Intelligent social worm propagation prediction method, defense method and device based on epidemiology

Abstract

The invention provides an epidemiology-based intelligent social worm propagation prediction method, defense method and device. The prediction method comprises the following steps: modeling a social network topology by adopting a multi-graph model to serve as a propagation environment, and simulating an intelligent social worm propagation mode in the propagation environment based on a state transition mechanism in an epidemic model; wherein in the multi-graph obtained through construction, nodes represent users, edges represent interaction relations of the users in different interest circles, and attributes of the edges represent the interest circles; in each round of directional propagation process, analyzing a social distance between a user in each interest circle and a target user, so as to identify a potential propagation set of each interest circle based on the social distance to perform next round of propagation; and evaluating the directional propagation effect of each round, and adjusting the propagation strategy according to the evaluation result.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an epidemiology-based intelligent social worm propagation prediction method, defense method and device. Background Art

[0002] With the prevalence of social networks, worm threats based on social connections are on the rise. Traditional social worms exploit friend networks to indiscriminately infect a wide range of targets. However, with the development of artificial intelligence (AI) and advanced persistent threats (APTs), a new type of worm—the intelligent social worm—has emerged. Incorporating the targeted attack strategies of APTs, intelligent social worms can precisely infiltrate high-value targets on social networks, such as key personnel in government or enterprise positions.

[0003] Unlike traditional social worms, intelligent social worms are more targeted and adaptable. They not only intelligently filter their targets based on their social characteristics (such as interests and text content), but also generate customized phishing attack content. By dynamically analyzing user data, intelligent social worms can adjust their propagation strategies and optimize their propagation paths, significantly improving attack efficiency and accuracy. This attack method not only significantly enhances propagation effectiveness but also places higher demands on existing defenses. Therefore, in-depth research on their propagation mechanisms is crucial for predicting the spread dynamics of intelligent social worms and evaluating defenses.

[0004] Among the existing research methods for worm propagation prediction, simulation modeling is an effective method for analyzing worm propagation mechanisms.

[0005] However, most current social worm propagation models focus on traditional worms that spread blindly, and thus have the following shortcomings:

[0006] (1) Lack of targeting: It is impossible to accurately simulate the targeted attack characteristics of intelligent social worms and it is difficult to truly reflect their propagation behavior;

[0007] (2) Ignoring user social characteristics: Failure to fully consider the interests, relationship networks, and behavior patterns of users in social networks, resulting in a lack of personalized communication strategies;

[0008] (3) Static defense strategy: Existing methods mostly use fixed rules or predefined defense strategies, which cannot be adjusted in real time according to the dynamic propagation behavior of worms.

[0009] Therefore, existing research methods are unable to accurately predict and effectively defend against the spread of intelligent social worms. This poses new challenges to the study of the spread mechanism of intelligent social worms and the design of defense measures, and there is an urgent need to develop more comprehensive, dynamic, and targeted spread prediction and defense methods. Summary of the Invention

[0010] In response to the problems that existing worm propagation prediction methods cannot effectively predict the propagation path of intelligent social worms and defense measures cannot be adjusted dynamically in real time, the present invention proposes an epidemiologically based intelligent social worm propagation prediction method, defense method and device.

[0011] In a first aspect, the present invention provides an epidemiologically based intelligent social worm propagation prediction method, comprising:

[0012] A multigraph model is used to model the social network topology as a propagation environment. Based on the state transition mechanism in the epidemic model, the intelligent social worm propagation mode is simulated in the propagation environment. In the constructed multigraph, nodes represent users, edges represent the interactive relationships between users in different interest circles, and the attributes of the edges represent the interest circles.

[0013] In each round of directed propagation, the social distance between users in each interest circle and the target user is analyzed, so as to identify the potential propagation set of each interest circle based on the social distance for the next round of propagation.

[0014] Evaluate the effectiveness of each round of targeted communication and adjust the communication strategy based on the evaluation results.

[0015] Traditional worm propagation models fail to effectively leverage social network characteristics, resulting in a lack of targeted prediction of propagation paths to specific targets. This invention achieves precise simulation of intelligent worm propagation by dynamically analyzing the social distance between users and adjusting target selection strategies in real time. This model not only optimizes the prediction capabilities of social worm propagation but can also be applied to network defense and early warning mechanisms, helping to develop more comprehensive security strategies.

