Malicious account detection method and device based on automatic evaluation of heterogeneous graph paths

Abstract

The present invention belongs to the field of graph neural network technology, and specifically relates to a malicious account detection method and device that automatically evaluates heterogeneous graph meta-paths. The method includes obtaining information from social media networks to construct a heterogeneous graph of social network relationships; projecting different types of entity features of accounts, posts, and communities at each layer of the heterogeneous graph neural network; performing intra-type aggregation of different types of entity nodes of accounts, posts, and communities at each layer of the heterogeneous graph neural network; and performing inter-type aggregation of different types of entity nodes of accounts, posts, and communities at each layer of the heterogeneous graph neural network. The optimal meta-path is found by calculating the scores of the meta-paths of the heterogeneous graph neural network, thereby performing malicious account detection. The present invention can realize the automatic search and mining of meta-paths in the heterogeneous graph of social network relationships, solving the problem that meta-paths in malicious account detection methods of heterogeneous graphs require manual design.

Description

Technical Field

[0001] The present invention belongs to the technical field of graph neural networks, and specifically relates to a malicious account detection method and device for automatic evaluation of heterogeneous graph element paths. Background Art

[0002] Graph neural networks are used to detect malicious accounts. Connections between accounts are constructed based on interactions such as likes, comments, and follows, effectively leveraging the correlation information between accounts. Compared to traditional machine learning algorithms that only utilize individual account features, this approach incorporates correlation information between accounts and, through neighborhood aggregation, enables the discovery of potentially malicious accounts, raising the upper limit of model performance. Currently, most research on graph neural networks focuses on homogeneous graphs, which can only express a single relationship between different entities. Compared to homogeneous graph neural network models, heterogeneous graph neural network models can express multiple relationships between different entities and offer better performance in complex scenarios. In recent years, increasing research has shifted towards heterogeneous graph neural networks.

[0003] In 2018, Liu et al. proposed GEM, the first heterogeneous graph neural network method for detecting malicious accounts in Alipay. It adaptively learns discriminative embeddings from heterogeneous account-device graphs based on two fundamental weaknesses of attackers: device clustering and activity clustering. For heterogeneous graphs composed of various node types, Rao et al. proposed a dynamic heterogeneous graph neural network framework to capture suspicious large-scale registrations, effectively predicting suspicious accounts. In 2019, Wang et al. proposed the Heterogeneous Graph Neural Network (HAN), which utilizes meta-paths to model high-order proximities. HAN introduces an attention mechanism to learn the weights of different neighbors and uses semantic-level attention to distinguish between meta-paths, thereby obtaining an optimal weighted combination of semantically specific node embeddings for a specific task. In 2020, Zhang et al. proposed a multi-dimensional heterogeneous graph network composed of K single-view attribute graphs. These K meta-paths are designed to extract correlations between users. A GCN is then used to learn embeddings for each view attribute graph, which are then fused using an attention mechanism. Comprehensive experiments were conducted on data collected from different hacker forums, and the effectiveness of the model in identifying hackers was verified by comparison with other methods.

[0004] While the application of heterogeneous graph neural networks has improved the accuracy of malicious account detection, they rely on manually designed task-specific meta-paths, which significantly impact how well the graph neural network extracts and aggregates node features within the graph. Improperly designed meta-paths can significantly impact the model's detection performance. Designing a good meta-path requires a high level of domain expertise. Because the features of entities like accounts, posts, and communities reside in different feature spaces, it's impossible to evaluate aggregated paths. Summary of the Invention

[0005] In response to the defects in the existing technology, the present invention proposes a malicious account detection method and device with automatic evaluation of heterogeneous graph meta-paths, which solves the problem that meta-paths need to be manually designed in the malicious account detection method of heterogeneous graphs.

[0006] In order to solve the above technical problems, the present invention adopts the following technical solutions:

[0007] The present invention provides a malicious account detection method for automatically evaluating heterogeneous graph paths, comprising the following steps:

[0008] Obtain information from social media networks and construct a heterogeneous graph of social network relationships;

[0009] Project different types of entity features of accounts, posts, and communities at each layer of the heterogeneous graph neural network;

[0010] Perform intra-node aggregation of different types of entities, such as accounts, posts, and communities, at each layer of the heterogeneous graph neural network;

[0011] Aggregate different types of entity nodes of accounts, posts, and communities at each layer of the heterogeneous graph neural network;

[0012] By calculating the scores of heterogeneous graph neural network meta-paths, the optimal meta-path is found to detect malicious accounts.

