Social network anomaly detection system and method based on network representation learning

Abstract

The application relates to the technical field of machine learning, in particular to a social network anomaly detection system and method based on network representation learning, which comprises a heterogeneous feature extraction layer, a cross-modal fusion layer, an anomaly decision layer, a joint optimization layer and a fairness module; text data obtained based on a social network is processed to obtain network structure data and semantic behavior data; the heterogeneous feature extraction layer is used to perform structure feature extraction through a GCN-M model, a BERT model is dynamically fine-tuned to extract semantic features, the cross-modal fusion layer adopts a double-channel dynamic attention mechanism to fuse the structure features and the semantic features to obtain a fusion feature matrix and send the fusion feature matrix to the anomaly decision layer; the anomaly decision layer realizes anomaly probability output through a deep forest classifier; the application enhances the feature extraction capability and the generalization performance of the model, realizes deep fusion of features, can more comprehensively depict user behavior patterns, and significantly improves the accuracy of anomaly detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of machine learning, and particularly relates to a social network anomaly detection system and method based on network representation learning. BACKGROUND

[0002] A social network is a network of relationships between individuals, i.e. people, organizations or computer systems. These individuals form social networks by interacting, sharing information and establishing connections.

[0003] Traditional anomaly detection methods rely heavily on manual feature engineering, which requires domain experts to extract features from network structure and user behavior. However, the dynamic and complex nature of social networks makes it difficult for manually designed features to fully capture abnormal patterns. For example, the non-linear interaction between users can form complex network effects, and traditional models are difficult to effectively model such long-range dependencies. Existing methods often isolate network structure features and semantic features, ignoring the complementarity between the two. Malicious users may hide abnormal behavior by disguising social relationships, and their text content may still reveal potential intentions. This feature fragmentation limits detection accuracy, especially when faced with highly concealed abnormal behavior.

[0004] The rise of network representation learning provides a new way of thinking for the above problems. This method can effectively capture the nonlinear structure and semantic association in graph data by automatically learning low-dimensional vector representations. For example, CN112861967B discloses a social network abnormal user detection method and device based on a heterogeneous graph neural network. The social network abnormal user detection method based on a heterogeneous graph neural network includes collecting user information for a social network and extracting features from the collected user information. Based on the extracted features, a heterogeneous information network based on a social network is constructed, and corresponding meta-paths and meta-graphs are designed using the relationship attributes of the social network. Based on the heterogeneous information network, meta-paths and meta-graphs, the representation of users in the social network is determined according to the intimacy and similarity between users. Based on the representation of users in the social network, the type of users is detected to determine abnormal users. CN110321493B discloses a social network anomaly detection and optimization method, system and device. The method includes converting a social network into graph data and strengthening and denoising the graph data using a reconstruction algorithm to obtain a reconstructed social network. A regularity metric is defined to evaluate the regularity level of the reconstructed social network, the likelihood of network links is calculated, and it is determined whether the network links are false links or missing critical links. The social network is optimized by selecting limited critical links and adjusting the reconfigurability of the network based on them to obtain an on-demand regulated social network. However, the existing research still has the following limitations: on the one hand, the fusion of network structure and semantic features mostly uses a simple splicing strategy, which fails to fully exploit the interaction information between features; on the other hand, the model fairness problem is rarely discussed, and data bias may lead to over-detection of specific user groups. SUMMARY

[0005] To solve the above problems of the prior art, the present application provides a social network anomaly detection system and method based on network representation learning. By constructing a dual-channel graph neural network model (GCN-M) that fuses multi-modal features, the improved feature extraction and fusion strategy is used to improve the accuracy and fairness of anomaly detection, breaking through the feature expression bottleneck of traditional methods and providing a new model for complex social network modeling. It provides strong support for helping platforms to realize efficient abnormal behavior early warning and maintain network ecological safety.

[0006] The complete technical solution of the present application includes:

[0007] The social network anomaly detection system based on network representation learning includes a heterogeneous feature extraction layer, a cross-modal fusion layer, an anomaly decision layer, and a joint optimization layer.

