A method, system, electronic device and storage medium for determining an information dissemination source

Abstract

The present application discloses a method, a system, an electronic device and a storage medium for determining an information dissemination source, and the technical field to which it belongs is data analysis technology. The method for determining the information dissemination source includes: receiving a dissemination source tracing request, and determining a candidate set according to the dissemination source tracing request; wherein, all devices include the devices in the candidate set and the devices not in the candidate set; determining the starting time t when none of the devices in the candidate set is in an infected state s ; querying all communication events of all devices from the starting time t s to the cut-off time t e , and sequentially performing decision operations on each communication event by an agent in chronological order to obtain the dissemination trajectory of the target information; determining the information dissemination source according to the dissemination trajectory. The present application can improve the tracing accuracy of the information dissemination source.

Description

Technical Field

[0001] The present application relates to the technical field of data analysis, and particularly relates to a method, a system, an electronic device, and a storage medium for determining an information dissemination source. Background Art

[0002] The spread of viruses (computer viruses, biological viruses), rumors, pollutants, etc. has brought great uncertainties to the stable development of the social and economic order. Source tracing (i.e., tracing the origin) is an important means to block the spread. For example, all devices in a certain computer intranet form a group, and the external environment consists of all factors that may introduce viruses into the intranet. The device that introduces the virus from the external environment is the source of spread. After tracing the source of spread, analyze the potential vulnerabilities therein, and find out the mechanism by which the virus enters the intranet from the external network, so as to block the virus from invading the intranet again from the external network. In related technologies, a source tracing algorithm based on structural information entropy is usually used to determine the source of spread, but the tracing accuracy of the above method is relatively low.

[0003] Therefore, how to improve the tracing accuracy of the information dissemination source is a technical problem that those skilled in the art need to solve at present. Summary of the Invention

[0004] The purpose of the present application is to provide a method, a system, an electronic device, and a storage medium for determining an information dissemination source, which can improve the tracing accuracy of the information dissemination source.

[0005] To solve the above technical problem, the present application provides a method for determining an information dissemination source, and the method for determining an information dissemination source includes:

[0006] Receiving a source tracing request for the dissemination source, and determining a candidate set according to the source tracing request; wherein, the candidate set includes all devices that are in an infected state at the cut-off moment t e The device in the infected state is a device that has received the target information;

[0007] Determining the starting moment t when all devices in the candidate set are not in an infected state s ;

[0008] Querying all communication events of all devices from the starting moment t s to the cut-off moment t e , and sequentially performing decision operations on each communication event by an agent in chronological order to obtain the dissemination trajectory of the target information; wherein, the i-th communication event is that device u i transmitted data to device v at moment t i , and the decision operation corresponding to the i-th communication event includes: determining whether there is a device in the candidate set that has received the data transmitted by device u at moment t i ; the decision operation corresponding to the i-th communication event includes: judging whether there is a device in the candidate set that has received the data transmitted by device u at moment t i-1 to t iWhether the devices in the candidate set are infected by external infection sources within a time period, t0 = t s ; If device u i has been determined to be in an infected state by the agent before the current decision operation and device v i has not been determined to be in an infected state, then the decision operation corresponding to the i-th communication event further includes: determining whether device v i is infected by u i at time t i .

[0009] Determine the information dissemination source according to the propagation trajectory.

[0010] Optionally, determining the candidate set according to the propagation source trace request includes:

[0011] Parsing the propagation source trace request to obtain the target information and the cut-off time t e ;

[0012] Constructing the candidate set according to the target information and the cut-off time t e .

[0013] Optionally, constructing the candidate set according to the target information and the cut-off time t e includes:

[0014] Determining the target device that received the target information at the cut-off time t e ;

[0015] Constructing the candidate set including all the target devices.

[0016] Optionally, determining the starting time t s when all the devices in the candidate set are not in an infected state, includes:

[0017] Taking the cut-off time t e as the starting point to trace the device scan records forward, and using the device scan records to determine the starting time t s when all the devices in the candidate set are not in an infected state.

[0018] Optionally, before the agent sequentially executes the state decision operations on each communication event in chronological order, it further includes:

[0019] Setting the environmental state so that the agent executes the decision operation according to the environmental state.

[0020] Optionally, it further includes:

[0021] After the agent executes a decision operation on a communication event, updating the environmental state.

[0022] Optionally, the intelligent agent is used to sequentially perform decision-making operations on each of the communication events in chronological order to obtain the propagation trajectory of the target information, including:

[0023] Using the intelligent agent to sequentially perform the decision-making operations on each of the communication events in chronological order;

[0024] Determine the benefit value of each decision-making operation, and calculate the total benefit of the alternative trajectory according to the total benefit calculation formula;

[0025] Set the alternative trajectory with a total benefit greater than the preset benefit value as the propagation trajectory of the target information.

[0026] Optionally, calculating the total benefit of the alternative trajectory according to the total benefit calculation formula includes:

[0027] Calculate the total benefit of the alternative trajectory according to the total benefit calculation formula;

[0028] Among them, the total benefit calculation formula is represents the total benefit, K represents the total number of communication events, r i is used to describe the probability that the device is infected during the time period from t i-1 to t i , r end is used to describe the probability that a device in the candidate set that has not been determined to be in an infected state by the intelligent agent is infected by external factors during the time period from t K to t e , and r penalty represents the misjudgment penalty value.

[0029] Optionally, it further includes:

[0030] Determine the first type of benefit value r 2i-1 and the second type of benefit value r 2i ; among them, the first type of benefit value r 2i-1 is positively correlated with the probability that the device in the candidate set is infected by an external infection source during the time period from t i-1 to t i , and the second type of benefit value r 2i is positively correlated with the probability that the target information is propagated through the i-th communication event at time t i ;

[0031] Take the logarithm of the probability that a device in the candidate set that has not been determined to be in an infected state by the intelligent agent is infected by external factors during the time period from t K to t e as the third type of benefit value r end ;

[0032] After the agent executes the decision operation on all the communication events, set the number of devices that are not in the candidate set and are determined by the agent to be in an infected state as the misjudgment number;

[0033] Determine the misjudgment penalty value r according to the misjudgment number penalty .

[0034] Optionally, before sequentially executing the decision operation on each of the communication events by the agent in chronological order, it further includes:

[0035] Train the decision network of the agent; wherein, the decision network is obtained by combining the Structure2Vector model and a recurrent neural network; wherein the inputs required for training the decision network include: communication logs, the initial policy parameters of the agent, the number of iterations, the number of propagation trajectories generated by the agent in each iteration, and hyperparameters for calculating the baseline return;

[0036] Obtain the policy parameters obtained through pre-training, and set the policy parameters obtained through pre-training as the initial policy parameters of the agent.

[0037] Optionally, after training the decision network of the agent, it further includes:

[0038] Use the trained agent for policy inference, so as to sequentially execute the decision operation on each of the communication events by the trained agent in chronological order.

[0039] Optionally, query all communication events of all devices from the start time t s to the end time t e , including:

[0040] Read the communication logs of all devices, and query all the communication events from the start time t s to the end time t e according to the communication logs.