[0016] Furthermore, in each round of directional communication, the social distance between users in each interest circle and the target user is analyzed, thereby identifying the potential communication set of each interest circle based on the social distance. Specifically, the following steps are performed:

[0017] For each interest circle, the social distance between each user in the interest circle and the target user is calculated, and all users in the interest circle are sorted according to the size of the social distance, so as to select users with a smaller social distance to the target user and add them to the preset set to obtain the potential propagation set of the interest circle in the current round; among which, the social distance refers to the degree of difference between the topic text vectors of two users in the same interest circle.

[0018] Furthermore, the interest circle c is calculated according to the following formula: k User u i With target user u t Social distance between Social (u i ,u t,c k ):

[0019]

[0020] Among them, v Text (u,c) represents the feature vector of all text contents of user u in interest circle c.

[0021] Furthermore, the effectiveness of each round of targeted communication is evaluated, including:

[0022] If the hit rate of the current round of directional propagation is 0, the total score of the current round is S total =S prev *a; where S prev is the total score of the previous round; a is the preset penalty coefficient, 0 <a<1;

[0023] If the hit rate of the current round of directional propagation is greater than 0, the calculation process of the total score of the current round includes:

[0024] First, calculate the feedback score S based on the difference between the predicted and actual infection social distances feedback :

[0025]

[0026] S feedback =f score (x feedback )

[0027] in, Indicates the average social distance of infected users predicted in this round, U T represents the set of users predicted to be infected in this round, Indicates U T The social distance between user u and the target user; Indicates the average social distance of users who were actually infected in the last round, represents the set of users successfully infected in the last round, x feedback represents the feedback item, R represents the hit rate, f score Represents the preset scoring function;

[0028] Next, calculate the social distance prediction change trend score S prospect :

[0029]

[0030] S prospect =f score (ΔD Social )

[0031] Where ΔD SocialIndicates the trend of social distance changes;

[0032] Finally, calculate the total score S of the current round total :

[0033] S total =(1-a)·(S feedback +S prospect )+a·S prev .

[0034] Furthermore, the communication strategy will be adjusted based on the evaluation results, including:

[0035] For the current interest circle, compare its score with the average score. If it is greater than the average score, increase the priority of the interest circle; otherwise, reduce the priority of the interest circle. When the priority of the interest circle is higher, increase the number of users participating in the dissemination in the interest circle; otherwise, try to switch to other interest circles with smaller social distance.

[0036] Furthermore, when the number of users participating in the dissemination in the interest circle needs to be increased, the number of users participating in the dissemination in the interest circle is calculated according to the following formula:

[0037]

[0038] Among them, round represents the rounding operation, N max and N min represents the maximum and minimum number of users participating in the transmission, k max represents the preset maximum priority value, and r represents the priority value of the interest circle.

[0039] In a second aspect, the present invention provides a defense method against an epidemiologically based intelligent social worm propagation model, comprising:

[0040] Analyze the target user's interest circle and use the prediction method described in the first aspect to identify potential high-risk users and transmission paths in the interest circle; when the high-risk user is detected to be close to the target user, issue an early warning;

[0041] In high-risk propagation paths, honeypot nodes are deployed to induce intelligent social worms to attack the honeypot nodes;

[0042] When users who have been infected by the intelligent social worm or users who are in close social distance with the intelligent social worm are isolated.

[0043] In a third aspect, the present invention provides an epidemiologically based intelligent social worm propagation prediction device, comprising:

[0044] A propagation evolution module is used to model the social network topology using a multigraph model as a propagation environment, and to simulate the intelligent social worm propagation pattern in the propagation environment based on the state transition mechanism in the epidemic model. In the constructed multigraph, nodes represent users, edges represent the interactive relationships between users in different interest circles, and the attributes of the edges represent the interest circles.

[0045] The target selection module is used to analyze the social distance between users in each interest circle and the target user during each round of directed propagation, thereby identifying the potential propagation set of each interest circle based on the social distance for the next round of propagation;

[0046] The dynamic feedback module is used to evaluate the effect of each round of directional communication and adjust the communication strategy based on the evaluation results.

