Multi-agent cooperation-based graph anomaly detection method and device, storage medium and computer device

Abstract

The application discloses a kind of based on multi-agent cooperation's graph anomaly detection method and device, storage medium, computer equipment, the method includes: obtaining the graph structure to be detected;By feature extraction agent, the low-dimensional embedding of each node in graph structure is extracted, and the topology structure and attribute feature of graph structure are reconstructed respectively according to this, the structural reconstruction error and attribute reconstruction error of each node are calculated based on reconstruction result;For each node, by exception scoring agent, according to graph structure, dynamic fusion weight is calculated, and structural reconstruction error and attribute reconstruction error are weighted summation according to dynamic fusion weight, and initial abnormal score is obtained;By result calibration agent, the initial abnormal score of each node is modified by calling domain rule base, and calibration abnormal score is generated;By exception scoring agent, the numerical distribution of calibration abnormal score is counted, and the discrimination threshold is determined according to numerical distribution, and the node exceeding discrimination threshold is judged as abnormal node, and graph anomaly detection result is generated.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a graph anomaly detection method and apparatus, storage medium, and computer equipment based on multi-agent collaboration. Background Technology

[0002] Graph data, as an effective data form capable of simultaneously representing entity attributes and their complex relationships, has been widely applied in many key fields such as social network analysis, financial transaction monitoring, bioinformatics, and recommender systems. With the continuous growth in the scale of graph data and the increasing diversification of application scenarios, efficiently and accurately identifying abnormal nodes that deviate from normal patterns (such as zombie accounts in image social networks and fraudulent transaction entities in financial networks) from massive graph data has become a core technical requirement for ensuring data security, maintaining business compliance, and improving system robustness.

[0003] Currently, graph anomaly detection toolkits, such as pyGOD, offer various deep learning-based graph anomaly detection models (e.g., DOMINANT, AnomalyDAE). Their core idea is to jointly reconstruct the graph topology and node attributes using a graph autoencoder, and then use the reconstruction error as the criterion for judging the degree of node anomaly. However, the fusion weights for structural reconstruction error and attribute reconstruction error in these existing methods are usually set to fixed values ​​based on human experience, leading to significant fluctuations in detection accuracy. Furthermore, existing methods rely entirely on model-driven approaches and cannot effectively incorporate expert experience and prior rules specific to particular business scenarios, making them unsuitable for practical applications in specialized scenarios with high costs of misjudgment, such as financial risk control and information security. Summary of the Invention

[0004] In view of this, this application provides a graph anomaly detection method and device, storage medium, and computer equipment based on multi-agent collaboration. Through the division of labor and cooperation of three agents—feature extraction, anomaly scoring, and result calibration—it solves the problem that fixed weights cannot adapt to different graph structures in the scoring stage, makes up for the problem that pure model-driven methods cannot incorporate domain knowledge in the calibration stage, and overcomes the limitation of insufficient cross-scenario generalization ability of fixed thresholds in the judgment stage. It forms a complete detection link from data reconstruction to dynamic scoring to rule calibration and then to adaptive threshold judgment. Compared with the existing technology, it has significant advantages in generalization ability, business adaptability, and detection accuracy.

[0005] According to one aspect of this application, a graph anomaly detection method based on multi-agent cooperation is provided, comprising: Obtain the graph structure to be detected; The feature extraction agent extracts the low-dimensional embeddings of each node in the graph structure, and reconstructs the topology and attribute features of the graph structure based on the low-dimensional embeddings. Based on the topology and attribute features, the structural reconstruction error and attribute reconstruction error of each node in the graph structure are calculated. For each node, the structural reconstruction error and attribute reconstruction error of the node are received by the anomaly scoring agent. Based on the edge density or node degree distribution characteristics of the graph structure, the dynamic fusion weight of the structural reconstruction error and the attribute reconstruction error is calculated. The structural reconstruction error and the attribute reconstruction error are then weighted and summed according to the dynamic fusion weight to obtain the initial anomaly score of the node. The result calibration agent receives the initial anomaly scores of each node, calls the domain rule base to correct the initial anomaly scores of each node, and generates the calibration anomaly scores of each node. The anomaly scoring agent statistically analyzes the numerical distribution of the calibration anomaly scores, determines a discrimination threshold based on the numerical distribution, and identifies nodes that exceed the discrimination threshold as anomaly nodes, generating graph anomaly detection results.

[0006] According to another aspect of this application, a graph anomaly detection device based on multi-agent cooperation is provided, comprising: The graph structure acquisition module is used to acquire the graph structure to be detected. The reconstruction error calculation module is used to extract the low-dimensional embedding of each node in the graph structure through the feature extraction agent, and reconstruct the topology and attribute features corresponding to the graph structure according to the low-dimensional embedding. Based on the topology and attribute features, the module calculates the structural reconstruction error and attribute reconstruction error of each node in the graph structure. An anomaly score calculation module is used to receive the structural reconstruction error and attribute reconstruction error of each node through an anomaly scoring agent, calculate the dynamic fusion weight of the structural reconstruction error and the attribute reconstruction error according to the edge density or node degree distribution characteristics of the graph structure, and perform a weighted summation of the structural reconstruction error and the attribute reconstruction error according to the dynamic fusion weight to obtain the initial anomaly score of the node. The anomaly score calibration module is used to receive the initial anomaly scores of each node through the result calibration agent, call the domain rule base to correct the initial anomaly scores of each node, and generate the calibration anomaly scores of each node. The abnormal node determination module is used to statistically analyze the numerical distribution of the calibration abnormal scores through the abnormal scoring agent, determine the discrimination threshold based on the numerical distribution, determine the nodes that exceed the discrimination threshold as abnormal nodes, and generate graph abnormality detection results.

[0007] According to another aspect of this application, a storage medium is provided that stores a computer program thereon, which, when executed by a processor, implements the above-described graph anomaly detection method based on multi-agent cooperation.

[0008] According to another aspect of this application, a computer device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the program to implement the above-described graph anomaly detection method based on multi-agent cooperation.

[0009] By employing the above technical solutions, this application provides a graph anomaly detection method and device, storage medium, and computer equipment based on multi-agent collaboration. Through the division of labor and cooperation among three agents—feature extraction, anomaly scoring, and result calibration—it solves the problem that fixed weights cannot adapt to different graph structures in the scoring stage, compensates for the problem that pure model-driven methods cannot incorporate domain knowledge in the calibration stage, and overcomes the limitation of insufficient cross-scenario generalization ability of fixed thresholds in the judgment stage. It forms a complete detection chain from data reconstruction to dynamic scoring to rule calibration and then to adaptive threshold judgment. Compared with existing technologies, it has significant advantages in generalization ability, business adaptability, and detection accuracy.

[0010] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0011] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 The diagram shows a flowchart of a graph anomaly detection method based on multi-agent cooperation provided in an embodiment of this application. Figure 2 This paper shows a schematic diagram of a graph anomaly detection device based on multi-agent cooperation provided in an embodiment of this application. Figure 3 A schematic diagram of the device structure of a computer device provided in an embodiment of this application is shown. Detailed Implementation

[0012] The present application will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of the present application can be combined with each other.

[0013] This embodiment provides a graph anomaly detection method based on multi-agent cooperation, such as... Figure 1 As shown, the method includes: Step 101: Obtain the graph structure to be detected.

[0014] Step 102: Extract the low-dimensional embeddings of each node in the graph structure using a feature extraction agent, and reconstruct the topology and attribute features of the graph structure based on the low-dimensional embeddings. Based on the topology and attribute features, calculate the structural reconstruction error and attribute reconstruction error of each node in the graph structure.

[0015] Step 103: For each node, the structural reconstruction error and attribute reconstruction error of the node are received by the anomaly scoring agent. According to the edge density or node degree distribution characteristics of the graph structure, the dynamic fusion weight of the structural reconstruction error and the attribute reconstruction error is calculated. The structural reconstruction error and the attribute reconstruction error are weighted and summed according to the dynamic fusion weight to obtain the initial anomaly score of the node.

[0016] Step 104: The result calibration agent receives the initial anomaly scores of each node, calls the domain rule base to correct the initial anomaly scores of each node, and generates the calibration anomaly scores of each node.