[0041] This application also provides a system for determining an information dissemination source, and the system includes:

[0042] A candidate set determination module, configured to receive a propagation source tracing request and determine a candidate set according to the propagation source tracing request; wherein, the candidate set includes all devices that are in an infected state at the end time t e , and the devices in the infected state are devices that have received the target information;

[0043] A time tracing module, configured to determine the start time t when none of the devices in the candidate set are in an infected state s ;

[0044] A decision-making module, configured to query all devices from the starting time t s to the ending time t e for all communication events, and sequentially perform decision-making operations on each of the communication events by using an agent in chronological order to obtain the propagation trajectory of the target information; wherein, the i-th communication event is that device u i transmits data to device v i at time t i , and the decision-making operation corresponding to the i-th communication event includes: determining whether the devices in the candidate set are infected by an external infection source during the time period from t i-1 to t i , where t0 = t s ; if device u i has been determined by the agent to be in an infected state before the current decision-making operation and device v i has not been determined to be in an infected state, then the decision-making operation corresponding to the i-th communication event further includes: determining whether device v i is infected by u i at time t i ;

[0045] A propagation source determination module, configured to determine the information propagation source according to the propagation trajectory.

[0046] The present application further provides a storage medium, on which a computer program is stored, and when the computer program is executed, the steps performed by the above-mentioned information propagation source determination method are implemented.

[0047] The present application further provides an electronic device, including a memory and a processor, where a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps performed by the above-mentioned information propagation source determination method are implemented.

[0048] The present application provides an information propagation source determination method, including: receiving a propagation source tracing request, and determining a candidate set according to the propagation source tracing request; wherein, the candidate set includes all devices that are in an infected state at the ending time t e , and the devices in the infected state are devices that have received the target information; determining the starting time t s when it is determined that all the devices in the candidate set are not in an infected state; querying all communication events of all devices from the starting time t s to the ending time t e , and sequentially performing decision-making operations on each of the communication events by using an agent in chronological order to obtain the propagation trajectory of the target information; wherein, the i-th communication event is that device u i transmits data to device v i at time t iData is transmitted, and the decision operation corresponding to the i-th communication event includes: determining whether the devices in the candidate set are infected by an external infection source during the time period from t i-1 to t i , where t0 = t s ; if device u i has been determined to be in an infected state by the agent before the current decision operation and device v i has not been determined to be in an infected state, then the decision operation corresponding to the i-th communication event further includes: determining whether device v i is infected by u i at time t i ; determining the information dissemination source according to the propagation trajectory.

[0049] This application determines the candidate set according to the received propagation source tracing request, and determines the start time t s and the end time t e for determining the propagation trajectory, and queries all communication events of all devices from the start time t s to the end time t e . This application uses the agent to sequentially execute decision operations on each of the communication events. Denote the i-th communication event as device u i transmitting data to device v i at time t i . For this event, the decision operation determines whether the devices in the candidate set are infected by an external infection source during the time period from t i-1 to t i , where t0 = t s . In addition, if u i has been determined to be in an infected state by the agent in the previous decision operation, the decision operation further includes determining whether v i is infected by u i and becomes infected at time t i . Through the above method, the decision-making process in the continuous time domain can be discretized into decisions at time periods and time points, and then the propagation trajectory of the target information and the information dissemination source can be obtained. The above method combines the communication time between devices and the propagation characteristics of information to determine the information dissemination source of the target information, which can improve the tracing accuracy of the information dissemination source. This application also provides a system for determining the information dissemination source, a storage medium, and an electronic device, which have the above beneficial effects and will not be elaborated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] To more clearly illustrate the embodiments of the present application, the following will briefly introduce the drawings required in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0051] Figure 1 It is a flowchart of a method for determining an information dissemination source provided by an embodiment of the present application;

[0052] Figure 2 It is a schematic diagram of the device state at time t provided by an embodiment of the present application e in an embodiment of the present application;

[0053] Figure 3 It is a schematic diagram of the device state in a candidate set provided by an embodiment of the present application;

[0054] Figure 4 It is a schematic diagram of the state of a device not in the candidate set provided by an embodiment of the present application;

[0055] Figure 5 It is a schematic diagram of the structure of a system for determining an information dissemination source provided by an embodiment of the present application;

[0056] Figure 6 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application;

[0057] Figure 7 It is a schematic diagram of the structure of a storage medium provided by an embodiment of the present application. Detailed implementation manners

[0058] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are some, but not all, of the embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts fall within the scope of protection of the present application.

[0059] Please refer to the following Figure 1 , Figure 1 which is a flowchart of a method for determining an information dissemination source provided by an embodiment of the present application.

[0060] The specific steps may include:

[0061] S101: Receive a dissemination source tracing request, and determine a candidate set according to the dissemination source tracing request;

[0062] Among them, this embodiment can be applied to a data analysis platform connected to a data center, and the data center includes multiple devices. The device administrator can scan the data center at a preset period (such as every 3 days). If the device administrator detects that a device has received the target information, a propagation source tracing request can be sent to the data analysis platform. For example, the device administrator performs a virus scan on the data center every 3 days. No virus is found during the scan on November 4, 2022, and a virus is found during the scan on November 7, 2022, indicating that the virus entered the data center between November 4, 2022, and November 7, 2022. The communication records between machines during this period are retrieved to perform the operation of determining the information propagation source of this embodiment.

[0063] After receiving the propagation source tracing request, the propagation source tracing request can be parsed to obtain the target information and the cut-off time t e , and then according to the target information and the cut-off time t e construct the candidate set. The above cut-off time t e can also be the time when the propagation source tracing request is received. The candidate set includes all devices in an infected state at the cut-off time t e . The devices in an infected state are devices that have received the target information, and the devices not in an infected state are devices that have not received the target information. Specifically, this step can determine the target devices that have received the target information at the cut-off time t e , and then construct the candidate set including all the target devices.

[0064] The above target information can be a virus, a rumor, or a pollutant (such as a picture or audio carrying bad information), and the content or type of the target information is not specifically limited here.

[0065] S102: Determine the starting time t s when all the devices in the candidate set are not in an infected state;

[0066] Among them, after determining the cut-off time t e , the starting time t s can be queried under the constraint conditions. The above constraint conditions are: t s is earlier than t e , and all the devices in the candidate set are not in an infected state at t s . As a feasible implementation manner, this step can trace back the device scan records forward from the cut-off time t e , and use the device scan records to determine the starting time t s when all the devices in the candidate set are not in an infected state.

[0067] S103: Query all devices from the starting time ts All communication events up to the cut-off time t e are used by the agent to perform decision-making operations on each communication event in chronological order to obtain the propagation trajectory of the target information;

[0068] Among them, from the start time t s to the cut-off time t e there are multiple communication events, and the occurrence time of the i-th communication event is t i . In this step, the communication logs of all devices in the candidate set can be read, and all the communication events from the start time t s to the cut-off time t e can be queried according to the communication logs. Among them, all devices include devices in the candidate set and devices not in the candidate set. The candidate set refers to all devices that are in the infected state at the cut-off time t e . The so-called "candidate" means that the device may be a propagation source.

[0069] After obtaining each communication event, this step can use the agent to perform decision-making operations on each communication event, so as to determine the propagation trajectory of the target information according to the results of the decision-making operations. The above agent can be an information trajectory analysis model.