[0047] The three modules—propagation evolution, target selection, and dynamic feedback—operate in tandem to form a comprehensive threat prediction and defense system. The propagation evolution module simulates the propagation patterns of traditional worms to predict potential worm transmission paths. The target selection module identifies key user nodes within social networks, ensuring accurate identification and monitoring of high-risk transmission paths. The dynamic feedback module analyzes data feedback during the propagation process to optimize and adjust strategies in real time, enhancing responsiveness to potential threats and improving overall network defense effectiveness.

[0048] In a fourth aspect, the present invention provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method described in the first aspect and / or the second aspect is implemented.

[0049] In a fifth aspect, the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect and / or the second aspect.

[0050] The beneficial effects of the present invention are:

[0051] Based on modeling the propagation of intelligent social worms, the present invention forms a complete intelligent social worm propagation model by constructing three modules: propagation evolution, intelligent target selection, and dynamic feedback. This model compensates for the traditional model's neglect of social characteristics and lack of precision, effectively improving the adaptability and prediction accuracy of intelligent worm propagation. Through the triple strategy of active early warning, propagation interference, and risk isolation, a dynamic and adaptive defense system is formed. The present invention can not only effectively predict and intercept the propagation path of intelligent social worms, but also continuously optimize based on the ever-changing threat characteristics, significantly improving the overall security in complex social network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A schematic diagram of a flow chart of an epidemiologically based intelligent social worm propagation prediction method provided by an embodiment of the present invention;

[0053] Figure 2 User infection mechanism provided by the embodiment of the present invention

[0054] Figure 3 State transfer mechanism provided by the embodiment of the present invention

[0055] Figure 4 The target selection algorithm provided by the embodiment of the present invention;

[0056] Figure 5 An interest circle propagation evaluation algorithm provided by an embodiment of the present invention;

[0057] Figure 6 A propagation strategy adjustment algorithm provided by an embodiment of the present invention;

[0058] Figure 7 A flowchart of a defense method for an epidemiologically based intelligent social worm propagation model provided by an embodiment of the present invention;

[0059] Figure 8 A schematic diagram of the structure of an epidemiologically based intelligent social worm propagation prediction device provided by an embodiment of the present invention;

[0060] Figure 9 This is a structural block diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0061] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0062] like Figure 1 As shown, the embodiment of the present invention provides an epidemiologically based intelligent social worm propagation prediction method, comprising the following steps:

[0063] S101: Propagation Evolution. A multigraph model is used to model the social network topology as the propagation environment. Based on the state transition mechanism in the epidemic model, an intelligent social worm propagation pattern is simulated within this propagation environment to comprehensively depict user behavior patterns and information propagation dynamics. In the constructed multigraph, nodes represent users, edges represent users' interactions in different interest circles, and edge attributes represent interest circles.

[0064] Specifically, in a social network, user groups can be divided according to their interests, hobbies or themes to obtain multiple interest circles. Any user can belong to multiple interest circles at the same time. Therefore, the interaction between two users can be an interaction between different interest circles. Therefore, the embodiment of the present invention uses a multi-graph model with edge attributes to model the social network topology, taking the users in the social network as nodes, the interactive relationships between users in different interest circles as edges, and the interest circle types as the attributes of the edges, thereby obtaining a model G = (V, E, C), where V represents the node set, E represents the edge set, and C represents the attribute set. Among them, the edge can be represented by a triple (v i ,v j ,c) means that user v i and user v j There is an interactive relationship in interest circle c.

[0065] In terms of state transition mechanism, the epidemiological (SI) model is used based on the discrete time framework to model the user's state into susceptible state and infected state. Represents the state of user i at time t:

[0066]

[0067] Initially, except for the source of transmission, all other users on the social network are in a susceptible state. Users in an infected state can infect their adjacent susceptible users. The transmission mechanism combines the user behavior characteristics in discrete time. The specific infection mechanism is as follows: Figure 2 shown.