[0013] Furthermore, obtaining social media network information and constructing a social network relationship heterogeneous graph includes:

[0014] Information on different types of entities, such as accounts, posts, and communities, on a social media network is obtained to construct a heterogeneous graph of social network relationships. The heterogeneous graph includes three different types of nodes, namely, accounts, posts, and communities, and two different types of edges, namely, accounts publishing posts and posts belonging to communities.

[0015] Furthermore, if an account publishes a post, an edge is constructed between the account and the post node; if the post is published in a community, an edge is constructed between the post and the community node; the feature vector of the account node is a feature extracted from the registration time, gender and age attribute information; the feature vector of the post node is a feature extracted from the text attribute information of the post; the feature vector of the community node is a feature extracted from the community theme and community post volume attribute information.

[0016] Furthermore, the projection of different entity features of accounts, posts, and communities at each layer of the heterogeneous graph neural network includes:

[0017] First, we select one entity from different types as the target object. Then, we define a projection matrix for a specific relationship to project the hidden representations of heterogeneous neighboring objects into a common semantic space corresponding to the target object type. We also define a self-projection matrix for each target object type to project the representation of the target object into the common semantic space.

[0018] The representations of different types of neighboring objects are then projected into a new common semantic space through a projection matrix with a specific relationship. At the same time, the self-projection matrix is ​​used to project the own features of the target object output by the previous layer into this space.

[0019] Furthermore, the intra-type aggregation of different entity nodes of accounts, posts, and communities in each layer of the heterogeneous graph neural network includes:

[0020] For each type of neighbor, the projected features are aggregated through the corresponding adjacency matrix to form several temporary features, namely: the projected features of the target object itself and the aggregated projected features of various types of neighbors. Each feature reflects the characteristics of the target object from different aspects.

[0021] Furthermore, the aggregation between different types of entity nodes of accounts, posts and communities in each layer of the heterogeneous graph neural network includes:

[0022] First, the self-projected features of the target object are mapped to the key values ​​of attention through different parameters, and the aggregated features of the neighbors are mapped to the corresponding key values ​​through different parameters;

[0023] Then, a small nonlinear neural network is used to map the key values ​​to attention coefficients.

[0024] The attention coefficient is normalized by the softmax function, and several temporary features are aggregated using the normalized attention coefficient to form a new feature output by the current layer of the target object;

[0025] Finally, the loss function is defined as the sum of the cross entropy of all labeled objects under each object type. The loss value is reduced through the back gradient propagation algorithm to achieve the optimization of the heterogeneous graph neural network.

[0026] Furthermore, the method of finding the optimal meta-path by calculating the score of the heterogeneous graph neural network meta-path includes:

[0027] The importance score of the meta-path of a specific target object is obtained by adding the scores of all path instances ending with that object. The score of the path instance is calculated by multiplying the selection probability between the objects along the path. The selection probability of an object in the path is the value of the object's attention coefficient when calculating the aggregation between node types. By calculating the score of the meta-path, the heterogeneous graph neural network automatically evaluates the importance of all possible meta-paths end-to-end and finds the optimal meta-path for the current task.

[0028] The present invention also provides a malicious account detection device for automatically evaluating heterogeneous primitive paths, comprising:

[0029] A social network relationship heterogeneous graph construction module is used to obtain information about social media networks and construct a social network relationship heterogeneous graph;

[0030] The feature projection module is used to project the features of different types of entities such as accounts, posts, and communities at each layer of the heterogeneous graph neural network;

[0031] The intra-node type aggregation module is used to aggregate different types of entity nodes such as accounts, posts, and communities in each layer of the heterogeneous graph neural network;

[0032] The node type aggregation module is used to aggregate different types of entity nodes such as accounts, posts, and communities in each layer of the heterogeneous graph neural network;

[0033] The meta-path score calculation module is used to find the optimal meta-path by calculating the score of the meta-path of the heterogeneous graph neural network, thereby detecting malicious accounts.