[0008] The heterogeneous feature extraction layer includes a structural feature extraction module and a semantic feature extraction module, which are used to process network structure data and semantic behavior data obtained from text data based on social networks. The structural feature extraction module uses an improved GCN model, namely the GCN-M model, to extract structural features from the network structure data. Specifically, for the adjacency matrix with added self-loops, a learnable edge weight parameter matrix is ​​introduced, and the elements of the adjacency matrix are thresholded and ranked by importance. A node retention score is calculated using a learnable projection vector, and high-scoring nodes are selected to form a new feature matrix. A pooled adjacency matrix is ​​generated simultaneously to achieve iterative propagation of node features. A residual connection structure combining concatenation and projection is used to concatenate the original input features with the graph convolution output along the feature dimension to obtain the structural features.

[0009] The semantic feature extraction module extracts semantic features, and the cross-modal fusion layer fuses structural features and semantic features and sends them to the anomaly decision layer; the anomaly decision layer outputs anomaly probability through a deep forest classifier.

[0010] Furthermore, the structural feature extraction module extracts structural features using the GCN-M model, and then feeds them into the cross-modal fusion layer after multi-scale topological embedding; specifically:

[0011] Let the initial network structure data be... The GCN-M model achieves iterative propagation of node features through spectral domain decomposition of the adjacency matrix, and its propagation rule is as follows:

[0012] (1)

[0013] In equation (1), Indicates the first The node feature matrix of the layer Indicates the first The node feature matrix of the layer, For batch size, It is the first The feature dimension of the layer It is a learnable weight matrix. It is the first The feature dimensions of the layer It is an activation function (such as ReLU). It is the adjacency matrix after adding self-loops. This is the original adjacency matrix. It is the identity matrix. It is the corresponding degree matrix.

[0014] Then, a learnable edge weight parameter matrix is ​​introduced. The improved adjacency matrix is ​​calculated by dynamically adjusting the information transmission strength between nodes. , is an element in the edge weight parameter matrix , is the improved adjacency matrix, is an element in the improved adjacency matrix.

[0015] Threshold screening is performed on the improved adjacency matrix elements , wherein denotes the node degree of the node , denotes the node degree of the node , is a threshold hyperparameter, is the average node degree of the network.

[0016] The matrix composed of the screened is substituted for in formula (1) to complete the improvement of the basic GCN architecture.

[0017] The node retention score is calculated through a learnable projection vector , which is used to measure the importance of the node i , and the top nodes with high scores are screened to form a new node feature matrix , and a pooled adjacency matrix is simultaneously generated, which is a node mask matrix.

[0018] The feature channel splicing residual connection structure is designed in the form of splicing + projection, and the original input features are spliced along the feature dimension with the graph convolution output : . In the formula, is a dimension reduction projection matrix, denotes a feature splicing operation.

[0019] The last layer of the feature dimension spliced is taken as the output result of the structural feature extraction module.

[0020] Further, the semantic feature extraction module extracts semantic features by dynamically fine-tuning the BERT model, and the original text sequence of the semantic behavior data is input into the BERT model after word segmentation processing, word vectors are obtained through an embedding layer, and the hidden state of the CLS mark is extracted as a global semantic representation, and is aligned to the structural feature space through a learnable projection matrix.

[0021] Furthermore, the dynamically fine-tuned BERT model adopts a two-stage fine-tuning strategy: first, it continues to pre-train the MLM task on a social media corpus, and then it eliminates platform-specific lexical bias through adversarial training to obtain a global semantic representation after the two-stage fine-tuning strategy, which forms semantic features after projection and bias.

[0022] Furthermore, specifically: the original text sequence of semantic behavior data. After word segmentation, the words are input into the BERT model, and word vectors are obtained through the embedding layer. In the formula , where is the embedding dimension of BERT-base.

[0023] From word vectors Extract the hidden state of the classification CLS label. As a global semantic representation, and aligned to the structural feature space via a learnable projection matrix:

[0024]

[0025] In the formula For a dimension reduction matrix, Consistent with the dimensions of network structure features, The bias vector is a learnable vector whose distribution is adjusted to suit subsequent tasks.

[0026] The two-stage fine-tuning strategy is as follows: First, the MLM task is pre-trained on a social media corpus. Then, adversarial training is used to eliminate platform-specific lexical biases, resulting in a global semantic representation after the two-stage fine-tuning strategy. Semantic features are formed after projection and biasing. .

