A malicious information tracing method based on neighborhood similarity and multi-type interaction

Abstract

The present application belongs to the field of information processing, and particularly relates to a malicious information tracing method based on neighborhood similarity and multi-type interaction; the method comprises obtaining user related data and malicious information related data in a social network platform, using a topological structure to depict the importance of a user node, obtaining an initial score vector of the user node, an initial score vector of a propagation path and an initial score vector of the malicious information; a multi-type triad interaction network is constructed to use representation learning to mine implicit information and optimize a transition probability matrix; the initial score vector of the user node, the initial score vector of the propagation path and the initial score vector of the malicious information are used to iteratively calculate a final score vector of the user node, and then the propagation source user of the malicious information is timely and effectively located; in this way, information can be targetedly defended, thereby improving the accuracy and reliability of information propagation in the social network platform.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of information processing, and particularly relates to a malicious information tracing method based on neighborhood similarity and multi-type interaction. BACKGROUND

[0002] In the information age, every person cannot do without the network in the aspects of office and life. In recent years, online social network platforms represented by Sina Weibo, Twitter, Facebook, Instagram, WeChat and Douyin have developed rapidly, indicating that social networks have become an important way for people to share opinions and participate in current affairs. Using online social platforms can spread danger information in emergency situations such as natural disasters (floods, storms, earthquakes) and man-made disasters. However, while spreading information, it may contain malicious information (false information, rumors), and the indiscriminate spread of malicious messages will have serious consequences.

[0003] Researching the propagation law of malicious information and quickly tracing and locating the malicious information source are of great significance for the propagation control of malicious information and the crackdown on network crimes.

[0004] Although many scholars have conducted a lot of research on malicious information tracing and have achieved quite good results, there are still some problems to be solved:

[0005] 1. The mass of user nodes. The user scale of the real network platform is super large, and if all user nodes in the malicious information propagation network are tracked to trace the malicious information propagation source, it will inevitably bring challenges in the amount of calculation.

[0006] 2. The interaction between multi-type elements. Malicious information will be affected by key elements such as users and paths in the propagation process, and how to depict the mutual influence and association relationship between key elements is very important for malicious information tracing.

[0007] 3. The complexity of malicious information tracing based on the interaction analysis mechanism. In order to depict the mutual influence relationship between elements, an interaction analysis mechanism is introduced in the prior art, but how to further quantify the influence of key elements on the basis of interaction becomes a difficulty. SUMMARY

[0008] Based on the problems existing in the prior art, the present application proposes a malicious information tracing method based on neighborhood similarity and multi-type interaction around the three elements of users, paths and malicious information. The method uses the topology structure to depict the importance of the user node to obtain the initial score vector of the user node. Then a multi-type interaction network is constructed to optimize the transition probability matrix by representation learning. Finally, the final score vector of the user node is calculated by iterative calculation, and the malicious information propagation source is located in time and effectively. The present application can be divided into the following core steps:

[0009] The first step is to obtain data sources. User-related data and malicious information-related data are obtained from API interfaces provided by data platforms and social platforms.

[0010] The second step is to build a relevant network. Based on user data and malicious information, according to user behavior information, a user relationship network, a malicious information path network and a malicious information propagation network are extracted.

[0011] The third step is to establish a model. Based on the extracted relevant network, the importance of the topology structure of the user node is quantified according to the neighborhood similarity, a multi-type interaction module is constructed to mine and depict the interaction information between different elements, and an iterative scoring strategy is used to establish a malicious information tracing model. The model indicates that the propagation of malicious information is affected by key users and propagation paths, and the identification of the propagation source can also be studied from the interaction mechanism.

[0012] The technical scheme adopted by the present application to solve the above technical problems is as follows:

[0013] User-related data and malicious information-related data in a social network platform are obtained, and user information, propagation paths and malicious information are extracted;

[0014] According to the user information, the propagation path and the malicious information, a user relationship network, a malicious information path network and a malicious information propagation network are constructed;

[0015] In the user relationship network, the importance degree of the user node is calculated by using neighborhood similarity, so as to calculate the initial score vector of the user; in the malicious information path network, the initial score vector of the propagation path is calculated according to the total number of propagation paths in the malicious information and the total number of users participating in the propagation path; in the malicious information propagation network, the initial score vector of the malicious information is calculated according to the total number of users participating in all malicious information and the total number of users participating in each malicious information;

[0016] According to the interaction relationship between the user information, the propagation path and the malicious information, a multi-type ternary interaction network is constructed;