[0017] Step 105: The abnormal scoring agent statistically analyzes the numerical distribution of the calibration abnormal scores, determines the discrimination threshold based on the numerical distribution, and identifies nodes that exceed the discrimination threshold as abnormal nodes, generating graph abnormality detection results.

[0018] This application provides a graph anomaly detection method based on multi-agent collaboration, which can effectively identify abnormal nodes in graph structures. Graph structure data plays an important role in many application scenarios. For example, in social networks, users are nodes and friend relationships are edges; in financial transaction networks, accounts are nodes and transfer records are edges. Each node also has a feature vector describing its own attributes. In this application embodiment, firstly, the graph structure to be detected is obtained. This graph data contains both the connection relationships between nodes (topology) and the attribute information of each node itself. However, the original data is often high-dimensional and complex in structure, and cannot be directly used to determine whether a node is abnormal. Therefore, a feature extraction agent is introduced. The feature extraction agent first compresses the original information of each node into a compact low-dimensional vector that can retain the core semantics (i.e., low-dimensional embedding), and then reverse-engineers based on these low-dimensional vectors to try to reconstruct the original topology and attribute features. By comparing the difference between the original data and the reconstructed data, the reconstruction error of each node is calculated. Reconstruction error reflects the degree to which a node is "out of place" in the graph. It is divided into two dimensions: structural reconstruction error and attribute reconstruction error. The former measures whether the connection pattern between the node and other nodes is abnormal, while the latter measures whether the attribute value of the node itself is abnormal. The larger the reconstruction error, the more the behavior pattern of the node deviates from the normal pattern in the graph.

[0019] These two types of reconstruction errors have completely different weights in determining anomalies depending on the graph structure. In a densely connected social network, the rich topological information allows structural reconstruction errors to be highly sensitive to anomalies, thus giving them a higher weight. Conversely, in a sparsely connected molecular network, the structural information is insufficient, resulting in low discriminative power for structural reconstruction errors. In this case, attribute reconstruction errors are more effective at reflecting problems. Based on this insight, the anomaly scoring agent can first analyze the dispersion of edge density or node degree distribution in the current graph structure. Based on this, it adaptively calculates the fusion weights for structural and attribute reconstruction errors, and then uses these calculated weights to perform a weighted sum of the two types of errors, generating a fused initial anomaly score for each node. The key to this process is that the weights are not fixed values ​​preset by humans, but automatically adapt to different graph structures, freeing anomaly scoring from prior assumptions about specific types of graph data. It should be noted that attribute features can refer to vectorized data carried by each node that describes the inherent attributes of the entity. For example, in social networks, this could be a user's registration duration, number of followers, recent active time, and posting frequency; in financial transaction networks, it could be an account's total transaction amount, transfer frequency, account balance, and account type; and in biological networks, it could be molecular weight, structural coding, and charge number. Specifically, all node-level descriptive information, except for topological structure (i.e., the connections between nodes), can fall under the category of attribute features.

[0020] The initial anomaly score provided by the anomaly scoring agent is based on pure statistical inference from the data. However, in real-world business scenarios, there is often domain knowledge that the anomaly scoring agent struggles to capture. For example, in financial risk control, multiple large cross-account transfers within a short period, while perhaps not significant in terms of reconstruction error, should be given high attention based on expert experience. Conversely, some internal test accounts, although having larger reconstruction errors, are clearly known in the business to be normal operations and should not be judged as anomalies. The result calibration agent is introduced to address this issue. It can load a pre-built domain rule base and perform fine-tuning of the initial anomaly score for each node at the business level. Specific calibration methods can include amplifying or reducing the score when a business rule is hit, compensating for the score based on business characteristics, and directly resetting the score of whitelisted nodes to zero. Finally, it outputs a calibrated anomaly score corrected by expert knowledge, ensuring that the detection results remain objective while being specific to the business scenario.

[0021] After obtaining the calibration anomaly scores for each node, a discrimination threshold can be determined to convert the scores into a binary judgment of whether they are anomalies or not. Specifically, the anomaly scoring agent can perform statistical analysis on the calibration anomaly scores of all nodes, and dynamically determine the discrimination threshold based on the overall numerical distribution of the scores. For example, the score corresponding to the 95th percentile can be taken as the discrimination threshold after arranging the scores from low to high. This approach allows the discrimination threshold to automatically adapt to the actual distribution of each batch of data to be detected. The discrimination threshold varies for different graph structures and different scenarios, avoiding the problem of misjudgment or missed judgment caused by a fixed threshold under different data distributions. Then, the calibration anomaly score of each node is compared with this dynamic discrimination threshold. Nodes that exceed the discrimination threshold are judged as anomalies, and the final output includes the anomaly node identifier, calibration anomaly score, and anomaly type.

[0022] By applying the technical solution of this embodiment, through the division of labor and cooperation of three intelligent agents—feature extraction, anomaly scoring, and result calibration—the shortcomings of fixed weights in adapting to different graph structures are solved in the scoring stage. In the calibration stage, the problem of pure model-driven approaches being unable to incorporate domain knowledge is compensated for. In the judgment stage, the limitation of insufficient cross-scenario generalization ability of fixed thresholds is overcome. A complete detection link is formed from data reconstruction to dynamic scoring to rule calibration and then to adaptive threshold judgment. Compared with existing technologies, it has significant advantages in generalization ability, business adaptability, and detection accuracy.

[0023] Optionally, after obtaining the graph structure to be detected, the method further includes converting the graph structure into a standardized graph structure by a preprocessing agent based on the following steps: analyzing the distribution characteristics of the graph structure, the distribution characteristics including at least one of node density, attribute feature dimension, and attribute feature missing value ratio; selecting at least one preprocessing strategy from candidate preprocessing strategies to process the graph structure according to the distribution characteristics, generating a standardized graph structure, and sending the standardized graph structure to the feature extraction agent.

[0024] In this embodiment, the raw image data often contains a lot of noise and irregularities. If it is directly fed into the feature extraction agent for processing, the accuracy of subsequent reconstruction and anomaly scoring may be affected by data quality issues. Therefore, a preprocessing agent can be called before feature extraction. This agent can perform quality checks and cleaning on the raw data to ensure that the data entering the feature extraction stage is standardized, clean, and uniformly formatted, thereby laying a reliable data foundation for the entire subsequent detection process.

[0025] The preprocessing agent first analyzes the distribution characteristics of the graph structure. Here, distribution characteristics refer to various indicators exhibited by the graph data at the statistical level, specifically including node density (the ratio of the actual number of edges in the graph structure to the maximum possible number of edges, reflecting the sparsity or density of the graph structure), attribute feature dimension (the number of attribute features carried by each node, reflecting the size of the feature space), and the proportion of missing attribute values ​​(the proportion of unrecorded or invalid values ​​in node attributes, reflecting the completeness of the data). The preprocessing agent can analyze one or more of the above three factors to comprehensively evaluate the current state of the graph structure.

[0026] Furthermore, based on the analyzed distribution characteristics, the preprocessing agent selects at least one candidate preprocessing strategy to process the graph structure. The candidate preprocessing strategies can be pre-configured data processing methods. For example, for sparse graphs with extremely low node density, edge pruning can be performed to remove isolated nodes that are not connected to any other nodes, thereby reducing data noise; for cases where attribute feature dimensionality is too high, feature dimensionality reduction can be performed to compress redundant information and avoid the curse of dimensionality; for cases where the proportion of missing values ​​is too high, missing value imputation can be performed, using known data to infer and fill in unknown attribute values. The preprocessing agent can determine which processing is needed for the current graph structure based on the analyzed distribution characteristics, and thus dynamically combine the most suitable preprocessing strategy for the current graph structure.

[0027] After the above selection and processing, the preprocessing agent outputs a standardized graph structure: in terms of quality, cleaning and padding make the data more complete and accurate; in terms of format, raw data from different sources and in different formats are uniformly converted into a standard data format that the feature extraction agent can directly accept. Subsequently, the preprocessing agent sends the generated standardized graph structure to the feature extraction agent as input for subsequent low-dimensional embedding extraction and reconstruction error calculation.

[0028] The preprocessing agent in this application embodiment can dynamically select the most suitable processing strategy based on the specific distribution characteristics of each graph structure, making the entire detection process robust to fluctuations in data quality. At the same time, the standardized output format provides reliable data input assurance for the stable operation of subsequent feature extraction agents and anomaly scoring agents.

