CN116128024A - Multi-perspective comparative self-supervised attribute network outlier detection method - Google Patents

Abstract

The invention discloses a multi-perspective comparative self-supervised attribute network anomaly detection method, combines the node structure and attribute information characteristics of the attribute network, proposes a new comparison instance pair, and applies multi-perspective sampling to comparative learning anomaly detection , so that the network anomaly detection can capture both structural anomalies and attribute anomalies. It mainly includes: injecting abnormalities into the attribute network; performing multi-view sampling to obtain multi-view comparative instance pairs; designing and training a multi-view graph neural network comparative learning model; Score, judge whether the node is abnormal, and mark the abnormal node. Through extensive experiments on various data sets, this method can not only effectively improve the accuracy of anomaly detection, but also mine meaningful anomalies in the network.

Description

Multi-view contrast self-supervised attribute network outlier detection method

Technical Field

The present invention relates to the field of network security, and in particular to a multi-view comparison self-supervisory attribute network anomaly detection method.

Background Art

In recent years, a lot of research has focused on the attribute network anomaly detection task. Attribute network anomaly detection methods are mainly divided into two types: traditional non-deep anomaly detection and deep anomaly detection.

Traditional non-deep anomaly detection uses different decomposition strategies to extract valuable information from graph structures and node attributes, and then discovers abnormal nodes through scoring functions or residual analysis, focusing on the use of matrix factorization (MF) technology. AMEN[1] considers the self-network information of each node and discovers abnormal neighborhoods on attribute networks. In addition, some studies focus on discovering abnormal nodes in node feature subspaces. ANOMALOUS[2] further incorporates CUR decomposition into residual analysis to alleviate the adverse effects of noise features on anomaly detection. However, these methods are limited by their shallow mechanisms and cannot handle key issues of attribute networks, such as network sparsity, data nonlinearity, and complex pattern interactions between different information sources and computational challenges. With the rapid development of deep learning for anomaly detection, researchers have proposed deep learning-based methods to solve the problem of anomaly detection on attribute networks.

Recently, deep learning has become an extremely important part of artificial intelligence and machine learning. It has shown excellent performance in extracting potential complex patterns in data and has been widely used in audio, image, and natural language processing. Deep learning methods can effectively process complex attribute information and learn implicit rules from data. The following are commonly used deep anomaly detection methods:

Based on network representation learning: encode the graph structure into the embedded vector space, aggregate the neighbor information to the central node, and find the relative scale between the abnormal nodes and the normal node edges through the training loss function.

Based on graph convolutional neural networks: The representation of the node is generated through the GCN layer, and then anomalies are detected based on the reconstruction of its neural network (in this case, the reconstruction loss is used as the anomaly score) or the distribution of the embedding space (in this case, anomaly ranking is performed based on density estimation). DOMINANT[3] constructs a graph autoencoder to simultaneously reconstruct attribute and structural information, and evaluates anomalies through reconstruction error.

Based on graph attention network: Given an input graph, an attention mechanism is used to learn node embedding for any vertex on the graph. The unsupervised technique AnomalyDAE[4] scores each node based on the reconstruction loss and marks the top-k nodes as abnormal.

Based on contrastive learning: learn nodes by comparing positive instance pairs and negative instance pairs. Design a contrastive learning model to learn the vector representation of node-subgraph instance pairs, and calculate the abnormality score of the node through the discriminator.

[References]

[1]Perozzi B,Akoglu L.Scalable anomaly ranking of attributedneighborhoods[C].In Proceedings of the 2016SIAM International Conference onData Mining,2016:207–215.

[2]Peng Z, Luo M, Li J, et al. ANOMALOUS: A Joint Modeling Approach for Anomaly Detection on Attributed Networks. [C]. In IJCAI, 2018: 3513–3519.

[3]Ding K, Li J, Bhanushali R, et al. Deep anomaly detection onattributed networks [C]. In Proceedings of the 2019SIAM International Conference on Data Mining, 2019:594–602.

[4]Fan H, Zhang F, Li Z.AnomalyDAE: Dual autoencoder for anomalydetection on attributed networks[C].In ICASSP 2020-2020IEEE International Conference on Acoustics, Speech and Signal Processing(ICASSP), 2020:5685–5689.