[0017] In the ternary interaction network, the implicit information between the user information, the propagation path and the malicious information is extracted by using a knowledge graph representation learning algorithm, and the feature representation vectors of the user nodes, the path nodes and the malicious information nodes in a unified vector space are obtained;

[0018] According to the feature representation vectors of each node, the similarity between the user vector, the propagation path vector and the malicious information vector is calculated;

[0019] According to the similarity among the user relationship, the propagation path and the malicious information, a transition probability matrix between the user and the propagation path and a transition probability matrix between the propagation path and the malicious information are calculated;

[0020] In a cross-iteration scoring manner, the score vectors of the user, the score vectors of the path and the score vectors of the malicious information are updated according to the transition probability matrix between the user and the propagation path and the transition probability matrix between the propagation path and the malicious information.

[0021] The updated score vectors of the user, the score vectors of the path and the score vectors of the malicious information are normalized to calculate the influence score of the user, and the propagation source user of the malicious information is determined according to the influence score value.

[0022] The beneficial effects of the present application are as follows:

[0023] The present application uses the topological structure of the user relationship network to depict the importance of the user node, considers the degree of the user node itself and the link redundancy of each pair of neighbor nodes, so that the topological importance of the user node is more accurately and reasonably evaluated; the present application uses the multi-type interaction module to simply and effectively depict the interactive influence of the participating user, the propagation path and the malicious information in the propagation process; the present application further mines the implicit information among the user information, the propagation path and the malicious information by using the knowledge graph representation learning algorithm, realizes the acquisition of the feature representation vector in the unified vector space, and optimizes the transition probability matrix among the three; the present application further performs cross-iteration scoring by using the initial score and the optimized transition probability matrix on the basis of the multi-type interaction graph, and performs normalization operation in the process, so that the malicious information propagation source can be effectively identified in an interactive analysis mechanism. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 is a malicious information tracing schematic diagram adopted by the embodiment of the present application;

[0025] Figure 2 is a malicious information tracing model diagram based on neighborhood similarity and multi-type interaction adopted by the embodiment of the present application;

[0026] Figure 3 is a malicious information tracing method flowchart based on neighborhood similarity and multi-type interaction adopted by the embodiment of the present application;

[0027] Figure 4 is an example diagram of quantifying the importance of the user topological structure adopted by the embodiment of the present application;

[0028] Figure 5 is a path analysis example diagram adopted by the embodiment of the present application;

[0029] Figure 6 is a multi-type element interaction mechanism diagram adopted by the embodiment of the present application

[0030] Figure 7 is a multi-type interaction example diagram adopted by the embodiment of the present application

[0031] Figure 8 is an implicit information mining mechanism diagram adopted by the embodiment of the present application. DETAILED DESCRIPTION

[0032] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0033] In order to better set forth the technical solutions of the present application and make the advantages more concise and clear, the problems to be solved by the present application will be explained specifically below, and then the specific embodiments of the present application will be further described in detail with reference to the drawings in the specification.

[0034] Figure 1 is a malicious information tracing diagram based on neighborhood similarity and multi-type interaction adopted by the embodiment of the present application, as shown in Figure 1 , which shows that the input of the present application is user-related data and malicious information-related data in a social network platform, and the output after the tracing model is the source user of the malicious information propagation.

[0035] Figure 2 is a malicious information tracing model diagram based on neighborhood similarity and multi-type interaction adopted by the embodiment of the present application, as shown in Figure 2 , on the one hand, a user topology graph is constructed by using user relationship, and an initial score vector of the user node is calculated according to neighborhood similarity D-NTC, on the other hand, a triple information of user-path-malicious information is extracted by using topic network, an implicit information space is learned by using TransD method, and a transition probability matrix is calculated; according to the initial score vector and the transition probability matrix, the score vector is calculated by using NSMTI-Rank iteration, and the final score vector is output after the iteration is ended, and the source user of the malicious information propagation is determined according to the influence score value.

[0036] Figure 3 is a malicious information tracing method flow diagram based on neighborhood similarity and multi-type interaction adopted by the embodiment of the present application, as shown in Figure 3 , the method comprises:

[0037] 101, Obtain user-related data and malicious information-related data in a social network platform, and extract user information, propagation path and malicious information;

[0038] Among them, the data acquisition method of the embodiment of the application can be from a public data website or by using a mature social network public API.

[0039] In some embodiments, the user-related data can refer to the user's friend relationship and the user's malicious information participation record, and the malicious information-related data can refer to the influence population of malicious information and the propagation time of malicious information; what needs to be obtained here is the malicious information participation record of the malicious information in its life cycle and the behavior record of all participating users. The malicious information participation record needs to obtain the forwarding time, the basic information of the participating user and the friend relationship information of the participating user (including the attention and attention information); the behavior record of the participating user includes the information forwarded and commented by the user in the past.