[0068] Assume that social users check messages at a certain time interval, and the random variable △T i Represents the time interval between consecutive message checks for user i, and defines the indicator variable read i (t) indicates whether user i has viewed the message at time t. The formula is as follows:

[0069]

[0070] A user can only be infected if they click on the malicious payload after viewing the message. User click behavior is influenced by multiple factors, including the user's security awareness (SA), frequency of communication with the information source (CF), and personalized text quality (TQ). This embodiment of the present invention simulates the probability of user i clicking on text d sent by user j at time t using the following formula:

[0071]

[0072] Among them, w1, w2, w3 are the weights of each factor, and the sum of the weights is 1. Combined with the probability P (read i (t)=1) and the probability of click behavior The probability of user i being infected at time t can be calculated using the following formula, where θ represents the probability of successful exploitation:

[0073]

[0074] Finally, the state transfer mechanism is as follows Figure 3 As shown in Figure 2, the process of a user transitioning from a susceptible state to an infected state is specifically shown. This process can be described by the following formula:

[0075]

[0076] S102: Target selection. During each round of targeted communication, the social distance between users in each interest group and the target user is analyzed, and the potential communication set of each interest group is identified based on the social distance for the next round of communication.

[0077] Specifically, analyzing social distance in targeted messaging ensures accurate information dissemination and can also be used as a defensive tool to monitor and predict potential threats. Specifically, embodiments of the present invention map user interest topics to target topics, thereby constructing an interest topic space. The social distance between users is calculated using topic vectors generated from text content. This distance measures social proximity, enabling the rapid identification of potentially high-risk communication nodes.

[0078] S103: Dynamic Feedback: Evaluate the effectiveness of each round of targeted communication and adjust the communication strategy based on the evaluation results.

[0079] Specifically, this step mainly uses a comprehensive scoring function to quantify the effect of each round of propagation to evaluate the accuracy of the current propagation strategy, thereby identifying potential propagation paths.

[0080] Traditional worm propagation models primarily focus on propagation speed and range, lacking in-depth analysis of individual characteristics and their role in propagation, making it difficult to effectively address the precise spread of intelligent social worms. This invention significantly improves the accuracy of potential propagation path predictions by introducing a propagation prediction method based on interests and social relationships, combining three mechanisms: propagation evolution, target selection, and dynamic feedback. This helps better detect and prevent the threat of social worm propagation.

[0081] In one embodiment, during each round of directed propagation, the social distance between users in each interest circle and the target user is analyzed, thereby identifying the potential propagation set of each interest circle based on the social distance, specifically including:

[0082] For each interest circle, the social distance between each user in that interest circle and the target user is calculated. All users in that interest circle are sorted by social distance, selecting users with a smaller social distance from the target user and adding them to the preset set to obtain the potential propagation set for that interest circle in the current round. Social distance refers to the degree of difference between the topic text vectors of two users in the same interest circle.

[0083] Specifically, first, the text content of potential users is subject modeling, and the user's interest topics are mapped to the target user's interest topic space C = {c1, c2, ..., c k This process generates a topic text vector v by analyzing the user's social activities and text content. Text (u i, c k ), indicating user u i In interest circle c k The feature vector of all text contents under .

[0084] Secondly, the topic text vector is used to calculate the social distance between the target user and the potential spreading users in the interest circle. Specifically, the social distance D Social (u i ,u t ,c k ) can be determined by calculating the similarity between the topic text vectors of two users. As an implementation method, the cosine similarity is used to calculate the similarity between the topic text vectors of two users, then user u i and target user u t In interest circle c k The formula for calculating social distance is as follows:

[0085]

[0086] The embodiment of the present invention also provides the code of the target selection algorithm, such as Figure 4 As shown in the figure, in the design of the propagation strategy, users with the smallest social distance from the target user are initially selected to form the initial propagation set (also known as the initial defense set), which monitors and issues early warnings for high-risk users in real time. In subsequent stages, the mechanism of re-evaluating and selecting propagation nodes in each round further strengthens control over potential propagation paths, preventing abnormal information spread within the network. This strategy effectively isolates potential threat paths and enhances defense capabilities in complex social network environments.