Summary of the invention

Since traditional attribute network anomaly detection algorithms cannot process large-scale data and ignore feature attribute information, although deep learning algorithms are more powerful in processing feature information, most of these works are aimed at learning data representation rather than directly detecting anomalies. Therefore, this paper proposes a multi-perspective comparison self-supervised attribute network anomaly detection method to achieve anomaly detection of large-scale attribute networks.

In order to solve the above technical problems, the present invention proposes a multi-view contrast self-supervised attribute network outlier detection method, which includes the following steps:

Step 1: Perform anomaly injection on the attribute network, including structural anomaly injection and attribute anomaly injection;

Step 2: Perform multi-view sampling to obtain multi-view comparison instance pairs, including:

2-1) Select the target node for the attribute network after the anomaly injection, and randomly traverse each node in the attribute network as the target node;

2-2) Through a sampler, the same target node is subsampled based on structural importance and attribute similarity to obtain local subgraph 1 and local subgraph 2 corresponding to the target node, which are recorded as perspective 1 based on structural importance and as perspective 2 based on attribute similarity; in the process of obtaining local subgraph 1, the breadth-first parameter p and depth-first parameter q are introduced to control the walk, p>1, q<1, and in the process of obtaining local subgraph 2, the walk is controlled by calculating the attribute similarity of the target node;

2-3) Anonymize the two local subgraphs obtained in step 2-2) and set the attribute vector of the target node to a zero vector;

2-4) Merge the anonymized target node and local subgraph 1 into a set of instance pairs, and merge the anonymized target node and local subgraph 2 into another set of instance pairs; save the positive sample pairs and negative sample pairs of the above two sets of instance pairs into two corresponding sample pools respectively;

Step 3: Design and train a multi-view graph neural network comparative learning model, including:

3-1) Design a multi-view graph neural network contrastive learning model, which includes a multi-view graph neural network module, a readout module and a discriminator module; the multi-view graph neural network module obtains subgraph representations and target node representations of two views respectively through two graph convolutional neural networks; the readout module converts the subgraph representation into a subgraph vector representation, and uses an average pooling function as a readout function; the discriminator module uses a bilinear scoring function to compare the node vector representation and the subgraph vector representation in the instance pair;

3-2) Initializing the parameters of the multi-view graph neural network contrastive learning model (W ⁽⁰⁾ , W ^(L) , W ^(d) ), where W is the discriminator weight matrix; training the contrastive learning model using a binary classification objective function to obtain a prediction score of the node used for training, and back-propagating the prediction score and the binary classification objective function to update the contrastive learning model parameters;

Step 4: Use the trained contrastive learning model to perform the inference phase, use the updated contrastive learning model parameters and the binary classification objective function to obtain the predicted score of the node, and take the average value through multiple rounds of calculation to obtain the final anomaly score;

Step 5: The target nodes with anomaly scores of 0.5±0.05 are regarded as abnormal nodes, and the abnormal nodes are marked as 1, and the non-abnormal nodes are marked as 0.

Furthermore, the multi-view contrast self-supervised attribute network outlier detection method described in the present invention comprises:

In step 2-4): the two sets of instance pairs are represented as follows:

是视角1对应的实例对，

是视角2对应的实例对，

为视角1目标节点，

为视角2目标节点，

为局部子图2，

为局部子图1，

是视角1实例对的标签，其中，

表示

是负实例对，

表示

是正实例对。

是视角2实例对的标签，其中，

表示

是负实例对，

表示

是正实例对。In formula (1),

is the instance pair corresponding to perspective 1,

is the instance pair corresponding to perspective 2,

is the target node of perspective 1,

is the target node of perspective 2,

is local sub-graph 2,

is local sub-graph 1,

is the label of the view 1 instance pair, where

express

is a negative instance pair,

express

It is a positive example pair.

is the label of the view 2 instance pair, where

express

is a negative instance pair,

express

It is a positive example pair.

In step 3-1), formula (2) shows the subgraph representation:

为隐藏层表示矩阵，

为隐藏层权值矩阵，

是子图邻接矩阵，φ是激活函数，

是子图的度矩阵；In formula (2),

is the hidden layer representation matrix,

is the hidden layer weight matrix,

is the subgraph adjacency matrix, φ is the activation function,

is the degree matrix of the subgraph;

Formula (3) shows the target node representation:

分别为由层(l-1)和第层(l)学习的目标节点的隐藏表示行向量，将输入

定义为目标节点的属性行向量，并将输出标记为目标节点向量表示

In formula (3),

are the hidden representation row vectors of the target nodes learned by layer (l-1) and layer (l), respectively.