[0034] Compared with the prior art, the present invention has the following advantages:

[0035] The present invention provides a malicious account detection method for automatically evaluating meta-paths in heterogeneous graphs. By constructing a social network relationship heterogeneous graph containing different types of entities such as accounts, posts, and communities, different types of objects such as accounts, posts, and communities are projected into a common semantic space corresponding to the target object type. Object-level aggregation and type-level aggregation are then performed to complete the search and mining of meta-paths in the social network relationship heterogeneous graph, and automatic evaluation of meta-path scores is achieved. This solves the problem of manually designing meta-paths in heterogeneous graph malicious account detection methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0037] Figure 1 1 is a flow chart of a malicious account detection method for automatically evaluating heterogeneous graph primitive paths according to an embodiment of the present invention;

[0038] Figure 2 This is a schematic diagram of the structure of a social network relationship heterogeneous graph according to an embodiment of the present invention;

[0039] Figure 3 is a schematic diagram of automatic evaluation of heterogeneous primitive paths according to an embodiment of the present invention;

[0040] Figure 4 This is a structural block diagram of a malicious account detection device for automatic evaluation of heterogeneous graph meta-paths according to an embodiment of the present invention. In the figure, 41 represents a social network relationship heterogeneous graph construction module, 42 represents a feature projection module, 43 represents an intra-node type aggregation module, 44 represents an inter-node type aggregation module, and 45 represents a meta-path score calculation module. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0042] Graph neural network is a new type of neural network that can not only use the features of objects, but also effectively utilize the relationships between objects. Figure 1 As shown, a malicious account detection method for automatically evaluating heterogeneous primitive paths in this embodiment includes the following steps:

[0043] Step S11: obtaining information of the social media network and constructing a heterogeneous graph of social network relationships.

[0044] Specifically, a web crawler or other method is used to obtain information on different types of entities such as accounts, posts and communities in a social media network, and to construct a heterogeneous graph of social network relationships. The heterogeneous graph of social network relationships contains three different types of nodes: accounts, posts and communities, as well as two different types of edges: accounts posting posts and posts belonging to communities. If an account posts a post, an edge is constructed between the account and the post node; if the post is published in a community, an edge is constructed between the post and the community node. The feature vector of the account node is a feature extracted from attribute information such as registration time, gender and age; the feature vector of the post node is a feature extracted from the text attribute information of the post (for example, the bag-of-words method can be used to count the frequency of keywords in all posts as the feature vector of the post); the feature vector of the community node is a feature extracted from attribute information such as the theme of the community and the number of posts in the community.

[0045] In step S12, different types of entity features of accounts, posts, and communities are projected in each layer of the heterogeneous graph neural network.

[0046] For different entity types, such as accounts, posts, and communities, one is selected as the target object. Considering that in a heterogeneous social network relational graph, the features of different object types reside in different semantic spaces and often have different distributions. To make the features of these different object types comparable, a relation-specific projection matrix is ​​defined to project the hidden representations of heterogeneous neighboring objects (of a different category than the target object) into a common semantic space corresponding to the target object type. A self-projection matrix is ​​also defined for each target object type to project the target object's representation into the common semantic space.

[0047] like Figure 2 As shown in the figure, the three types of nodes, account, post, and community, are represented by circles, triangles, and rectangles respectively. The lines in the figure show all possible meta-paths of nodes with account type A. The representations of different types of neighbor objects are projected into a new common semantic space through a projection matrix with a specific relationship: Φ→Ψ =H Φ W Φ→Ψ At the same time, the self-projection matrix is ​​used to project the self-features of the target object output from the previous layer into this space: Y Ψ→Ψ =H Ψ W Ψ→Ψ ,in, and Respectively and The representation matrix, Φ belongs to the neighborhood of Ψ, W Ψ→Ψ and W Φ→Ψ Represents the self-projection matrix and the projection matrix of a specific relationship respectively.

[0048] Step S13: perform intra-type aggregation (intra-type aggregation is also called object-level aggregation) of different types of entity nodes of accounts, posts, and communities in each layer of the heterogeneous graph neural network.

[0049] Considering the adjacency matrix A Ψ-Φ It represents the adjacency relationship between the target object of category Ψ and the neighbor objects of category Φ. The adjacency matrix can be used to perform intra-type aggregation between the neighbor objects of each target object.

[0050] like Figure 3 As shown, for each type of neighbor, the projected features are aggregated through the corresponding adjacency matrix: Z Φ→Ψ =A Φ→Ψ ·Y Φ→Ψ The projected features themselves do not need to perform object-level aggregation: Z Ψ→Ψ =Y Ψ→Ψ At this point, several temporary features are formed, namely: the projection features of the target object itself and the projection features of various types of aggregated neighbors. Each feature reflects the characteristics of the target object from different aspects.

[0051] In step S14, inter-type aggregation (inter-type aggregation is also called type-level aggregation) of different types of entity nodes of accounts, posts, and communities is performed in each layer of the heterogeneous graph neural network.