[0027]

[0028] In the formula, This is the projection matrix.

[0029] Furthermore, the cross-modal fusion layer uses a dual-channel dynamic attention mechanism to obtain the fusion feature matrix, which is then fed into the anomaly detection module.

[0030] Furthermore, the cross-modal fusion layer adopts a progressive fusion method. It uses a gating weighting mechanism to perform basic fusion based on the structural and semantic features of network nodes. Then, it introduces covariance alignment constraints. The two channel outputs achieve information interaction through cross-modal attention, calculate the attention coefficients between nodes, and obtain the fused features through attention weighted aggregation.

[0031] Specifically: network nodes The structural features obtained by the structural feature extraction module are: The semantic features obtained by the semantic feature extraction module are The basic fusion strategy adopts a gating weighting mechanism:

[0032] (4)

[0033] wherein, is a gating weight, is a Sigmoid function, denotes element-wise multiplication. is a gating bias vector, is the fused node feature.

[0034] Further introducing a covariance alignment constraint.

[0035] The two-channel outputs realize information interaction through cross-modal attention, and the node attention coefficient of is calculated as:

[0036] (5)

[0037] wherein, is a learnable vector, is a feature transformation matrix, is a neighborhood set of the node . The final fused feature is aggregated through attention weighting to obtain the aggregated fused multi-modal feature :

[0038] (6)

[0039] wherein, is a neighborhood set of the node , and is the mth feature transformation matrix of the multi-head self-attention mechanism, used for generating feature vector projections of different attention heads.

[0040] Further, the anomaly decision layer includes an anomaly detection module, which constructs a multi-granularity scanning layer to generate a candidate feature subset through a deep forest classifier, and then gradually refines the decision through a cascaded forest structure to realize anomaly probability output.

[0041] Further, the joint optimization layer is connected with the anomaly detection module, the cross-modal fusion layer, the structural feature extraction module, and the semantic feature extraction module, respectively, and realizes parameter updating of the anomaly detection module, the cross-modal fusion layer, the structural feature extraction module, and the semantic feature extraction module through a multi-task loss function and an adaptive gradient clipping strategy, and optimizes the social network anomaly detection system based on network representation learning.

[0042] Further, the multi-task joint loss function introduces a contrastive regularization term to enhance the discriminability of features:

[0043]

[0044] wherein, is the loss, is the classification loss, is the contrastive loss.

[0045] The classification loss uses weighted cross-entropy:

[0046]

[0047] wherein is the class weight coefficient, used to alleviate sample imbalance. is the predicted probability of the i-th sample.

[0048] The contrastive loss is:

[0049]

[0050] wherein is the feature of the same class sample, is the feature of the different class sample, is the multi-modal feature generated by the feature fusion module, is the cosine similarity, is the temperature coefficient, is the total number of samples participating in loss calculation in the current batch, is the number of different class samples.

[0051] Further, the joint optimization layer adopts a two-stage progressive optimization strategy during optimization: in the first stage, the parameters of the BERT model are frozen, only the improved GCN-M network and the feature fusion module are trained, and the loss function is used to perform coarse-grained feature alignment; in the second stage, the fine-tuning ability of the BERT parameters is released, and the complete loss function is used to realize fine-grained semantic-structural collaborative optimization, and an adaptive gradient clipping strategy is used to improve training stability.

[0052] Further, the fairness module is located before the heterogeneous feature extraction layer and includes:

[0053] The feature decoupling sub-module: uses an orthogonal projection matrix to decompose node features into sensitive related components and task related components, eliminating sensitive information residues in the feature space;

[0054] ​The adversarial training submodule: based on the gradient reversal mechanism, the mutual information between the prediction result and the sensitive attribute is minimized through the adversarial loss function;

[0055] The graph structure modification submodule: based on the learning edge weight mask matrix, the propagation of sensitive attributes in the graph topology is suppressed.