Defined as a row vector of attributes of the target node and label the output as the target node vector representation

The readout function is shown in formula (4):

为子图表示向量，(E_i)子图表示矩阵，(E_i)_k是(E_i)的第k行，Readout表示读出函数。In formula (4),

is a subgraph representing a vector, (E _i ) subgraph represents a matrix, (E _i ) _k is the k-th row of (E _i ), and Readout represents the readout function.

In step 3-2), the prediction score of the node used for training is calculated by equations (5) and (6):

表示视角1目标节点的预测分数，Discriminator是双线性评分函数，

表示视角1目标节点向量表示，

表示视角2子图向量表示，

为视角1判别器权值矩阵，σ是S形函数；

表示视角2目标节点的预测分数，

表示视角2目标节点向量表示，

表示视角1子图表示向量，

为视角2判别器权值矩阵。In formula (5) and formula (6),

Represents the predicted score of the target node in perspective 1. Discriminator is a bilinear scoring function.

Represents the target node vector representation of view 1,

represents the view 2 sub-image vector representation,

is the weight matrix of the view 1 discriminator, σ is the S-shaped function;

represents the prediction score of the target node of view 2,

Represents the target node vector representation of view 2,

represents the view 1 sub-image representation vector,

is the view 2 discriminator weight matrix.

In step 3 and step 4, the binary classification objective function is as follows:

In formula (7), CLM() is a multi-view graph neural network contrastive learning model.

In step 4, the abnormality score calculation formula is as follows:

是视角1负实例对的预测分数，

是视角1正实例对的预测分数，

是视角2负实例对的预测分数，

是视角2正实例对的预测分数。In formula (8), f() is the anomaly score mapping function,

is the prediction score for the view 1 negative instance pair,

is the predicted score of the view 1 positive instance pair,

is the prediction score for the view 2 negative instance pair,

is the prediction score for view 2 positive instance pairs.

Compared with the prior art, the present invention has the following beneficial effects:

The multi-view contrast self-supervised attribute network anomaly detection method (referred to as MV-CoLA in the present invention) proposed in the present invention is compared with four attribute network anomaly detection methods (a joint modeling method based on attribute network anomaly detection-ANOMALOUS, attribute network deep anomaly detection method-DOMINANT, graph depth maximization mutual information method-DGI, contrast self-supervised learning attribute network anomaly detection method-CoLA). AUC value: The ROC curve is a graph of the true positive rate (anomaly identified as anomaly) and the false positive rate (normal node identified as anomaly) based on the ground truth anomaly label and anomaly detection results. The AUC value is the area under the ROC curve, which indicates the probability that a randomly selected abnormal node is ranked higher than a normal node. AUC is close to 1, indicating that the method has a higher performance. By calculating the area under the ROC curve, the AUC values of different comparison methods on 6 data sets are shown in Table 3. On all 6 data sets, the method of the present invention has achieved the best anomaly detection performance. Compared with the best results of the comparison method CoLA, the average AUC of the method of the present invention has been improved. The main reason is that the method of the present invention successfully captures the relationship and attribute characteristics between each node and its local subgraph through multi-view instance pair sampling, and uses the multi-view GNN contrastive learning model to calculate the anomaly score from the context and structural information.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a block diagram of a multi-view contrast self-supervised attribute network outlier detection method according to the present invention;

FIG2 is a schematic diagram of multi-view sampling shown in FIG1 ;

FIG3 is a flow chart of a multi-view contrast self-supervised attribute network outlier detection method according to the present invention;

FIG4 is an anomaly detection result of a local paper collaboration network of 6000 nodes in an embodiment of the present invention;

FIG. 5-1 and FIG. 5-2 show the distribution of the organizations to which the top 1000 abnormal nodes belong in an embodiment of the present invention.

DETAILED DESCRIPTION

The present invention proposes a multi-perspective comparative self-supervised attribute network anomaly detection method with the following design concept: combining the node structure and attribute information characteristics of the attribute network, a new comparative instance pair is proposed, and multi-perspective sampling is applied to comparative learning anomaly detection, so that network anomaly detection can simultaneously capture structural anomalies and attribute anomalies. The method of the present invention has been widely experimented on various data sets, which proves that the method is superior to many comparative methods. In addition to being able to effectively improve the accuracy of anomaly detection, it can also mine practical anomalies in the network.