[0070] Among them, the i-th communication event is that device u i transmitted data to device v i at time t i . The decision-making operation corresponding to the i-th communication event includes: judging whether the devices in the candidate set are infected by an external infection source during the time period from t i-1 to t i , t0 = t s ; if device u i has been determined by the agent to be in the infected state before the current decision-making operation and device v i has not been determined to be in the infected state, then the decision-making operation corresponding to the i-th communication event further includes: judging whether device v i is infected by u i at time t i ; t i represents the occurrence time of the i-th communication event. After the agent executes the above decision-making operations, the benefit value of each alternative trajectory can be obtained, and then the propagation trajectory of the target information can be determined according to the benefit value. The above alternative trajectory is determined according to the agent's decision on all communication events. If the agent determines that the device u in the candidate set is infected by an external infection source, then u is the propagation source; if the agent determines that the target information propagates from u to v, then the positions of u and v are adjacent in the alternative trajectory.

[0071] S104: Determine the information propagation source according to the propagation trajectory.

[0072] Among them, the propagation trajectory describes the transmission order of the target information between the external environment and each device. By the operations of this embodiment, at least one propagation trajectory can be determined. The device that introduces the target information from the external environment is the information propagation source. In this step, the first device in the propagation trajectory can be set as the information propagation source. Further, after determining the information propagation source according to the propagation trajectory, network security auditing operations can also be performed on the information propagation source.

[0073] This embodiment determines a candidate set according to the received propagation source traceback request, and determines the starting time t for determining the propagation trajectory s and the ending time t e , and queries all communication events of the devices in the candidate set from the starting time t s to the ending time t e . This embodiment uses an agent to sequentially perform decision-making operations on each of the communication events. Denote the i-th communication event as device u i transmitting data to device v i at time t i . For this event, the above decision-making operation determines whether the devices in the candidate set are infected by an external infection source during the time period from t i-1 to t i , where t0 = t s . In addition, if u i has been determined to be in an infected state by the agent in the previous decision-making operation, the decision-making operation further includes determining whether v i is infected by u i and becomes an infected state at time t i . Through the above method, the decision-making process in the continuous time domain can be discretized into decisions at time periods and time points, and then the propagation trajectory of the target information and the information propagation source can be obtained. The above method combines the communication time between devices and the propagation characteristics of information to determine the information propagation source of the target information, which can improve the traceability accuracy of the information propagation source.

[0074] As a further introduction to the Figure 1 corresponding embodiment, before sequentially performing state decision-making operations on each of the communication events using an agent in chronological order, the environmental state can also be set so that the agent performs the above decision-making operations according to the environmental state. Further, after the agent performs a decision-making operation on one of the communication events once, the above environmental state can also be updated.

[0075] As a further introduction to the Figure 1 corresponding embodiment, the process of using an agent to perform decision-making operations to obtain the propagation trajectory includes the following steps:

[0076] Step 1: Use the agent to sequentially perform the decision-making operation on each communication event in chronological order;

[0077] Step 2: Determine the benefit value of each decision-making operation, and calculate the total benefit of the alternative trajectory according to the total benefit calculation formula;

[0078] Specifically, the above total benefit calculation formula is

[0079] r total represents the total benefit, K represents the total number of communication events, r i is used to describe the probability that the device is infected during the time period from t i-1 to t i . Among them, t0 = t s . r end is used to describe the probability that a device in the candidate set that has not been determined to be in an infected state by the agent is infected by external factors during the time period from t K to t e . r penalty represents the misjudgment penalty value. In the scenario of the data center, all factors that can introduce viruses into the system are external factors. For example: the lessee of the server may introduce viruses by uploading files, and the device administrator may introduce viruses by using an infected USB flash drive. The above behaviors are all external factors.

[0080] Step 3: Set the alternative trajectory with a total benefit greater than the preset benefit value as the propagation trajectory of the target information.

[0081] In this embodiment, the alternative trajectory with the maximum total benefit can be used as the propagation trajectory of the target information, or the alternative trajectory with a total benefit greater than the preset benefit value can be used as the propagation trajectory of the target information.

[0082] As a feasible implementation manner, r i can be determined in the following way: Determine the first type of benefit value r 2i-1 and the second type of benefit value r 2i ; among them, the first type of benefit value r 2i-1 is positively correlated with the probability that the device in the candidate set is infected by an external infection source during the time period from t i-1 to t i , and the second type of benefit value r 2i is positively correlated with the probability that the target information is propagated through the i-th communication event at time t i .

[0083] The above embodiment can also determine r end in the following way: From t K to t eThe logarithm of the probability that a device in the candidate set is infected by external factors during a time period is used as the third type of return value r end 。

[0084] The above embodiment can also determine r in the following manner penalty : After the agent executes the decision operation on all the communication events, the number of devices that are not in the candidate set and are determined by the agent to be in an infected state is set as the misjudgment number; the misjudgment penalty value r is determined according to the misjudgment number penalty 。

[0085] As a further introduction to the corresponding embodiment Figure 1 Before sequentially executing the decision operation on each communication event by the agent in chronological order, the decision network of the agent can also be trained; wherein, the decision network is obtained by combining the Structure2Vector model and a recurrent neural network

[0086] Furthermore, before training the decision network of the agent, it also includes: inputting communication logs, the initial policy parameters of the agent, the number of iterations, the number of propagation trajectories generated by the agent during each iteration, and hyperparameters for calculating the baseline return to the algorithm for training the decision network

[0087] To improve the efficiency of training the agent, the above embodiment can obtain the policy parameters obtained through pre-training and set the pre-trained policy parameters as the initial policy parameters of the agent

[0088] After completing the training of the policy network of the agent, the trained agent can also be used for policy inference, so as to sequentially execute the decision operation on each communication event by the trained agent in chronological order

[0089] The following illustrates the process described in the above embodiment through a propagation source tracing scheme based on reinforcement learning in practical applications

[0090] The spread of viruses (computer viruses, biological viruses), rumors, and pollutants has brought great uncertainties to the stable development of the social and economic order. Viruses (note: without loss of generality, the spread of viruses, rumors, and pollutants is collectively referred to as virus spread in this embodiment) enter a group from the external environment and then spread in the group. The infection route of any individual in the group can be divided into: (1) being infected by contacting the external environment; (2) being infected by contacting other infected individuals in the group. Among them, the propagation source refers to an individual infected by contacting the external environment

[0091] In the related art, a source tracing algorithm based on structural information entropy is used to determine the information dissemination source. The disadvantages of the above source tracing algorithm based on structural information entropy for determining the information dissemination source are as follows: (1) The contact time between individuals is ignored. In actual scenarios, obtaining the contact time usually does not require additional costs. For example, a certain computer virus spreads through shared files, and the time when two devices share files can easily be obtained from the log. (2) The propagation characteristics of the virus are not utilized. For example, in an intranet, the more services that device u enables for external network access, the greater the probability that device u becomes a dissemination source. The more files shared between device u and device v, the greater the probability of mutual infection. These propagation characteristics can be estimated through expert experience or from historical data. (3) The manually designed source tracing strategy has limitations.