[0056] Further, the method for detecting social network anomalies using the system comprises the following steps:

[0057] (1) The text data obtained based on the social network is preprocessed as input data, and after being processed by the fairness module, it is then processed into network structure data and semantic behavior data;

[0058] (2) The network structure data is sent to the structure feature extraction module, the structure feature is extracted through the GCN-M model, and after being embedded by the multi-scale topology, it is sent to the cross-modal fusion layer;

[0059] (3) The semantic behavior data is sent to the semantic feature extraction module, the semantic feature is extracted through the dynamic fine-tuning BERT model to realize the context semantic embedding, and then sent to the cross-modal fusion layer;

[0060] (4) The cross-modal fusion layer adopts a double-channel dynamic attention mechanism to obtain a fusion feature matrix, and sends it to the anomaly detection module; the anomaly probability is output through the deep forest classifier.

[0061] The beneficial effects of the present application are:

[0062] 1. The improved graph convolution network (GCN) is introduced in the present application, which introduces BatchNorm, TopKPooling and residual connection, enhances the feature extraction ability and generalization performance of the model, and effectively captures the complex relationship and long distance dependence between nodes. The improved GCN structure dynamically adjusts the weight of the neighbor node, which significantly improves the sensitivity to abnormal user behavior.

[0063] 2. The double-channel design based on the self-attention mechanism is adopted, which processes the network structure features and semantic features respectively, and realizes the deep fusion of features through the self-attention mechanism. The globality of the network structure features and the locality of the semantic features are fully utilized, so that the model can more comprehensively depict the user behavior pattern, thereby significantly improving the accuracy of anomaly detection.

[0064] 3. An improved graph neural network model (GCN-M) is constructed, which introduces TransformerConv and multi-task joint loss function, improves the adaptability of the model to complex graph structure and long distance dependence, and enhances the discriminability of the features. The introduction of TransformerConv enables the model to dynamically adjust the weight of the neighbor node, and more accurately capture the heterogeneous relationship and long distance dependence in the graph.

[0065] 4. In terms of fairness, a set of fairness metrics is defined, and a fairness enhancement module is designed to reduce algorithm bias through feature decoupling, adversarial training and graph structure correction, ensuring fair treatment of the model for all user groups. Not only improves the credibility of the model, but also provides a new way of thinking for solving algorithm ethics. BRIEF DESCRIPTION OF DRAWINGS

[0066] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the drawings needed in the embodiments will be briefly introduced below. The features and advantages of the present application can be more clearly understood by referring to the drawings. The drawings are schematic and should not be construed as any limitation on the present application. For those skilled in the art, other drawings can be obtained without creative labor on the basis of these drawings. Among them:

[0067] Figure 1 The GCN-M system architecture diagram of the present application.

[0068] Figure 2 The GCN-M triple constraint fairness enhancement system architecture diagram of the present application. DETAILED DESCRIPTION

[0069] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the drawings needed in the embodiments will be briefly introduced below. The features and advantages of the present application can be more clearly understood by referring to the drawings. The drawings are schematic and should not be construed as any limitation on the present application. For those skilled in the art, other drawings can be obtained without creative labor on the basis of these drawings. Among them:

[0070] As shown in the figure, the social network anomaly detection system based on network representation learning includes a heterogeneous feature extraction layer, a cross-modal fusion layer, an anomaly decision layer, a joint optimization layer and a fairness module. Figure 1

[0071] (1) The heterogeneous feature extraction layer includes a structure feature extraction module and a semantic feature extraction module.

[0072] 1) The structure feature extraction module extracts structure features through the GCN-M model, and sends them to the cross-modal fusion layer after multi-scale topological embedding. Specifically:

[0073] Let the initial network structure data be , the GCN-M model realizes the iterative propagation of node features through the spectral domain decomposition of the adjacency matrix, and the propagation rule is:

[0074] (1)

[0075] In formula (1), represents the first ​Node feature matrix of the layer, represents the Node feature matrix of the layer, is the batch size, is the feature dimension of the layer, is the learnable weight matrix, is the feature dimension of the layer, is the activation function (such as ReLU), is the adjacency matrix after adding a self-loop, is the original adjacency matrix, is the identity matrix, is the corresponding degree matrix.

[0076] In view of the long-tail distribution characteristics and noise connection problems existing in social networks, the application improves the basic GCN architecture from three dimensions:

[0077] 1) In the aspect of depth expansion, a hierarchical feature propagation mechanism is established by stacking more than 5 graph convolution modules, so that the node receptive field covers the jump neighbor relationship, and the cross-community abnormal propagation path is effectively captured.