[0040] Generally, the original data obtained is unstructured and cannot be directly used for data analysis. Through simple data cleaning, most of the unstructured data can be structured, so that abnormal values or null values no longer appear, reducing the inconvenience brought to subsequent calculations.

[0041] The data after simple data cleaning needs to be stored using a database, and the data is further standardized through a table structure, and the database can greatly improve the data retrieval efficiency and the mapping of inter-table relationships.

[0042] 102, According to the user information, the propagation path and the malicious information, a user relationship network, a malicious information path network and a malicious information propagation network are constructed;

[0043] Discovering the multi-type malicious information tracing process based on user-path-malicious information is essentially modeling and analyzing the transition probability matrix of the two relationships of user-path and path-malicious information. The application aims at the interaction among the participating users, the propagation path and the malicious information in the malicious information propagation network, and from the three aspects of user information, propagation path and malicious information, important associations among the three are mined and related networks are defined, as follows:

[0044] 1) User relationship network G U

[0045] In the social network, the interaction between users mainly depends on the relationship composition of the users. The user relationship can promote the spread of malicious information, thereby affecting the spread situation of the malicious information. The more complex the relationship composition of the user and other users in the network is, and the greater the number of relationships is, the greater the role of the user in the spread and diffusion of malicious information is. Therefore, the present application defines the user relationship network as follows:

[0046]

[0047] Wherein, U i represents a user i, n(i) represents a set of friends followed by the user U o , U i′ ∈ n(i) represents that the user U i′ has a friend relationship with the user U i .

[0048] 2) Malicious information path network G P

[0049] The spread and diffusion of malicious information in the social network mainly depend on the forwarding behavior of the user. When a user forwards malicious information, the friend set of the user will have a high probability of contacting the forwarded malicious information. Then, part of the users in the user set may further forward the malicious information. Finally, the spread of malicious information in the network space is caused, and loss is caused. Therefore, the definition of the user behavior information of the present application is as follows:

[0050] A={(a,U i )|U i ∈U} (2)

[0051] Wherein, a represents the behavior information of the user node U i . The behavior information of the present application only refers to the forwarding behavior of the user.

[0052] According to the forwarding behavior of the user, the present application can extract the propagation path of the complete life cycle of the malicious information, so as to construct the malicious information path network.

[0053] For the propagation path of the malicious information, the present application sets the link from the starting node to the forwarding terminal node in sequence as a propagation path. Therefore, the definition of the malicious information path network of the present application is as follows:

[0054] G P ={U M ,P M} (3)

[0055] Wherein, U M is a set of users participating in the malicious information, is the set of propagation path of the malicious information, |p j |p represents the number of users involved in the jth propagation path, and k represents the total number of propagation paths of the malicious information.

[0056] 3) Malicious information propagation network G M

[0057] In the process of malicious information propagation, different malicious information spreads in different user groups. Therefore, the definition of the malicious information propagation network is as follows:

[0058] G M = {U ∑ , M ∑} (4)

[0059] where U ∑ is the set of all users involved in the process of malicious information propagation, and M ∑ is the set of malicious information.

[0060] 103、In the user relationship network, the importance degree of the user node is calculated by using neighborhood similarity, so as to calculate the initial score vector of the user; in the malicious information path network, the initial score vector of the propagation path is calculated according to the total number of propagation paths of the malicious information and the total number of users involved in the propagation path; in the malicious information propagation network, the initial score vector of the malicious information is calculated according to the total number of users involved in all malicious information and the total number of users involved in each malicious information.

[0061] In the embodiment of the application, for the user node in the network, the importance depends not only on the degree of the node itself, but also on the dependence degree of the neighborhood node on the node. The neighborhood node of the application specifically refers to the low-order neighbor node within two layers, and how to quantify the importance of the topological structure of the user node is a problem to be solved by the application. In fact, the topological coincidence degree between the neighbor nodes is related to the link redundancy of each pair of neighbor nodes, but if the topological importance of the node is to be measured, only the sum of the coincidence degrees of the neighbor nodes is not enough to accurately reflect the importance of the topological structure of the node.

[0062] In order to more accurately evaluate the importance of the topological structure of the user node, according to the definition of the topological coincidence degree (NTC) of the node, the application comprehensively considers the degree of the node itself and the topological coincidence degree of the neighbor node, and proposes an algorithm based on the degree of the node and the topological coincidence degree of the neighbor node, i.e., neighborhood similarity D-NTC.