The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments, but the following embodiments are by no means intended to limit the present invention in any way.

As shown in FIG1 and FIG3 , the present invention proposes a multi-view contrast self-supervised attribute network outlier detection method, which mainly includes the following steps:

Step 1: Inject anomalies into the attribute network;

Step 2: Perform multi-view sampling to obtain multi-view comparison instance pairs;

Step 3: Design and train a multi-view graph neural network comparative learning model;

Step 4: Use the trained contrastive learning model to perform the inference phase and calculate the anomaly score;

Step 5: Use the anomaly score to determine whether the node is abnormal and mark the abnormal node.

Each step is described in detail as follows:

Step 1: Input the attribute network and perform exception injection, including structural exception injection and attribute exception injection.

The NNSF dataset is processed into the data format required by the cost method. Since the NNSF dataset contains real anomaly labels, there is no need to inject anomalies into the dataset.

This example evaluates the MV-CoLA method on six widely used datasets. These datasets include two social network datasets and four citation network datasets. See Table 1 for details of the datasets. Since there are no real anomalies in the above datasets, anomalies need to be injected into the attribute network. Structural anomaly injection, after specifying the cluster size as m, randomly select m nodes from the network, make these nodes fully connected, and then treat the m nodes in the cluster as anomalies. Repeat this process iteratively until n clusters are generated, and the total number of structural anomalies is m×n. Attribute anomaly injection, first randomly select another m×n node as an attribute perturbation candidate. For each selected node i, randomly select another i nodes from the data, and select the node j with the largest attribute deviation from node i among the k nodes by maximizing the Euclidean distance ||x_ _{i} -x_ _{j} || ^{2} . Then, change the attribute of node _{x_{i}} to x_ _{j} . Input MV-CoLA method parameters, training period T, batch size: B, number of sampling rounds R, walk probability p, q.

Table 1. 6 experimental datasets

Dataset node side property abnormal Cora 2,708 5,429 1,433 150 Citeseer 3,327 4,732 3,703 150 BlogCatalog 5,196 171,743 8,189 300 Flickr 7,575 239,738 112,407 450 ACM 16,484 71,980 8,337 600 Pubmed 19,717 44,338 500 600

Social networks: BlogCatalog and Flickr, in these datasets, nodes represent users of the website, and edges represent the relationship between users. In social networks, users usually generate personalized content, such as posting blogs or sharing photos with label descriptions, and these text contents are regarded as node attributes.

Citation networks: Cora, CiteSeer, Pubmed, ACM are four available public datasets consisting of scientific publications. In these networks, nodes represent published papers, while edges represent citation relationships between papers.

The number of convolutional layers is set to 1. The embedding dimension is set to 64. The batch size B for each dataset is set to 300. The training epoch T is 400 for BlogCatalog, Flickr, and ACM datasets, and 100 for Cora, Citeseer, and Pubmed datasets. The learning rate is 0.001 for Cora, Citeseer, Pubmed, and Flickr, and 0.003 and 0.0005 for BlogCatalog and ACM, respectively.

Step 2: Perform multi-view sampling to obtain multi-view comparison instance pairs.

First, the target node is selected, and each node in the graph is randomly traversed as the target node. Then multi-perspective sampling is performed. Through a sampler, the same node is sub-sampled from two perspectives. The sampler uses two sampling methods to sample local subgraphs. The first perspective (based on structural importance, that is, perspective 1) sampling method introduces two parameters p (breadth-first BFS) and q (depth-first DFS) to control the wandering strategy. When the p and q values are different, the sampled subgraphs are different. If p>1, the wandering tends to the node neighbors, reflecting the BFS characteristics. If q<1, the wandering tends to run far away, reflecting the DFS characteristics. Control p and q at the same time to obtain local subgraph 1 based on structural importance sampling. The second perspective (based on attribute similarity, that is, perspective 2) sampling wanders according to the calculated node attribute similarity. The specific steps are shown in Figure 2. Secondly, anonymization is performed, and the attribute vector of the initial node is set to the zero vector to prevent the contrast learning model from easily identifying the existence of the target node in the local subgraph. Finally, they are combined into instance pairs, and the above-mentioned multi-perspective comparison instance pairs based on multi-perspective fusion are constructed. The target nodes of perspective 1 and local subgraph 2 are merged into one group of instance pairs, and the other group of instance pairs is composed of local subgraph 1 and target nodes of perspective 2. The positive sample pairs (target node instance pairs) and negative sample pairs (instance pairs other than target nodes) of the two groups of instance pairs are saved in the corresponding sample pools respectively.

