注意力时态GCN：动态图中异常检测的新突破

需积分: 42 63 浏览量更新于2024-08-12 收藏 710KB PDF 举报

"AddGraph: Anomaly Detection in Dynamic Graphs Using Attention-based Temporal GCN" 在现代信息技术领域，动态图异常检测对于许多实际应用至关重要，特别是在推荐系统等场景中，如用户行为分析和欺诈检测。由于异常情况通常具有高度灵活性且标记数据有限，传统的异常检测方法往往难以有效应对。为此，研究人员提出了一种新颖的深度学习框架——AddGraph，该框架基于注意力机制的时态图卷积网络（Temporal GCN），旨在从结构、内容和时间三个维度捕捉动态图中的复杂模式。 AddGraph的核心在于其扩展的时态GCN，它能够同时处理长程和短程模式。通过注意力机制，该模型能够对图中的节点和边赋予不同的权重，根据它们对异常检测的重要性自动聚焦。这不仅增强了模型的泛化能力，还能减少噪声的影响，使得在缺乏显式标记数据的情况下，也能学习到异常的潜在规律。在训练过程中，AddGraph采用半监督学习策略，引入了选择性负采样技术，以缓解标记数据不足的问题。这种方法允许模型在没有过多异常样本的情况下，有效地学习正常行为的模式，从而提高对异常情况的识别能力。此外，边距损失函数被用于优化模型的性能，进一步提升了模型在异常检测任务中的表现。实验证明，AddGraph在处理各种现实世界数据集时，表现出显著的优势，相较于当前最先进的异常检测算法，能够在精确度和召回率上取得更好的平衡。这表明，通过结合注意力机制和时态GCN，AddGraph提供了一种有效的动态图异常检测解决方案，对于提升许多领域的数据分析和决策支持具有重要意义。 AddGraph是一个强大的工具，它革新了动态图异常检测的方式，通过考虑全面的结构、内容和时间特征，以及利用注意力机制来增强时态GCN，解决了数据标记不足的问题。这个成果不仅在理论上有深度，而且在实践中展现了实际价值，是IT行业中解决复杂异常检测问题的重要突破。"

AddGraph: Anomaly Detection in Dynamic Graph Using Attention-based

Temporal GCN

Li Zheng

1,2

, Zhenpeng Li

, Jian Li

, Zhao Li

3∗

and Jun Gao

1,2∗

The Key Laboratory of High Conﬁdence Software Technologies, Ministry of Education, China

School of EECS, Peking University, China

Alibaba Group, China

{greezheng, gaojun}@pku.edu.cn, {zhen.lzp,zeshan.lj,lizhao.lz}@alibaba-inc.com

Abstract

Anomaly detection in dynamic graphs becomes

very critical in many different application scenar-

ios, e.g., recommender systems, while it also raises

huge challenges due to the high ﬂexible nature of

anomaly and lack of sufﬁcient labelled data. It is

better to learn the anomaly patterns by consider-

ing all possible hints including the structural, con-

tent and temporal features, rather than utilizing

heuristic rules over the partial features. In this pa-

per, we propose AddGraph, a general end-to-end

anomalous edge detection framework using an ex-

tended temporal GCN (Graph Convolutional Net-

work) with an attention model, which can capture

both long-term patterns and the short-term patterns

in dynamic graphs. In order to cope with insufﬁ-

cient explicit labelled data, we employ a selective

negative sampling and margin loss in training of

AddGraph in a semi-supervised fashion. We con-

duct extensive experiments on real-world datasets,

and illustrate that AddGraph can outperform the

state-of-the-art competitors in anomaly detection

signiﬁcantly.

1 Introduction

The recent years witness the rapid development of dynamic

graphs. Taking the e-commerce sites as an example. Massive

users perform different operations, such as item clicking, item

buying, in the sites every day, which contribute to millions of

newly-added edges into the graph. The modiﬁcation of other

attributes for accounts/items also produces a large amount of

content information. These dynamic graphs serve as the basis

for the most important tasks in the e-commerce sites like the

query and item recommendation.

Anomalous users may perform some operations to gener-

ate fake data in the dynamic graphs to achieve the potential

gain. These fake data are called anomaly in this paper. Taking

the anomaly in the recommendation as an example. Anoma-

lous users can improve the popularity of their target items

through a large number of new operations related to target

∗

Contact Author

items, like clicking both target items and popular ones fre-

quently. Then, the target items may show some similarities to

other popular ones, which increases the chances and upgrade

rankings in the recommendation

[

Hooi et al., 2016

]

. In order

to achieve the goal quickly, anomalous users usually control

multiple accounts to perform these operations in a short time

period. The anomaly detection in dynamic graph, especially

anomalous edges detection, is then highly needed before the

data are fed into the following tasks

[

Akoglu et al., 2015;

Ranshous et al., 2015

]

It is not trivial to detect the anomaly due to its ﬂexible and

dynamic nature. Some anomalous operations show some ex-

plicit patterns but try to hide them in a large graph, while oth-

ers are with implicit patterns. Take an explicit anomaly pat-

tern in the recommender system as an example. As anoma-

lous users usually control multiple accounts to promote the

target items, the edges between these accounts and items may

compose a dense subgraph, which emerge in a short time pe-

riod. In addition, although the accounts which involve the

anomaly perform anomalous operations sometimes, these ac-

counts perform normally most of the time, which hides their

long-term anomalous behavior and increases the difﬁculty of

detection. The similar anomaly pattern appears in the net-

work attack against IP-IP network

[

Eswaran et al., 2018

]

where there are sudden large number of connections, forming

a very dense subgraph in the network. Such cases indicate

the ﬂexible nature of anomaly, which requires us to learn the

anomaly patterns by combining all available hints like struc-

tural, temporal and content features.

Another challenge in the anomaly detection lies in the in-

sufﬁcient labelled data. Even if the initial data are normal,

anomaly data will be ﬁnally mixed with the normal ones in

the real-world applications as time goes by. It results in high

burden or is even infeasible if we check the anomaly every

day by hand. Even if we can label some anomaly operations,

they may occupy a small part of anomalies. It indicates that

the explicit labelled data may be not representative, and re-

sults in the poor performance if we learn a detection model in

a supervised way.

Most of existing approaches to detecting the anomalies in

dynamic large graphs rely on the heuristic rules which con-

sider the above features in a rigid way. For example,

[

Hooi

et al., 2016

]

mainly relies on the structural features. They

deﬁne a density function and discover the target mainly us-

下载后可阅读完整内容，剩余6页未读，立即下载

weixin_38519060

粉丝: 1
资源: 900

注意力时态GCN：动态图中异常检测的新突破

网络安全评估系统－源码

Cluster-GCN An Efficient Algorithm for Training Deep and Large Graph...ppt pdf

ST-GCN基于图卷积的行为识别修改模型文件

基于python使用基于自注意力池化机制结合GCN模型实现图分类

使用基于自注意力池化机制结合GCN模型实现图分类

SKIN_GCN:皮肤检测（使用GCN）

图分类项目：自注意力池化与GCN模型集成实现

ModuleNotFoundError: No module named 'stgcn'

使用基于自注意力池化机制结合GCN模型实现图分类.zip

GCN_linkprediction:在pytorch上使用GCN进行链接预测

最新资源