Malicious information detection method, device and system based on multi-feature fusion

Abstract

This invention belongs to the field of network information processing, specifically relating to a method, apparatus, and system for detecting malicious information based on multi-feature fusion. The method includes acquiring propagation information from a social network platform to obtain sentence-level semantic vectors and character-level semantic vectors of the source text and comment text; obtaining source text features and comment text features respectively; processing these features to obtain source text feature detection results and comment text feature detection results; constructing an information propagation tree between user nodes and their neighboring nodes based on user relationship attributes; constructing a propagation subgraph according to the information propagation tree; vectorizing the propagation subgraph to obtain propagation features; processing these features to obtain propagation feature detection results; and using a time-varying function-based fusion method to fuse the source text feature detection results, comment text feature detection results, and propagation feature detection results to detect malicious information. This invention can more accurately and earlier detect malicious information.

Description

Technical Field

[0001] This invention belongs to the field of network information processing and involves the propagation characteristics and text features of network information. It is used for the detection and analysis of malicious information in social networks, specifically involving a malicious information detection method, device and system based on multi-feature fusion. Background Technology

[0002] Malicious information refers to information that contradicts facts and possesses a certain degree of destructiveness. This type of information can mislead the public and affect their normal behavior. With the development of the internet, everyone can become a publisher and disseminator of information, resulting in a wide range of quality online. Furthermore, the rapid spread of malicious information can easily cause public panic. Traditional methods for detecting malicious information mostly rely on public reporting and official verification, which are time-consuming and ineffective in promptly stopping its spread. Therefore, identifying and blocking the spread of malicious information as early as possible has become an unavoidable challenge in the modern industrial information age.

[0003] In recent years, scholars both domestically and internationally have conducted in-depth research on malicious information from multiple perspectives, greatly enriching the theory of malicious information detection. The research mainly focuses on two aspects: detection data and detection methods. From the perspective of malicious information detection data, most researchers detect malicious information through relevant textual features, while some researchers attempt to analyze the topological structure of malicious information dissemination to obtain better detection results. From the perspective of malicious information detection methods, initially, researchers constructed, extracted, and selected features from data in social networks, using machine learning for malicious information detection. Later, to overcome the limitations of manual feature extraction, researchers used deep learning to obtain the inherent features of malicious information text and the dissemination patterns of malicious information.

[0004] Existing detection methods lack efficient text cleaning during the text analysis phase, potentially leading to large training datasets with low quality. Furthermore, they neglect the fact that words can have different meanings in different contexts during detection. In analyzing the propagation process, existing methods focus on the explicit structural features of the propagation tree itself, while implicit features of nodes (such as node influence) can more effectively improve detection accuracy. Finally, for the fusion of single-feature detection results, existing fusion techniques ignore the time-dependent impact on information features; a single fusion method cannot flexibly adjust feature weights according to the information propagation cycle. Therefore, although scholars both domestically and internationally have conducted extensive research on malicious information detection and achieved considerable results, several challenges remain.

[0005] 1. The polysemy of words in malicious information texts. Words in malicious information texts have different meanings in different contexts. Considering semantics, filtering text data and extracting the relationship features between texts becomes a major challenge.

[0006] 2. The periodicity of malicious information dissemination. The dissemination of malicious information has a breeding phase, a spread phase, and a disappearance phase. Therefore, determining the dissemination period of the detected text and extracting the inherent and transitional features of different periods has become a challenge in the analysis of the malicious information dissemination process.

[0007] 3. Timeliness and accuracy of malicious information detection. Malicious information detection relies on the text and propagation characteristics of the information; however, as malicious information spreads, the reliability of detection based on different features is affected by time. Analyzing the reliability of detection results from different features at different stages presents a major challenge for feature fusion. Summary of the Invention

[0008] To address the above challenges, considering that the text features of malicious information can meet the timeliness requirements of detection, and the propagation process can further improve the accuracy of detection, combining the text features and propagation features of information to detect malicious information has excellent performance. In this method, not only is the text and propagation structure of the information comprehensively analyzed, but the influence of time factors on features is also considered. This invention proposes a malicious information detection method, device, and system based on multi-feature fusion. This improves the accuracy of information detection. This invention performs semantic representation of the text content of malicious information. Considering semantics, invalid comment text in the information is filtered, making the trained text highly usable. Regarding the propagation cycle of information, this invention determines the propagation stage of information through the comment relationships between texts, realizing feature extraction for different diffusion stages of information. The extracted text features and propagation features of the information are analyzed to achieve preliminary detection of the information. Finally, the detection result of the information is determined by combining the credibility of the feature detection results. This invention can complete the detection of malicious information more accurately and earlier. It includes data acquisition, extraction of text features and propagation features of information for preliminary detection, and finally quantitative analysis of the credibility of the detection results of different features of the information.