Inspired by the latest progress in multi-view contrastive learning for visual representation learning, node and graph representations are learned by maximizing the mutual information between node representations from one view and graph representations from another view. Compared with comparing global or multi-views, two-view contrast can obtain better node representations. Therefore, the present invention designs a new multi-view contrastive learning method, which sub-samples the same nodes from two views through a sampler. The sub-sampling consists of two effective walk mechanisms, combining the advantages of attributed random walks and structured random walks. Among them, the nodes not only have the characteristics of network connections A, but also have rich auxiliary information described by the node attributes X. Joint sampling of A and X will make the random walk more informative. Sampling is divided into four steps: target node selection, multi-view sampling, anonymization, and combination into instance pairs.

2-1) Target node selection: After the abnormal injection (not necessary in this embodiment), the attribute network is selected as the target node, and each node in the attribute network is randomly traversed as the target node.

2-2) Multi-graph sampling. Through a sampler, the same target node is sub-sampled from two perspectives, namely, perspective 1 is based on structural importance and perspective 2 is based on attribute similarity, to obtain local subgraph 1 based on structural importance perspective 1 and local subgraph 2 based on attribute similarity perspective 2 corresponding to the target node.

The sampler uses two random walk methods as local subgraph sampling strategies. In the process of obtaining local subgraph 1, the breadth-first parameter p and depth-first parameter q are introduced to control the walk, p>1, q<1. In the process of obtaining local subgraph 2, the walk is controlled by calculating the attribute similarity of the target node, as shown in Figure 2.

2-3) Anonymization: The purpose of anonymization is to prevent the contrastive learning method from easily identifying the existence of the target node in the local subgraph. The two local subgraphs obtained in step 2-2) are anonymized, and the attribute vector of the target node is set to a zero vector.

2-4) Combine into instance pairs. The anonymized target node and the subgraph are combined into a set of instance pairs. Specifically, the anonymized target node and the local subgraph 1 are combined into a set of instance pairs, and the anonymized target node and the local subgraph 2 are combined into another set of instance pairs. The positive sample pairs and negative sample pairs of the above two sets of instance pairs are respectively saved in the corresponding two sample pools.

The two sets of example pairs are represented as follows:

是视角1对应的实例对，

是视角2对应的实例对，

为视角1目标节点，

为视角2目标节点，

为局部子图2，

为局部子图1，

是视角1实例对的标签，其中，

表示

是负实例对，

表示

是正实例对。

是视角2实例对的标签，其中，

表示

是负实例对，

表示

是正实例对。In formula (1),

is the instance pair corresponding to perspective 1,

is the instance pair corresponding to perspective 2,

is the target node of perspective 1,

is the target node of perspective 2,

is local sub-graph 2,

is local sub-graph 1,

is the label of the view 1 instance pair, where

express

is a negative instance pair,

express

It is a positive example pair.

is the label of the view 2 instance pair, where

express

is a negative instance pair,

express

It is a positive example pair.

Step 3: Design and train a multi-view graph neural network comparative learning model, and update the multi-view graph neural network comparative learning model.

The sampled multi-view contrast instance pairs are used to train the multi-view graph neural network contrastive learning model. The multi-view graph neural network contrastive learning model consists of three main components: a multi-view graph neural network module, a readout module, and a discriminator module. The multi-view graph neural network module obtains subgraph representations of two views respectively through two graph convolutional neural network modules. The readout module converts the subgraph representation into a vector representation and uses the average pooling function as the readout function. The discriminator module uses a bilinear scoring function to compare the embeddings of two elements in an instance pair and outputs the final prediction score. Finally, by integrating the three components of the multi-view graph neural network module, the readout module, and the discriminator module, the multi-view graph neural network contrastive learning model is used as a binary classification objective function to predict the labels of the contrast instance pairs. The specific description is as follows:

3-1) Design a multi-view graph neural network contrastive learning model, which includes a multi-view graph neural network module, a readout module and a discriminator module.

