for Huber, balancing hyperparameters. The preferred value is 0.5. The preferred value is 0.1; self-supervised comparison loss The InfoNCE loss is defined as follows:

[0049]

[0050] in A set of positive sample pairs with spatiotemporal semantic similarity. For nodes The negative sample collection, temperature parameter\ , This is the cosine similarity function.

[0051] S32 uses proximal gradient updates to iteratively optimize the energy function, ensuring iterative convergence, and outputs the final node representation after multi-layer propagation:

[0052] Iterative optimization is performed using the proximal gradient descent method, with an iteration step size of [missing information]. Number of iterations The updated formula is:

[0053]

[0054]

[0055] in This represents the smooth, differentiable part of the energy function. For non-smooth regularized parts, The corresponding proximal operator is used; the iterative process ensures that the energy function value decreases monotonically, and the final node representation is output after 3 rounds of propagation.

[0056] Step S4: Input the final node representation into the classifier to complete the classification prediction of the graph nodes.

[0057] S41 inputs the final node representation into the fully connected layer, outputs the classification probability in the 0-1 interval through the sigmoid activation function, sets the classification threshold to 0.5, and completes the binary classification prediction of majority normal nodes / minority abnormal nodes.

[0058] The S42 LWGNN model is trained using the AdamW optimizer with a learning rate of 0.001, a weight decay of 1e-4, and a batch size of 1024. The loss function is a binary cross-entropy loss with class-balanced weights. Early stopping is performed based on the F1 score on the validation set with a patience value of 10. Recall is used as the core metric to evaluate the recognition performance of minority class nodes.

[0059] Experimental verification and effect analysis:

[0060] To verify the effectiveness of the method of the present invention, this embodiment selects three public / industry datasets from two typical scenarios: financial anti-money laundering and malicious account detection on social networks, and conducts comparative experiments with existing mainstream graph neural network models. All experiments are repeated three times, and the results are taken as mean ± standard deviation.

[0061] 1. Experimental dataset setup:

[0062] The Elliptic dataset is a publicly available Bitcoin transaction graph dataset containing 203,769 nodes and 234,355 transaction edges, divided into 49 discrete time slices. Illegal and abnormal nodes account for only about 2%, legitimate nodes account for about 21%, and the rest are unlabeled nodes, representing a typical class-imbalanced time-series dynamic graph scenario. Divided chronologically, the first 34 time slices are the training set, time slices 35-42 are the validation set, and time slices 43-49 are the test set.

[0063] IT-AML dataset: An anonymous dataset of real bank transfer transactions. Nodes are bank accounts, edges are timestamped transfer transactions, and labels are suspicious / normal accounts marked by compliance investigations. Compared with the Elliptic dataset, it has a more extreme class imbalance. The training set, validation set, and test set are divided into training set, validation set, and test set in 8:1:1 ratio according to time sequence.

[0064] TwiBot-20 Social Bot Detection Dataset: A large-scale Twitter social network dataset containing 229,573 user nodes and 455,958 follow relationship edges. The labeled automated bot accounts are a minority of anomalous nodes, accounting for a very low percentage. The training set, validation set, and test set are divided into three parts according to the user registration time in an 8:1:1 ratio.

[0065] 2. Comparison model settings:

[0066] This embodiment selects three mainstream models as comparison baselines:

[0067] (1) Static graph models: GCN, GraphSAGE;

[0068] (2) General dynamic graph models: TGAT, TGN, NeurTWs;

[0069] (3) Class imbalance-specific graph models: GraphSMOTE, CDCGAN, GraphBSSN;

[0070] (4) The method of this invention: LWGNN.

[0071] 3. Experimental Results and Analysis:

[0072] The core performance metrics (Recall, F1 score, AUC) for each model on the three datasets are as follows:

[0073] Experimental results, as shown in Tables 1 and 2, demonstrate that the LWGNN model proposed in this invention outperforms existing mainstream models on all core metrics across the three datasets. On the Elliptic and IT-AML datasets, used in the anti-money laundering scenario, the method's anomaly node recall rates reached 65.5% and 63.5%, respectively, representing improvements of 3.5 and 2.5 percentage points compared to the best-performing baseline model, GraphBSSN. As shown in Table 3, on the TwiBot-20 dataset, used in the social network bot detection scenario, the method's anomaly node recall rate reached 77.0%, a 4 percentage point improvement over the baseline model. These results fully validate the invention's superior ability to identify minority-class anomaly nodes and its excellent generalization performance in imbalanced dynamic graph scenarios.