[0009] In a first aspect, the present invention provides a method for detecting malicious information based on multi-feature fusion, the method comprising:

[0010] Obtain dissemination information from social networking platforms, wherein the dissemination information includes message text and user relationship attributes;

[0011] Semantic encoding is performed on the information text to obtain sentence-level semantic vectors for the source text and comment text, as well as character-level semantic vectors for the source text;

[0012] The source text features are obtained based on the character-level semantic vectors of the source text; the semantic relevance is obtained based on the sentence-level semantic vectors of the source text and the comment text, thus obtaining the comment text features.

[0013] The source text features and comment text features are processed to obtain the source text feature detection results and comment text feature detection results;

[0014] Based on user relationship attributes, an information propagation tree is constructed between user nodes and their neighboring nodes. A propagation subgraph is constructed according to the information propagation tree. The propagation subgraph is vectorized to obtain the propagation features.

[0015] The propagation characteristics are processed to obtain the propagation characteristic detection results;

[0016] A time-varying function-based fusion method is used to integrate the source text feature detection results, comment text feature detection results, and propagation feature detection results to detect malicious information.

[0017] In a second aspect, the present invention also provides a malicious information detection device based on multi-feature fusion, the detection device comprising:

[0018] The data acquisition module is used to acquire dissemination information from social networking platforms, including information text and user relationship attributes.

[0019] The text analysis module is used to semantically encode the information text, obtaining sentence-level semantic vectors for the source text and comment text, as well as character-level semantic vectors for the source text; it obtains source text features based on the character-level semantic vectors of the source text; and it obtains semantic relevance and comment text features based on the sentence-level semantic vectors of the source text and comment text.

[0020] The text detection module is used to process the features of the source text and the comment text to obtain the source text feature detection results and the comment text feature detection results;

[0021] The propagation analysis module processes the source text features and comment text features to obtain the source text feature detection results and comment text feature detection results; based on user relationship attributes, it constructs an information propagation tree between user nodes and their neighboring nodes, constructs a propagation subgraph according to the information propagation tree, and vectorizes the propagation subgraph to obtain the propagation features;

[0022] The propagation detection module is used to process propagation features and obtain propagation feature detection results;

[0023] The time-varying fusion module is used to fuse the source text feature detection results, comment text feature detection results, and propagation feature detection results using a time-varying function-based fusion method to detect malicious information.

[0024] In a third aspect, the present invention also provides a malicious information detection system based on multi-feature fusion, including one or more malicious information detection devices as described in the second aspect of the present invention.

[0025] The beneficial effects of this invention are as follows: This invention comprehensively analyzes the textual and propagation characteristics of information, better meeting the requirements of timeliness and accuracy in information detection. In the text analysis stage, semantic encoding of the text is performed using the BERT model, improving the accuracy of text representation. Based on semantic encoding, the sim function is used to filter invalid comment text information, improving the reliability of the detected text and making the trained text highly usable. Regarding the information propagation cycle, this invention determines the propagation stage of information through the comment relationships between texts, achieving feature extraction for different propagation stages. In the construction of the propagation subgraph, traditional mean pooling and max pooling cannot reflect the different influences of nodes. This method utilizes the influence of nodes to adopt adaptive pooling to obtain a vectorized representation of the subgraph, making the pooling results more representative. Finally, the feature detection results are fused according to a time-varying function to obtain different weights of features at different time periods, improving the flexibility of information detection while ensuring accuracy. This invention can more accurately and earlier detect malicious information. Attached Figure Description

[0026] Figure 1 This is a flowchart of a malicious information detection method based on multi-feature fusion in an embodiment of the present invention;

[0027] Figure 2 This is a text feature analysis diagram in an embodiment of the present invention;

[0028] Figure 3 This is an analysis diagram of the propagation characteristics in an embodiment of the present invention. Detailed Implementation

[0029] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] like Figure 1 The diagram shown is the overall framework of this invention, indicating that the input of this invention is the text of the information and the comment and forwarding relationship between users, and the output after the detection model is whether the information belongs to malicious information.

