A user classification model training method and a user detection method

Abstract

The embodiments of this application disclose a user classification model training method and a user detection method. The user classification model training method includes: constructing a multi-relationship graph based on original user features; obtaining the feature representation of each node in the multi-relationship graph, and obtaining the final representation of each node based on the feature representation; obtaining an initial user classification model based on the final representation of each node; obtaining feature sample data through a federated learning network framework, and training the initial user classification model based on the feature sample data to obtain the user classification model.

Description

Technical Field

[0001] This application relates to the field of abnormal user detection technology, and in particular to a user classification model training method and a user detection method. Background Technology

[0002] The rapid development of the internet has brought our lives closer to it, especially in terms of social interaction. Online social networks, as the most important information transmission platform on the internet, have become a crucial vehicle for the public to receive information and express opinions. "Water army" users refer to large collections of accounts generated by software bots or created manually. When driven by profit, they will publish large amounts of false information, spread rumors, and increase their follower count. By manipulating topics and enhancing user influence, they aim to confuse public opinion and affect information security on social networks. Therefore, identifying and combating these hidden "water army" users among social network users is one of the challenges facing online order.

[0003] With the development of deep learning, many problems that traditional methods cannot solve can be solved by efficient neural networks. This technology can automatically learn features from raw data without manual selection, and has shown excellent recognition and classification performance in fields such as natural language processing, image recognition, and speech recognition. Therefore, this technology is being increasingly applied by researchers to abnormal user detection models.

[0004] Current research on detecting online trolls on social networks can be categorized into four types: graph-based methods, feature-based methods, behavior-based clustering methods, and crowdsourced troll methods.

[0005] (1) Graph-based detection methods: Graph-based algorithms treat each user as a node in a graph and the relationships between users in a social network as edges. For example, one detection method considers the dynamic changes in the graph structure. Many previous works are based on the assumption that in social networks, edges between users mainly exist between normal users or between fake users, and the number of edges between normal and fake users is extremely limited. This assumption is mainly based on the lack of trust between users in traditional social networks, making it difficult for attackers to establish connections with normal users, such as Renren and Facebook. Some detection methods are also based on the assumption that normal user groups and fake user groups are separated in social networks. Unfortunately, some studies have found that this assumption is not valid; normal users can still contact and establish connections with fake users. Recent research has relaxed this assumption and adopted a combined approach, first predicting the victim node,

[0006] The graph is weighted based on the prediction results, and an upper limit is set on the weight of the edges between normal users and fake users. Then, a random walk algorithm is used on the weighted graph to classify different users.

[0007] (2) Feature-based detection methods: The advantage of feature-based detection methods is that user behavior features can be easily quantified into feature vectors. Then, machine learning models are trained using user account information and user-level behavioral features to correctly distinguish between normal users and fake users. Different methods use different feature sets to describe the differences between normal users and fake users. Some studies consider the content posted by users on social networks to detect fake users, such as comments, posts, tags, and URL information in the content. For example, Facebook's immune system combines user profiles and behavior to detect fake users on Facebook. Some methods detect accounts stolen by malicious users through abnormal changes in user behavior patterns. Meanwhile, some scholars have studied the differences in a user's tweet-retweeting behavior patterns to detect fake accounts on Twitter.

[0008] (3) Behavioral clustering-based methods: Recent research has focused more on detecting user groups rather than individual users. Some researchers have implemented a hybrid approach that first clusters users based on their similarity, and then uses the analysis of user groups to detect fake user groups. The main idea behind this type of method is that user groups can better reflect the behavioral characteristics of fake users compared to individual users. Even if fake users manage to imitate normal users in certain ways, their characteristics are amplified when they are aggregated into a group.

[0009] (4) Crowdsourcing-based detection methods: Some studies have tested the efficiency of using crowdsourcing (hiring users or experts on crowdsourcing platforms) to detect fake users by observing users' personal information. The accuracy of detection can be improved by using multiple people to vote.

[0010] On the one hand, most existing detection methods rely on the social network relationships established between users within social networks, analyzing each user's connections within the network, or training a machine learning model to detect fake users by selecting effective feature values. However, anomalous users in different domains have different characteristics. Real-world bots in the political sphere exhibit certain behaviors and related characteristics, and their neighbors are all in the same domain. In contrast, e-commerce bots post about everyday e-commerce topics and interact with users active in the e-commerce field. Furthermore, bots on review-based social networks create fake reviews by applying for numerous fake accounts; these fake reviews can boost the scores of inflated merchants. Therefore, diversity across different domains can and should be an important characteristic for distinguishing between normal users and bots.