[0063]

[0064] where U j and U k are the user Ui The neighboring nodes, the expanded form of the D-NTC algorithm expression is as follows:

[0065]

[0066] Where D-NTC(i) represents user node U i The degree of importance, n(i) represents the user node U i The set of neighboring nodes, By user node U i The degree size N is obtained by mapping; NTC(i′,i″) represents the user node U. i′ and user node U i″ The degree of topological overlap is as follows:

[0067]

[0068] Where n(i′) and n(i″) represent user node U respectively. i′ and U i″ The set of neighboring nodes, user node U i′ and U i″ All are user U i Friends, but not the same user.

[0069] It can be seen that the D-NTC index comprehensively considers the degree of a user node and the topological overlap between its neighboring nodes. A larger D-NTC value indicates a higher degree for the node and a lower topological overlap between its neighboring nodes, suggesting greater topological importance for this user node. Figure 4 As shown in the diagram. In subgraph A, node a has three first-order neighbors, and these three neighbors have no direct relationship (i.e., no edges connecting them). This indicates that the network's dependence on node a is relatively high, and node a's importance is also higher. In subgraph B, node a has fewer first-order neighbors, and its second-order neighbors share three common nodes. This weakens node a's importance. In subgraph C, node a's first-order neighbors have friendly relationships. In this case, node a's importance is weakened to the greatest extent.

[0070] Based on the above analysis, the user's initial rating vector X can be obtained.

[0071] Based on the time-sensitive nature of malicious information propagation, this invention takes the chronological order of user forwarding behavior as the starting point during the malicious information propagation process. Simultaneously, it divides the entire malicious information propagation network into multiple sub-networks, extracts and analyzes the propagation paths of different malicious information, and calculates a score vector for each propagation path.

[0072] When the user nodes propagate malicious information, the malicious information publisher can be regarded as a root node, each forwarding user is regarded as a child node, and each forwarding behavior is regarded as an edge between the participating users, and the forwarding behaviors of all participating users can form a malicious information propagation tree model. Then, taking the root node as the starting point and the leaf node as the end point, each propagation path in the malicious information propagation process is extracted. As shown in Figure 5 , it is a propagation path analysis example formed by a certain malicious information in the propagation process.

[0073] Among them, the X vector set by the application represents the importance of the user, the Y vector set by the application represents the importance of the path, and the Z vector represents the propagation degree of the malicious information. Combined with the user node importance vector X calculated above, X, Y, and Z are initialized as X (0) , Y (0) , Z (0) .

[0074] X (0) =[D-NTC(1),D-NTC(2),....D-NTC(s)] (8)

[0075] Wherein, s represents the total number of participating users in the entire malicious information propagation network, and D-NTC(i) represents the importance of the user node U i , i={1,2,…,s}.

[0076] For the initialization of the score value of the malicious information propagation path, the application believes that the importance of the malicious information propagation path mainly depends on the number of participating users. Generally, the larger the number of participating users, the more important the propagation path. Therefore, the application uses Y (0) to represent the initial value of the influence of the propagation path in the malicious information propagation process, and the calculation formula is as follows:

[0077] Y (0) =[num(1),num(2),...,num(n)] T (9)

[0078] Wherein, n represents the total number of paths, and num(j) represents the total number of participating users in the propagation path P j , j={1,2,…,n}.

[0079] For the initialization of the influence value of the malicious information, the application believes that the importance of the malicious information mainly depends on the propagation range, that is, the number of people forwarding the malicious information accounts for the total number of malicious information propagation. Generally, the more the number of forwarding people, the greater the influence of the malicious information. The initial value Z (0) of the influence of the malicious information is:

[0080]

[0081] wherein, represents the total number of participants of all malicious information, for the convenience of calculation, the embodiment can only be directed to the forwarding behavior, m k represents the number of participants of the kth malicious information, k={1, 2,..., K}, K is the total number of malicious information.