[0031] In this embodiment of the invention, a malicious information detection method based on multi-feature fusion is provided, such as... Figure 1 As shown, the method includes:

[0032] Obtain dissemination information from social networking platforms, wherein the dissemination information includes message text and user relationship attributes;

[0033] Semantic encoding is performed on the information text to obtain sentence-level semantic vectors for the source text and comment text, as well as character-level semantic vectors for the source text;

[0034] The source text features are obtained based on the character-level semantic vectors of the source text; the semantic relevance is obtained based on the sentence-level semantic vectors of the source text and the comment text, thus obtaining the comment text features.

[0035] The source text features and comment text features are processed to obtain the source text feature detection results and comment text feature detection results;

[0036] Based on user relationship attributes, an information propagation tree is constructed between user nodes and their neighboring nodes. A propagation subgraph is constructed according to the information propagation tree. The propagation subgraph is vectorized to obtain the propagation features.

[0037] The propagation characteristics are processed to obtain the propagation characteristic detection results;

[0038] A time-varying function-based fusion method is used to integrate the source text feature detection results, comment text feature detection results, and propagation feature detection results to detect malicious information.

[0039] In another embodiment of the present invention, the present invention may include the following three steps:

[0040] S1: Online Data Acquisition. This can be done by acquiring data from publicly available data websites or by utilizing mature social network public APIs. What's needed here is information on all participants' forwarding and commenting activities throughout the information's lifecycle. Information participation records require the time the information was forwarded and commented on, basic information about the participating users, and their friend relationship information.

[0041] S2: Obtain information-related attribute features. Based on the obtained information, mark the source text and comment text of the information, extract the basic information and following lists of participating users, and construct the information propagation tree structure based on the forwarding and comments among users.

[0042] S3: Model Building. First, the labeled information text is semantically represented using the BERT model. A sim algorithm is designed to filter invalid data, and two TextCNNs are used to obtain the textual features and comment features of the information. Then, a GCN is used to obtain the graph vectors of the information propagation subgraph to represent the propagation stages, and an RNN is used to obtain the transition features of each propagation stage. Finally, the impact of time factors on the detection of individual features is considered, and the results are fused.

[0043] Step S1 above obtains the data source. It mainly consists of the following two steps.

[0044] S11: Obtain the raw data. Raw data can be obtained through public social network APIs or by directly downloading existing data sources.

[0045] S12: Simple Data Cleaning. Raw data is often unstructured and cannot be directly used for data analysis. Simple data cleaning can structure most unstructured data. For example, this includes removing duplicate data and cleaning up invalid information.

[0046] The above step S2 obtains the relevant attributes. It mainly consists of the following two steps.

[0047] Detecting the malice of information essentially involves extracting relevant features from both the textual and propagation levels of the information and then modeling and analyzing these features. This paper focuses on the source text of the information, user comments on the source text, and the forwarding structure of the information to uncover key features of malicious information, as detailed below:

[0048] S21: For each character in the message text, represent it using a corpus provided by Google. Add a [CLS] flag at the beginning of each sentence in the message text to indicate the start of a sentence, and add a [SEP] flag to indicate the end of a sentence.

[0049] S22: The propagation structure of information can be viewed as a directed graph with a root node. This method constructs a propagation graph with users as nodes and forwarding and commenting between users as edges, and uses the hierarchical structure of the propagation graph to represent the propagation stages of information. The construction process of the propagation graph is as follows: a unique ID represents a message, and Sid represents the ID of the commented and forwarded message. If the Sid of a message is empty, it indicates that it is the source text. The topology formed by the message ID and Sid constitutes the propagation graph. To integrate more information into the propagation graph, this method adds attributes such as the number of followers and the number of people following, in addition to using the user's text information. Due to the large number of information interactors, the propagation tree structure becomes too large. Therefore, this method uses the sim algorithm described below to filter users with low relevance comments based on the user's comment text, thus pruning the propagation tree.