Multi-view graph neural network module. The goal is to aggregate the information between nodes in the local subgraph and transfer the high-dimensional attributes to the low-dimensional embedding space. The present invention designs two graph convolutional neural networks to obtain subgraph representations of two perspectives respectively.

为隐藏层表示矩阵，

为学习参数，本发明采用GCN，那么上述等式可以具体写成：in,

is the hidden layer representation matrix,

To learn the parameters, the present invention uses GCN, so the above equation can be specifically written as:

为隐藏层表示矩阵，

为隐藏层权值矩阵，

是子图邻接矩阵，φ是激活函数，

是子图的度矩阵。In formula (2),

is the hidden layer representation matrix,

is the hidden layer weight matrix,

is the subgraph adjacency matrix, φ is the activation function,

is the degree matrix of the subgraph.

The target node represents:

分别为由层(l-1)和第层(l)学习的目标节点的隐藏表示行向量，将输入

定义为目标节点的属性行向量，并将输出标记为目标节点向量表示

In formula (3),

are the hidden representation row vectors of the target nodes learned by layer (l-1) and layer (l), respectively.

Defined as a row vector of attributes of the target node and label the output as the target node vector representation

Readout module. The goal is to transform the subgraph representation into a vector representation. For simplicity, the average pooling function is used as the readout function, and the readout function is written as follows:

为子图表示向量，(E_i)子图表示矩阵，(E_i)_k是(E_i)的第k行，Readout表示读出函数。In formula (4),

is a subgraph representing a vector, (E _i ) subgraph represents a matrix, (E _i ) _k is the k-th row of (E _i ), and Readout represents the readout function.

Discriminative module. The discriminative module is the core component of the contrastive learning method. It compares the embeddings of two elements in an instance pair, using a bilinear scoring function to compare the node vector representation and the subgraph vector representation in the instance pair.

3-2) Initializing the parameters of the multi-view graph neural network contrastive learning model (W ⁽⁰⁾ , W ^(L) , W ^(d) ), where W is the discriminator weight matrix; training the contrastive learning model using a binary classification objective function to obtain a prediction score of the node used for training, and back-propagating the prediction score and the binary classification objective function to update the contrastive learning model parameters;

The prediction score of the node used for training is calculated by equations (5) and (6):

表示视角1目标节点的预测分数，Discriminator是双线性评分函数，

表示视角1目标节点向量表示，

表示视角2子图向量表示，

为视角1判别器权值矩阵，σ是S形函数；

表示视角2目标节点的预测分数，

表示视角2目标节点向量表示，

表示视角1子图表示向量，

为视角2判别器权值矩阵。In formula (5) and formula (6),

Represents the predicted score of the target node in perspective 1. Discriminator is a bilinear scoring function.

Represents the target node vector representation of view 1,

represents the view 2 sub-image vector representation,

is the weight matrix of the view 1 discriminator, σ is the S-shaped function;

represents the prediction score of the target node of view 2,

Represents the target node vector representation of view 2,

represents the view 1 sub-image representation vector,

is the view 2 discriminator weight matrix.

In the present invention, by integrating the above three components, the proposed contrastive learning method based on graph neural network is used as a binary classification method to predict the labels of contrast instance pairs. The binary classification objective function is as follows:

In formula (7), CLM() is a multi-view graph neural network contrastive learning model.

Step 4: Use the trained contrastive learning model to perform the inference phase. Use the updated contrastive learning model parameters and a classifier to use the binary classification objective function to obtain the node prediction score. Take the average value through multiple rounds of calculation to obtain the final anomaly score.

After the contrastive learning method is well trained, the consistency between the node representation from one perspective and the subgraph representation from another perspective is obtained through the classifier. Under ideal conditions, for a normal node, the prediction score of its positive pair s ⁽⁺⁾ should be close to 1, while the negative pair s ^(-) should be close to 0. For an abnormal node, the method cannot distinguish its matching pattern well, and its prediction score of positive and negative pairs is poor (close to 0.5).

是视角1负实例对的预测分数，

是视角1正实例对的预测分数，

是视角2负实例对的预测分数，

是视角2正实例对的预测分数。In formula (8), f() is the anomaly score mapping function,

is the prediction score for the view 1 negative instance pair,

is the predicted score of the view 1 positive instance pair,

is the prediction score for the view 2 negative instance pair,

is the prediction score for view 2 positive instance pairs.