[0052] Type-level aggregation uses a type-level attention mechanism to learn the importance of different types of neighbors to the target object and then performs type-level aggregation on the object-level aggregation results. To learn a more comprehensive feature representation, it is necessary to fuse the representations from different types of neighboring objects. For a target object, information from different types of neighboring objects may have different impacts on a specific task. Using the attention mechanism, these temporary features are aggregated to comprehensively characterize the characteristics of the target object.

[0053] First, the self-projected features of the target object are mapped to the key values ​​of attention through different parameters, and the aggregated features of the neighbors are mapped to the corresponding key values ​​through different parameters: K Ψ→Ψ =Z Ψ→Ψ W Ψ , K Φ→Ψ =Z Φ→Ψ W Ψ , K Ψ→Ψ and K Φ→Ψ Respectively represent the key values ​​of the target objects (Ψ categories) mapped to the Ψ category and the Φ category, W Ψ represents the learnable parameters of the neural network when the target category is Ψ.

[0054] Then, a small nonlinear neural network is used to map the key values ​​to attention coefficients:

[0055] e self-Ψ =elu(K Ψ→Ψ· W Ψ )

[0056] e Φ→Ψ =elu(K Φ→Ψ W Ψ )

[0057] Among them, e self-Ψ and e Φ-Ψ denote the attention coefficients of Ψ and Φ categories respectively.

[0058] Normalize the attention coefficient through the softmax function:

[0059]

[0060] Using the normalized attention coefficient, several temporary features are aggregated to form new features output by the target object at this layer:

[0061]

[0062] Finally, the loss function is defined as the sum of the cross entropy of all labeled objects under each object type:

[0063]

[0064] Among them, Φ Ψ express objects with labels in C Ψ express All object categories in Represents the loss value of object i in category j, which can be calculated by the cross entropy loss function. The probability of object i belonging to category j is obtained by passing the output features through a linear layer (MLP). The loss value is reduced by the back gradient propagation algorithm to optimize the heterogeneous graph neural network model.

[0065] In step S15, the optimal meta-path is found by calculating the scores of the heterogeneous graph neural network meta-paths, thereby detecting malicious accounts.

[0066] The importance score of the meta-path of a specific target object is obtained by adding the scores of all path instances ending with the object. The score of the path instance is calculated by multiplying the selection probability between the objects along the path. The selection probability of an object in the path is the value of the attention coefficient of the object when calculating the aggregation between node types in step S14. By calculating the score of the meta-path, the heterogeneous graph neural network can automatically evaluate the importance of all possible meta-paths end-to-end and find the optimal meta-path for the current task. By using the optimal meta-path, the performance of the model can be improved and the accuracy of malicious account detection can be increased.

[0067] Corresponding to the malicious account detection method of automatic evaluation of heterogeneous graph paths, as Figure 4 As shown, this embodiment also proposes a malicious account detection device for automatic evaluation of heterogeneous graph paths, including:

[0068] A social network relationship heterogeneous graph construction module 41 is used to obtain information of the social media network and construct a social network relationship heterogeneous graph;

[0069] A feature projection module 42 is used to project features of different types of entities such as accounts, posts, and communities in each layer of the heterogeneous graph neural network;

[0070] The node type intra-aggregation module 43 is used to perform intra-aggregation of different types of entity nodes of accounts, posts and communities in each layer of the heterogeneous graph neural network;

[0071] The node type aggregation module 44 is used to aggregate different types of entity nodes of accounts, posts and communities in each layer of the heterogeneous graph neural network;

[0072] The meta-path score calculation module 45 is used to find the optimal meta-path by calculating the score of the heterogeneous graph neural network meta-path, thereby detecting malicious accounts.

[0073] The present invention can realize automatic search and mining of meta-paths in heterogeneous graphs of social network relationships, solving the problem that meta-paths need to be manually designed in malicious account detection methods in heterogeneous graphs.

[0074] It should be noted that, in this article, the terms "comprises", "includes" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or apparatus that includes a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements that are inherent to such process, method, article or apparatus.