[0050] The above step S3 establishes the model. It mainly consists of the following three steps.

[0051] The model mainly consists of three stages: text feature analysis, propagation feature analysis, and fusion of single feature detection results. In the first stage, the BERT model is used to semantically encode text information. The Sim algorithm is designed to filter invalid text based on semantics. After obtaining valid data, two TextCNNs are used to obtain the text features of the information and the relationship features with the comment text for text detection. In the second stage, the subgraphs G' of the propagation graph are used to represent the propagation stages of information, and GCN is used to obtain the representation vector G of the subgraphs. m The specific process is as follows: First, the various user features are fused into a long vector, which serves as the initialization vector for the nodes. Then, the node vector and the adjacency matrix of the graph are used as inputs to the GCN to update the node vector representation. Finally, pooling operations are used to extract the graph representation vector. In the third stage, the detection results of text features and propagation features are used as inputs, and a time-varying function is used to fuse the single detection results.

[0052] S31: Extraction and detection of text features.

[0053] S311: Semantic representation of text

[0054] BERT is a language representation model pre-trained using MLM (mask language model) and NSP (Next Sentence Prediction). This model has strong generalization ability and applies transfer learning to the field of natural language processing. The text representation obtained in the previous stage is processed through three embedding layers to obtain the input vector x. x is calculated as follows:

[0055] x = x segment +x position +x token

[0056] That is, the input vector x of the word is composed of the word vector x of the information. segment Text vector x position and position vector x token It is obtained by summing the elements.

[0057] BERT's multi-layered Transformer allows the model to encode words considering the context. Each Transformer layer consists of a multi-head self-attention mechanism, residual connection layers, and regularization layers. The multi-head attention mechanism performs weighted fusion of all characters in the information to obtain an enhanced semantic vector for each character. The residual connection layers directly add the input and output of the module, thereby reducing the network's training time. BERT only needs to focus on the encoding part of the Transformer.

[0058] The BERT model can obtain both character-level and sentence-level vectors. In the model presented in this paper, in addition to inputting the semantic vectors of the information sentence level into TextCNN to obtain the source text features, character-level vectors are also needed to calculate the semantic relevance between the comment text and the source text. The execution process is as follows: first, a sentence vector matrix is ​​constructed based on the character augmentation vectors of the information and the comment; then, the sim algorithm function is used to calculate the similarity between the character vectors of the information and the comment.

[0059] S312: Using text semantics to design a Sim algorithm to filter invalid text

[0060] After obtaining the semantic representation of the text using the BERT model, this paper uses sim to calculate the relevance between the source text and the comment text. A larger value of sim(St,Ct) indicates a stronger relevance between the two texts. The calculation formula is as follows:

[0061]

[0062] A relevance matrix K is constructed based on the word vector sets of the source text St and the comment text Ct. Considering that the importance of words in the text varies, this method employs an attention mechanism to obtain the importance score w of each character in the text. i k i This represents the relevance between words, calculated through the dot product of character vectors. For example, given short texts A = (a1, a2, a3, a4) and B = (b1, b2, b3, b4), the relevance is calculated by... i The dot product of the word vectors in B and a yields the result of the product of the word vectors in B and a. i Most similar word b j This value is related to w i The product of k forms the elements k in K. ij Then, select the largest element k from K in sequence. (i) nm until all words in the source text have been traversed, using k (i) nmThe relevance between two texts is represented by the average of their relevance scores. After ranking the relevance scores, the top 70% are used as input for downstream tasks. This method introduces an attention mechanism while considering word polysemy, which can fully combine the structural features of the text to improve the accuracy of similarity calculation, thereby improving the efficiency of training texts.

[0063] S313: Feature extraction and detection based on TextCNN.

[0064] TextCNN is a convolutional neural network model based on CNN, which can extract local features from the input matrix more efficiently. The TextCNN model consists of an input layer, convolutional layers, pooling layers, and an output layer. To simplify the model structure, the features are initially classified in the output layer.