[0087] In one embodiment, the evaluation of the effect of each round of directed propagation specifically includes:

[0088] If the hit rate of the current round of directional propagation is 0, the total score of the current round is S total=S prev *a; where S prev is the total score of the previous round; a is the preset penalty coefficient, 0 <a<1;

[0089] If the current round's directional propagation hit rate is greater than 0, the total score for the current round is calculated based on the following three core factors: feedback on the difference between the predicted and actual results, an assessment of the prospect of changes in social distance, and the continuity of historical performance. The specific process is as follows:

[0090] (1) Calculate the feedback score S based on the difference between the predicted and actual infection social distances feedback :

[0091]

[0092] in, Indicates the average social distance of infected users predicted in this round, U T represents the set of users predicted to be infected in this round, Indicates U T The social distance between user u and the target user; Indicates the average social distance of users who were actually infected in the last round, represents the set of users successfully infected in the last round, x feedback represents the feedback item, R represents the hit rate, f score Represents a preset scoring function; this embodiment does not limit this.

[0093] (2) Calculate the social distance prediction trend score S prospect :

[0094]

[0095] S prospect =f score (ΔD Social ) (12)

[0096] Where ΔD Social Indicates the trend of social distance change (also called trend term);

[0097] (3) Calculate the total score S of the current round total :

[0098] S total =(1-a)·(S feedback +S prospect )+a·S prev (13)

[0099] Among them, S feedbackIt represents the feedback score calculated based on the difference between the predicted and actual infection social distances, which is used to reflect the degree of fit of the model to the current transmission effect; S prospect Represents the social distance prediction change trend score, which is used to evaluate whether the model's dissemination strategy is forward-looking; S prev It is the total score of the previous round, and historical information is introduced to smooth score fluctuations. In this embodiment, the penalty coefficient a = 0.1, that is, the overall score is mainly based on the current performance (accounting for 90%), and combined with the score of the previous round (accounting for 10%) to achieve smooth adjustment, thereby ensuring that the evaluation results can not only reflect the effectiveness of the communication strategy in real time, but also have robustness.

[0100] Specifically, this embodiment first uses a scoring function to quantify the effect of each round of communication. The core indicators include social distance and targeted communication hit rate. Actual social distance To evaluate the accuracy of the current strategy and identify potential transmission paths. The future transmission potential is predicted by analyzing the trend of social distance changes and predicting the possible direction of risk transmission. The global performance of the comprehensive historical data generates the final total score S for each round of transmission. total , helping to identify abnormal patterns and optimize defense strategies. This dynamic evaluation algorithm significantly improves the system's ability to identify and adjust propagation paths. Figure 5 shown.

[0101] Based on the evaluation results, in one embodiment, an interest circle strategy adjustment algorithm is further proposed, which specifically includes: for the current interest circle, comparing its score with the average score, if it is greater than the average score, increasing the priority of the interest circle; otherwise, lowering the priority of the interest circle; when the priority of the interest circle is higher, increasing the number of users participating in the dissemination in the interest circle, otherwise, trying to switch to other interest circles with smaller social distance.

[0102] The embodiment of the present invention adjusts the priority of an interest circle by comparing the score of the interest circle with the average score: if the score is higher than the average, the priority of the interest circle is increased; otherwise, the priority is lowered. When the priority is high, the system will increase the number of users participating in the dissemination in the circle to expand the dissemination range; otherwise, it will try to switch to other interest circles with smaller social distance. The specific algorithm is as follows Figure 6 shown.

[0103] As an implementable method, when the number of users participating in the dissemination in the interest circle needs to be increased, the number of users participating in the dissemination in the interest circle is calculated according to the following formula:

[0104]

[0105] Among them, round represents the rounding operation, Nmax and N min represents the maximum and minimum number of users participating in the transmission, k max represents the preset maximum priority value, and r represents the priority value of the interest circle.

[0106] This embodiment of the present invention achieves flexible defense optimization through an interest circle strategy adjustment algorithm. This algorithm dynamically adjusts the priority of interest circles based on a comparison of their scores with the average. When the score is higher than the average, the priority of the interest circle is increased, expanding the number of participating users in the interest circle, thereby strengthening monitoring and early warning effectiveness. When the score is low, monitoring is switched to other interest circles with a closer social distance. This mechanism adjusts parameters based on actual performance after each round of dissemination, ensuring that the system can quickly identify potential threats and optimize dissemination strategies for more accurate threat defense and prediction.