[0092] In view of the above disadvantages in the related art, this embodiment proposes a source tracing solution based on reinforcement learning, which can be used as an effective supplement to existing source tracing algorithms. Compared with existing source tracing algorithms, the source tracing algorithm proposed in this proposal improves the accuracy of source tracing from the following two aspects: (1) The source tracing problem is modeled as a sequential decision-making problem, and reinforcement learning is used to automatically learn the source tracing strategy to avoid the limitations of manual strategies. In particular, this proposal proposes an Evolve-S2V model based on the S2V (Structure2Vector) model as the state perception module of the intelligent agent. Compared with the S2V model, Evolve-S2V can dynamically generate a graph neural network in each decision operation to perceive the state in different decision operations. (2) The time when contact occurs and the propagation characteristics of the virus are fully utilized during the decision-making process. In particular, the reward function in the sequential decision-making problem is designed using the time when contact occurs and the propagation characteristics of the virus.

[0093] This embodiment models the source tracing problem as a sequential decision-making problem, incorporates the time when contact occurs and the propagation characteristics of the virus into the reward mechanism to improve the source tracing accuracy, and discretizes the decision-making process in the continuous time domain into decisions at time periods and time points. This embodiment proposes a learning process and an inference process for the source tracing strategy; models the state as a graph structure, and proposes an Evolve-S2V algorithm based on the S2V algorithm as the perception module of the intelligent agent to handle decisions with a finite number of steps and variable-length state graph sequences; this embodiment also proposes a specific implementation scheme for source tracing.

[0094] The decision-making process will be briefly introduced below in combination with a specific scenario. In a certain data center, at time t e the device administrator discovers a virus, and then diagnoses all devices to find all infected devices. Therefore, the information obtained by the device administrator at time t e is as Figure 2 shown, Figure 2 which is a schematic diagram of the device state at time t e provided by this embodiment of the application,Figure 2 shows all external factors that can introduce viruses, t e all devices in the infected state at time t (candidate set), and t e devices that are not infected at time t.

[0095] Assume that a device will remain in the infected state until it is repaired by the device administrator after being infected. Therefore, it is only necessary to find the source of transmission among the devices in the infected state (candidate set) at time t. This embodiment uses the communication records between devices over a period of time, and t e the status of all devices (infected or not infected) at time t to infer the source of transmission. To achieve this goal, this embodiment uses an agent trained by reinforcement learning to make decisions on the status of devices. Specifically, two decisions are made before and after each communication between devices. For example, in a certain communication, device v receives data from device u at time t, and the time interval from the last communication event between devices is Δt. Then the two decision operations are as follows: e Decision operation 1: Determine the status of devices in the candidate set that have not been determined to be in the infected state.

[0096] Decision operation 1: Determine the status of devices in the candidate set that have not been determined to be in the infected state.

[0097] Please refer to Figure 3 , Figure 3 which is a schematic diagram of the status of devices in a candidate set provided by an embodiment of the present application. Figure 3 shows all external factors that can introduce viruses, t e all devices in the infected state at time t (candidate set), t e devices that are not infected at time t. Figure 3 The circles with gray scale in it indicate the devices that have been determined to be in the infected state by the agent before the current decision operation, and the circles without gray scale indicate the devices that have not been determined to be in the infected state. In this decision operation, the agent only considers the devices in the candidate set that have not been determined to be in the infected state, and determines whether these devices are infected by external factors during the Δt time period. For the devices determined to be infected by external factors, the corresponding nodes are changed to circles with gray scale.

[0098] Decision operation 2: Judge the status of device v. If device v has not been determined to be in the infected state, and device u has been determined to be in the infected state in the previous decision operation, then the agent determines whether device v is infected by device u and becomes infected. Please refer to Figure 4 , Figure 4 which is a schematic diagram of the status of devices not in the candidate set provided by an embodiment of the present application. Figure 4 shows all external factors that can introduce viruses, t e all devices in the infected state at time t (candidate set), t e devices that are not infected at time t.

[0099] For each communication event, the above two decision-making operations are performed until decisions are made for all communication events. After this process is completed, the source of propagation is obtained. The above process can be repeated multiple times to improve the accuracy of tracing.

[0100] The decision-making process of the agent is driven by communication events. For each event, the agent makes two decisions. Therefore, for K communication events, there are a total of 2K decision-making operations. When the agent performs each decision-making operation, it judges the state changes of relevant devices. Therefore, the entire decision-making process of the agent corresponds to a propagation link of the virus. It is proportional to the probability of this propagation link occurring in the environment. r penalty represents the penalty that the agent receives for misjudging an uninfected node as an infected node, which is the penalty for misjudgment in the entire decision-making process. The communication event (u i , v i , t i ) indicates that device u i communicates with device v i at time t i . t i represents the occurrence time of the i-th communication event.

[0101] The entire decision-making process can be described as follows:

[0102] Let t s be the time when no device in the data center is infected;

[0103] In this embodiment, the decision-making process of the agent is as follows:

[0104] When observing the first communication event (u1, v1, t1), two decisions are made:

[0105] The first decision: Judge whether the nodes in the candidate set are infected by an external infection source during (t s , t1);

[0106] The second decision: Judge whether v1 is infected by u1 at time t1.

[0107] When observing the second communication event (u2, v2, t2), the third decision and the fourth decision are made.

[0108] The third decision: Judge whether the nodes in the candidate set are infected by an external infection source during (t1, t2);

[0109] The fourth decision: Judge whether v2 is infected by u2 at time t2.

[0110] And so on, until observing the last communication event

[0111] (u K , v K , t K ) make the (2K - 1)-th decision and the 2K-th decision.

[0112] (2K - 1)-th decision: Determine whether the nodes in the candidate set are infected by external infection sources in (t K-1 , t K );

[0113] 2K-th decision: Determine whether v K is infected by u K at time t K .

[0114] After completing 2K decisions, for the nodes in I that have not been infected, the agent defaults that these nodes are infected by external factors in (t K , t e ).

[0115] The symbol description of this embodiment is as follows:

[0116] O represents the population, that is, the set composed of all individuals;

[0117] Z0 represents all external (relative to the population) factors that can introduce the virus into O;

[0118] t s represents the initial time, and at this time no individual is infected;

[0119] t e represents the time when an infected individual is found;

[0120] I represents the set composed of all infected individuals at t e , that is, the candidate set;

[0121] λ u represents the infection rate of u through Z0;

[0122] T u represents the time point when u is infected through Z0;

[0123] p u，v represents the probability that v is infected when u is in an infected state and u contacts v;

[0124] R represents the set of real numbers.

[0125] The calculation of the rate λ u is related to the specific application scenario. For example, in a data center, the infection rate of a certain server is related to the ports opened on the server, the user group it faces, the frequency of user-uploaded data, etc.

[0126] The assumptions of this embodiment are as follows:

[0127] (1) An individual can be in an infected state or a non-infected state. Once an individual is infected, they will remain in the infected state continuously.

[0128] (2) Contacts are directed, i.e., (u, v, t) represents that u has a contact with v at time t (i.e., a communication event occurs), and the virus can only spread from u to v. For undirected contacts, they can be expressed by directed contacts (u, v, t) and (v, u, t).

[0129] (3) λ u and p u，v can both be estimated through expert experience and historical data.

[0130] (4) If at time t, individual u is in a non-infected state, then the probability Pr that u is infected through Z0 in [t, t + Δt] is:

[0131] The problem description of this embodiment is as follows:

[0132] At the initial time t s no individual is in an infected state, and at time t e it is found that there are infected individuals. Given the historical contact record Log = {(u, v, t): u ∈ O, v ∈ O, t ∈ [t s , t e}, given I, infer the source of infection, i.e., the individuals in I that are infected through Z0.