[0065] The input to the TextCNN1 module is a matrix M1 composed of sentence-level vectors from the source text and the comment text, while the input to TextCNN2 is a matrix M2 composed of character-level vectors from the source text. In M1, rows represent the [CLS] augmented vectors including both the source and comment texts, and columns represent the dimension of the [CLS] sentence-level augmented vectors. In M2, rows represent the number of characters in the source text, and columns represent the dimension of the character-level augmented vectors. The convolutional layers extract features using three convolutional kernels, and the convolution calculation is as follows:

[0066] a i =f(W*M i:i+h-1 +b)

[0067] In the formula a i Let W represent the i-th feature extracted by the convolution kernel, W represent the parameter size in the network, b be the bias term, and M be the value of the convolution kernel. i:i+h-1 Representing the values ​​of vectors with different dimensions, this method uses the ReLU function as the activation function f. The feature vector A = [a1, a2, ..., a...] is obtained through convolution operations. n-h+1 Max pooling is used to extract generalized features of regions, that is, the largest feature value is selected to replace the region vector, and then these maximum values ​​are used to construct a new feature vector. After the text information is processed through multiple pooling operations to obtain the feature vector, the Sigmoid function is used to obtain the probability that the information is malicious. The function expression is as follows:

[0068]

[0069] Finally, gradient descent is used as the loss function to update the model parameters. At this point, the module's output contains the source text and the feature detection results after fusing the comments.

[0070] S32: Extraction and detection of propagation features.

[0071] S321: Obtain the representation vector G of each order of the propagation graph's subgraphs. m '

[0072] In this method, GCN uses three convolutional layers to obtain the connections between each node and its neighbors. The formula for a single-layer GCN is as follows:

[0073]

[0074] In the formula, H k Let represent the input of the Kth layer, n represent the number of graph nodes, D represent an n*n diagonal matrix, A represent the adjacency matrix of the graph, σ represent the activation function, and θ represent the learnable parameters. This convolution operation updates the vector representations of the nodes. Finally, to obtain the propagating subgraph G... m The representation vector ' needs to be aggregated from the node vectors in the graph into a single vector. This invention employs adaptive weighted pooling, and the adaptive process is as follows:

[0075] First, initialize the parameter k based on the number of nodes. i This represents the importance of nodes during the propagation process. Then, nodes are ranked according to their influence attributes, and at each stage of information propagation, nodes k that have not yet participated are ranked. i Assigning 0 to the importance parameter k of the participating nodes i Normalization is performed to obtain the node weight parameters w. i Finally, the weight parameter w i The pooling result is obtained by multiplying the results by the corresponding nodes, summing them, and then averaging the results, as shown below:

[0076]

[0077] y is the vector representation of the output subgraph, n is the number of nodes, w is the influence weight of the nodes, and I is the node feature vector. The initialized weight parameters will be iteratively optimized through gradient descent based on the downstream classification results until convergence.

[0078] S322: Analysis of the Characteristics of Information Dissemination

[0079] In certain situations, GCN embeds graphs with different topologies into the same representation vector. Therefore, this invention uses RNN to address this issue. m ` indicates that the vector is used for temporal augmentation. The RNN model passes the network state of the upper layer to the current input, and then uses the current network state as the input to the next state. Therefore, the stage-wise temporal augmentation vector obtained by this method fully considers the characteristics of the previous propagation structure.

[0080] The representation vectors G of each order of subgraphs obtained in the previous section mAs the input vector of the RNN, the information extracted from each propagation stage is fed forward through the transition function T, carrying the state vector S. The vector y is the temporal enhancement vector for each propagation stage. The specific working process of a single-layer RNN is as follows: at each time step t, the RNN generates a new state vector S. t :

[0081] h t =τ(x) t ,h t-1 )

[0082] Then use s t Calculate the output y t :

[0083] y t =f(x) t ,s t )

[0084] In the formula, τ is the state transition function of the RNN, and f is the output function of the RNN. To enhance the representational power of the model, the RNN in this paper adopts a 3-layer structure in space. We call the matrix composed of the outputs y the Global Propagation Feature Matrix (GPM). Finally, the GPM matrix is ​​used as the input of the classifier to obtain the classification result of the information detection.