[0029] Optionally, in this embodiment, the step of "selecting at least one preprocessing strategy from candidate preprocessing strategies to process the graph structure and generate a standardized graph structure according to the distribution characteristics" includes: if the node density is lower than a preset density threshold, traversing all nodes in the graph structure, identifying nodes with a degree value of zero as isolated nodes, and removing the isolated nodes and all their associated edges from the graph structure; if the attribute feature dimension is higher than a preset dimension threshold, performing a dimensionality reduction transformation on the original attribute features of the graph structure to generate dimensionality-reduced attribute features; if the missing attribute value ratio is higher than a preset ratio threshold, determining the missing attribute value of the node to be filled by iteratively aggregating the attribute features of the neighboring nodes of the node to be filled, and using the missing attribute value as the current attribute feature of the node to be filled; and outputting the processed graph structure as a standardized graph structure.

[0030] In this embodiment, after analyzing the distribution characteristics of the graph structure, the preprocessing agent can trigger corresponding processing strategies based on specific distribution features. When the node density of the graph structure is detected to be lower than a preset density threshold, it indicates that the graph structure is very sparse, with a large number of isolated nodes that have no connection to other nodes. Here, the degree value refers to the number of edges connected to a node. A degree value of zero means that the node has no edges with any other node in the graph and is completely outside the main connected structure. These isolated nodes do not carry any topological information but can consume computational resources for subsequent feature extraction and reconstruction. Therefore, the preprocessing agent traverses all nodes, identifies nodes with a degree value of zero and removes them from the graph structure, while deleting all edges associated with them, thereby performing an effective pruning and purification of the graph structure.

[0031] When the analysis results show that the dimensionality of the attribute features exceeds a preset dimensionality threshold, it indicates that each node carries a large amount of attribute information. An excessively large feature space may lead to the curse of dimensionality, resulting in excessively high computational complexity and a tendency for overfitting in subsequent models. In this case, the preprocessing agent triggers a feature dimensionality reduction strategy, performing a dimensionality reduction transformation on the original attribute features. This involves compressing the high-dimensional attribute space into a low-dimensional attribute space through linear or nonlinear mathematical mappings, while preserving as much of the most important principal component information as possible from the original data. The dimensionality of the attribute features is significantly reduced after dimensionality reduction, but the core discriminative information is retained. This not only greatly reduces the computational overhead of subsequent feature extraction and reconstruction but also effectively alleviates the model performance degradation caused by distance metric distortion in the high-dimensional feature space.

[0032] When the analysis results show that the proportion of missing attribute features exceeds a preset threshold, it indicates that a large number of nodes in the graph structure have no records or invalid values ​​for certain attribute dimensions. Using such incomplete data directly would severely affect the accuracy of subsequent reconstruction error calculations. The preprocessing agent chooses a graph-based feature propagation strategy to handle missing values. Its core idea is to use the association information within the graph structure itself to infer missing attribute values. Specifically, for each node with missing attribute values ​​to be filled, the preprocessing agent iteratively propagates attribute features along the edges to neighboring nodes. The attribute features of the neighboring nodes are then weighted and aggregated to estimate the missing attribute value for that node. The filled value is then used as the node's current attribute feature. This process can be repeated multiple times. As iterations proceed, attribute information gradually diffuses and propagates through the graph structure, ultimately ensuring that all missing attribute values ​​are filled with reasonable values, and that the filled values ​​fully consider the contextual information of the node within the local topology.

[0033] After the preprocessing operations described above, the preprocessing agent outputs the processed graph structure as a standardized graph structure. Isolated nodes in this standardized graph structure have been removed, making the topology more concise and compact. High-dimensional attribute features have been compressed and reduced in dimensionality, making the feature space more refined and efficient. Missing attribute values ​​have been filled with graph structure information, significantly improving data completeness. The entire graph structure has achieved a unified format and reliable quality at both the topological and attribute levels, and can be directly used as standardized input for the feature extraction agent to perform subsequent low-dimensional embedding extraction and reconstruction error calculation.

[0034] This application embodiment achieves refined quality governance of graph structures through parallel monitoring and adaptive triggering of three dimensions: node density, feature dimension, and missing value ratio. It achieves a good balance between computational efficiency and data integrity. The three branch strategies are effective independently and do not interfere with each other, ensuring that the preprocessing agent can provide targeted processing regardless of the quality problems in the graph structure, thereby laying a solid data foundation for the entire anomaly detection process.

[0035] In this embodiment, optionally, the feature extraction agent reconstructs the topology and attribute features corresponding to the graph structure based on the following steps: obtaining the graph type of the graph structure, wherein the graph type is a static attribute graph, a dynamic graph, or a multimodal graph; when the graph type is a static attribute graph, calling a structural autoencoder to encode the adjacency matrix of the graph structure to generate structural representations of each node, calling an attribute autoencoder to encode the attribute matrix of the graph structure to generate attribute representations of each node, and concatenating the structural representations and the attribute representations to form low-dimensional embeddings of each node; decoding the low-dimensional embeddings of each node through a structural decoder to reconstruct the topology of the graph structure, and decoding the low-dimensional embeddings of each node through an attribute decoder to reconstruct the attribute features of the graph structure; when the graph type is a dynamic graph, detecting newly added nodes and / or edges in the graph structure relative to historical time, identifying incremental change regions based on the detection results; determining each newly added node involved in the incremental change region, performing feature encoding on each newly added node, and generating low-dimensional embeddings of each newly added node. The process involves: inputting the low-dimensional embeddings of each newly added node; decoding and reconstructing each newly added node using a decoder to generate adjacency matrix reconstruction data and attribute matrix reconstruction data corresponding to each newly added node, serving as the incremental reconstruction result; acquiring the historical reconstruction results of each historical node at a historical moment; merging the incremental reconstruction results with the historical reconstruction results to obtain the topological structure and attribute features after full node reconstruction; when the graph type is a multimodal graph, assigning an encoder to the original data of each modality for independent encoding to generate modality encoding vectors for each node in each modality; performing cross-modal fusion of the modality encoding vectors of the same node through an attention mechanism to generate multimodal low-dimensional embeddings for each node; decoding and reconstructing the multimodal low-dimensional embeddings node by node using the decoder corresponding to each modality to output the predicted reconstruction data of each node in each modality; determining the topological structure of the reconstructed graph structure based on the predicted reconstruction data corresponding to the topological modality in the predicted reconstruction data, and determining the attribute features of the reconstructed graph structure based on the predicted reconstruction data corresponding to the non-topological modality in the predicted reconstruction data.

[0036] In this embodiment, feature extraction is the core technical step in the entire graph anomaly detection process. Its goal is to transform the raw graph data into a low-dimensional embedded representation that reflects the essential characteristics of each node, and to provide an error basis for subsequent anomaly scoring through the reconstruction process. However, different types of graph structures differ fundamentally in their structural characteristics and processing requirements. All information in a static attribute graph is fixed over time, while the information in a dynamic graph evolves and accumulates over time, and the information in a multimodal graph originates from various types of raw data. Therefore, before performing feature extraction, the feature extraction agent first acquires and determines the graph type of the current graph structure to be processed, so that different processing strategies can be invoked accordingly.

[0037] When the graph type is a static attribute graph, the information of all nodes and edges in the graph is fixed at the detection time, with no change in the time dimension and no need for multi-modal fusion. For this most common graph type, the feature extraction agent calls a structural autoencoder to encode the adjacency matrix of the graph structure. The adjacency matrix is ​​a square matrix, where each row and each column corresponds to a node. The values ​​in the matrix indicate whether there is an edge connection between corresponding node pairs, thus completely describing the topological connections between all nodes in the graph. At the same time, the feature extraction agent calls an attribute autoencoder to encode the attribute matrix of the graph structure. Each row of the attribute matrix corresponds to a node, and each column corresponds to an attribute dimension. The values ​​in the matrix record the specific values ​​of each node in each attribute dimension, thus completely describing the feature information of all nodes themselves. After these two independent encodings, each node obtains a structural representation and an attribute representation, which are respectively high-dimensional abstractions of the node in the topological and attribute dimensions. Subsequently, the feature extraction agent concatenates the structural and attribute representations of the same node along the vector dimension to form a unified low-dimensional embedding. This embedding simultaneously condenses the topological and attribute information of the node, which is the basis for subsequent decoding and reconstruction. Building upon this, the structural decoder takes the low-dimensional embeddings of each node as input, reverse-engineers, and outputs the reconstructed adjacency matrix; similarly, the attribute decoder takes the low-dimensional embeddings of each node as input, reverse-engineers, and outputs the reconstructed attribute matrix. These two decoder structures form a symmetrical relationship with their corresponding encoders, constituting two independent "encoder-decoder" pathways, responsible for compressing and restoring the topological and attribute dimensions, respectively. It's important to note that the deviation between the decoded data and the original data is essentially the information loss caused by the autoencoder discarding non-critical information during compression to preserve core features. In anomaly detection, because the autoencoder compresses and decompresses according to the distribution pattern of normal nodes, abnormal nodes, deviating from this pattern, exhibit significantly greater deviations during reconstruction than normal nodes, thus becoming the basis for anomaly detection.