[0133] The problem modeling of this embodiment is as follows:

[0134] This embodiment models the source tracing problem as a sequential decision-making problem and uses reinforcement learning to automatically learn the source tracing strategy. In reinforcement learning, the agent observes the environmental state, selects an action based on the information obtained from the observation, and applies it to the environment to change the environmental state to obtain the corresponding reward. The agent repeats this process until it reaches the termination state. The goal of the agent is to maximize the cumulative reward obtained during the interaction with the environment. The following will describe the interaction process between the agent and the environment in the source tracing problem:

[0135] The decision-making task of the agent is to determine when an individual is infected, which is a decision-making problem in a continuous time domain.

[0136] For ease of calculation, this proposal transforms the decision-making problem in the continuous time domain into a decision-making problem in discrete time steps. The communication record Log contains a total of K contacts. Sort Log in the order of the occurrence of contacts: where t i < t j , As described above, there are two decision-making operations for each contact (communication event).

[0137] This proposal represents the environmental state using the graph G = (V, E, W, X), where:

[0138] (1) The node set V = {z0} ∪ O remains unchanged in all decision-making operations;

[0139] (2) The edge set E depicts the contacts between nodes in the current decision-making operation;

[0140] (3) W: E → R, W(e) represents the weight of edge e, depicting the probability of virus transmission through e;

[0141] (4) X: O → {0, 1}, X(u) = 0 indicates that the agent determines u to be in a non-infected state, and X(u) = 1 indicates that the agent determines u to be in an infected state.

[0142] The definition of the initial state G1 is as follows:

[0143] (1) V1 = V;

[0144] (2) E1 = {(z0, u): u ∈ I, X1(u) = 0};

[0145] (3) W1(z0, u) = Pr{T u ≤ t1|T u > t0}, where t0 = t s ;

[0146] (4) X1(u) = 0,

[0147] For 1 ≤ i ≤ K, after observing G 2i-1 the action set of the agent is where I 2i-1 = {u: u ∈ I, X 2i-1 (u) = 0} consists of all individuals in I that have not been determined to be in an infected state. Among them, denotes the power set of I 2i-1 The agent selects an action according to the policy π Applying A 2i-1 to the environment: determining all individuals in A 2i-1 to be in an infected state. The reward obtained from this step operation is: the probability that the virus spreads from Z0 to the individuals in A i-1 during the time period [t i and does not spread to the individuals in I 2i-1 \ A 2i-1 2i-1 2i-1 2i-1 2i-1 The individuals in A 2i-1 are described as follows:

[0148] If I 2i-1 ={1, 2}, it means that device 1 and device 2 have not been infected; is the action set of the agent, and the behaviors of the agent are the following 4 types:

[0149] It means that neither device 1 nor device 2 has been infected;

[0150] {1} means that device 1 is infected;

[0151] {2} means that device 2 is infected;

[0152] {1, 2} means that both device 1 and device 2 are infected;

[0153] A 2i-1 The individuals in it represent the infected devices.

[0154] I 2i-1 \A 2i-1 represents the set A 2i-1 and the set I 2i-1 's difference.

[0155] For the convenience of calculation, take the logarithm of the probability as the reward as follows:

[0156]

[0157] The definition of probability refers to the assumptions described above. If A 2i-1 and I 2i-1 \A 2i-1 are both empty sets, then r 2i-1 = 0.

[0158] After this step of operation, the environmental state will be updated to G 2i :

[0159] (1) V 2i = V:

[0160] (22)

[0161] (3)

[0162] (4)

[0163] After observing G 2i the agent determines whether to change v i to the infected state. If (indicating that u i is in the non-infected state or v i is in the infected state), then the action set Otherwise, The agent selects an action according to the policy π Apply A 2i to the environment: Apply A 2i All individuals in are determined to be in an infected state. The reward obtained from this step of operation is:

[0164]

[0165] Among them, if the agent determines v i to be in an infected state, the reward obtained is the logarithm of the probability that the virus successfully infects v i ; when the agent determines v i to be in a non-infected state, the reward obtained is the logarithm of the probability that the virus does not successfully infect v i .

[0166] A communication event has two decisions, and i is the index of the communication event.

[0167] When i = 1, for the first communication event (u1, v1, t1), two decisions are made at this time: the state observed in the first decision is G1 (i.e., G 2i-1 ), and the state observed in the second decision is G2 (i.e., G 2i ).

[0168] When i = 2, for the second communication event (u2, v2, t2), two decisions are made at this time: the state observed in the first decision is G3 (i.e., G 2i-1 ), and the state observed in the second decision is G4 (i.e., G 2i ).

[0169] After this step of operation, the environmental state will be updated to G 2i+1 :

[0170] (1) V 2i+1 = V;

[0171] (2) E 2i+1 = {(z0, u): u ∈ I, X 2i+1 (u) = 0};

[0172] (3) W 2i+1 (z0, u) = Pr{T u ≤ t i+1 |T u > t i},

[0173] (4)

[0174] Increase the value of \(i\) and repeat the above process until the agent completes the last decision (i.e., the \(2K\) -th decision). All individuals in \(I\) that are still judged to be in the non - infected state form the set \(I'=\{u:u\in I,X 2K+1 (u) = 0\}\). The agent will obtain a benefit which is the logarithm of the probability that the virus spreads from \(Z_0\) to \(I'\) during the time period \([t K ,t e \).

[0175]

[0176] In addition, for the set \(I''\) of nodes in \(O\setminus I\) that are judged to be in the infected state, \(I'' = \{u:u\in O\setminus I,X 2K+1 (u)=1\}\). The agent will obtain a negative benefit:

[0177]

[0178] where, is a pre - given penalty function, represents the penalty for misjudging an uninfected individual \(u\) as being in the infected state.

[0179] In summary, the total benefit obtained by the agent is:

[0180]

[0181] In the above decision - making process, at each time period \([t i-1 ,t i \), the agent judges whether the nodes in \(I\) are infected through \(Z_0\); at each time point \(t i \), the agent judges whether the virus spreads through \((u i ,v i )\). Therefore, this proposal transforms the decision - making problem in the continuous - time domain into a decision - making problem in discrete time steps through decision - making in time periods and at time points, simplifying the calculation process.

[0182] The decision - making process of the agent is a process of generating a propagation trajectory. Each propagation trajectory may have one or more propagation sources. The process of generating a propagation trajectory according to the above decision - making process is as follows:

[0183] (1) A propagation trajectory \(\tau\) is an infection tree or multiple infection trees. The root node of each infection tree is a certain propagation source, that is: the node that the agent decides is infected through \(Z_0\) during a certain time period \([t i-1 ,t i \).

[0184] (2) The edge \((u, v)\) is in \(\tau\) if and only if the agent judges that the virus spreads from \(u\) to \(v\) through contact \((u, v, t)\).

[0185] (3) When there are multiple propagation sources, a propagation trajectory contains multiple infection trees.

[0186] The total reward obtained by the agent is related to the following two aspects:

[0187] (1) The probability of the generated propagation trajectory occurring in the environment;

[0188] (2) After making a decision, the degree of coincidence between the states of all individuals it determines and the states of all individuals at time t e when all individuals are in the state.

[0189] Therefore, the higher the total reward obtained by the agent, the more accurate the generated propagation trajectory.