[0078] 2) In the aspect of feature aggregation, a learnable edge weight parameter matrix is introduced to dynamically adjust the information transmission strength between nodes, and the improved adjacency matrix is calculated as , is an element in the edge weight parameter matrix , is the improved adjacency matrix, is an element in the improved adjacency matrix.

[0079] 3) In the dimension of calculation optimization, an adaptive sparsification strategy based on node degree is designed to threshold filter the elements of the improved adjacency matrix , wherein represents the node degree of node , represents the node degree of node , is a threshold hyperparameter, is the average node degree of the network.

[0080] 4) The matrix composed of the above filtered is used to replace in formula (1) to complete the improvement of the basic GCN architecture.

[0081] Subsequently, in view of the feature distribution deviation problem commonly existing in the deep graph neural network training process, which is manifested as uncontrollable changes in the scale of node embedding vectors with the increase of network depth, the application embeds a BatchNorm layer after each graph convolution, and performs standardization processing on the feature channels:

[0082] (2)

[0083] In the formula, is the batch mean, is the batch variance, is the node i The output feature vector of the first layer, is the standardized and rescaled node feature vector, is the learnable affine parameter, is used to maintain numerical stability.

[0084] To cope with the scalability challenge of social networks, the application designs a TopKPooling mechanism based on importance ranking, and calculates the node retention score by using a learnable projection vector to measure the importance of nodes i , is the dimension of the learning projection vector, and the top high-score nodes constitute a new node feature matrix , , represent the top high-score nodes, is the node mask matrix.

[0085] At the same time, the deep network architecture faces the problem of gradient attenuation while expanding the receptive field, which is manifested as the gradual disappearance of the shallow parameter update signal in the backpropagation process.

[0086] To solve this problem, unlike the additive form commonly used by traditional residual connections (such as ResNet), the application adopts a splicing + projection form to design a feature channel splicing residual connection structure, which splices the node feature matrix of the original input feature at the first layer with the graph convolution output along the feature dimension: In the formula, is the dimension reduction projection matrix, denotes the feature splicing operation.

[0087] The feature dimension spliced obtained by the last layer is taken as the output result of the structural feature extraction module.

[0088] 2) The semantic feature extraction module adopts a dynamically fine-tuned BERT model, combined with adversarial training and hierarchical pooling strategies, to extract behavioral intent and emotional polarity features from user text, and aligns them to the structural feature space through a projection matrix.

[0089] The semantic feature extraction module uses a hierarchical semantic encoding method based on the BERT model, and the original text sequence of semantic behavior data. After word segmentation, the words are input into the BERT model, and word vectors are obtained through the embedding layer. In the formula , where is the embedding dimension of BERT-base.

[0090] The BERT model uses a 12-layer Transformer encoder for contextual semantic modeling, with each layer containing a multi-head self-attention mechanism.

[0091] (3)

[0092] In the formula, These are query, key, and value matrices, respectively. For single-head attention dimension, For the number of attention heads.

[0093] Ultimately from word vectors Extract the hidden state of the classification CLS label. As a global semantic representation, and aligned to the structural feature space via a learnable projection matrix:

[0094]

[0095] In the formula For a dimension reduction matrix, Consistent with the dimensions of network structure features, The bias vector is a learnable vector whose distribution is adjusted to suit subsequent tasks.

[0096] To enhance domain adaptability, this invention employs a two-stage fine-tuning strategy: first, the MLM task is pre-trained on a social media corpus, and then adversarial training is used to eliminate platform-specific lexical biases, resulting in a global semantic representation after the two-stage fine-tuning strategy, which makes the semantic encoder robust to cross-domain texts.

[0097] Output Semantic features are formed after projection and biasing. .

[0098]

[0099] In the formula, This is the projection matrix.

[0100] (2) Cross-modal fusion layer

[0101] The cross-modal fusion layer uses a dual-channel dynamic attention mechanism to obtain the fused feature matrix, which is then fed into the anomaly detection module.