[0074]

[0075] Table 1

[0076] Table 1 compares the performance of the method of this invention with existing mainstream models on the Elliptic anti-money laundering dataset.

[0077]

[0078] Table 2

[0079] Table 2 compares the performance of the method of this invention with existing mainstream models on the IT-AML anti-money laundering dataset.

[0080] Table 3

[0081] Table 3 is a performance comparison table of the method of the present invention and existing mainstream models on the TwiBot-20 social bot detection dataset.

[0082] Although the illustrative specific embodiments of the present invention have been described above to enable those skilled in the art to understand the invention, it should be understood that the invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the invention as defined and determined by the appended claims, and all inventions utilizing the concept of the present invention are protected.

Claims

1. A label-aware walk-enhanced method for class-imbalanced dynamic graph node classification, characterized in that, Includes the following steps: S1. For continuous-time dynamic graphs, construct a spatiotemporal walk sampling strategy that is aware of label distribution, integrate temporal constraints, topological features and label distribution information to improve the sampling weight of labeled nodes, and generate a set of temporal walk paths; S2. Construct a semantically enhanced anonymized coding module based on the temporal walk path, complete the node anonymization process and fuse the relative position and label attribute encoding, extract the spatiotemporal dependency features through temporal coding and multi-head attention mechanism, and generate the initial node embedding; S3. Construct a temporal energy propagation layer with self-supervised regularization. Taking the initial node embedding as input, the energy function with feature consistency, graph smoothness and self-supervised contrast constraints is iteratively optimized to achieve long-range information diffusion and generate the final node representation. S4. Input the final node representation into the classifier to complete the classification prediction of the graph nodes.

2. The label-aware walk-enhanced class imbalanced dynamic graph node classification method according to claim 1, characterized in that, In S1, the label distribution-aware spatiotemporal walk sampling strategy includes the following operations: S11 defines a continuous-time dynamic graph as follows: ,in for Interactive events at specific times, targeting query time. The root node below The spacetime travel path is defined as follows: ； in The path timestamps are arranged in reverse order to ensure the integrity of the temporal constraints, representing the walk length. S12, introducing the resampling multiplier With label preference strength Define label-aware weights to improve the sampling coverage of labeled nodes; S13, integrates temporal proximity, node degree centrality and label preference to calculate sampling transition probability, completes temporal walk sampling and generates path set.

3. The label-aware walk-enhanced class imbalanced dynamic graph node classification method according to claim 1, characterized in that, In S2, the semantically enhanced anonymization coding module includes the following operations: S21, Anonymize the nodes within the temporal walk path by replacing the original identity of the nodes with relative position indices, and introduce the pattern semantics of the injected nodes by embedding labels to generate anonymized path representations. S22, based on Bochner's theorem, constructs a temporal coding function to map irregular time intervals into learnable continuous vector representations, and combines node features to construct an entity-temporal feature matrix; S23 calculates attention weights and aggregates neighborhood information through a multi-head attention mechanism, and generates the initial node embedding through pooling and feedforward neural network transformation.

4. The label-aware walk-enhanced class imbalanced dynamic graph node classification method according to claim 1, characterized in that, In S3, the time-series energy propagation layer includes the following operations: S31, Construct the energy function for optimizing node representation, the formula is: ； Initial embedding of nodes, For node embedding after propagation, Let this be the set of edges at the current time. For robust penalty functions, , To balance hyperparameters, For self-supervised comparison loss; S32 uses proximal gradient updates to iteratively optimize the energy function, ensuring iterative convergence, and outputs the final node representation after multi-layer propagation.

5. The label-aware walk-enhanced method for class-imbalanced dynamic graph node classification according to claim 1, characterized in that, In S4, Includes the following operations: S41, the final node representation is input into the fully connected layer, and the sigmoid activation function outputs the classification probability in the 0-1 interval. The threshold is set to complete the binary classification prediction of the majority / minority class nodes. S42, the model is trained using the AdamW optimizer, performs early stopping based on the F1 score on the validation set, and evaluates the recognition performance of minority class nodes with recall as the core indicator.

Images