[0082] 104. According to the interaction relationship among user information, propagation path and malicious information, a multi-type ternary interaction network is constructed;

[0083] In the embodiment of the application, the interactive influence relationship existing among participating users, propagation paths and malicious information in the propagation process is comprehensively considered, in order to discover the interaction situation among the three key elements of users, paths and malicious information, the three key elements are divided into three mutually exclusive sets by referring to a three-part graph model, and a multi-type ternary interaction network based on users, paths and malicious information is constructed; the ternary interaction network of users-paths-malicious information can be represented as:

[0084] G_UPM={U∪P∪M,A∪B∪A T ∪B T} (11)

[0085] Wherein, U is a set of users, P is a set of paths, and M is a set of malicious information. A and A T are the transition probability matrices between users and paths, and B and B T are the transition probability matrices between paths and malicious information, as shown in Figure 6 The ternary interaction graph includes three element types, i.e. user elements, path elements and malicious information elements, the user set U is converted into the path set P through the transition probability matrix A, the path set P is converted into the user set U through the transition probability matrix A T , the path set P is converted into the malicious information set M through the transition probability matrix B, and the malicious information set M is converted into the path set P through the transition probability matrix B T . Through the probability transition relationship, the interaction relationship between users and paths and the interaction relationship between paths and malicious information can be determined, so that the mutual influence relationship in the ternary interaction graph is used to calculate the final influence score values of the three key element nodes.

[0086] 105. In the ternary interaction network, the knowledge graph representation learning algorithm is used to extract the implicit information among the user information, the propagation path and the malicious information, and obtain the feature representation vectors of the user nodes, the path nodes and the malicious information nodes in the unified vector space;

[0087] In the embodiments of the present application, it is considered that in the malicious information propagation network, the three different types of key elements of users, paths and malicious information have their own characteristics, and the three are related to each other. There are different semantics in the connection between two different users, such as user-to-user, including user-to-malicious information-to-user, user-to-malicious information-to-path-to-user, user-to-user friend relationship, and the like. These semantics contain rich information, and we can learn the feature representation of each node through these different relationships, not only to reconstruct the previous network, but also to support further network derivation. As shown in Figure 7 User U3 exists in path P1 and path P2 respectively, if the traditional calculation method is used, the two paths will be divided into transfer probability. However, path P2 contains a large number of mutual attention friend relationships of malicious information propagators, so the probability actually allocated to path P2 will be larger. Similarly, path P1 propagates malicious information M1 and M2, but the number of users participating in malicious information M2 is larger, so the actual probability of M2 will also be larger.

[0088] Considering the diversity of relationships, we use the knowledge representation TransD algorithm to perform unified vector representation on nodes. As shown in Figure 8 The multi-type entity is mapped to the relationship space through a dynamic mapping matrix to obtain the feature representation of each node in the unified vector space.

[0089]

[0090]

[0091] Then under the training of the objective function L, the multi-type entity is mapped to the relationship space through a dynamic mapping matrix to obtain the feature representation of each node in the unified vector space.

[0092]

[0093] Among them, for a triple (h, r, t), it needs to satisfy fr(h, t) = ||M rh *h+r-M rt *t|| 2 ≈0.

[0094] 106、According to the feature representation vector of each node, the similarity between the user vector, the propagation path vector and the malicious information vector is calculated;

[0095] Through the mining of the implicit relationship between the multiple types of elements, the unified vector representation of the three types of element nodes is obtained. In this section, the transition probability matrix between different types of elements is calculated according to the similarity between different types of elements.

[0096] First, the similarity matrix between the user vector U i and the path vector P j is represented as:

[0097]

[0098] Among them, the similarity between vectors can also be calculated by other similarity distance formulas, such as Euclidean distance, Minkowski distance, Manhattan distance, and Hamming distance.

[0099] 107、According to the similarity between the user relationship, the propagation path and the malicious information, the transition probability matrix between the user and the propagation path, and the transition probability matrix between the propagation path and the malicious information are calculated;

[0100] In the embodiment of the application, the transition probability matrix of the user-path network G UP can be represented as:

[0101]

[0102] Similarly, the transition probability matrix of the propagation path-malicious information network G

[0103]

[0104] Among them, represents the transition probability matrix of the user node U i to the propagation path P j , represents the transition probability matrix of the propagation path P j to the user node U i ; Sim(U i , P j ) and Sim(P j , U i ) represent the similarity matrix between the user node U i and the propagation path P j ; N(U i ) represents the set of propagation path nodes P j′ that have a propagation relationship with the user node U i , and N(P j ) represents the set of user nodes U i′ that have a propagation relationship with the propagation path P j . represents the transition probability matrix of the user node Ui There is an interaction between the propagation path P j′ , The propagation path P j and the user node U i′ There is an interaction between the user node and the propagation path E UP The set of interactions between the user node and the propagation path is represented.