[0038] When the graph type is dynamic, the nodes or edges in the graph structure are constantly added or updated over time. If the entire graph is reprocessed every time a change occurs, the computational cost will increase dramatically with the graph size, making it difficult to meet the needs of real-time detection. Therefore, the feature extraction agent first detects which nodes and edges have been added to the graph structure at the current time compared to historical time steps, and identifies the changed local regions, i.e., the incremental change regions, rather than treating the entire graph as a whole. Subsequently, the feature extraction agent determines each newly added node involved in the incremental change region and performs feature encoding on each of these newly added nodes, generating a low-dimensional embedding for each node. Based on the low-dimensional embeddings of each newly added node, the decoder decodes and reconstructs each newly added node separately, generating adjacency matrix reconstruction data (i.e., the predicted values ​​of the node's connections with all other nodes in the graph) and attribute matrix reconstruction data (i.e., the predicted values ​​of each attribute feature of the node). These reconstruction results are collectively referred to as incremental reconstruction results. Simultaneously, the feature extraction agent obtains the historical reconstruction results of each historical node that have been stored in previous detection batches. These results have already been calculated and verified in previous detection batches and do not need to be recalculated in the current batch. Finally, the feature extraction agent merges the incremental reconstruction results with the historical reconstruction results. The reconstruction results of historical nodes are retained as is and do not participate in any recalculation, while the reconstruction results of newly added nodes are directly added to the corresponding positions in the full result. Thus, without recalculating historical nodes, the complete topological structure and attribute features after full node reconstruction are obtained efficiently. This incremental update mechanism ensures that the computational cost of processing dynamic graphs is always proportional to the amount of change, rather than proportional to the total size of the graph, thereby significantly improving the detection efficiency in dynamic scenes.

[0039] When the graph type is multimodal, each node in the graph may carry multiple different types of data information simultaneously. For example, in a social network, a user node may simultaneously contain text modality (posted content), image modality (user avatar), and topological modality (friend relationships). These different modalities of data have fundamental differences in form, structure, and semantics, and cannot be directly mixed together for processing. Therefore, the feature extraction agent first assigns an encoder matching the data type of the raw data for each modality to encode it independently. For example, text modality data is encoded using a natural language processing encoder such as BERT to extract textual semantic features, topological modality data is encoded using a graph neural network encoder such as GCN to extract structural features, and image modality data is encoded using a visual encoder such as CNN to extract visual features. After each independent encoding, each node obtains a modality encoding vector for each modality, and these vectors describe a certain dimension of the node's features from different perspectives. Since the encoding vectors of different modalities may differ significantly in semantic space and numerical scale, simply concatenating them can lead to information loss and weight imbalance. For example, high-dimensional text features may numerically suppress low-dimensional structural features, making the fused representation unable to truly reflect the comprehensive information of each modality. To address this, the feature extraction agent introduces an attention mechanism to perform cross-modal fusion of the encoding vectors of different modalities at the same node. The core idea of ​​the attention mechanism is to allow the model to automatically learn the importance weight of each modality for the current node. Modalities with higher importance have a larger weight in the fusion, while those with lower importance have a correspondingly reduced influence. Finally, the attention-weighted fusion generates a multimodal low-dimensional embedding for each node. After obtaining the multimodal low-dimensional embedding, the feature extraction agent decodes and reconstructs the embedding node by node using the decoders corresponding to each modality. Each modality's decoder reconstructs the original data under that modality based on the same multimodal low-dimensional embedding. For example, the topology decoder reconstructs information related to the topology structure, the attribute decoder reconstructs information related to attribute features, the text decoder reconstructs information related to the text content, and so on. Ultimately, among the predicted reconstruction data of all modalities, the reconstruction data corresponding to the topological modalities is determined as the reconstructed topological structure of the graph structure, while the predicted reconstruction data corresponding to non-topological modalities (such as attribute modalities, text modalities, image modalities, etc.) are uniformly classified into the reconstruction attribute features of the graph structure. This is because no matter how many non-topological modalities the graph data contains, they are essentially descriptions of the node's own attribute information, only differing in form. Therefore, they can be unified under the broad concept of attribute features, thus forming a precise correspondence with the two types of errors received in the subsequent anomaly scoring process: structural reconstruction error and attribute reconstruction error.

[0040] In this embodiment, the feature extraction agent, through an architecture design that first identifies the graph type and then adapts the processing method, achieves processing of static attribute graphs, dynamic graphs, and multimodal graphs. Figure 3 Differentiated processing for different scenarios: the three processing strategies are independent and do not interfere with each other, together forming a general feature extraction framework covering static, dynamic, and multimodal scenarios, providing an accurate and reliable error data foundation for subsequent anomaly scoring and result calibration.

[0041] Optionally, in this embodiment of the application, step 103, "calculating the dynamic fusion weight of the structural reconstruction error and the attribute reconstruction error based on the edge density or node degree distribution characteristics of the graph structure," includes: calculating the ratio of the number of edges to the number of nodes in the graph structure as the edge density of the graph structure; determining a first weight coefficient corresponding to the structural reconstruction error based on the edge density; determining a second weight coefficient corresponding to the attribute reconstruction error based on the first weight coefficient; and using the first weight coefficient and the second weight coefficient as the dynamic fusion weight, wherein the first weight coefficient is positively correlated with the edge density; statistically analyzing the degree values ​​of all nodes in the graph structure; determining a first weight coefficient corresponding to the structural reconstruction error based on the variance or range of the degree values; determining a second weight coefficient corresponding to the attribute reconstruction error based on the first weight coefficient; and using the first weight coefficient and the second weight coefficient as the dynamic fusion weight, wherein the first weight coefficient is positively correlated with the variance or range.

[0042] In this embodiment, before the anomaly scoring agent merges the structural reconstruction error and attribute reconstruction error of each node into a single initial anomaly score, the importance of each type of error is first determined. Simply adding them at a fixed ratio would ignore the significant differences in the contribution of topological and attribute information to anomaly identification under different graph structures. Therefore, the anomaly scoring agent adaptively calculates the fusion weights of both based on the inherent characteristics of the current graph structure. In actual execution, the anomaly scoring agent can choose one of the two for weight calculation according to a preset configuration.

[0043] The first weighting calculation scheme is based on the edge density of the graph structure. Edge density refers to the ratio of the actual number of edges in a graph structure to the maximum possible number of edges. A higher ratio means denser connections between nodes, richer topological information, and a more accurate reflection of the abnormality of nodes by the structural reconstruction error. The anomaly scoring agent first calculates the ratio of the number of edges to the number of nodes in the current graph structure as the edge density, and then determines the first weight coefficient corresponding to the structural reconstruction error based on this edge density. This coefficient is positively correlated with the edge density. When the graph structure is dense, the first weight coefficient takes a higher value, making the structural reconstruction error dominate the anomaly scoring; when the graph structure is sparse, the first weight coefficient takes a lower value, reducing the influence of the structural reconstruction error. After determining the first weight coefficient, the second weight coefficient corresponding to the attribute reconstruction error is determined based on the first weight coefficient. The sum of the two is always equal to 1. Therefore, the second weight coefficient is actually a complementary value to the first weight coefficient. That is, in sparse graphs, the attribute reconstruction error has a higher weight in the anomaly scoring because topological information is insufficient and attribute features are more reflective of the abnormal state of nodes. Ultimately, the anomaly scoring agent uses both the first and second weight coefficients as the dynamic fusion weights for the two types of reconstruction errors.