[0075] Finally, it should be noted that the above description is merely a preferred embodiment of the present invention and is intended only to illustrate the technical solution of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A malicious account detection method based on automatic evaluation of heterogeneous graph paths, characterized in that: The following steps are involved: Step 1: Obtain information about social media networks and construct a heterogeneous graph of social network relationships; Step 2: Project the features of different types of entities, such as accounts, posts, and communities, at each layer of the heterogeneous graph neural network. Step 3: In each layer of the heterogeneous graph neural network, different types of entity nodes of accounts, posts, and communities are aggregated. Step 4: Aggregate different types of entity nodes of accounts, posts, and communities in each layer of the heterogeneous graph neural network; Step 5: Calculate the scores of the heterogeneous graph neural network meta-paths to find the optimal meta-path and perform malicious account detection. Specifically, The importance score of the meta-path of a specific target object is obtained by adding the scores of all path instances ending with that object. The score of the path instance is calculated by multiplying the selection probability between the objects along the path. The selection probability of an object in the path is the value of the object's attention coefficient when calculating the aggregation between node types. By calculating the score of the meta-path, the heterogeneous graph neural network automatically evaluates the importance of all possible meta-paths end-to-end and finds the optimal meta-path for the current task.

2. The malicious account detection method based on automatic evaluation of heterogeneous graph paths according to claim 1 is characterized in that: The step of obtaining information of the social media network and constructing a heterogeneous graph of social network relationships includes: Information on different types of entities, such as accounts, posts, and communities, on a social media network is obtained to construct a heterogeneous graph of social network relationships. The heterogeneous graph includes three different types of nodes, namely, accounts, posts, and communities, and two different types of edges, namely, accounts publishing posts and posts belonging to communities.

3. The malicious account detection method for automatically evaluating heterogeneous graph paths according to claim 2 is characterized in that: If an account publishes a post, an edge is constructed between the account and the post node; if the post is published in a community, an edge is constructed between the post and the community node; the feature vector of the account node is a feature extracted from the registration time, gender and age attribute information; the feature vector of the post node is a feature extracted from the text attribute information of the post; the feature vector of the community node is a feature extracted from the community theme and community post volume attribute information.

4. The malicious account detection method for automatically evaluating heterogeneous graph paths according to claim 1 is characterized in that: The feature projection of different types of entities, such as accounts, posts, and communities, is performed at each layer of the heterogeneous graph neural network, including: First, we select one entity from different types as the target object. Then, we define a projection matrix for a specific relationship to project the hidden representations of heterogeneous neighboring objects into a common semantic space corresponding to the target object type. We also define a self-projection matrix for each target object type to project the representation of the target object into the common semantic space. The representations of different types of neighboring objects are then projected into a new common semantic space through a projection matrix with a specific relationship. At the same time, the self-projection matrix is ​​used to project the own features of the target object output by the previous layer into this space.

5. The malicious account detection method for automatically evaluating heterogeneous graph paths according to claim 4 is characterized in that: The aggregation of different types of entity nodes of accounts, posts, and communities at each layer of the heterogeneous graph neural network includes: For each type of neighbor, the projected features are aggregated through the corresponding adjacency matrix to form several temporary features, namely: the projected features of the target object itself and the aggregated projected features of various types of neighbors. Each feature reflects the characteristics of the target object from different aspects.

6. The malicious account detection method for automatically evaluating heterogeneous graph paths according to claim 5 is characterized in that: The aggregation between different types of entity nodes of accounts, posts and communities in each layer of the heterogeneous graph neural network includes: First, the self-projected features of the target object are mapped to the key values ​​of attention through different parameters, and the aggregated features of the neighbors are mapped to the corresponding key values ​​through different parameters; Then, a small nonlinear neural network is used to map the key values ​​to attention coefficients. The attention coefficient is normalized by the softmax function, and several temporary features are aggregated using the normalized attention coefficient to form a new feature output by the current layer of the target object; Finally, the loss function is defined as the sum of the cross entropy of all labeled objects under each object type. The loss value is reduced through the back gradient propagation algorithm to achieve the optimization of the heterogeneous graph neural network.

7. A malicious account detection device with automatic evaluation of heterogeneous graph paths, characterized in that: A method for detecting malicious accounts by automatically evaluating heterogeneous graph paths according to any one of claims 1 to 6, the device comprising: A social network relationship heterogeneous graph construction module is used to obtain information about social media networks and construct a social network relationship heterogeneous graph; The feature projection module is used to project the features of different types of entities such as accounts, posts, and communities at each layer of the heterogeneous graph neural network; The intra-node type aggregation module is used to aggregate different types of entity nodes such as accounts, posts, and communities in each layer of the heterogeneous graph neural network; The node type aggregation module is used to aggregate different types of entity nodes such as accounts, posts, and communities in each layer of the heterogeneous graph neural network; The meta-path score calculation module is used to find the optimal meta-path by calculating the score of the meta-path of the heterogeneous graph neural network, thereby detecting malicious accounts.

Images