[0105] Secondly, the transition probability matrix of the path-malicious information network G PM can be represented as:

[0106]

[0107] Similarly, the calculation of

[0108]

[0109] Wherein, The transition probability matrix of the propagation path P j to the malicious information M k , The transition probability matrix of the malicious information M k to the propagation path P j ; Sim(P j ,M k ) and Sim(M k ,P j ) represent the similarity matrix between the propagation path P j and the malicious information M k ; N(P j ) represents the set of malicious information nodes M k′ which have a propagation relationship with the propagation path P j , and N(M k ) represents the set of path nodes P j′ which have a propagation relationship with the malicious information M k ; and There is an interaction between the propagation path P j and the malicious information M k , E PM The set of interactions between the propagation path and the malicious information is represented.

[0110] 108. In a cross-iteration based scoring manner, the score vector of the user, the score vector of the path and the score vector of the malicious information are updated according to the transition probability matrix between the user and the propagation path, the transition probability matrix between the propagation path and the malicious information;

[0111] In this embodiment of the invention, a cross-iterative scoring algorithm is used to update the scoring vector. The idea behind the cross-iterative scoring algorithm is that if a node is a hub node, it has a high authority value because it is easily accessed by other nodes. If a node has a high authority value, it is likely to be an important node. Therefore, we can draw on the idea of ​​cross-iterative scoring, consider the mutual influence relationship in the user-path-malicious information ternary interaction graph, and calculate the final influence score of the three key element nodes. Based on the initial influence values ​​of the multi-type element nodes obtained above and the optimized transition probability matrix, positive scoring and negative scoring are performed. The specific process is as follows:

[0112] In positive scoring, firstly, based on the scoring vector X of the user set, the transition probability matrix A between users and propagation paths is used to transform it into a path scoring vector, resulting in a new path scoring vector Y′. Then, based on the new path scoring vector Y′, the transition probability matrix B between the propagation path and malicious information is used to transform it into a malicious information scoring vector, resulting in a new malicious information scoring vector Z′. The calculation formula is shown below:

[0113] Y'=(1-α)Y+αA·X (17)

[0114] Z'=(1-α)Z+αB·Y' (18)

[0115] Similarly, we perform reverse scoring, based on the same principle as forward scoring, updating the scores of X and Y, using the malicious information scoring vector Z, and the transition probability matrix B between the propagation path and the malicious information. T The path is transformed into a scoring vector, resulting in a new path scoring vector Y′; based on the new path scoring vector Y′, the transition probability matrix A between the user and the propagation path is used. T The scoring vector is transformed into a scoring vector for the user set, resulting in a new scoring vector X′ for the user set. The calculation formula is shown below:

[0116] Y'=(1-α)Y+αB T ·Z' (19)

[0117] X'=(1-α)X+αA T ·Y' (20)

[0118] Where α is the damping coefficient, and X, Y, and Z represent the scores before the iteration.

[0119] To ensure convergence, this invention requires setting a threshold ε. When ||X′-X||≤ε, the iteration stops and the iteration result is returned. Furthermore, after each iteration, the scores of X, Y, and Z need to be normalized.

[0120] 109、The updated user score vector, the path score vector and the malicious information score vector are normalized to obtain the influence score of the user, and the source user of the malicious information is determined according to the influence score value.

[0121] In the embodiment of the application, the influence score value of each user is obtained after the score vector result of the final iteration is normalized, and for each malicious information, the source user of the malicious information can be determined according to the highest influence score.

[0122] Through the output result of the model based on neighborhood similarity and multi-type interaction in the application, the system can effectively mine the importance of the user node and the interaction information of the multi-type elements in the network, and timely and effectively identify the source of the malicious information propagation. The network information security department can control the flow of different malicious information sources, thereby achieving the fastest control of malicious information with the lowest cost.

[0123] The model can quickly find the source when malicious information appears, timely curb the continuous spread of rumors, punish the spreaders of malicious information, and hold the legal responsibility of the spreaders with serious circumstances, thereby warning the behavior of other malicious information spreaders. The model can also provide a basis for the government to develop effective measures to regulate the spread of malicious information. On the other hand, the model can also be used for the promotion of enterprise products and services, which is helpful for the rapid promotion and diffusion of advertisements in target groups, improves the exposure of advertisements and brand awareness, and obtains good economic and social benefits.

[0124] Although the embodiments of the application have been shown and described, it can be understood by those of ordinary skill in the art that various changes, modifications, replacements and variations can be made to the embodiments without departing from the principles and spirits of the application, and the scope of the application is defined by the appended claims and their equivalents.