Step 5: The target nodes with anomaly scores of 0.5±0.05 are regarded as abnormal nodes, and the abnormal nodes are marked as 1, and the non-abnormal nodes are marked as 0.

In this embodiment, the anomaly score of the node is obtained by calculating the average of 256 rounds of anomaly scores. If the score is close to 0.5, then the node will be considered abnormal. The MV-CoLA method was compared with four attribute network anomaly detection methods (ANOMALOUS, DOMINANT, DGI, CoLA). AUC value: The ROC curve is a graph of the true positive rate (anomalies identified as anomalies) and the false positive rate (normal nodes identified as anomalies) based on the ground truth anomaly labels and anomaly detection results. The AUC value is the area under the ROC curve, which indicates the probability that a randomly selected abnormal node is ranked higher than a normal node. AUC is close to 1, indicating that the method has a higher performance. By calculating the area under the ROC curve, the AUC values of different comparison methods on 6 data sets are shown in Table 2. On all 6 data sets, this method has achieved the best anomaly detection performance.

Table 2

method Cora Citeseer BlogCatalog Flickr ACM Pubmed ANOMALOUS 0.5770 0.6307 0.7237 0.7434 0.7038 0.7316 DOMINANT 0.8155 0.8251 0.7468 0.7442 0.7601 0.8081 DGI 0.7532 0.8293 0.5827 0.6237 0.6240 0.6962 CoLA 0.9043 0.8965 0.7854 0.7620 0.8237 0.9512 MV-CoLA 0.9162 0.9294 0.8035 0.7813 0.8502 0.9620

The present invention is applied to real-world scenarios to detect anomalies, rank the anomaly scores of nodes, select the top nodes for analysis, find the author names and institutions corresponding to the original natural science data sets corresponding to these nodes, and explore the rules contained in the natural science project data.

Apply MV-CoLA to the NNSF dataset of millions of large-scale networks. The National Natural Science Foundation dataset contains 763,311 papers and corresponding fund project information from 2052 research institutions and 789,669 scholars from 2000 to 2021. The research fields are classified according to national disciplines, covering chemistry, biology, architecture, agriculture, computer science and other fields. See Table 3 for details of the dataset.

Table 3

Dataset node side property abnormal NNSF 1,521,995 7,555,319 1,405 2,0785

Figure 4 shows a local paper collaboration network with 6,000 nodes. The gray dots in the figure are abnormal nodes that have been filtered out. The mesh structure is the paper author collaboration network. It can be seen from the figure that the paper author collaboration network has a small-world attribute. Researchers working in the same research institution form a smaller community network. The personnel practice closely within the community, and there is relatively little academic exchange outside the community. Figures 5-1 and 5-2 show the distribution of the corresponding institutions of the top 1,000 abnormal nodes. Statistical analysis shows that researchers from 985 universities account for the largest proportion. Among them, Peking University, Tsinghua University, Sun Yat-sen University and the Chinese Academy of Sciences Research Institute have a high proportion of personnel participating in natural science projects. Other non-985 ordinary universities account for 20%. 985 universities such as Southeast University and Dalian University of Technology have a low proportion of personnel participating in natural science projects.

Although the present invention has been described above in conjunction with the accompanying drawings, the present invention is not limited to the above-mentioned specific embodiments, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can make many modifications without departing from the purpose of the present invention, which are all within the protection of the present invention.

Claims (6)