[0190] The training and reasoning of the source tracing strategy in the agent are described as follows:

[0191] The following introduces the learning of the agent's strategy π. For ease of description, π θ is used to emphasize the parameter θ in the strategy.

[0192] Denote the interaction process between the agent and the environment described in the previous section (in other words, the propagation trajectory generation process) as the function GenTrajectories, whose input is π θ , and the output is a trajectory T composed of one or more generated infection trees, and the reward r corresponding to T. Since π θ is a random strategy, the output of each call to GenTrajectories may be different.

[0193] The training process of the strategy is as follows:

[0194] Input: θ0, IterNum, BatchSize, α;

[0195] Parameter description:

[0196] θ0 represents the initial value of the parameter θ;

[0197] IterNum represents the number of iterations;

[0198] BatchSize represents the number of times GenTrajectories is called in each iteration process;

[0199] GenTrajectories represents a decision-making process of the agent.

[0200] α ∈ (0, 1) represents the hyperparameter for calculating the baseline return.

[0201]

[0202] Step 2.2 Calculate the gradient:

[0203]

[0204] In the above formula, B represents the batch size BatchSize;

[0205] b represents the baseline return, see step 2.4;

[0206] represents the derivative of the function lnπ θ (T i ) with respect to the parameter θ.

[0207] Among them, π θ (T i ) represents the probability that the policy network generates T i .

[0208] Step 2.3 Update the parameter θ←ADAM(θ, dθ);

[0209] Step 2.4 Update the baseline return

[0210] The training process is essentially that the agent continuously generates propagation trajectories. For the propagation trajectories with high rewards, increase the probability of generating such trajectories; for the propagation trajectories with low rewards, reduce the probability of generating such trajectories.

[0211] In practical applications, one or more pre-collected Logs can be used to pre-train the policy π starting from the randomly initialized θ0 pretrain . For the Logs that need to be traced subsequently, use the parameters of π pretrain as the initial parameters for adaptive training to save training time.

[0212] The inference process of the policy is as follows:

[0213] Input: π, PopulationSize, CandidateNum

[0214] Parameter description:

[0215] π represents the trained policy

[0216] PopulationSize represents the number of sampling times from π

[0217] CandidateNum represents the length of the output result

[0218] Output: The CandidateNum individuals that are most likely to be the propagation source;

[0219] Step 1. For i = 1, …, PopulationSize; its meaning is: generate PopulationSize trajectories.

[0220] T i , r i = GenTrajectories(π θ );

[0221] Step 2. Count the number of times the individuals in I are identified as the source of transmission in ;

[0222] Step 3. Return the CandidateNum individuals with the most times of being identified as the source of transmission.

[0223] The agent generates multiple transmission trajectories, and one or more sources of transmission can be inferred from each transmission trajectory. The node with the most times of becoming the source of transmission is determined as the source of transmission.

[0224] The perception and decision-making module of the agent is described as follows:

[0225] Perception module: The sequential decision-making problem in this proposal is a sequential decision-making problem with a finite number of steps. Therefore, this proposal uses different graph neural networks in different decision-making operations. In addition, to process variable-length graph state sequences, this proposal combines the S2V model and the recurrent neural network to propose the Evolve-S2V model. Compared with the S2V model, the Evolve-S2V model can dynamically generate graph neural networks in each decision-making operation to extract information from the state. The perception module can represent the environment (i.e., nodes, node states, edges) as dense vectors for the agent to use.

[0226] Let the number of layers of the graph neural network be L, and L is a hyperparameter. If the state G = (V, E, W, X) is observed in the decision-making operation i, the hidden vector of the individual u in the l-th layer is calculated as follows:

[0227]

[0228] where are the parameters of the graph neural network used in the decision-making operation i in the l-th layer, 1 ≤ l ≤ L. For any individual u,

[0229] represents the hidden vector of node u output by the graph neural network in the l-th layer in the i-th decision-making operation. X(u) represents the feature of node u, X(u) = 0 means that the agent has not yet determined that u has become an infected state. X(u) = 1 means that in the previous decision-making operation, the agent has determined that u has become an infected state. Denote the vector that transforms the central node features in the \(l\)-th layer of the graph neural network in the \(i\)-th decision operation. \(W(v, u)\) represents the probability that node \(v\) infects node \(u\). Denote the matrix that transforms the weights on the edges in the \(l\)-th layer of the graph neural network in the \(i\)-th decision operation. Denote the matrix that transforms the hidden vectors of neighbor nodes in the \((l - 1)\)-th layer in the \(l\)-th layer of the graph neural network in the \(i\)-th decision operation. Denote the vector \(W(v, u)\) that is transformed in the \(l\)-th layer of the graph neural network in the \(i\)-th decision operation.

[0230] The parameter \(W\) of the graph neural network in the \(l\)-th layer in decision operation \(i\) i，l evolves from the parameter \(W\) of the graph neural network in the previous decision operation \(i - 1\). i-1，l Specifically, this proposal uses a gated recurrent unit (GRU) of a recurrent neural network to model this evolution relationship: \(W\) i，l = GRU(\(W\) i-1，l , \(g\) i，l-1 ).

[0231] where is the representation of the graph in the \((i - 1)\)-th layer in decision operation \(i\). Initialize \(W\) 0，l = 0.

[0232] The description of the decision module is as follows:

[0233] The agent selects a set \(A\) from the action set and determines that the individuals in \(A\) are in the infected state. For ease of calculation, in this proposal, the agent independently judges whether each candidate point is selected into \(A\). Denote the set of candidate points in decision operation \(i\) as \(C\) (in different decision operations, \(C\) is an individual in \(I\) that is not infected or an individual that has contact with an infected individual), for \(v\in C\), the agent selects \(v\) into \(A\) with a probability of , or does not select \(v\) into \(A\) with a probability of . In different decision operations, \(u\) is an external factor \(Z_0\) that can introduce the virus into \(O\) or an infected individual that has contact with \(v\).

[0234] This embodiment specifically addresses three problems existing in existing traceability algorithms: (1) ignoring the contact time between individuals; (2) not utilizing the transmission characteristics of the virus; (3) the manually designed traceability strategy has limitations. To solve the above problems, this proposal improves the accuracy of traceability from the following two aspects: (1) Modeling the traceability problem as a sequential decision-making problem and using reinforcement learning to automatically learn the traceability strategy. In particular, this embodiment proposes the Evolve-S2V model based on the S2V model as the state perception module of the intelligent agent. Compared with the S2V model, Evolve-S2V can dynamically generate a graph neural network in each decision operation to perceive the state in different decision operations. (2) Making full use of the time of contact occurrence and the transmission characteristics of the virus during the decision-making process. In particular, using the time of contact occurrence and the transmission characteristics of the virus to design the reward function in the sequential decision-making problem. The algorithm proposed in this embodiment can not only identify the source of transmission but also restore the transmission trajectory of the virus in the population. Therefore, the algorithm in this embodiment can be used as an auxiliary means in scenarios such as electronic forensics and network security auditing.