[0102] A gradual fusion approach is adopted, with network nodes set. The structural features obtained by the structural feature extraction module are: The semantic features obtained by the semantic feature extraction module are The basic fusion strategy adopts a gating weighting mechanism:

[0103] (4)

[0104] In the formula, For gating weights, For the Sigmoid function, This indicates element-wise multiplication. This is the gated bias vector. The features of the merged nodes, It is an intermediate variable.

[0105] While this method can achieve adaptive feature fusion, it does not explicitly model cross-modal associations.

[0106] Further, a covariance alignment constraint is introduced: , Let be the Frobenius norm. In the formula... These are the covariance matrices of structural features and semantic features, respectively. The Frobenius norm constraint causes the distributions of the two types of features to converge.

[0107] The two-channel outputs achieve information exchange through cross-modal attention, and the computing nodes... For nodes Attention coefficient:

[0108] (5)

[0109] In the formula, For learnable vectors, The dimension of the learnable vector. The characteristic transformation matrix, For nodes The neighborhood set. The final fused features are obtained by attention-weighted aggregation. :

[0110] (6)

[0111] In the formula, For nodes a neighborhood set of the node, is the mth feature transformation matrix of the multi-head self-attention mechanism, M is the number of feature transformation matrices, and is used to generate feature vector projections of different attention heads.

[0112] (3) Abnormal decision layer

[0113] The abnormal decision layer includes an anomaly detection module, and the anomaly probability output is realized through a deep forest classifier.

[0114] The deep forest classifier is used to replace the traditional full connection network, so as to improve the generalization capability in a small sample scene. A multi-granularity scanning layer is constructed to generate a candidate feature subset, and a cascade forest structure is used to gradually refine the decision:

[0115]

[0116] In the formula, is a prediction probability, is a true label of an mth sample, , is a multi-modal feature fusion. is a number of forest layers, is a number of trees in each layer, is a decision area of an nth tree in an mth layer, is an integrated weight. (4) Joint optimization layer

[0117] The joint optimization layer is connected with the anomaly detection module, the cross-modal fusion layer, the structural feature extraction module and the semantic feature extraction module, respectively. The joint optimization layer improves the model robustness through a multi-task loss function and an adaptive training strategy.

[0118] The multi-task loss function realizes model parameter updating and updates the structural feature extraction module and the semantic feature extraction module. The loss function combines a weighted cross-entropy and a contrastive loss, and dynamically schedules a weight coefficient to balance learning goals. A cyclic cosine annealing learning rate and a gradient clipping technology are used in the model training process, and two-stage progressive optimization is used.

[0119] The multi-task joint loss function designed in the application introduces a contrastive regularization term to enhance feature discriminability.

[0120] The multi-task joint loss function designed in the application introduces a contrastive regularization term to enhance feature discriminability.

[0121]

[0122] Among them, is a loss, is a classification loss, is a contrastive loss.

[0123] The classification loss​​ The weighted cross-entropy is used:

[0124]

[0125] wherein is a category weight coefficient, used to alleviate sample imbalance. is the predicted probability of the i-th sample.

[0126] The contrastive loss L is:

[0127]

[0128] wherein is the feature of the same class sample, is the feature of the different class sample, is the multi-modal feature generated by the feature fusion module, is the cosine similarity, is the temperature coefficient, is the total number of samples participating in the loss calculation in the current batch, is the number of different class samples.

[0129] Further, in the model training phase of the social network anomaly detection system of the application, a two-stage progressive optimization strategy is adopted: in the first stage, the parameters of the BERT model are frozen, only the improved GCN-M network and the feature fusion module are trained, and the loss function L is used for coarse-grained feature alignment; in the second stage, the fine-tuning ability of the BERT parameters is released, and the complete loss function L is used to realize fine-grained semantic-structure collaborative optimization. This strategy effectively prevents the problem of topological information being submerged due to semantic feature overfitting in the early stage of model training by constraining the parameter update space.

[0130] In the optimization process, an adaptive gradient clipping strategy is used to improve the training stability.

[0131] (5) Fairness module

[0132] The fairness module is located before the heterogeneous feature extraction layer, and further fairness enhancement design is made for the possible algorithm bias problem of the GCN-M anomaly detection architecture. By introducing the triple constraint mechanism of feature decoupling, adversarial training and graph structure correction, it is ensured that the model retains the original advantages of anomaly detection performance while meeting the fairness requirements of statistical equality and equal opportunity. Avoid bias to sensitive attributes.