1. A multi-view contrast self-supervised attribute network outlier detection method, characterized in that it includes the following steps: Step 1: Perform anomaly injection on the attribute network, including structural anomaly injection and attribute anomaly injection; Step 2: Perform multi-view sampling to obtain multi-view comparison instance pairs, including: 2-1) Select the target node for the attribute network after the anomaly injection, and randomly traverse each node in the attribute network as the target node; 2-2) Through a sampler, sub-sample the same target node based on structural importance and attribute similarity to obtain local subgraph 1 and local subgraph 2 corresponding to the target node, which are recorded as perspective 1 based on structural importance and as perspective 2 based on attribute similarity; In the process of obtaining the local subgraph 1, the breadth-first parameter p and the depth-first parameter q are introduced to control the walk, p>1, q<1, In the process of obtaining the local subgraph 2, the walk is controlled by calculating the attribute similarity of the target node; 2-3) Anonymize the two local subgraphs obtained in step 2-2) and set the attribute vector of the target node to a zero vector; 2-4) Merge the anonymized target node and local subgraph 1 into a set of instance pairs, and merge the anonymized target node and local subgraph 2 into another set of instance pairs; save the positive sample pairs and negative sample pairs of the above two sets of instance pairs into two corresponding sample pools respectively; Step 3: Design and train a multi-view graph neural network comparative learning model, including: 3-1) Designing a multi-view graph neural network contrastive learning model, which includes a multi-view graph neural network module, a readout module and a discriminator module; The multi-view graph neural network module obtains subgraph representations and target node representations of two perspectives respectively through two graph convolutional neural networks; The readout module converts the sub-graph representation into a sub-graph vector representation, and uses an average pooling function as a readout function; The discriminator module compares the node vector representation and the subgraph vector representation in the instance pair using a bilinear scoring function; 3-2) Initializing the parameters of the multi-view graph neural network contrastive learning model (W ⁽⁰⁾ , W ^(L) , W ^(d) ), where W is the discriminator weight matrix; training the contrastive learning model using a binary classification objective function to obtain a prediction score of the node used for training, and back-propagating the prediction score and the binary classification objective function to update the contrastive learning model parameters; Step 4: Use the trained contrastive learning model to perform the inference phase, use the updated contrastive learning model parameters and the binary classification objective function to obtain the predicted score of the node, and take the average value through multiple rounds of calculation to obtain the final anomaly score; Step 5: The target nodes with anomaly scores of 0.5±0.05 are regarded as abnormal nodes, and the abnormal nodes are marked as 1, and the non-abnormal nodes are marked as 0. 2. The multi-view contrast self-supervised attribute network outlier detection method according to claim 1 is characterized in that in step 2-4), the two groups of instance pairs are represented as follows:

In formula (1),

is the instance pair corresponding to perspective 1,

is the instance pair corresponding to perspective 2,

is the target node of perspective 1,

is the target node of perspective 2,

is local sub-graph 2,

is local sub-image 1;

is the label of the view 1 instance pair, where

express

is a negative instance pair,

express

is a positive instance pair;

is the label of the view 2 instance pair, where

express

is a negative instance pair,

express

It is a positive example pair. 3. The multi-view contrast self-supervised attribute network outlier detection method according to claim 1, characterized in that in step 3-1): Formula (2) shows the subgraph representation:

In formula (2),

is the hidden layer representation matrix,

is the hidden layer weight matrix,

is the subgraph adjacency matrix, φ is the activation function,

is the degree matrix of the subgraph; Formula (3) shows the target node representation:

In formula (3),

are the hidden representation row vectors of the target nodes learned by layer (l-1) and layer (l), respectively.

Defined as a row vector of attributes of the target node and label the output as the target node vector representation

The readout function is shown in formula (4):

In formula (4),

is a subgraph representing a vector, (E _i ) subgraph represents a matrix, (E _i ) _k is the k-th row of (E _i ), and Readout represents the readout function. 4. The multi-view contrast self-supervised attribute network outlier detection method according to claim 3 is characterized in that, in step 3-2), the prediction score of the node used for training is calculated by equations (5) and (6):

In formula (5) and formula (6),

Represents the predicted score of the target node in perspective 1. Discriminator is a bilinear scoring function.

Represents the target node vector representation of view 1,

represents the view 2 sub-image vector representation,

is the weight matrix of the view 1 discriminator, σ is the S-shaped function;

represents the prediction score of the target node of view 2,

Represents the target node vector representation of view 2,

represents the view 1 sub-image representation vector,

is the view 2 discriminator weight matrix. 5. The multi-view contrast self-supervised attribute network outlier detection method according to claim 1, characterized in that in step 3 and step 4, The binary classification objective function is as follows:

In formula (7), CLM() is a multi-view graph neural network contrastive learning model. 6. The multi-view contrast self-supervised attribute network outlier detection method according to claim 1, characterized in that in step 4, the anomaly score calculation formula is as follows:

In formula (8), f() is the anomaly score mapping function,

is the prediction score for the view 1 negative instance pair,

is the predicted score of the view 1 positive instance pair,

is the prediction score for the view 2 negative instance pair,

is the prediction score for view 2 positive instance pairs.

Images