[0085] S33: Fusion of single feature detection results:

[0086] This invention considers that the detection accuracy of different features is affected by time factors. That is, as the information propagation structure continuously improves over time, the detection accuracy of the feature also increases. However, the feature values ​​of the source text do not change over time. Therefore, in the feature fusion process, the detection weight of the information propagation structure should be increased compared to the detection weight of the text. Thus, this paper proposes a fusion method based on a time-varying function.

[0087] S331: Feature Fusion Design Concept:

[0088] The main design idea of ​​this method is: based on the topological structure of information propagation, the current propagation stage of the information can be determined. As mentioned above, we use the propagation stage of information to represent time t. In parts s1 and s2, we can obtain the text detection result f1, the text comment detection result f2, and the propagation structure detection result f3. Therefore, the detection formula is:

[0089] L=F(R(f1,f2,f3,t))

[0090]

[0091] F = Re Lu(x)

[0092] In the formula, L represents the label attribute of the information. A, B, and C are the detection weights of the features, and are the parameters to be trained. As shown in the formula, the time variation factors of weights A, B, and C are (zt), respectively. Considering the temporal consistency between information dissemination and comment generation, the same time factor is assigned to reduce training complexity. As t increases, the weight A decreases relative to B and C to ensure that the weight of the source text decreases over time while the weight of the propagation feature increases over time. Simultaneously, this method introduces a parameter z to adjust the degree to which weight A is affected by time. Finally, this method uses the ReLU function as the activation function.

[0093] S332: Method inputs and outputs:

[0094] As shown in the formula above, the input to this part is the information propagation stage t, the text detection features of the information, and the propagation feature value of the information. The output is the label attribute L∈(0,1) of the information. If the label of the information is 0, the information is benign; if the label of the information is 1, the information is malicious.

[0095] S34: Model Prediction Results

[0096] By utilizing the multi-feature detection result fusion output of this invention, the system can detect the malice of current information. Public opinion departments can detect the malice of information by analyzing its dissemination trends and text at each moment, and release corresponding debunking information based on the detection results, thereby achieving the fastest and most cost-effective suppression of malicious information.

[0097] In this embodiment of the invention, a malicious information detection device based on multi-feature fusion is also provided, the detection device comprising:

[0098] The data acquisition module is used to acquire dissemination information from social networking platforms, including information text and user relationship attributes.

[0099] The text analysis module is used to semantically encode information text, obtain sentence-level semantic vectors of source text and comment text, as well as character-level semantic vectors of source text; obtain source text features based on character-level semantic vectors of source text; and obtain semantic relevance based on sentence-level semantic vectors of source text and comment text, thus obtaining comment text features.

[0100] The text detection module is used to process the features of the source text and the comment text to obtain the source text feature detection results and the comment text feature detection results;

[0101] The propagation analysis module processes the source text features and comment text features to obtain the source text feature detection results and comment text feature detection results; based on user relationship attributes, it constructs an information propagation tree between user nodes and their neighboring nodes, constructs a propagation subgraph according to the information propagation tree, and vectorizes the propagation subgraph to obtain the propagation features;

[0102] The propagation detection module is used to process propagation features and obtain propagation feature detection results;

[0103] The time-varying fusion module is used to fuse the source text feature detection results, comment text feature detection results, and propagation feature detection results using a time-varying function-based fusion method to detect malicious information.

[0104] In this embodiment of the invention, a malicious information detection system based on multi-feature fusion is also provided, including one or more malicious information detection devices described in the above embodiments.

[0105] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for detecting malicious information based on multi-feature fusion, characterized in that, The method includes: Obtain dissemination information from social networking platforms, wherein the dissemination information includes message text and user relationship attributes; Semantic encoding is performed on the information text to obtain sentence-level semantic vectors for the source text and comment text, as well as character-level semantic vectors for the source text; The source text features are obtained by analyzing the character-level semantic vectors of the source text; the semantic relevance is obtained by analyzing the sentence-level semantic vectors of the source text and the comment text, thus obtaining the comment text features. The source text features and comment text features are processed to obtain the source text feature detection results and comment text feature detection results; Based on user relationship attributes, an information propagation tree is constructed between user nodes and their neighboring nodes. A propagation subgraph is constructed according to the information propagation tree. The propagation subgraph is vectorized to obtain the propagation features. The propagation characteristics are processed to obtain the propagation characteristic detection results; A time-varying function-based fusion method is used to fuse the source text feature detection results, comment text feature detection results, and propagation feature detection results to detect malicious information. The fusion method based on the time-varying function to fuse the text feature detection results and propagation feature detection results includes determining the propagation stage of the current information text according to the topology of the information propagation tree, and fusing the text feature detection results and propagation feature detection results with adaptive weights according to the propagation stage of the current information text.