[0107] Based on the same inventive concept, Figure 7 As shown, an embodiment of the present invention further provides a defense method against an epidemiologically based intelligent social worm propagation model, comprising the following steps:

[0108] S201: Analyze the target user's interest circle and use the aforementioned intelligent social worm propagation prediction method to identify potential high-risk users and propagation paths in the interest circle; issue an early warning when it is detected that the high-risk user is in close social proximity to the target user;

[0109] S202: deploying a honeypot node in a high-risk propagation path to induce the intelligent social worm to attack the honeypot node;

[0110] S203: Isolate users who have been infected by the intelligent social worm or users who are in close social distance to the intelligent social worm.

[0111] The defense method provided by this invention combines active early warning, propagation interference, and risk isolation to achieve comprehensive control of worm threats. These defense strategies, based on target selection and a dynamic feedback mechanism, form a closed-loop system from threat perception to propagation interception. The active early warning mechanism is the first line of defense in this defense system. Based on the target selection mechanism, the system analyzes user interest circles and topics to proactively identify potential high-risk users and propagation paths. When a high-risk user is detected to be in close social proximity to a target user, the system immediately issues an early warning, prompting management to strengthen protection. The potential high-risk paths simulated during the propagation evolution phase can also be used to assess the risk level of key nodes, providing a decision-making basis for subsequent defense measures. The propagation interference strategy actively disrupts the worm's propagation logic to slow its spread. Honeypot nodes are deployed as false targets along high-risk propagation paths, inducing intelligent worms to attack ineffective targets, thereby wasting their propagation resources. Furthermore, the system pushes randomly generated false interest features or behavior patterns to disrupt the worm's propagation screening logic, reducing its attack accuracy and propagation efficiency. The risk isolation mechanism is the system's direct response to high-risk nodes. When the system detects that a worm has infected certain users or is approaching critical nodes, it will isolate these nodes, such as temporarily restricting their messaging capabilities or access rights, thereby severing their transmission chain to other nodes. Simultaneously, the system can dynamically adjust the topology of the social network, reducing the frequency of interaction between high-risk nodes and other nodes to prevent their spread.

[0112] For long-term optimization of the defense system, a dynamic feedback mechanism collects and analyzes key data from the propagation process to continuously refine propagation models and defense strategies. For example, by integrating historical propagation data, the module can continuously train predictive models, making them more accurate in responding to new propagation threats. This adaptive mechanism enables the system to dynamically evolve, enabling it to not only address current threats but also provide defense support for more complex propagation scenarios in the future.

[0113] From a defense and prediction perspective, the target selection and propagation feedback mechanism of this invention can effectively assist in detecting and preventing potential social worm propagation threats. By using user text information to segment interest groups within the target selection mechanism, the system can identify closely connected user groups within social networks and help predict potential propagation paths. If a high-risk user is detected to be close to the target user, the system can issue an early warning, indicating the potential risk of propagation.

[0114] The introduction of a dynamic feedback mechanism further enhances defense capabilities. By real-time monitoring of effectiveness indicators during the propagation process (such as propagation success rate and changes in social distance), the system can quickly identify anomalous propagation behavior and dynamically adjust its propagation strategy to address potential threats. Feedback data can also be used to train models, enabling them to more accurately predict and prevent anomalous propagation paths in the future. This adaptive feedback mechanism not only enhances the system's flexibility but also enables rapid response and adjustment, effectively reducing the potential harm of social worm spread.

[0115] Overall, this invention achieves effective prediction and control of potential propagation paths through precise interest group segmentation, a dynamic feedback mechanism, and an adaptive optimization strategy. The system can identify and isolate high-risk propagation paths, enhancing network security. This precise defense mechanism significantly improves the system's ability to respond to worm-propagation threats in complex social networks, providing stronger support for social network security.

[0116] Based on the same inventive concept, Figure 8 As shown, an embodiment of the present invention further provides an epidemiologically based intelligent social worm propagation prediction device, which includes a propagation evolution module, a target selection module and a dynamic feedback module.