[0044] The second weighting scheme is based on the degree distribution characteristics of all nodes in the graph structure. A node's degree value refers to the number of edges directly connected to it, reflecting its connectivity activity within the graph. The variance or range of all node degree values ​​measures the dispersion of connectivity activity across the entire graph. The anomaly scoring agent first counts the degree values ​​of all nodes in the graph structure, then calculates the variance or range of these degree values. Both are statistical measures of data dispersion; variance reflects the overall deviation of degree values ​​from the average, while range reflects the span between the maximum and minimum degree values. When the variance or range of degree values ​​is large, it indicates that the graph structure contains both highly connected hub nodes and a large number of edge nodes, indicating strong topological heterogeneity. This means that structural reconstruction errors have a stronger ability to distinguish between different local regions. Therefore, the anomaly scoring agent establishes a positive correlation between the first weight coefficient and the variance or range. The greater the degree of dispersion, the higher the weight of structural reconstruction error in anomaly scoring; conversely, if the degree values ​​of all nodes are very similar, the topological information of the graph structure tends to be homogeneous, and the distinguishability of structural reconstruction error decreases, so the weight of structural reconstruction error should be reduced. Similarly, the second weight coefficient is determined after the first weight coefficient is determined, and the sum of the two is always equal to 1, ultimately constituting the dynamic fusion weight.

[0045] In actual execution, the anomaly scoring agent can select one of the schemes for weight calculation according to the preset configuration. The two schemes do not interfere with each other and realize the quantitative evaluation of graph structure features from two different dimensions: edge density and degree distribution dispersion, respectively, and complete the adaptive determination of dynamic weights for the two types of reconstruction errors.

[0046] This application's embodiments establish a positive correlation between weight coefficients and the edge density or degree distribution dispersion of the graph structure. This allows structural reconstruction errors to automatically receive higher weights when topological information is abundant, and attribute reconstruction errors to automatically receive higher weights when topological information is scarce. This completely eliminates the limitation of traditional schemes that rely on pre-fixed weights based on human experience. This data-adaptive weight allocation mechanism ensures that the anomaly scoring process always matches the inherent characteristics of the current graph structure. This means that regardless of whether the graph is dense, sparse, or has an extremely uneven degree distribution, the fusion ratio of the two types of reconstruction errors can accurately reflect their true contribution to anomaly identification, thereby effectively improving the generalization ability and scoring accuracy of anomaly detection across scenes and datasets.

[0047] In this embodiment of the application, optionally, for each node, the result calibration agent generates the calibration anomaly score of the node based on the following steps: obtaining the business scenario corresponding to the graph structure, loading the domain rule base, extracting a set of correction rules matching the business scenario from the domain rule base, wherein each correction rule in the set of correction rules has its own execution attributes and execution priority, and the execution attributes include mutually exclusive attributes and superimposed attributes; when the set of correction rules contains correction rules with mutually exclusive attributes, the initial anomaly score is corrected by the correction rules with mutually exclusive attributes, and the correction result is used as the final calibration anomaly score; when the set of correction rules contains only correction rules with superimposed attributes, the initial anomaly score is corrected sequentially by the correction rules with superimposed attributes according to the execution priority, and the execution result of the last executed correction rule is used as the final calibration anomaly score; when the set of correction rules is empty, the initial anomaly score is used as the final calibration anomaly score.

[0048] In this embodiment, the initial anomaly score is calculated entirely based on the reconstruction error of the graph structure, reflecting the agent's judgment on the degree of node deviation from the perspective of data distribution. However, in actual business scenarios, the correction logic that should be adopted when different nodes hit different business rules is often different. After receiving the initial anomaly scores of each node, the result calibration agent first obtains the business scenario to which the current graph structure belongs (such as financial transaction monitoring, social network risk control, or bioinformatics analysis), and then loads a pre-built domain rule base. This rule base contains various judgment rules for different business scenarios. The result calibration agent can extract a set of correction rules that match the current business scenario. These correction rules each have two key features: execution attribute and execution priority. The execution attribute is used to identify whether the rule is mutually exclusive or superimposed when executed. The mutually exclusive attribute means that once the rule is executed, its result is the final conclusion, and no other rules are considered. The superimposed attribute means that the rule is fine-tuned based on the current score and then handed over to subsequent rules for processing.

[0049] When the set of correction rules includes correction rules with mutually exclusive attributes, the result calibration agent directly corrects the initial anomaly score using that mutually exclusive rule (e.g., setting the initial anomaly score to zero or a preset safety value), and uses the corrected result as the final calibration anomaly score for that node. Simultaneously, it skips all remaining rules in the correction rule set and does not perform any further correction operations. This design ensures that the highest priority of mutually exclusive rules is strictly guaranteed, preventing superimposed rules from making secondary adjustments to the results of mutually exclusive rules, thus avoiding compromising the correctness of the business logic.

[0050] When the set of correction rules does not contain mutually exclusive attributes but contains superimposed attributes, it indicates that there is no mutually exclusive relationship in business logic among the multiple rules matched by the current node. Multiple rounds of superimposed adjustments can be made based on the initial anomaly score. The calibration agent executes the superimposed rules sequentially according to their preset execution priorities. For example, the rule with the highest priority is executed first, adjusting the current score once; then the rule with the next lower priority adjusts the score again based on the previous correction result, and so on, until all superimposed rules have been executed. The output of the last executed correction rule is used as the final calibrated anomaly score for that node. This chain-like superimposed execution method allows the rules to complement each other: one rule is responsible for capturing business anomaly patterns and amplifying the score, while another rule is responsible for compensating and correcting based on the magnitude of business characteristics. Multiple rules refine the initial anomaly score from different dimensions, working together on the same node.

[0051] Furthermore, when the set of correction rules is empty, meaning the current node does not hit any correction rules, the node skips all correction operations, the initial anomaly score remains unchanged, and is directly output as the final calibration anomaly score.

[0052] This application's embodiments construct a rule calibration mechanism that combines rigid constraints with flexible adjustment capabilities through the classification design of mutually exclusive and superimposed rules, and the introduction of execution priorities. Mutually exclusive rules ensure that scenarios requiring absolute accuracy in business operations, such as whitelists and test nodes, can directly cover the model's output score, avoiding false positives. Superimposed rules allow different business rules to be sequentially superimposed and applied on the same node, achieving multi-dimensional and refined score correction without the need for manual judgment of conflict relationships between rules. This mechanism enables anomaly detection results to maintain objectivity while flexibly adapting to the differentiated needs of different business scenarios.

[0053] In this embodiment of the application, optionally, the anomaly scoring agent determines the discrimination threshold based on the following steps: obtaining the calibration anomaly scores of all nodes to form a score set for the current detection batch, and statistically analyzing each calibration anomaly score in the score set to determine the numerical distribution state of the score set; obtaining the detection performance indicators of historical detection batches, and determining a threshold offset coefficient based on the deviation of the detection performance indicators relative to the target performance indicators, wherein the detection performance indicators include at least one of recall, precision, and F1 score; determining a baseline quantile based on the numerical distribution state of the score set, and adjusting the baseline quantile based on the threshold offset coefficient to obtain a target quantile; selecting the score value corresponding to the target quantile from the score set as the discrimination threshold for the current batch.

[0054] In this embodiment, after obtaining the calibration anomaly scores of all nodes, the anomaly scoring agent can determine a discrimination threshold to convert continuous score values ​​into a binary judgment result of whether or not anomaly occurs. The selection of the discrimination threshold directly determines which nodes will ultimately be marked as anomalies. If the discrimination threshold is set too low, a large number of normal nodes will be misclassified as anomalies; if it is set too high, truly anomalous nodes will be missed. To solve this problem, the anomaly scoring agent first obtains the calibration anomaly scores of all nodes in the current detection batch, aggregates these scores into a score set, and then performs statistical analysis on all score values ​​in the set to calculate its overall numerical distribution, including the central tendency, dispersion, and frequency distribution in different intervals.