[0011] On the other hand, as countries around the world have increasingly emphasized cybersecurity and privacy protection in recent years, how to protect user data privacy when building detection models across multiple social networks is a pressing issue. Vertically, industry giants monopolize vast amounts of data, making it difficult for smaller companies to access this data, leading to a widening gap between companies. Horizontally, companies at the same level but in different industries find it difficult to exchange and integrate data due to the closed and isolated nature of their systems and businesses, making joint modeling a challenge that requires overcoming numerous barriers. Summary of the Invention

[0012] To solve or partially solve the above problems, this application provides a user classification model training method and a user detection method.

[0013] This application proposes a user classification model training method, the method comprising: constructing a multi-relationship graph based on original user features; obtaining the feature representation of each node in the multi-relationship graph, and deriving the final representation of each node based on the feature representation; obtaining an initial user classification model based on the final representation of each node; obtaining feature sample data through a federated learning network framework, and training the initial user classification model based on the feature sample data to obtain a user classification model.

[0014] In some examples, constructing a multi-relationship graph based on original user characteristics includes: generating a multi-relationship graph based on user interaction behavior, the multi-relationship graph including an original graph and subgraphs, the subgraphs being generated by a subgraph generator based on the original graph.

[0015] In some examples, obtaining the feature representation of each node in the multi-relationship graph and deriving the final representation of each node based on the feature representation includes: obtaining the feature representation of each node in the subgraph through the graph embedding layer of the graph neural network; setting a preference vector between each node; and calculating the final representation of each node based on the preference vector and the feature of each node.

[0016] In some examples, obtaining an initial user classification model based on the final representation of each node includes: training the initial user classification model for each domain separately based on the final representation of each node.

[0017] In some examples, the method further includes training a robot detection classification model for each domain based on the final representation of each node.

[0018] In some examples, feature sample data is obtained through a federated learning network framework, and the initial user classification model is trained based on the feature sample data to obtain a user classification model. This includes: obtaining the feature sample data through a social platform under the federated learning network framework, calculating the model gradient for the feature sample data, and obtaining gradient information; sending the gradient information to a writing platform under the federated learning network framework, aggregating the gradient information through the writing platform, performing a weighted average, and sending the weighted average gradient information to the social platform; and iterating the initial user classification model through the social platform based on the weighted average gradient information to obtain the user classification model.

[0019] This application also provides a user detection method, the method comprising: acquiring user data of a user;

[0020] The user data is input into the user model to determine whether the user is an abnormal user. The user model is trained using any of the user classification model training methods described above.

[0021] Compared with the prior art, this application has the following beneficial effects:

[0022] The technical solution provided in this application includes a user classification model training method comprising: constructing a multi-relationship graph based on original user features; obtaining the feature representation of each node in the multi-relationship graph, and deriving the final representation of each node based on the feature representation; obtaining an initial user classification model based on the final representation of each node; obtaining feature sample data through a federated learning network framework, and training the initial user classification model based on the feature sample data to obtain a user classification model.

[0023] (1) From an overall perspective, the model uses binary classification for abnormal user detection. As the number of training rounds increases, the accuracy gradually converges. The model can use multiple source data to train the same model and protect data privacy, so it is feasible in anomaly detection.

[0024] (2) From an individual perspective, the data in the dataset is randomly and uniformly divided into K parts, each representing the dataset owned by each user. The results show that, under the same dataset size, the recognition accuracy of the user detection model based on federated learning is higher than that of the abnormal user detection model trained only on local data. In the case of multi-class classification, due to the scarcity of data of certain types, each user's local dataset may have little or no data of that type. If the model is trained only on the local dataset, it will result in low model recognition accuracy or even failure to train the model, making the comparison more obvious. Therefore, under the same data size, users can obtain better recognition results by using the multi-relationship graph representation model based on federated learning, which fully verifies the feasibility of this model in the field of cross-Internet abnormal user detection.

[0025] In addition, this invention has the following three advantages:

[0026] (1) Adaptability: Given any number of relation graphs, adaptively select the optimal number of neighbors for each user node to aggregate;

[0027] (2) Universality: This model framework is not only applicable to the detection of abnormal users on the Internet, but can also autonomously calculate different adaptive neighbor numbers in other different tasks.