[0117] The propagation evolution module uses a multigraph model to model the social network topology as the propagation environment. Based on the state transition mechanism in the epidemic model, it simulates the intelligent social worm propagation pattern within this propagation environment. In this constructed multigraph, nodes represent users, edges represent the interactions between users in different interest circles, and the attributes of the edges represent the interest circles. During each round of directed propagation, the target selection module analyzes the social distance between users in each interest circle and the target user, thereby identifying the potential propagation set for each interest circle based on social distance for the next round of propagation. The dynamic feedback module evaluates the effectiveness of each round of directed propagation and adjusts the propagation strategy based on the evaluation results.

[0118] Specifically, the propagation evolution module constructs a propagation environment based on a social network model, introduces a state transition mechanism (such as the SI model) in epidemiology, dynamically simulates user behavior, accurately reflects the key nodes and paths in the worm propagation process, and thus reproduces its propagation evolution more realistically. In order to improve the pertinence of the model, the present invention introduces the concept of "social distance" in the target selection module, and analyzes the interest circle of infected users from two dimensions: interest matching and relationship strength. By evaluating the closeness between the target user and other nodes in the social network, screening target users with high propagation potential, generating personalized propagation paths, and making the prediction more in line with the actual propagation strategy of the intelligent social worm. The dynamic feedback module collects and analyzes the key data in the propagation simulation (such as hit rate / propagation success rate, social distance change) in real time, and optimizes the propagation evolution and target selection strategy accordingly, and continuously adjusts the model parameters to adapt to changes in the propagation environment. This dynamic iteration mechanism greatly improves the prediction accuracy and adaptability of the model.

[0119] The intelligent social worm propagation prediction device proposed in this paper aims to construct a predictive model for the spread of intelligent social worms. Based on epidemiological models, through the collaborative work of three modules: propagation evolution, target selection, and dynamic feedback, the device can comprehensively simulate and predict the potential propagation paths of intelligent social worms, thereby improving accurate understanding of worm propagation paths and supporting network security defense strategies. By modeling the propagation environment, designing multi-module collaboration, and implementing data feedback, the device achieves accurate simulation of intelligent worm propagation and verifies defense strategies based on this simulation.

[0120] Figure 9 An example of a physical structure diagram of an electronic device is shown below. Figure 9 As shown, the electronic device may include: a processor 901, a communication interface 902, a memory 903, and a communication bus 904, wherein the processor 901, the communication interface 902, and the memory 903 communicate with each other via the communication bus 904. The processor 901 may call logic instructions in the memory 903 to execute an epidemiologically based intelligent social worm propagation prediction method, which includes: using a multi-graph model to model the social network topology as a propagation environment, and simulating the intelligent social worm propagation pattern in the propagation environment based on the state transition mechanism in the epidemic model; wherein, in the constructed multi-graph, nodes represent users, edges represent the interactive relationships of users in different interest circles, and the attributes of the edges represent the interest circles; in each round of directed propagation, the social distance between users in each interest circle and the target user is analyzed, thereby identifying the potential propagation set of each interest circle based on the social distance for the next round of propagation; and evaluating the effect of each round of directed propagation, and adjusting the propagation strategy based on the evaluation results.

[0121] In addition, when the logic instructions in the above-mentioned memory 903 are implemented in the form of a software functional unit and sold or used as an independent product, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0122] An embodiment of the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the epidemiological-based intelligent social worm propagation prediction method provided by the above-mentioned method embodiments.

[0123] An embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the intelligent social worm propagation prediction method based on epidemiology provided by the above-mentioned method embodiments is implemented.

[0124] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0125] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. An intelligent social worm propagation prediction method based on epidemiology, characterized by: include: A multigraph model is used to model the social network topology as a propagation environment. Based on the state transition mechanism in the epidemic model, the intelligent social worm propagation mode is simulated in the propagation environment. In the constructed multigraph, nodes represent users, edges represent the interactive relationships between users in different interest circles, and the attributes of the edges represent the interest circles. In each round of directed propagation, the social distance between users in each interest circle and the target user is analyzed, so as to identify the potential propagation set of each interest circle based on the social distance for the next round of propagation. Evaluate the effectiveness of each round of targeted communication and adjust the communication strategy based on the evaluation results.