Claims

1. A method for tracing malicious information based on neighborhood similarity and multi-type interaction, characterized in that, The method comprises: obtaining user-related data and malicious information-related data in a social network platform, and extracting user information, a propagation path and malicious information; constructing a user relationship network, a malicious information path network and a malicious information propagation network according to the user information, the propagation path and the malicious information; in the user relationship network, calculating the importance degree of a user node by using neighborhood similarity, thereby calculating an initial score vector of the user node; in the malicious information path network, calculating an initial score vector of the propagation path according to the total number of propagation paths in the malicious information and the total number of users participating in the propagation paths; in the malicious information propagation network, calculating an initial score vector of the malicious information according to the total number of users participating in all malicious information and the total number of users participating in each malicious information; constructing a multi-type ternary interaction network according to the interaction relationship among the user information, the propagation path and the malicious information; in the ternary interaction network, extracting the implicit information among the user information, the propagation path and the malicious information by using a knowledge graph representation learning algorithm, and obtaining feature representation vectors of user nodes, propagation path nodes and malicious information nodes in a unified vector space; calculating the similarity among user vectors, propagation path vectors and malicious information vectors according to the feature representation vectors of each node; calculating a transition probability matrix between user nodes and propagation paths, and a transition probability matrix between propagation paths and malicious information according to the similarity among the user relationship, the propagation path and the malicious information; updating the score vector of the user node, the score vector of the propagation path and the score vector of the malicious information according to the transition probability matrix between the user nodes and the propagation paths, and the transition probability matrix between the propagation paths and the malicious information by using a cross-iteration scoring-based method; normalizing the updated score vector of the user node, the score vector of the propagation path and the score vector of the malicious information, calculating an influence score of the user, and determining a propagation source user of the malicious information according to the influence score value.

2. The method of claim 1, wherein, calculating the importance degree of the user node by using neighborhood similarity comprises calculating the topological importance of the user node according to the difference between the degree of the user node itself and the topological coincidence degree of the neighbor nodes, and is expressed as: Wherein, D-NTC(i) represents the importance degree of the user node U i , n(i) represents the neighbor node set of the user node U i , mapped by the degree N of the user node U i ; NTC(i', i") represents the topology coincidence degree of the user node U i′ and the user node U i″ , n(i') and n(i") respectively represent the neighbor node set of the user node U i′ and U i″ .

3. The method of claim 1, wherein, the initial score vector of the user node, the initial score vector of the propagation path and the initial score vector of the malicious information are expressed as: X (0) = [D-NTC(1), D-NTC(2),... D-NTC(s)] Y (0) = [num(l), num(2),..., num(n) [ T wherein X (0) represents the initial score vector of user nodes, Y (0) represents the initial score vector of propagation paths, Z (0) represents the initial score vector of malicious information, s represents the total number of participating users in the entire malicious information propagation network, D-NTC(i) represents the importance degree of the user node U i , i={1, 2, …, s}; n represents the total number of propagation paths, num(j) represents the total number of participating users in the propagation path P j , j={1, 2, …, n}; sum represents the total number of participating users of all malicious information, m k represents the number of participating users of the kth malicious information, k={1, 2, …, K}, K is the total number of malicious information; the superscript T represents transposition.

4. The method of claim 1, wherein, The construction process of the ternary interaction network includes constructing a transition probability matrix between the user nodes and the propagation paths and a transition probability matrix between the propagation paths and the malicious information according to the interaction relationship between the user nodes and the propagation paths and the interaction relationship between the propagation paths and the malicious information, and combining a user set, a propagation path set and a malicious information set, the ternary interaction network constructed is represented as: G_UPM={U∪P∪M,A∪B∪A T ∪B T}; wherein U is a set of users, P is a set of propagation paths, M is a set of malicious information; A is a transition probability matrix between the user nodes and the propagation paths, B is a transition probability matrix between the propagation paths and the malicious information, and the superscript T represents a transposed matrix.

5. The method of claim 1, wherein, the knowledge graph representation learning algorithm is used to extract the implicit information among the user information, the propagation path and the malicious information, and obtain the feature representation vectors of the user nodes, the path nodes and the malicious information nodes in the unified vector space, which comprises representing each node by two initial vectors, one vector being used to represent the node and the other vector being used to construct a projection matrix to form a node pair; a unique mapping matrix is constructed for each node pair; the triple information in the ternary interaction network is taken as a positive sample, and a negative sample is obtained by randomly replacing the head entity or the tail entity in the positive sample; the actual node feature representation vectors are obtained by considering the loss function of the positive sample and the negative sample and through training.