[0055] While relying solely on the score distribution of the current batch to determine the discrimination threshold can adapt to the statistical characteristics of the current data, it cannot reflect the actual performance of the detection system in past operations. For example, if the discrimination threshold was set too low in historical batches, resulting in a large number of false positives, or set too high, resulting in a large number of false negatives, these lessons should be used to guide the adjustment of the threshold for the current batch. Therefore, the anomaly scoring agent also obtains the detection performance indicators recorded in historical detection batches. These indicators may include recall (the proportion of successfully detected true anomalies out of all true anomalies, reflecting the recall capability), precision (the proportion of true anomalies among those judged as anomalies, reflecting the precision capability), and F1 score (the harmonic mean of recall and precision, reflecting the overall detection performance). The anomaly scoring agent compares the historical actual performance indicators with the preset target performance indicators and calculates the deviation between the two. For example, a recall rate lower than the target value indicates that the system has a false negative problem, and a precision rate lower than the target value indicates that the system has a false positive problem. Based on the direction and magnitude of the deviation, the anomaly scoring agent determines a threshold offset coefficient, which indicates whether the discrimination threshold of the current batch should be adjusted upward or downward relative to the reference position, and by how much, thereby incorporating historical experience feedback into the threshold decision of the current batch.

[0056] Next, the anomaly scoring agent integrates information from two dimensions: the distribution characteristics of the current batch and the detection performance indicators of historical batches. First, a baseline quantile is determined based on the numerical distribution of the score set. A quantile is a value that, after sorting a set of data by magnitude, falls at a certain percentage; for example, the 50th percentile is the median, and the 95th percentile means that 95% of the scores are below that value. The selection of the baseline quantile can refer to the distribution pattern characteristics; for example, a lower quantile is chosen when the overall scores are low, and a higher quantile is chosen when the overall scores are high. Then, the anomaly scoring agent applies the threshold offset coefficient determined in the previous step to this baseline quantile, adjusting it upwards or downwards to obtain a corrected target quantile. The sign of the offset coefficient determines the direction of adjustment, and the absolute value of the offset coefficient determines the adjustment magnitude.

[0057] Finally, the anomaly scoring agent uses the target quantile as an index to select the corresponding score value from the score set as the discrimination threshold for the current batch. For example, if the target quantile is 95%, the score set is sorted from smallest to largest, and the specific score value at the 95th position is taken as the discrimination threshold; if the target quantile becomes 93% after adjustment by the offset coefficient, the score value at the 93rd position is taken as the discrimination threshold. Subsequently, the calibration anomaly score of each node is compared with this discrimination threshold. Nodes with scores higher than the discrimination threshold are judged as anomaly nodes, and nodes with scores lower than or equal to the discrimination threshold are judged as normal nodes.

[0058] This application's embodiments overcome the limitations of traditional schemes that rely on fixed discrimination thresholds or simply taking quantiles from current data by introducing a dual-driven mechanism of current distribution and historical feedback. On one hand, the discrimination threshold is determined based on the target quantile after sorting the scores of the current batch, ensuring that the discrimination threshold for each detection matches the actual distribution of the current data. On the other hand, historical detection performance indicators serve as feedback signals to drive the adjustment of the threshold offset coefficient, enabling the system to automatically correct the bias direction of the discrimination threshold based on its own detection performance during continuous operation. This closed-loop threshold adaptive mechanism allows the anomaly detection system to continuously self-calibrate during long-term operation, avoiding the tedious manual parameter tuning and significantly improving the stability and reliability of detection results under different data distributions and different operating stages.

[0059] Optionally, in this embodiment of the application, the method further includes: The collaboration manager obtains the overall performance index of this graph anomaly detection; for each agent, it calculates the marginal contribution of the agent to the overall performance index and the performance index of the corresponding subtask, where the marginal contribution is the decrease in the overall performance index after removing the agent; and it assigns incentive values ​​to each agent based on the marginal contribution and the subtask performance index. For any given agent, the following steps are performed: The stimulus value is compared with a preset stimulus threshold: When the incentive value is higher than the preset incentive threshold, the decision strategy used in the current detection process is marked as the preferred strategy and stored in the local strategy library. When the features of the graph structure match the features of the current graph structure in subsequent detection, the preferred strategy is called first for decision-making. When the incentive value is lower than the preset incentive threshold, an alternative strategy is selected from the preset candidate strategy set to replace the current decision strategy. When the features of the graph structure match the features of the current graph structure in subsequent detection, the alternative strategy is called first for decision-making.

[0060] In this embodiment, the excitation value calculation formula can be as follows: ; in, Marginal contribution of agent i (the decrease in overall performance metrics after removing agent i). For intelligent agents Subtask performance metrics These are preset coefficients.

[0061] In another embodiment, after completing preprocessing, the preprocessing agent does not simply send the standardized graph structure to the feature extraction agent and end the task. Instead, it synchronously shares a description of the preprocessing scheme performed in the form of a structured message with all other agents through a collaboration manager. This structured message includes at least the type of preprocessing operation (such as feature normalization, topology denoising, edge pruning, feature dimensionality reduction, etc.) and the specific parameters corresponding to each operation (such as the target dimension after dimensionality reduction, the statistics used during normalization, etc.). This sharing mechanism ensures that each agent in the entire system works under the same data state description, rather than independently guessing or assuming the format and feature distribution of the input data, thereby guaranteeing the consistency and reliability of the entire detection process at the mechanism level.

[0062] After receiving the structured information of the preprocessing scheme, different agents make targeted adjustments to the subsequent processing strategies according to their own functional positioning.

[0063] Specifically, the feature extraction agent can automatically adapt the model structure and hyperparameters based on the type of preprocessing operation. For example, when the structured message indicates that the data has undergone PCA dimensionality reduction and explicitly gives the target dimension after dimensionality reduction, the feature extraction agent automatically configures the dimension of the model's input layer to this dimensionality-reduced dimension to avoid runtime errors caused by dimension mismatch; when the data indicates that topological denoising has been performed, the feature extraction agent can appropriately reduce the sensitivity of the graph convolutional layers in the model to local noise.

[0064] The anomaly scoring agent dynamically adjusts the fusion weight between structural reconstruction errors and attribute reconstruction errors based on structured information. For example, when a structured message indicates that an "edge pruning" operation has been performed and removed a large number of isolated nodes, it means that the topology of the graph structure has been cleaned up and is more reliable. Accordingly, the anomaly scoring agent automatically increases the weight of structural reconstruction errors in anomaly scoring, so that the cleaned topology information plays a greater role in the scoring.

[0065] By acquiring structured information, the result calibration agent can more accurately control the magnitude of subsequent rule calibration. When the data has undergone strong preprocessing (such as denoising and feature attribute imputation), the score given by the model has already been adjusted once, and the result calibration agent can appropriately reduce the intensity of rule compensation to avoid overcalibration; conversely, when the preprocessing is weak, rule calibration can play a greater corrective role.

[0066] By knowing whether each modal data has undergone preprocessing operations such as normalization and dimensionality reduction, and their specific parameters, the feature extraction agent fully considers the changes in the numerical range and distribution of each modal data after preprocessing during the multimodal fusion process. This allows for more accurate cross-modal feature alignment and attention weight calculation, avoiding the attention mechanism's bias towards modalities with larger numerical ranges due to different preprocessing intensities.

[0067] In addition, after receiving the structured information of the preprocessing scheme, the collaboration manager associates it with the overall performance indicators of this detection and records it to build a mapping database of "preprocessing scheme → detection effect". This mapping relationship can be used for contribution tracing in Shapley value reward allocation and scheme selection in strategy iteration. For example, when a preprocessing scheme is associated with high detection performance multiple times, the collaboration manager can mark it as a high-value scheme and prioritize its scheduling in the detection of similar graph data in the future.

[0068] Through the differentiated responses and collaborative cooperation of the aforementioned intelligent agents, the structured sharing mechanism of the preprocessing scheme achieves global information alignment for the entire detection process. This enables decisions at each stage to be made based on an accurate understanding of the true state of the data, fundamentally avoiding decision-making biases caused by the independent processing stages and information fragmentation in traditional schemes. This significantly improves the overall consistency of the detection process and the effectiveness of collaboration among the intelligent agents.

[0069] In another embodiment, the collaboration manager serves as the central hub for multi-agent collaboration, acting as the hub for message routing and data synchronization among agents. Each agent sends its processing results to the collaboration manager, which then distributes them to downstream agents, ensuring end-to-end information synchronization and clear boundaries of responsibility. The collaboration manager is also responsible for coordinating the execution sequence of each agent, dynamically scheduling incremental updates, cross-modal fusion, and other branch processes based on the graph type, and calculating overall performance metrics after detection. Before graph anomaly detection, the collaboration manager is also responsible for the initialization operations of each agent.

