A social media individual abnormal user detection method based on the evolution of self-network structure

Abstract

The invention belongs to the security field of social media abnormal user detection, and in particular relates to a social media individual abnormal user detection method based on self-network structure evolution. Include comparison snapshot G T‑1 and G T To identify the time-varying component; based on the time-varying component to build a suspicious abnormal node set SAN-Set (T); for each node v in SAN-Set (T) i , build the core network Core‑net T‑1 (v i ) and Core‑net T (v i ); for each node v in SAN‑Set(T) i , find the abnormal score Outlying‑Score(v i ), and sort according to the size of the abnormal score; output the top n largest abnormal scores. The present invention aims at the scene where individual users have abnormal behaviors in social media, and proposes an improved incremental local evolution anomaly detection method Db-IcLEOD based on a directed graph on the basis of the existing IcLEOD method. The improved method can be used for Deal with social media user interaction state network based on directed graph, taking into account the directionality of user interaction, through this improvement, only the nodes that have two-way interaction with suspicious abnormal nodes will be included in its core network, thus avoiding the original method Exception false positive.

Description

technical field [0001] The invention belongs to the security field of social media abnormal user detection, and in particular relates to a social media individual abnormal user detection method based on self-network structure evolution. Background technique [0002] In recent years, a large number of social applications have emerged and developed rapidly. For example, domestic well-known ones include Tencent QQ, WeChat, Sina Weibo, Baidu Tieba, Douban, Tianya Community, Zhihu, etc. Foreign well-known professional social networking sites LinkedIn, Weibo, etc. Social networking site Twitter, light blogging social platform Tumblr, the world's largest social networking site Facebook, image-based social networking site Pinterest, SNS social networking site Google+, etc. These social applications allow users to interact easily no matter where they are, and can make strangers who have never met before make friends and confidants with similar interests. It can increase the communica...

AI Technical Summary

Problems solved by technology

Among them, graph-based social media anomaly user detection methods mostly analyze anomalies from a global perspective. However, the current social media has a complex structure and a large scale, so it is impractical to grasp the structural information of the entire graph.

Moreover, the global analysis method can detect anomalies under certain conditions, but when anomalous objects are hidden among their neighbors, the global method will fail

In addition, due to the directionality of user interaction in social media, this directionality can be described using directed graphs. However, most of the existing anomaly detection methods are based on undirected graphs, so they have certain limitations.

Ji T et al. proposed an incremental local evolutionary outlier detection method (Incremental Local Evolutionary Outlier Detection, hereinafter referred to as IcLEOD), which dynamically analyzes the time-varying components (nodes, edges and weights) and the nodes affected by them. Neighborhood structure changes to detect local anomalies. Although this technique can avoid analyzing the global information of the graph and can detect local anomalies, it cannot consider the directionality of user interaction in social media because it deals with undirected graphs. , this limitation creates two problems:

[0004] 1. Analyze a large amount of invalid information: Since the type of graph processed by the IcLEOD method is an undirected graph, and an undirected graph cannot describe the direction of user interaction, that is, as long as there is an edge between two nodes, it means that two users have interacted, so it is impossible to judge the direction of user interaction. One-way interaction or two-way interaction between users, taking Weibo as an example, the main interaction behaviors such as like, follow and forward are usually one-way interaction, and most one-way interactions usually cannot reflect the abnormal behavior of users, so the analysis These one-way interactive information is meaningless for anomaly detection

[0005] 2. There are abnormal false positives: because the directionality of the interaction is not considered, it may cause abnormal false positives

Still taking Weibo as an example, assuming that there are two users A and B, B initiates one-way interaction with A multiple times within a time step, but A does not respond to B, in this case, if the IcLEOD algorithm is used, as Normal user A will be falsely reported as an abnormal user

Images