6. The method of claim 1, wherein, The transition probability matrix between users and propagation paths is represented as: wherein, denotes a user node U i to a propagation path P j , a transition probability matrix, denotes a transition probability matrix from a propagation path P j to a user node U i ; Sim(U i , P j ) and Sim(P j , U i ) denote a similarity matrix between a user node U i and a propagation path P j ; N(U i ) denotes a set of propagation path nodes P j′ that have a propagation relationship with a user node U i , and N(P j ) denotes a set of user nodes U i′ that have a propagation relationship with a propagation path P j ; denotes that there is an interaction between a user node U i and a propagation path P j′ , denotes that there is an interaction between a propagation path P j and a user node U i′ , and E UP denotes a set of user nodes and propagation paths that have an interaction.

7. The method of claim 1, wherein, The transition probability matrix between propagation paths and malicious information is represented as: wherein, represents a propagation path P j to malicious information M k , a transition probability matrix, represents malicious information M k to a propagation path P j , a transition probability matrix; Sim(P j , M k ) and Sim(M k , P j ) represent a similarity matrix between a propagation path P j and malicious information M k ; N(P j ) represents a set of malicious information nodes M j having a propagation relationship with a propagation path P k′ , and N(M k ) represents a set of path nodes P k having a propagation relationship with malicious information M j′ ; and represent that a propagation path P j and malicious information M k have an interaction, E PM represents a set of propagation paths and malicious information having an interaction.

8. The method of claim 1, wherein, The score vectors of the user nodes, the score vectors of the propagation paths and the score vectors of the malicious information are updated according to the transition probability matrix between the users and the propagation paths and the transition probability matrix between the propagation paths and the malicious information by using a cross-iteration scoring-based method, including using forward scoring, converting the score vectors of the user nodes X into the score vectors of the propagation paths by using the transition probability matrix A between the user nodes and the propagation paths, obtaining new propagation path score vectors Y'; converting the new propagation path score vectors Y' into the score vectors of the malicious information by using the transition probability matrix B between the propagation paths and the malicious information, obtaining new malicious information score vectors Z'; using reverse scoring, converting the score vectors of the malicious information Z into the score vectors of the propagation paths by using the transition probability matrix B between the propagation paths and the malicious information, obtaining new propagation path score vectors Y'; converting the new propagation path score vectors Y' into the score vectors of the user nodes by using the transition probability matrix A between the user nodes and the propagation paths, obtaining new user node score vectors X'; and stopping iteration and returning the score vectors of the user nodes, the score vectors of the propagation paths and the score vectors of the malicious information updated by iteration when ||X'-X||≤ε. T The score vectors of the user nodes, the score vectors of the propagation paths and the score vectors of the malicious information are updated according to the transition probability matrix between the users and the propagation paths and the transition probability matrix between the propagation paths and the malicious information by using a cross-iteration scoring-based method, including using forward scoring, converting the score vectors of the user nodes X into the score vectors of the propagation paths by using the transition probability matrix A between the user nodes and the propagation paths, obtaining new propagation path score vectors Y'; converting the new propagation path score vectors Y' into the score vectors of the malicious information by using the transition probability matrix B between the propagation paths and the malicious information, obtaining new malicious information score vectors Z'; using reverse scoring, converting the score vectors of the malicious information Z into the score vectors of the propagation paths by using the transition probability matrix B between the propagation paths and the malicious information, obtaining new propagation path score vectors Y'; converting the new propagation path score vectors Y' into the score vectors of the user nodes by using the transition probability matrix A between the user nodes and the propagation paths, obtaining new user node score vectors X'; and stopping iteration and returning the score vectors of the user nodes, the score vectors of the propagation paths and the score vectors of the malicious information updated by iteration when ||X'-X||≤ε. T The score vectors of the user nodes, the score vectors of the propagation paths and the score vectors of the malicious information are updated according to the transition probability matrix between the users and the propagation paths and the transition probability matrix between the propagation paths and the malicious information by using a cross-iteration scoring-based method, including using forward scoring, converting the score vectors of the user nodes X into the score vectors of the propagation paths by using the transition probability matrix A between the user nodes and the propagation paths, obtaining new propagation path score vectors Y'; converting the new propagation path score vectors Y' into the score vectors of the malicious information by using the transition probability matrix B between the propagation paths and the malicious information, obtaining new malicious information score vectors Z'; 9. The method of claim 8, wherein, The update formula used in the forward scoring process is represented as: Y' = (1 - a)Y + aA X Z' = (1 - a)Z + aB Y' Where a represents a damping coefficient.

10. The method of claim 8, wherein, The update formula used in the backward scoring process is represented as: Y' = (1 - a)Y + aB T • Z' X' = (1 - a)X + aA T • Y' Where a represents a damping coefficient.

Images