2. The malicious information detection method based on multi-feature fusion according to claim 1, characterized in that, Based on user relationship attributes, an information propagation tree is constructed between user nodes and their neighboring nodes. A propagation subgraph is constructed according to the information propagation tree. The propagation subgraph is vectorized to obtain propagation features, including constructing a propagation subgraph with users of the social network platform as nodes, user influence attributes as edge weights, and forwarding and commenting between users as edges.

3. The malicious information detection method based on multi-feature fusion according to claim 1, characterized in that, The semantic relevance is obtained by using sentence-level semantic vectors of the source text and comment text. The features of the comment text include generating a relevance matrix based on the semantic vectors of the source text and comment text, calculating the semantic relevance of the source text and comment text based on a similarity function, and filtering out comment texts with low relevance.

4. The malicious information detection method based on multi-feature fusion according to claim 3, characterized in that, The process of calculating the semantic relevance between source text and comment text based on the similarity function includes: calculating the importance score of each character in the source text through an attention mechanism; calculating the relevance using the dot product between the character-level semantic vectors of each source text and comment text; establishing a relevance matrix based on the importance scores and relevance of the character-level semantic vectors of the source text and comment text; sequentially selecting the largest element corresponding to each comment text in the relevance matrix, removing the source text character corresponding to the largest element, until all source text characters have been traversed; and using the average of the largest elements corresponding to all comment texts to represent the relevance between the source text and comment text.

5. The malicious information detection method based on multi-feature fusion according to claim 1, characterized in that, The process of processing the propagation features to obtain the propagation feature detection results includes using an adaptive weighted pooling method to sort user nodes according to their user influence, assigning different pooling weight parameters to user nodes, and aggregating the user node vectors in each propagation subgraph into a single vector according to the corresponding pooling weight parameters.

6. The malicious information detection method based on multi-feature fusion according to claim 1, characterized in that, The fusion formula is expressed as: Where R(f1,f2,f3,t) represents the fusion function based on the time-varying function, t represents the current propagation stage of the information text, f1 represents the source text feature detection result, f2 represents the comment text feature detection result, f3 represents the propagation feature detection result; z represents the degree to which the feature is affected by time, A is the detection weight of the source text feature, B is the detection weight of the comment text feature, and C is the detection weight of the propagation feature, all of which are parameters to be trained.

7. A malicious information detection device based on multi-feature fusion, the device being used to execute the malicious information detection method based on multi-feature fusion as described in any one of claims 1 to 6, characterized in that, The detection device includes: The data acquisition module is used to acquire dissemination information from social networking platforms, including information text and user relationship attributes. The text analysis module is used to semantically encode the information text, obtaining sentence-level semantic vectors for the source text and comment text, as well as character-level semantic vectors for the source text; it obtains source text features based on the character-level semantic vectors of the source text; and it obtains semantic relevance and comment text features based on the sentence-level semantic vectors of the source text and comment text. The text detection module is used to process the features of the source text and the comment text to obtain the source text feature detection results and the comment text feature detection results; The propagation analysis module processes the source text features and comment text features to obtain the source text feature detection results and comment text feature detection results; based on user relationship attributes, it constructs an information propagation tree between user nodes and their neighboring nodes, constructs a propagation subgraph according to the information propagation tree, and vectorizes the propagation subgraph to obtain the propagation features; The propagation detection module is used to process propagation features and obtain propagation feature detection results; The time-varying fusion module is used to fuse the source text feature detection results, comment text feature detection results, and propagation feature detection results using a time-varying function-based fusion method to detect malicious information.

8. A malicious information detection system based on multi-feature fusion, characterized in that, It includes one or more malicious information detection devices as described in claim 7.

Images