[0235] Please refer to Figure 5 , Figure 5 which is a schematic structural diagram of a system for determining the source of information dissemination provided by an embodiment of the present application;

[0236] The system may include:

[0237] A candidate set determination module 501, configured to receive a source of transmission traceability request and determine a candidate set according to the source of transmission traceability request; wherein, the candidate set includes all devices in an infected state at the cut-off moment t e The devices in the infected state are devices that have received the target information;

[0238] A time traceability module 502, configured to determine the starting moment t when none of the devices in the candidate set are in an infected state s ;

[0239] A decision module 503, configured to query all communication events of all devices from the starting moment t s to the cut-off moment t e , and sequentially perform decision operations on each of the communication events using an intelligent agent in chronological order to obtain the dissemination trajectory of the target information; wherein, the i-th communication event is that device u i transmitted data to device v i at moment t i , and the decision operation corresponding to the i-th communication event includes: determining whether the devices in the candidate set are infected by an external infection source within the time period from t i-1 to t i , t0 = t s ; If device ui has been determined by the agent to be in an infected state before the current decision operation, and device v i has not been determined to be in an infected state yet, then the decision operation corresponding to the i-th communication event further includes: determining whether device v i is infected by u i at time t i ;

[0240] The source determination module 504 is configured to determine the information source according to the propagation trajectory.

[0241] In this embodiment, the candidate set is determined according to the received source tracing request, and the starting time t s and the end time t e for determining the propagation trajectory are determined, and all communication events of all devices from the starting time t s to the end time t e are queried. In this embodiment, the agent is used to perform decision operations on each of the communication events in sequence. Denote the i-th communication event as device u i transmitting data to device v i at time t i . For this event, the above decision operation determines whether the devices in the candidate set are infected by an external infection source within the time period from t i-1 to t i , where t0 = t s . In addition, if u i has been determined by the agent to be in an infected state in the previous decision operation, the decision operation further includes determining whether v i is infected by u i and becomes an infected state at time t i . Through the above method, the decision-making process in the continuous time domain can be discretized into decisions at time periods and time points, and then the propagation trajectory of the target information and the information source can be obtained. The above method combines the communication time between devices and the propagation characteristics of information to determine the information source of the target information, which can improve the accuracy of tracing the information source.

[0242] Further, the process of the candidate set determination module 501 determining the candidate set according to the source tracing request includes: parsing the source tracing request to obtain the target information and the end time t e ; constructing the candidate set according to the target information and the end time t e .

[0243] Further, the process of the candidate set determination module 501 constructing the candidate set according to the target information and the end time t e includes: determining at the end time t eThe target device that has received the target information; construct a candidate set including all the target devices.

[0244] Further, the time tracing module 502 determines the starting time t when none of the devices in the candidate set are in an infected state s The process of includes: starting from the cut-off time t e Trace the device scan records forward, and use the device scan records to determine the starting time t when none of the devices in the candidate set are in an infected state s .

[0245] Further, it further includes:

[0246] An environment setting module, configured to set the environment state before sequentially performing state decision operations on each of the communication events by the agent in chronological order, so that the agent performs the decision operation according to the environment state.

[0247] Further, it further includes:

[0248] An environment update module, configured to update the environment state after the agent performs a decision operation on one of the communication events.

[0249] Further, the process that the decision module 503 sequentially performs decision operations on each of the communication events by the agent in chronological order to obtain the propagation trajectory of the target information includes: sequentially performing the decision operations on each of the communication events by the agent in chronological order; determining the benefit value of each decision operation, and calculating the total benefit of the alternative trajectories according to the total benefit calculation formula; setting the alternative trajectories with the total benefit greater than the preset benefit value as the propagation trajectory of the target information.

[0250] Further, the process that the decision module 503 calculates the total benefit of the alternative trajectories according to the total benefit calculation formula includes: calculating the total benefit of the alternative trajectories according to the total benefit calculation formula;

[0251] Wherein, the total benefit calculation formula is represents the total benefit, K represents the total number of communication events, r i is used to describe the probability that a device is infected during the time period from t i-1 to t i , where t0 = t s . r end is used to describe the probability that a device in the candidate set that has not been determined to be in an infected state by the agent is infected by external factors during the time period from t K to t e , r penalty represents the misjudgment penalty value.

[0252] Further, it further includes:

[0253] A gain determination module, configured to determine a first type of gain value r 2i-1 and a second type of gain value r 2i ;

[0254] wherein, the first type of gain value r 2i-1 is positively correlated with the probability that the devices in the candidate set are infected by an external infection source during the time period from t i-1 to t i , and the second type of gain value r 2i is positively correlated with the probability that the target information is propagated through the i-th communication event at time t i .

[0255] The gain determination module is further configured to use the logarithm of the probability that the devices in the candidate set that are not determined by the agent to be in an infected state are infected by external factors during the time period from t K to t e as the third type of gain value r end .

[0256] Further, it further includes:

[0257] A penalty determination module, configured to, after the agent executes the decision operation on all the communication events, set the number of devices that are not in the candidate set and are determined by the agent to be in an infected state as the misjudgment number; and is further configured to determine the misjudgment penalty value r according to the misjudgment number penalty .

[0258] Further, it further includes:

[0259] A training module, configured to train the decision network of the agent before sequentially executing the decision operation on each of the communication events by the agent in chronological order; wherein, the decision network is obtained by combining the Structure2Vector model and a recurrent neural network;

[0260] Further, it further includes:

[0261] A parameter setting module, configured to input communication logs, the initial policy parameters of the agent, the number of iterations, the number of propagation trajectories generated by the agent during each iteration, and hyperparameters for calculating the baseline return into the training algorithm of the agent before training the agent.

[0262] Further, it further includes:

[0263] A policy parameter setting module, configured to obtain the policy parameters obtained through pre-training and set the pre-trained policy parameters as the initial policy parameters of the agent.

[0264] Furthermore, it further includes:

[0265] An inference module, configured to, after training the agent, perform policy inference using the trained agent, so as to sequentially perform decision-making operations on each of the communication events using the trained agent in chronological order.

[0266] Furthermore, it further includes:

[0267] An audit module, configured to perform a network security audit operation on the information dissemination source after determining the information dissemination source according to the dissemination track.

[0268] Furthermore, the process of the decision module 503 querying all communication events of all devices from the start time t s to the end time t e includes: reading the communication logs of all devices, and querying all the communication events from the start time t s to the end time t e according to the communication logs.

[0269] Since the embodiments in the system part correspond to the embodiments in the method part, for the embodiments in the system part, please refer to the description of the embodiments in the method part, which will not be elaborated here.

[0270] This application also provides an electronic device, which may include a memory and a processor. A computer program is stored in the memory. When the processor calls the computer program in the memory, the steps provided by the above embodiments can be implemented. Of course, the electronic device may further include various network interfaces, power supplies and other components. Figure 6 Shown in Figure 6 is a schematic structural diagram of an electronic device provided by an embodiment of this application. The electronic device includes:

[0271] A communication interface 601, capable of interacting with other devices such as network devices.

[0272] A processor 602, connected to the communication interface 601 to realize information interaction with other devices, and is used to execute the method for determining the information dissemination source provided by the above one or more technical solutions when running a computer program. And the computer program is stored on the memory 603.

[0273] Of course, in actual application, each component in the electronic device is coupled together through a bus system 604. It can be understood that the bus system 604 is used to realize the connection and communication between these components. The bus system 604 includes not only a data bus, but also a power bus, a control bus and a status signal bus. However, for the sake of clear illustration, in Figure 6Various buses are labeled as bus system 604.