[0070] Furthermore, as Figure 1 In terms of specific implementation, this application provides a graph anomaly detection device based on multi-agent cooperation, such as... Figure 2 As shown, the device includes: The graph structure acquisition module is used to acquire the graph structure to be detected. The reconstruction error calculation module is used to extract the low-dimensional embedding of each node in the graph structure through the feature extraction agent, and reconstruct the topology and attribute features corresponding to the graph structure according to the low-dimensional embedding. Based on the topology and attribute features, the module calculates the structural reconstruction error and attribute reconstruction error of each node in the graph structure. An anomaly score calculation module is used to receive the structural reconstruction error and attribute reconstruction error of each node through an anomaly scoring agent, calculate the dynamic fusion weight of the structural reconstruction error and the attribute reconstruction error according to the edge density or node degree distribution characteristics of the graph structure, and perform a weighted summation of the structural reconstruction error and the attribute reconstruction error according to the dynamic fusion weight to obtain the initial anomaly score of the node. The anomaly score calibration module is used to receive the initial anomaly scores of each node through the result calibration agent, call the domain rule base to correct the initial anomaly scores of each node, and generate the calibration anomaly scores of each node. The abnormal node determination module is used to statistically analyze the numerical distribution of the calibration abnormal scores through the abnormal scoring agent, determine the discrimination threshold based on the numerical distribution, determine the nodes that exceed the discrimination threshold as abnormal nodes, and generate graph abnormality detection results.

[0071] Optionally, the apparatus further includes a preprocessing agent; the preprocessing agent is configured to: After obtaining the graph structure to be detected, the distribution characteristics of the graph structure are analyzed. The distribution characteristics include at least one of node density, attribute feature dimension, and the proportion of missing attribute feature values. Based on the distribution characteristics, at least one preprocessing strategy is selected from the candidate preprocessing strategies to process the graph structure, generate a standardized graph structure, and send the standardized graph structure to the feature extraction agent.

[0072] Optionally, the preprocessing agent is further configured to: If the node density is lower than a preset density threshold, then all nodes in the graph structure are traversed, nodes with a degree value of zero are identified as isolated nodes, and the isolated nodes and all their associated edges are removed from the graph structure. If the attribute feature dimension is higher than a preset dimension threshold, then the original attribute feature of the graph structure is subjected to a dimension reduction transformation to generate a dimension-reduced attribute feature. If the distribution feature includes the proportion of missing attribute features, and the proportion of missing attribute features is higher than a preset proportion threshold, then for a node to be filled with missing values, the missing attribute value of the node to be filled is determined by iteratively aggregating the attribute features of the neighboring nodes of the node to be filled, and the missing attribute value is used as the current attribute feature of the node to be filled. The processed graph structure is output as a standardized graph structure.

[0073] Optionally, the feature extraction agent is used to: Obtain the graph type of the graph structure, wherein the graph type is a static attribute graph, a dynamic graph, or a multimodal graph; When the graph type is a static attribute graph, a structural autoencoder is invoked to encode the adjacency matrix of the graph structure to generate a structural representation of each node, and an attribute autoencoder is invoked to encode the attribute matrix of the graph structure to generate an attribute representation of each node. The structural representation and the attribute representation are concatenated to form a low-dimensional embedding of each node. The low-dimensional embedding of each node is decoded by a structural decoder to reconstruct the topological structure of the graph structure, and the attribute decoder is decoded by an attribute decoder to reconstruct the attribute features of the graph structure. When the graph type is a dynamic graph, newly added nodes and / or edges in the graph structure relative to historical time are detected, and incremental change regions are identified based on the detection results; each newly added node involved in the incremental change region is determined, and feature encoding is performed on each newly added node to generate a low-dimensional embedding for each newly added node; based on the low-dimensional embedding of each newly added node, each newly added node is decoded and reconstructed through a decoder to generate adjacency matrix reconstruction data and attribute matrix reconstruction data corresponding to each newly added node, as the incremental reconstruction result; the historical reconstruction results of each historical node at historical time are obtained; the incremental reconstruction result is merged with the historical reconstruction result to obtain the topology and attribute features after full node reconstruction; When the graph type is a multimodal graph, an encoder is assigned to the original data of each modality for independent encoding, generating modality encoding vectors for each node in each modality; cross-modal fusion of the modality encoding vectors of the same node is performed through an attention mechanism to generate multimodal low-dimensional embeddings for each node; the multimodal low-dimensional embeddings are decoded and reconstructed node by node through the decoder corresponding to each modality, and the predicted reconstruction data of each node in each modality is output; the topology of the graph structure reconstruction is determined based on the predicted reconstruction data corresponding to the topological modality in the predicted reconstruction data, and the attribute features of the graph structure reconstruction are determined based on the predicted reconstruction data corresponding to the non-topological modality in the predicted reconstruction data.

[0074] Optionally, the abnormal score calculation module is used for: The ratio of the number of edges to the number of nodes in the graph structure is calculated as the edge density of the graph structure. A first weight coefficient corresponding to the structure reconstruction error is determined based on the edge density. A second weight coefficient corresponding to the attribute reconstruction error is determined based on the first weight coefficient. The first weight coefficient and the second weight coefficient are used as the dynamic fusion weight. The first weight coefficient is positively correlated with the edge density. The degree values ​​of all nodes in the graph structure are statistically analyzed. A first weight coefficient corresponding to the structural reconstruction error is determined based on the variance or range of the degree values. A second weight coefficient corresponding to the attribute reconstruction error is determined based on the first weight coefficient. The first weight coefficient and the second weight coefficient are used as the dynamic fusion weights. The first weight coefficient is positively correlated with the variance or range.

[0075] Optionally, for each node, the result calibrates the agent for: Obtain the business scenario corresponding to the graph structure, load the domain rule library, extract a set of correction rules that match the business scenario from the domain rule library, and each correction rule in the set of correction rules has its own execution attributes and execution priority, the execution attributes include mutually exclusive attributes and superimposed attributes; When the set of correction rules includes correction rules with mutually exclusive attributes, the initial anomaly score is corrected by the correction rules with mutually exclusive attributes, and the correction result is used as the final calibrated anomaly score. When the set of correction rules contains only correction rules with superimposed attributes, the initial anomaly score is corrected sequentially by the correction rules with superimposed attributes according to the execution priority, and the execution result of the last correction rule is used as the final calibrated anomaly score. When the set of correction rules is empty, the initial anomaly score is used as the final calibration anomaly score.

[0076] Optionally, the anomaly scoring agent is further configured to: Obtain the calibration anomaly scores of all nodes to form the score set of the current detection batch, and perform statistics on each calibration anomaly score in the score set to determine the numerical distribution of the score set. Obtain the detection performance indicators of historical detection batches, and determine the threshold offset coefficient based on the deviation of the detection performance indicators from the target performance indicators. The detection performance indicators include at least one of recall, precision, and F1 value. Based on the numerical distribution of the score set, a baseline quantile is determined, and the baseline quantile is adjusted by offset according to the threshold offset coefficient to obtain the target quantile. Select the score value corresponding to the target quantile from the score set as the discrimination threshold for the current batch.

[0077] It should be noted that other corresponding descriptions of the functional units involved in the graph anomaly detection device based on multi-agent cooperation provided in this application embodiment can be found in the following references. Figure 1 The corresponding descriptions in the method will not be repeated here.

[0078] This application also provides a computer device, which may specifically be a personal computer, a server, a network device, etc. Figure 3 As shown, the computer device includes a bus, a processor, memory, and a communication interface, and may also include an input / output interface and a display device. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores location information. The network interface allows communication with external terminals via a network connection. When the computer program is executed by the processor, it implements the steps in the various method embodiments.