[0133] The GCN-M-Fair fairness module is a vertical supplement to the GCN-M architecture and is integrated before the heterogeneous feature extraction layer, such as Figure 2 ​​​​As shown, it includes a feature decoupling submodule, a graph structure correction submodule, and an adversarial fairness training module, forming a progressive processing flow of "feature decoupling → structure correction → fair fusion". Its core structure forms an end-to-end closed loop with the overall system architecture, specifically: the input preprocessing layer receives the original feature matrix and adjacency matrix generated by the feature extraction module, and outputs task-related features after decoupling processing by the sensitive attribute; the graph structure correction submodule dynamically adjusts the adjacency matrix to form a corrected propagation path; the adversarial training flow constrains the parameter space of the abnormal decision layer for fairness through the gradient reverse propagation mechanism.

[0134] The system architecture design includes four core components, as follows:

[0135] The input preprocessing layer receives the original graph data, including the node feature matrix, the original adjacency matrix , and the sensitive attribute vector . Through spectral clustering analysis, an initial distribution graph of sensitive attribute propagation paths is constructed, providing a basis for subsequent feature decoupling and graph structure correction.

[0136] The triple constraint execution layer includes three key modules that jointly control sensitive information and decouple features: the feature decoupling submodule, which uses an orthogonal projection matrix to decompose node features into sensitive-related components and task-related components , eliminating sensitive information residues in the feature space through low-rank constraint; the adversarial training submodule, which constructs a dynamic game system based on the gradient reverse mechanism, with the main network minimizing the mutual information between the prediction results and the sensitive attributes through the adversarial loss function; the graph structure correction submodule, which learns an edge weight mask matrix based on the variational information bottleneck theory, suppressing the propagation of sensitive attributes in the graph topology and thus reducing the propagation entropy of sensitive information through the graph structure.

[0137] The heterogeneous feature fusion layer inputs the decoupled features and the corrected adjacency matrix into the dynamic graph convolutional network, implementing multi-scale feature aggregation through a multi-head attention mechanism. This layer aims to fuse node features and graph structure information to extract discriminative feature representations.

[0138] The multi-objective decision layer jointly optimizes the anomaly detection loss function and the fairness constraint term, generating a decision boundary that balances detection accuracy and fairness using the Pareto optimal frontier search algorithm. Specifically, by minimizing the anomaly detection error and maximizing the fairness measure, the model ensures accurate identification of anomalies while avoiding bias towards sensitive attributes.

[0139] Further, a social network anomaly detection method based on network representation learning using the above system includes the following steps:

[0140] (1) Obtain input data based on social network, and process into network structure data and semantic behavior data;

[0141] (2) The network structure data is sent to the structure feature extraction module, the structure feature is extracted through the GCN-M model, and is sent to the cross-modal fusion layer after being embedded by the multi-scale topology;

[0142] (3) The semantic behavior data is sent to the semantic feature extraction module, the context semantic embedding is realized through the dynamic fine-tuning BERT model, and is sent to the cross-modal fusion layer;

[0143] (4) The cross-modal fusion layer adopts a double-channel dynamic attention mechanism to obtain a fusion feature matrix, and sends it to the anomaly detection module; the abnormal probability output is realized through the deep forest classifier.