[0028] (3) High efficiency: By optimizing the model loss function and the calculation process, this invention improves computational efficiency through optimization of computation time and space. Attached Figure Description

[0029] Figure 1 This is a basic schematic diagram illustrating a user classification model training method in an embodiment of this application. Detailed Implementation

[0030] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0031] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0032] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0033] It should also be noted that "multiple" as mentioned in this application refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0034] Example 1

[0035] like Figure 1 As shown, Figure 1 This example presents a basic flowchart illustrating a user classification model training method, which includes:

[0036] S101. Construct a multi-relationship graph based on the original user characteristics;

[0037] S102. Obtain the feature representation of each node in the multi-relationship graph, and derive the final representation of each node based on the feature representation;

[0038] S103. Obtain an initial user classification model based on the final representation of each node;

[0039] S104. Obtain feature sample data through a federated learning network framework, and train the initial user classification model based on the feature sample data to obtain a user classification model.

[0040] In some examples, constructing a multi-relationship graph based on original user characteristics includes: generating a multi-relationship graph based on user interaction behavior, the multi-relationship graph including an original graph and subgraphs, the subgraphs being generated by a subgraph generator based on the original graph.

[0041] In social networks, based on user interactions, a multi-relationship graph G = {V, X, E, Y} can be defined (where V represents user nodes {v1, v2, ... v...}). n Let X be the set of user primitive features, and n be the number of users. Represents node v i and node v j There exist edges with the relation r∈{1,…,R}, indicating a relationship between users i and j. For example, user i follows user j or user i comments on user j. Y represents the tag for each user. Then, a multi-relationship graph generator is introduced to generate a subgraph G of the original graph G. r The subgraph generator consists of independent edge learning and feature learning.

[0042] Edge learning, where edge learning is used to obtain the entire relation graph by selecting only the relationships r between users in the entire relation graph. Therefore, G r The edge set in E is r We define the set E of all edge relations. r The edge in Adding the nodes at both ends, the nodes form a set V. r Then, add individual features and labels to each node. The resulting subgraph G r It can be represented as

[0043] G r ={V r X r E r Y r}

[0044] Feature learning, which assumes that the features of the same user have different roles in different relation graphs, involves learning the features of each subgraph separately.

[0045]

[0046] Among them, X r It is G r The initial characteristics of each node are given by σ(), which is a nonlinear function.

[0047] In some examples, obtaining the feature representation of each node in the multi-relationship graph and deriving the final representation of each node based on the feature representation includes: obtaining the feature representation of each node in the subgraph through the graph embedding layer of the graph neural network; setting a preference vector between each node; and calculating the final representation of each node based on the preference vector and the feature of each node.

[0048] Specifically, a series of graph embedding layers and semantic attention layers are used to obtain the final high-level representation for each user. In particular, we first obtain the feature representation of each node in all relational subgraphs through multiple GNN-based graph embedding layers. Then, we aggregate the feature representations of each node to finally achieve embedding based on a semantic attention network, resulting in the final representation.

[0049] Among them, the graph embedding layer based on GNN is used. Graph Neural Networks (GNNs) are a deep learning framework that embeds structural information of nodes by aggregating the features of neighboring nodes. In this module, we first construct a graph embedding layer based on GNN to obtain each relational subgraph G. r Feature representation of a specific node in the middle:

[0050]

[0051] in It is a node v i The set of one-hop adjacency subgraphs, Represents node v j The representation of the (l-1)th layer in the GNN. We use... As the initial representation of the zeroth layer, we can obtain the node v of the lth layer in the GNN. i The representation of:

[0052]

[0053] in and These are parameters that need to be learned. Used as node v i Representation in GNN-based graph embeddings.

[0054] The semantic attention layer obtains the representation of each user node in multiple relation graphs through multiple GNN-based embedding layers. Based on the assumption that relations have different importance, we employ a semantic attention layer to fuse all representations of each user node. First, we introduce a relation preference vector for relation r. For node v i The representation z on a specific relation r r (v i Its weight depends on a r and z r (v i The similarity between ) is determined. To obtain the weights, the d-dimensional representation vector z is first... r (v i Transform into a d′-dimensional representation vector h r (v i )

[0055] h r(v i )=σ(W r ·z k (v i )+b r );

[0056] Where σ() is a nonlinear function, tanh is used in this invention. Calculate a r and z r (v i Similarity between )

[0057]

[0058] Where ||·|| denotes the L2 normalization of the vector. This is related to the assignment to node v. i The weights on relation r are standardized using softmax as follows:

[0059]

[0060] Finally, the node v in all relations is obtained. i The final representation is

[0061]

[0062] In some examples, obtaining an initial user classification model based on the final representation of each node includes: training the initial user classification model for each domain separately based on the final representation of each node.

[0063] In some examples, the method further includes training a robot detection classification model for each domain based on the final representation of each node.