2. The epidemiological-based intelligent social worm propagation prediction method according to claim 1, characterized in that: In each round of directional communication, the social distance between users in each interest circle and the target user is analyzed, and the potential communication set of each interest circle is identified based on the social distance. Specifically, the following are involved: For each interest circle, the social distance between each user in the interest circle and the target user is calculated, and all users in the interest circle are sorted according to the size of the social distance, so as to select users with a smaller social distance to the target user and add them to the preset set to obtain the potential propagation set of the interest circle in the current round; among which, the social distance refers to the degree of difference between the topic text vectors of two users in the same interest circle.

3. The epidemiological-based intelligent social worm propagation prediction method according to claim 2, characterized in that: Calculate the interest circle c according to the following formula k User u i With target user u t Social distance between Social (u i ,u t ,c k ): Among them, v Text (u,c) represents the feature vector of all text contents of user u in interest circle c.

4. The epidemiological-based intelligent social worm propagation prediction method according to claim 1, characterized in that: Evaluate the effectiveness of each round of targeted communication, including: If the hit rate of the current round of directional propagation is 0, the total score of the current round is S total =S prev *a; where S prev is the total score of the previous round; a is the preset penalty coefficient, 0 <a<1; If the hit rate of the current round of directional propagation is greater than 0, the calculation process of the total score of the current round includes: First, calculate the feedback score S based on the difference between the predicted and actual infection social distances feedback : S feedback =f score (x feedback ) in, Indicates the average social distance of infected users predicted in this round, U T represents the set of users predicted to be infected in this round, Indicates U T The social distance between user u and the target user; Indicates the average social distance of users who were actually infected in the last round, represents the set of users successfully infected in the last round, x feedback represents the feedback item, R represents the hit rate, f score Represents the preset scoring function; Next, calculate the social distance prediction change trend score S prospect : S prospect =f score (ΔD Social ) Where ΔD Social Indicates the trend of social distance changes; Finally, calculate the total score S of the current round total : S total =(1-a)·(S feedback +S prospect )+a·S prev 。 5. The epidemiological-based intelligent social worm propagation prediction method according to claim 1, characterized in that: Adjust the communication strategy based on the evaluation results, including: For the current interest circle, compare its score with the average score. If it is greater than the average score, increase the priority of the interest circle; otherwise, reduce the priority of the interest circle. When the priority of the interest circle is higher, increase the number of users participating in the dissemination in the interest circle; otherwise, try to switch to other interest circles with smaller social distance.

6. The epidemiological-based intelligent social worm propagation prediction method according to claim 5, characterized in that: When it is necessary to increase the number of users participating in the dissemination in the interest circle, the number of users participating in the dissemination in the interest circle can be calculated according to the following formula: Among them, round represents the rounding operation, N max and N min represents the maximum and minimum number of users participating in the transmission, k max represents the preset maximum priority value, and r represents the priority value of the interest circle.

7. A defense method for an epidemiologically based intelligent social worm propagation model, characterized in that: include: Analyze the target user's interest circle and use the prediction method described in any one of claims 1 to 6 to identify potential high-risk users and transmission paths in the interest circle; when it is monitored that the social distance between the high-risk user and the target user is close, issue an early warning; In high-risk propagation paths, honeypot nodes are deployed to induce intelligent social worms to attack the honeypot nodes; When users who have been infected by the intelligent social worm or users who are in close social distance with the intelligent social worm are isolated.

8. An intelligent social worm propagation prediction device based on epidemiology, characterized in that: include: A propagation evolution module is used to model the social network topology using a multigraph model as a propagation environment, and to simulate the intelligent social worm propagation pattern in the propagation environment based on the state transition mechanism in the epidemic model. In the constructed multigraph, nodes represent users, edges represent the interactive relationships between users in different interest circles, and the attributes of the edges represent the interest circles. The target selection module is used to analyze the social distance between users in each interest circle and the target user during each round of directed propagation, thereby identifying the potential propagation set of each interest circle based on the social distance for the next round of propagation; The dynamic feedback module is used to evaluate the effect of each round of directional communication and adjust the communication strategy based on the evaluation results.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images