[0079] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0080] In one embodiment, a computer-readable storage medium is provided, which may be non-volatile or volatile, having stored thereon a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0081] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0082] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0083] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0084] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0085] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A graph anomaly detection method based on multi-agent cooperation, characterized in that, include: Obtain the graph structure to be detected; The feature extraction agent extracts the low-dimensional embeddings of each node in the graph structure, and reconstructs the topology and attribute features of the graph structure based on the low-dimensional embeddings. Based on the topology and attribute features, the structural reconstruction error and attribute reconstruction error of each node in the graph structure are calculated. For each node, the structural reconstruction error and attribute reconstruction error of the node are received by the anomaly scoring agent. Based on the edge density or node degree distribution characteristics of the graph structure, the dynamic fusion weight of the structural reconstruction error and the attribute reconstruction error is calculated. The structural reconstruction error and the attribute reconstruction error are then weighted and summed according to the dynamic fusion weight to obtain the initial anomaly score of the node. The result calibration agent receives the initial anomaly scores of each node, calls the domain rule base to correct the initial anomaly scores of each node, and generates the calibration anomaly scores of each node. The anomaly scoring agent statistically analyzes the numerical distribution of the calibration anomaly scores, determines a discrimination threshold based on the numerical distribution, and identifies nodes that exceed the discrimination threshold as anomaly nodes, generating graph anomaly detection results.

2. The method according to claim 1, characterized in that, After obtaining the graph structure to be detected, the method further includes converting the graph structure into a normalized graph structure by a preprocessing agent based on the following steps: Analyze the distribution characteristics of the graph structure, wherein the distribution characteristics include at least one of node density, attribute feature dimension, and the proportion of missing attribute feature values; Based on the distribution characteristics, at least one preprocessing strategy is selected from the candidate preprocessing strategies to process the graph structure, generate a standardized graph structure, and send the standardized graph structure to the feature extraction agent.

3. The method according to claim 2, characterized in that, The step of selecting at least one preprocessing strategy from candidate preprocessing strategies to process the graph structure and generate a standardized graph structure based on the distribution characteristics includes: If the node density is lower than a preset density threshold, then all nodes in the graph structure are traversed, nodes with a degree value of zero are identified as isolated nodes, and the isolated nodes and all their associated edges are removed from the graph structure. If the attribute feature dimension is higher than a preset dimension threshold, then the original attribute feature of the graph structure is subjected to a dimension reduction transformation to generate a dimension-reduced attribute feature. If the distribution feature includes the proportion of missing attribute features, and the proportion of missing attribute features is higher than a preset proportion threshold, then for a node to be filled with missing values, the missing attribute value of the node to be filled is determined by iteratively aggregating the attribute features of the neighboring nodes of the node to be filled, and the missing attribute value is used as the current attribute feature of the node to be filled. The processed graph structure is output as a standardized graph structure.

4. The method according to claim 1, characterized in that, The feature extraction agent reconstructs the topological structure and attribute features corresponding to the graph structure based on the following steps: Obtain the graph type of the graph structure, wherein the graph type is a static attribute graph, a dynamic graph, or a multimodal graph; When the graph type is a static attribute graph, a structural autoencoder is called to encode the adjacency matrix of the graph structure to generate the structural representation of each node, and an attribute autoencoder is called to encode the attribute matrix of the graph structure to generate the attribute representation of each node. The structural representation and the attribute representation are then concatenated to form a low-dimensional embedding of each node. The graph topology is reconstructed by decoding the low-dimensional embeddings of each node using a structure decoder, and the attribute features of the graph are reconstructed by decoding the low-dimensional embeddings of each node using an attribute decoder. When the graph type is a dynamic graph, newly added nodes and / or edges in the graph structure relative to historical time are detected, and incremental change regions are identified based on the detection results; each newly added node involved in the incremental change region is determined, and feature encoding is performed on each newly added node to generate a low-dimensional embedding for each newly added node; based on the low-dimensional embedding of each newly added node, each newly added node is decoded and reconstructed through a decoder to generate adjacency matrix reconstruction data and attribute matrix reconstruction data corresponding to each newly added node, as the incremental reconstruction result; the historical reconstruction results of each historical node at historical time are obtained; the incremental reconstruction result is merged with the historical reconstruction result to obtain the topology and attribute features after full node reconstruction; When the graph type is a multimodal graph, an encoder is assigned to the original data of each modality for independent encoding, generating modality encoding vectors for each node in each modality; cross-modal fusion of the modality encoding vectors of the same node is performed through an attention mechanism to generate multimodal low-dimensional embeddings for each node; the multimodal low-dimensional embeddings are decoded and reconstructed node by node through the decoder corresponding to each modality, and the predicted reconstruction data of each node in each modality is output; the topology of the graph structure reconstruction is determined based on the predicted reconstruction data corresponding to the topological modality in the predicted reconstruction data, and the attribute features of the graph structure reconstruction are determined based on the predicted reconstruction data corresponding to the non-topological modality in the predicted reconstruction data.

5. The method according to claim 1, characterized in that, The step of calculating the dynamic fusion weight of the structure reconstruction error and the attribute reconstruction error based on the edge density or node degree distribution characteristics of the graph structure includes: The ratio of the number of edges to the number of nodes in the graph structure is calculated as the edge density of the graph structure. A first weight coefficient corresponding to the structure reconstruction error is determined based on the edge density. A second weight coefficient corresponding to the attribute reconstruction error is determined based on the first weight coefficient. The first weight coefficient and the second weight coefficient are used as the dynamic fusion weight. The first weight coefficient is positively correlated with the edge density. The degree values ​​of all nodes in the graph structure are statistically analyzed. A first weight coefficient corresponding to the structural reconstruction error is determined based on the variance or range of the degree values. A second weight coefficient corresponding to the attribute reconstruction error is determined based on the first weight coefficient. The first weight coefficient and the second weight coefficient are used as the dynamic fusion weights. The first weight coefficient is positively correlated with the variance or range.

6. The method according to claim 1, characterized in that, For each node, the result calibration agent generates a calibration anomaly score for that node based on the following steps: Obtain the business scenario corresponding to the graph structure, load the domain rule library, extract a set of correction rules that match the business scenario from the domain rule library, and each correction rule in the set of correction rules has its own execution attributes and execution priority, the execution attributes include mutually exclusive attributes and superimposed attributes; When the set of correction rules includes correction rules with mutually exclusive attributes, the initial anomaly score is corrected by the correction rules with mutually exclusive attributes, and the correction result is used as the final calibrated anomaly score. When the set of correction rules contains only correction rules with superimposed attributes, the initial anomaly score is corrected sequentially by the correction rules with superimposed attributes according to the execution priority, and the execution result of the last correction rule is used as the final calibrated anomaly score. When the set of correction rules is empty, the initial anomaly score is used as the final calibration anomaly score.

7. The method according to claim 1, characterized in that, The anomaly scoring agent determines the discrimination threshold based on the following steps: Obtain the calibration anomaly scores of all nodes to form the score set of the current detection batch, and perform statistics on each calibration anomaly score in the score set to determine the numerical distribution of the score set. Obtain the detection performance indicators of historical detection batches, and determine the threshold offset coefficient based on the deviation of the detection performance indicators from the target performance indicators. The detection performance indicators include at least one of recall, precision, and F1 value. Based on the numerical distribution of the score set, a baseline quantile is determined, and the baseline quantile is adjusted by offset according to the threshold offset coefficient to obtain the target quantile. Select the score value corresponding to the target quantile from the score set as the discrimination threshold for the current batch.

8. A graph anomaly detection device based on multi-agent cooperation, characterized in that, include: The graph structure acquisition module is used to acquire the graph structure to be detected. The reconstruction error calculation module is used to extract the low-dimensional embedding of each node in the graph structure through the feature extraction agent, and reconstruct the topology and attribute features corresponding to the graph structure according to the low-dimensional embedding. Based on the topology and attribute features, the module calculates the structural reconstruction error and attribute reconstruction error of each node in the graph structure. An anomaly score calculation module is used to receive the structural reconstruction error and attribute reconstruction error of each node through an anomaly scoring agent, calculate the dynamic fusion weight of the structural reconstruction error and the attribute reconstruction error according to the edge density or node degree distribution characteristics of the graph structure, and perform a weighted summation of the structural reconstruction error and the attribute reconstruction error according to the dynamic fusion weight to obtain the initial anomaly score of the node. The anomaly score calibration module is used to receive the initial anomaly scores of each node through the result calibration agent, call the domain rule base to correct the initial anomaly scores of each node, and generate the calibration anomaly scores of each node. The abnormal node determination module is used to statistically analyze the numerical distribution of the calibration abnormal scores through the abnormal scoring agent, determine the discrimination threshold based on the numerical distribution, determine the nodes that exceed the discrimination threshold as abnormal nodes, and generate graph abnormality detection results.

9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

10. A computer device, comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 7.

Images