[0064] Among them, the final representation z of each user node v is obtained. v Existing methods generally treat the detection task as a binary classification task, inputting the node representation into a multi-layer fully connected neural network structure to obtain the predicted value:

[0065]

[0066] Where σ(·) represents the activation function, This is the predicted label for node v. In social networks, anomalous users from different domains exhibit significant differences, leading to poor classification performance. Therefore, we propose a domain-aware classifier to improve detection performance. First, for each domain… Train a social network bot detection classifier as a bot detection and classification model;

[0067] P d (v) = softmax(W)d ·z v +b d ).

[0068] Where P d (v) represents the probability that node v is an anomalous user in the neighborhood d. Then, the anomalous probability for node v can be obtained as:

[0069]

[0070] Where M is the number of domains. Similarly, a classifier for normal users is trained as the initial user classification model;

[0071] P h (v) = softmax(W) h ·z v +b h ).

[0072] Where P h (v) represents the probability that node v is a normal node. Therefore, a predicted label can be obtained. And determine the probability of ultimately predicting someone as an anomalous user:

[0073]

[0074] In some examples, feature sample data is obtained through a federated learning network framework, and the initial user classification model is trained based on the feature sample data to obtain a user classification model. This includes: obtaining the feature sample data through a social platform under the federated learning network framework, calculating the model gradient for the feature sample data, and obtaining gradient information; sending the gradient information to a writing platform under the federated learning network framework, aggregating the gradient information through the writing platform, performing a weighted average, and sending the weighted average gradient information to the social platform; and iterating the initial user classification model through the social platform based on the weighted average gradient information to obtain the user classification model.

[0075] Understandably, due to data privacy concerns, data cannot be collected from multiple social network services for centralized model training. Therefore, a federated learning strategy is adopted. Federated learning can be mainly divided into three categories: horizontal federated learning, vertical federated learning, and federated transfer learning. Horizontal federated learning, or sample joint learning, is suitable for situations with high feature overlap and low sample overlap; vertical federated learning, or feature joint learning, is suitable for situations with low feature overlap and high sample overlap; federated transfer learning is suitable for situations with low feature overlap and low user overlap.

[0076] Faced with the complex, ever-changing, and difficult-to-prevent abnormal users on social networks, relying on a single platform is insufficient. It is necessary to unite various social platforms to make data analysis more comprehensive and improve the accuracy of abnormal user identification. Social platforms possess data with similar characteristics, and their customer groups generally have little overlap. Therefore, anomaly user detection models can be built through horizontal federated learning.

[0077] In a federated learning network framework, each client retains complete data locally and has its own initialized model. Each client can train the model independently using its local data, but because the data from different clients differs, the trained models will have varying parameters. These different model parameters are uploaded to the cloud. After the cloud updates and aggregates the model parameters, each client can download the new model for training. This process iterates repeatedly until the entire training result converges. This distributed approach to model training reduces the pressure on network communication and also ensures that user data is not leaked.

[0078] Suppose K social network platforms participate in each round of federated learning, and the k-th participant calculates the local average gradient of the model in round t.

[0079] g k =ΔF k (ω t )

[0080] Where ω t These are the global parameters downloaded from the server in round t. Each client updates its local parameters accordingly.

[0081]

[0082] Then, the server aggregates the data uploaded by each client participant.

[0083]

[0084] Where n k It is the data size of the kth participant.

[0085] The overall operation process is as follows:

[0086] Step 1: Each social platform uses a multi-relationship graph neural network algorithm (such as logistic regression) locally to calculate the model gradient on the above-mentioned communication behavior feature sample dataset, and uses encryption technologies such as homomorphic encryption, differential privacy or secret sharing to encrypt the gradient information before sending it to the collaboration platform.

[0087] Step 2: The collaboration platform securely aggregates the encrypted gradient information received from various social platforms, performs a weighted average, and then sends the calculated gradient information to the platform.

[0088] Step 3: After receiving the encrypted gradient information, each platform decrypts it to obtain the plaintext gradient and updates the local model parameters.

[0089] Step 4: After multiple iterations, when the model converges or reaches the maximum allowed number of iterations, training and model evaluation are complete, and the model can be used for online prediction of abnormal users.

[0090] Using privacy-preserving techniques such as secure multi-party computation to encrypt gradient information or model parameters during federated learning can prevent data leakage and protect user privacy. As people become increasingly reliant on the internet, more and more private information is being uploaded and stored online. Therefore, privacy snooping has shifted from offline to online, leading to a surge in malicious attacks targeting privacy and security. To address this situation, a network protection mechanism is needed to safeguard user privacy. To improve the system's detection success rate and efficiency, it is necessary to modify traditional intrusion detection systems to achieve multi-party system data sharing under privacy-preserving conditions. Therefore, a federated learning mechanism is introduced to share data among participating parties while protecting user privacy and security, coordinating joint modeling among the parties to improve the detection success rate and efficiency for all participants.