[0274] The present application also provides a storage medium having a computer program stored thereon, and when the computer program is executed, the steps provided in the above embodiments can be implemented. The storage medium may include: semiconductor storage chips, USB flash drives, mobile hard disks, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical discs, etc., various media that can store program codes. Figure 7 It is a schematic structural diagram of a storage medium provided by an embodiment of the present application. The storage medium may be a non-volatile or non-transitory storage chip, and specifically includes a decoding driver, a storage matrix, a read / write circuit, address lines, data lines, chip select lines, and read / write control lines.

[0275] The embodiments in the specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. For the same or similar parts among the embodiments, reference can be made to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and reference can be made to the description of the method part for the relevant parts. It should be noted that for those of ordinary skill in the art in the technical field of the present application, without departing from the principle of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the protection scope of the claims of the present application.

[0276] It should also be noted that in this specification, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the term "comprising", "including", or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article, or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or further includes elements inherent to such process, method, article, or device. Without further limitation, an element defined by the statement "including one..." does not exclude the existence of another identical element in the process, method, article, or device including the said element.

Claims

1. A method for determining an information dissemination source, characterized in that, including: Receive a propagation source tracing request and determine a candidate set according to the propagation source tracing request; wherein, the candidate set includes all devices in an infected state at the cut-off time t e The devices in the infected state are devices that have received the target information; Determine the starting time t when none of the devices in the candidate set are in an infected state s ; Query all devices from the starting time t s to the ending time t e for all communication events, and sequentially execute decision operations on each of the communication events in chronological order using an agent to obtain the propagation trajectory of the target information; where the i-th communication event is that device u i transmitted data to device v i at time t i , and the decision operation corresponding to the i-th communication event includes: determining whether the devices in the candidate set are infected by an external infection source during the time period from t i-1 to t i , where t0 = t s ; if device u i has been determined to be in an infected state by the agent before the current decision operation and device v i has not been determined to be in an infected state, then the decision operation corresponding to the i-th communication event further includes: determining whether device v i is infected by u i at time t i . determining an information dissemination source according to the dissemination trajectory; 2. The method for determining the information dissemination source according to claim 1, wherein determining a candidate set according to the dissemination source tracing request, including: Parse the propagation source trace request to obtain the target information and the cut-off time t e ; Based on the target information and the deadline t e Construct the candidate set.

3. The method for determining the information dissemination source according to claim 2, wherein Based on the target information and the deadline t e Construct the candidate set, including: Determine at the cut-off time t e The target device that has received the target information; constructing the candidate set including all the target devices; 4. The method for determining the information dissemination source according to claim 1, wherein Determine the starting time t when none of the devices in the candidate set are in an infected state s , including: Starting from the cut-off moment t e trace back the device scan records forward, and use the device scan records to determine the starting moment t when none of the devices in the candidate set are in an infected state s .

5. The method for determining the information dissemination source according to claim 1, wherein before sequentially performing a state decision operation on each of the communication events by an agent in chronological order, further including: setting an environmental state so that the agent performs the decision operation according to the environmental state; 6. The method for determining the information dissemination source according to claim 5, wherein further including: after the agent performs a decision operation on one of the communication events, updating the environmental state; 7. The method for determining an information dissemination source according to claim 1, wherein sequentially performing a decision operation on each of the communication events by the agent in chronological order to obtain the dissemination trajectory of the target information, including: sequentially performing the decision operation on each of the communication events by the agent in chronological order; determining the benefit value of each decision operation and calculating the total benefit of the alternative trajectory according to the total benefit calculation formula; setting the alternative trajectory with the total benefit greater than the preset benefit value as the dissemination trajectory of the target information; 8. The method for determining the information dissemination source according to claim 7, wherein calculating the total benefit of the alternative trajectory according to the total benefit calculation formula, including: calculating the total benefit of the alternative trajectory according to the total benefit calculation formula; Among them, the total revenue calculation formula is r total represents the total revenue, K represents the total number of communication events, and r i is used to describe the probability that the device is infected during the time period from t i-1 to t i . r end is used to describe the probability that a device in the candidate set that has not been determined to be in an infected state by the agent is infected by external factors during the time period from t K to t e . r penalty represents the misjudgment penalty value.

9. The method for determining the information dissemination source according to claim 8, wherein further including: Determine the first type of return value r 2i-1 and the second type of return value r 2i ; wherein, the first type of return value r 2i-1 is positively correlated with the probability that the devices in the candidate set are infected by external infection sources during the time period from t i-1 to t i , and the second type of return value r 2i is positively correlated with the probability that the target information is transmitted through the i-th communication event at time t i . Take the logarithm of the probability that a device not judged to be in an infected state by the agent in the candidate set is infected by external factors during the time period from t K to t e as the third type of benefit value r end ; after the agent performs the decision operation on all the communication events, setting the number of devices that are not in the candidate set and are determined by the agent to be in an infected state as the misjudgment number; Determine the misjudgment penalty value r according to the number of misjudgments penalty .

10. The method for determining the information dissemination source according to claim 1, wherein before sequentially performing a decision operation on each of the communication events by an agent in chronological order, further including: training a decision network of the agent; wherein, the decision network is obtained by combining a Structure2Vector model and a recurrent neural network; the inputs required for training the decision network include: communication logs, initial policy parameters of the agent, the number of iterations and the number of dissemination trajectories generated by the agent during each iteration, and hyperparameters for calculating the baseline return; obtaining the pre-trained policy parameters and setting the pre-trained policy parameters as the initial policy parameters of the agent; 11. The method for determining the information dissemination source according to claim 10, characterized in that, after training the decision network of the agent, further including: performing policy inference by using the trained agent so that the trained agent sequentially performs a decision operation on each of the communication events in chronological order; 12. The method for determining an information dissemination source according to claim 1, characterized in that Query all devices from the starting time t s to the ending time t e for all communication events, including: Read the communication logs of all devices, and query all the communication events from the start time t s to the end time t e according to the communication logs.

13. A determination system for an information dissemination source, characterized in that, including: A candidate set determination module, configured to receive a propagation source tracing request and determine a candidate set according to the propagation source tracing request; wherein, the candidate set includes all devices in an infected state at the cut-off time t e The devices in the infected state are devices that have received the target information; A time tracing module, configured to determine a starting time t when none of the devices in the candidate set are in an infected state s ; A decision-making module for querying all communication events of all devices from the starting time t s to the ending time t e and sequentially performing decision-making operations on each of the communication events by using an agent in chronological order to obtain the propagation trajectory of the target information; where the i-th communication event is that device u i transmitted data to device v i at time t i , and the decision-making operation corresponding to the i-th communication event includes: determining whether the devices in the candidate set are infected by an external infection source during the time period from t i-1 to t i , where t0 = t s ; if device u i has been determined to be in an infected state by the agent before the current decision-making operation and device v i has not been determined to be in an infected state, then the decision-making operation corresponding to the i-th communication event further includes: determining whether device v i is infected by u i at time t i . a dissemination source determination module for determining an information dissemination source according to the dissemination trajectory; 14. An electronic device, characterized in that, including a memory and a processor, where a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps of the method for determining an information dissemination source according to any one of claims 1 to 12 are implemented; 15. A storage medium, characterized in that, computer-executable instructions are stored in the storage medium, and when the computer-executable instructions are loaded and executed by a processor, the steps of the method for determining an information dissemination source according to any one of claims 1 to 12 are implemented.

Images