[0144] The above only describes the preferred embodiments of the present application and is not used to limit the present application. For those skilled in the art, the present application can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A social network anomaly detection system based on network representation learning, comprising a heterogeneous feature extraction layer, a cross-modal fusion layer, an anomaly decision layer, and a joint optimization layer; characterized in that, the heterogeneous feature extraction layer comprises a structure feature extraction module and a semantic feature extraction module, and is used for processing network structure data and semantic behavior data obtained based on social network text data; the structure feature extraction module is used for extracting structure features from the network structure data by using an improved GCN model, namely, a GCN-M model; specifically, a learnable edge weight parameter matrix is introduced for an adjacency matrix after adding a self-loop, and the elements of the adjacency matrix are sorted in importance after threshold screening; a node retention score is calculated by using a learnable projection vector, a new feature matrix is formed by screening high-score nodes, a pooled adjacency matrix is simultaneously generated, and iterative propagation of node features is realized; and a residual connection structure combining concatenation and projection is used to concatenate the original input features and the graph convolution output results along the feature dimension, so as to obtain the structure features; the semantic feature extraction module is used for extracting semantic features, the cross-modal fusion layer is used for fusing the structure features and the semantic features and sending them to the anomaly decision layer, and the anomaly decision layer is used for realizing anomaly probability output by using a deep forest classifier; the cross-modal fusion layer is used for obtaining a fusion feature matrix by using a double-channel dynamic attention mechanism, and sending the fusion feature matrix to the anomaly decision layer; the cross-modal fusion layer is used for adopting a progressive fusion method to perform basic fusion on the structure features and the semantic features of network nodes by using a gating weighting mechanism, subsequently introducing covariance alignment constraints, realizing information interaction between two channels by using cross-modal attention, calculating attention coefficients between nodes, and obtaining fusion features by using attention weighted aggregation; the joint optimization layer is connected with the anomaly detection module, the cross-modal fusion layer, the structure feature extraction module, and the semantic feature extraction module, respectively, and is used for realizing parameter updating of the anomaly detection module, the cross-modal fusion layer, the structure feature extraction module, and the semantic feature extraction module by using a multi-task loss function and an adaptive gradient clipping strategy, and optimizing the social network anomaly detection system based on network representation learning; in the optimization process, the joint optimization layer adopts a two-stage progressive optimization strategy: in the first stage, the parameters of a BERT model are frozen, only the GCN-M model and the cross-modal fusion layer are trained, and coarse-grained feature alignment is performed; and in the second stage, the fine-tuning ability of the BERT model parameters is released, and fine-grained semantic-structure collaborative optimization is realized. 2.The social network anomaly detection system based on network representation learning according to claim 1, characterized in that, the semantic feature extraction module is used for extracting semantic features by dynamically fine-tuning a BERT model, and the original text sequence of semantic behavior data is input into the BERT model after being processed by word segmentation, word vectors are obtained by using an embedding layer, and the hidden state of a CLS mark is extracted as a global semantic representation, and is aligned to the structure feature space by using a learnable projection matrix. ​ 3.The network representation learning based social network anomaly detection system of claim 2, wherein, The dynamic fine-tuning BERT model adopts a two-stage fine-tuning strategy: first, continue pre-training the MLM task on the social media corpus, and then eliminate platform-specific vocabulary bias through adversarial training to obtain global semantic representation after two-stage fine-tuning strategy, and form semantic features after projection and bias. 4.The network representation learning based social network anomaly detection system of claim 3, wherein, The anomaly decision layer includes an anomaly detection module, which constructs a multi-granularity scanning layer to generate a candidate feature subset through a deep forest classifier, and then gradually refines the decision through a cascade forest structure to realize anomaly probability output. 5.The network representation learning based social network anomaly detection system of claim 4, wherein, It also includes a fairness module located before the heterogeneous feature extraction layer, including: A feature decoupling sub-module: adopts an orthogonal projection matrix to decompose node features into sensitive related components and task related components; An adversarial training sub-module: based on the gradient reversal mechanism, minimizes the mutual information between the prediction result and the sensitive attribute through the adversarial loss function; A graph structure correction sub-module: based on the learning edge weight mask matrix, suppresses the propagation of sensitive attributes in the graph topology.

6. A method for social network anomaly detection, the method comprising: The implementation of the social network anomaly detection system based on network representation learning of claim 5 includes the following steps: (1) Preprocess the text data obtained based on the social network as input data, and then process it into network structure data and semantic behavior data after processing by the fairness module; (2) The network structure data is sent to the structure feature extraction module, the structure feature is extracted through the GCN-M model, and then sent to the cross-modal fusion layer after multi-scale topological embedding; (3) The semantic behavior data is sent to the semantic feature extraction module, the semantic feature is extracted through the dynamic fine-tuning BERT model, and then sent to the cross-modal fusion layer; (4) The cross-modal fusion layer adopts a double-channel dynamic attention mechanism to obtain a fusion feature matrix, and sends it to the anomaly detection module; the anomaly probability output is realized through the deep forest classifier.

Images