【作者】 林永辉；

【导师】 许力；

【作者基本信息】 福建师范大学 ， 网络空间安全， 2024， 硕士

【摘要】 随着互联网技术的持续进步,属性图因其卓越的建模能力而得到了广泛应用。同时,属性图上的局部异常节点检测也逐渐受到关注。在进行局部异常节点检测时,社团结构往往被作为关键的参考信息。然而,目前大多数方案对社团结构的利用过于粗糙,只使用了粗略划分的社团结构作为参考信息来执行局部异常节点的检测,这样粗糙的社团信息影响了局部异常节点检测的准确性。针对这一问题,本文精心设计了三个不同的解决方案:(1)为了解决使用的社团信息过于粗糙的问题,本文首先提出了基于社团上下文调整的局部异常节点检测方法。相较于传统方法,该方法对获取的粗糙社团信息进行了细致的调整,从而使其更好地服务于社团内异常节点的检测。为实现这一目标,我们设计了集成框架ADRC。首先,ADRC将属性信息与拓扑信息相结合,获取初始的社团结构;接着,利用已有的社团信息计算潜在的异常节点;然后进行迭代处理,在迭代处理过程中,ADRC逐一处理潜在异常节点,确保它们不会对其他节点的异常评估产生不良影响;同时,每次迭代结束后,ADRC还会对误判的节点进行还原;最终,在迭代过程结束后,ADRC根据经过精细化调整后的社团信息来判断最终的异常节点。通过合成数据集和真实数据集的实验验证,该方案展现出了显著的有效性。(2)相较于在社团探测结束后处理社团信息来解决社团信息过于粗糙这一问题,直接在探测过程中进行处理显然更为高效且直接。为此,我们提出了一种基于社团核心的局部异常节点检测方法,设计了DAWCSN框架。该方法通过融合属性信息、结构信息和初始种子节点来启动社团探测;同时,在探测过程中,该框架逐步加入节点并对其进行判断,标记出可疑节点,直至一个社团探测完成;接着,DAWCSN运用种子节点搜索策略来发现新的种子节点,进而探测其他社团,并对可疑节点进行标记;最终,该框架利用探测得到的所有社团核心对所有可疑节点进行判断,以识别异常节点。在合成数据集和真实数据集上的实验表明了该方案的有效性。(3)为了解决社团信息过于粗糙的问题,同时考虑到数据量的不断增长,以及用户通常只对小部分特定数据感兴趣,我们引入了用户偏好使得社团信息能更好的服务与社团内异常节点检查。我们设计了集成框架SLCAO,该框架专注于用户感兴趣的数据部分,避免了对整体数据的全面挖掘。首先,SLCAO根据用户提供的样本节点来探测其周围节点,以寻找合适的种子节点;接着,该框架结合样本节点和种子节点来推测用户偏好,并据此处理图数据;在社团搜索过程中,SLCAO利用种子节点集合来发现可疑节点并进行标记。同时,为了确保社团搜索朝正确方向进行,我们提出了一种修复策略,来消除异常节点对搜索过程的影响;最后,SLCAO根据得到的社团结构对可疑节点进行最终判断,从而识别出社团内的异常节点。在合成数据集和真实数据集上的实验结果表明,该方案不仅提高了社团质量,而且在社团内异常节点检测方面表现出色。经过一系列精心设计的方案及其实验验证,我们证明了社团信息在社团内异常节点检测中的关键作用。深入分析表明,社团信息不仅精准指引我们定位社团内异常节点,还为揭示社团内异常节点的成因及其影响机制提供了宝贵线索。同时,我们深知社团内异常节点的存在对社团的负面影响不容小觑。因此,及时发现并妥善处理这些异常节点对于社团检测同样至关重要。综上所述,社团信息在社团内异常节点检测中占据重要地位,而异常节点的存在亦对社团检测有着深远影响。更多还原

【Abstract】 With the advancement of Internet technology,attribute graphs have become widely used due to their superior modelling capabilities.Recently,there has been increasing attention on local anomaly node detection on attribute graphs.When conducting local anomaly node detection,the community structure is often used as the key reference information.However,many current schemes do not effectively utilise community information and only use a rough community structure to guide the detection of local anomalous nodes.Local anomaly detection accuracy is affected by coarse community information as anomaly judgments depend on the reference object.In this paper,three solutions are proposed to address this problem more closely.(1)To address the issue of imprecise community information,this paper proposes a method for detecting local anomalous nodes based on community context adjustment.The proposed method refines the rough community information to better detect anomalous nodes within the community,as compared to traditional methods.In order to achieve this objective,we have designed the integrated framework ADRC.Firstly,ADRC combines attribute information with topology information to obtain the initial community structure.Next,potential anomalous nodes are identified using the existing community information.During the iterative process,ADRC deals with potential anomaly nodes one by one to ensure that they do not adversely affect the anomaly assessment of other nodes.At the end of each iteration,ADRC restores the misjudged nodes.Finally,at the end of the iterative process,ADRC identifies the final anomalous nodes based on the fine-tuned community information.The scheme has been experimentally validated on both synthetic and real datasets,demonstrating significant effectiveness.(2)Compared to processing community information at the end of community detection to address the issue of rough community information,it is more efficient and direct to process it during the detection process.Therefore,we propose a local anomaly node detection method based on community core and design the DAWCSN framework.The method initiates community detection by combining attribute information,structural information,and initial seed nodes.The framework gradually joins nodes during the detection process and marks suspicious nodes until a community detection is completed.Then,DAWCSN applies the seed node search strategy to discover new seed nodes,detect other communities,and mark suspicious nodes.Ultimately,the framework uses the cores of all communities detected to identify anomalous nodes.Experiments on synthetic and real datasets show the effectiveness of the scheme.(3)To address the issue of rough community information,and considering the growing amount of data and the fact that users are usually only interested in a small part of specific data,we introduce user preferences to make community information more useful for anomalous node checking within the community.Our integration framework,SLCAO,focuses on the relevant data and avoids comprehensive mining of the overall data,while also including anomalous node checking within the community.SLCAO first probes the surrounding nodes based on the sample nodes provided by the user to find suitable seed nodes.Next,the framework combines the sample nodes and seed nodes to infer user preferences and process the graph data accordingly.During the community search process,SLCAO uses the set of seed nodes to detect suspicious nodes and mark them.To ensure an objective community search,we propose a repair strategy that eliminates the influence of abnormal nodes on the process.The final judgement on suspicious nodes is made by SLCAO based on the community structure obtained,identifying any abnormal nodes within the community.The experimental results on both synthetic and real datasets demonstrate that the scheme enhances the quality of communities and effectively detects anomalous nodes within the community.Following a series of well-designed schemes and their experimental validation,we demonstrate the crucial role of community information in detecting anomalous nodes within a community.In-depth analysis shows that community information not only accurately guides us in locating anomalous nodes,but also provides valuable clues for revealing the causes of anomalous nodes and their influence mechanisms.Simultaneously,it is acknowledged that the presence of anomalous nodes within a community can have a detrimental effect on said community,which should not be disregarded.Therefore,the timely identification and appropriate management of these anomalous nodes is also vital for community detection.In conclusion,community information is a significant factor in the detection of anomalous nodes within a community,and the existence of such nodes can have a profound impact on community detection.更多还原