[0091] The household classification model training method provided in this embodiment has the following advantages:

[0092] (1) From an overall perspective, the model uses binary classification for abnormal user detection. As the number of training rounds increases, the accuracy gradually converges. The model can use multiple source data to train the same model and protect data privacy, so it is feasible in anomaly detection.

[0093] (2) From an individual perspective, the data in the dataset is randomly and uniformly divided into K parts, each representing the dataset owned by each user. The results show that, under the same dataset size, the recognition accuracy of the user detection model based on federated learning is higher than that of the abnormal user detection model trained only on local data. In the case of multi-class classification, due to the scarcity of data of certain types, each user's local dataset may have little or no data of that type. If the model is trained only on the local dataset, it will result in low model recognition accuracy or even failure to train the model, making the comparison more obvious. Therefore, under the same data size, users can obtain better recognition results by using the multi-relationship graph representation model based on federated learning, which fully verifies the feasibility of this model in the field of cross-Internet abnormal user detection.

[0094] In addition, this invention has the following three advantages:

[0095] (1) Adaptability: Given any number of relation graphs, adaptively select the optimal number of neighbors for each user node to aggregate;

[0096] (2) Universality: This model framework is not only applicable to the detection of abnormal users on the Internet, but can also autonomously calculate different adaptive neighbor numbers in other different tasks.

[0097] (3) High efficiency: By optimizing the model loss function and the calculation process, this invention improves computational efficiency through optimization of computation time and space.

[0098] This application also provides a user detection method, the method comprising: acquiring user data of a user;

[0099] The user data is input into the user model to determine whether the user is an abnormal user. The user model is trained using any of the user classification model training methods described above.

[0100] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0101] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments of the present invention, depending on actual needs.

[0102] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0103] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0104] The technical solutions provided by the embodiments of the present invention have been described in detail above. Specific examples have been used in this patent to illustrate the principles and implementation methods of the embodiments of the present invention. The descriptions of the embodiments above are only for helping to understand the principles of the embodiments of the present invention. The above descriptions are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A user classification model training method, characterized in that, The method comprises: constructing a multi-relation graph according to original user features; obtaining a feature representation of each node in the multi-relation graph, and deriving a final representation of each node based on the feature representation; obtain an initial user classification model based on the final representation of each node; specifically comprising: training a robot detection classification model for each field respectively based on the final representation of each node; training a robot detection classification model for each field respectively based on the final representation of each node training a social network robot detection classifier as the robot detection classification model: where represents a node In the field probability of an abnormal user, represents the final representation of each user node ; For node , the abnormal probability can be obtained: wherein is the number of domains; training the initial user classification model separately for each domain based on the final representation of each node: where represents a node is the probability of being a normal node; obtaining a predicted label and deciding the probability of the final prediction being an abnormal user: ； obtaining feature sample data through a federated learning network framework, and training the initial user classification model based on the feature sample data to obtain a user classification model.

2. The method of claim 1, wherein, The method comprises: constructing a multi-relation graph according to original user features, comprising:

3. The method of claim 2, wherein, generating a multi-relation graph based on the interaction behavior between users, the multi-relation graph comprising an original graph and a subgraph, the subgraph being generated by a subgraph generator according to the original graph. obtaining a feature representation of each node in the multi-relation graph, and deriving a final representation of each node based on the feature representation, comprising: obtaining the feature representation of each node in the subgraph through a graph embedding layer of a graph neural network; 4. The method of claim 1, wherein, setting a preference vector between each node, and calculating the final representation of each node based on the preference vector and the feature representation of each node. obtaining feature sample data through a federated learning network framework, and training the initial user classification model based on the feature sample data to obtain a user classification model, comprising: obtaining the feature sample data through a social platform under the federated learning network framework, and calculating model gradients for the feature sample data to obtain gradient information; sending the gradient information to a writing platform under the federated learning network framework, aggregating the gradient information through the writing platform, and sending the weighted average gradient information to the social platform after weighted averaging; 5. A user detection method characterized by, iterating the initial user classification model based on the weighted average gradient information through the social platform to obtain the user classification model. The method comprises: obtaining user data of a user; inputting the user data into a user model to determine whether the user is an abnormal user, the user model being trained by the user classification model training method of any one of claims 1-4.

Images