A Deep Darknet Crowd Detection Method Based on Network Representation Learning

Abstract

This invention discloses a method for deep dark web population detection based on network representation learning, including the construction of a heterogeneous information network of the deep dark web and multi-view deep embedded clustering based on an autoencoder. The construction of the heterogeneous information network includes building various types of nodes and various types of relationships within the heterogeneous information network. The multi-view deep embedded clustering based on an autoencoder includes user multi-view construction based on meta-paths, user embedding representation learning based on an autoencoder, and self-supervised clustering based on KL divergence. Finally, the user embedding representation learning based on an autoencoder and the self-supervised clustering based on KL divergence are jointly learned, and the reconstruction loss and clustering loss are jointly optimized. For a target deep dark web, the soft label distribution of each user in the target deep dark web is obtained using the optimized encoder and the self-supervised clustering module based on KL divergence. This invention can achieve good population detection results.

Description

Technical Field

[0001] This invention belongs to the field of computer network security technology, specifically relating to a method for discovering deep dark web populations based on network representation learning. Background Technology

[0002] Dark web group discovery refers to the identification of user groups or communities with similar characteristics or goals from a large number of users within the hidden social networks of the dark web, based on collected and accumulated social network data. This has significant theoretical and practical value. Group discovery of hidden social networks on the dark web not only allows for comprehensive analysis of their network structure and node attributes, providing researchers with a theoretical basis for understanding the organizational structure of these networks, but also helps in understanding the formation and development of illegal activities on the dark web. Furthermore, it provides crucial support for law enforcement agencies in governing the dark web, enabling them to maintain a healthy online environment and ensure social stability.

[0003] Existing methods for discovering network groups primarily analyze and mine the entire network from a single perspective, suitable for social networks with rich attribute information or dense social connections. However, in the hidden social networks of the dark web, due to strategies such as anonymity and privacy protection, users typically lack tag information and attribute descriptions. The vast majority of users only have nicknames, lacking information features such as region, gender, and occupation—features directly usable for attribute analysis—compared to those of users on the surface web (microblogs). Furthermore, communication in these hidden dark web networks is straightforward and mostly consists of short text messages with limited information, posing a significant challenge to directly applying existing group discovery methods based on user attribute features. In addition, there are no obvious direct social connections between users in the dark web, such as the follower / follower relationship on the surface web. Explicit interactions between users are also typically limited, such as likes and reposts. These factors result in a sparse and highly dimensional network structure for dark web users, making it impossible to effectively mine user groups directly based on network structure information.

[0004] Given the above background, and considering the difficulty in effectively segmenting groups due to the lack of tag information and attribute descriptions among users of the dark web's hidden social networks, as well as the sparse social connections, the key challenge in discovering dark web groups lies in how to fully explore and integrate the user attribute characteristics and network structure characteristics of the dark web's hidden social networks to assist in accurately discovering these groups. Summary of the Invention

[0005] The purpose of this invention is to effectively alleviate the problem of difficulty in grouping users due to the sparse social connections and lack of labeled information in the deep dark web. It provides a deep dark web group discovery method based on network representation learning, which considers the similarity of group attributes and structural cohesion to analyze and classify network users. It makes full use of and mines all available information in the hidden social network of the deep dark web, and can perform unsupervised deep dark web group discovery in an end-to-end manner.

[0006] The technical solution of this invention is as follows:

[0007] A method for detecting deep dark web populations based on network representation learning, comprising the following steps:

[0008] 1) Obtain users, messages, and groups from the deep dark web; extract sensitive entities from each message; and extract topic entities based on message data using a topic modeling model. Then, use the obtained users, groups, messages, topic entities, and sensitive entities as nodes in the heterogeneous information network of the deep dark web. Then, establish edge connections between corresponding nodes according to the relationships between them to generate the heterogeneous information network of the deep dark web. The relationships include the subordinate relationship between users and groups, the publishing relationship between users and messages, the forwarding relationship between messages, the discussion relationship between users and topics, and the inclusion relationship between messages and sensitive entities.

[0009] 2) Extract multiple meta-paths from the heterogeneous information network of the deep dark web; different meta-paths describe the complex relationships between users from different perspectives; construct a single-view user attribute graph based on each meta-path, and generate the attribute feature matrix of each single-view user attribute graph; the nodes in the single-view user attribute graph are users, and the edges are complex relationships based on meta-paths.

[0010] 3) The autoencoder encoder encodes the attribute feature matrix and network structure matrix of each single-view user attribute graph to obtain a low-dimensional vector representation of the user; then the autoencoder decoder decodes each low-dimensional vector representation of the user to reconstruct the corresponding network structure matrix and attribute feature matrix.

[0011] 4) Select an attention mechanism to fuse the obtained low-dimensional vector representations of each user to generate a unified and comprehensive user representation;

[0012] 5) Input the user representation obtained in step 4) into a self-supervised clustering module based on KL divergence to obtain the soft label distribution for each user;

[0013] 6) Based on the objective function The autoencoder and the self-supervised clustering module based on KL divergence are optimized; where γ is the balance coefficient, m is the number of single-view user attribute graphs, and L is the clustering loss function. c=KL(E||H), where H is the soft label distribution of the cluster, and E is the target distribution based on H; the m-th single-view user attribute graph G m The corresponding attribute feature matrix is ​​X, and the network structure matrix is... The corresponding low-dimensional user vector is represented by Z. m Based on Z m Reconstruct G using the inner product method m Corresponding network structure matrix Based on Z m , Reconstruct G using the deconvolution method m Corresponding attribute feature matrix G m The corresponding loss function for optimizing the autoencoder is: Cross-entropy function Mean square error

[0014] 7) For a target deep dark web, generate multiple single-view user attribute graphs corresponding to the target deep dark web; use the encoder of the optimized autoencoder to encode the attribute feature matrix and network structure matrix of each single-view user attribute graph to obtain a low-dimensional vector representation of the user and input it into the optimized self-supervised clustering module based on KL divergence to obtain the soft label distribution of each user.

[0015] Furthermore, the network structure of the single-view user attribute graph is expressed using an adjacency matrix, where the m-th single-view user attribute graph G... m adjacency matrix If the single-view user attribute diagram G m If there are edges between users, then otherwise Let N be a single-view user attribute graph G. m The number of users in the single-view user attribute graph G m The attribute feature matrix is in It's a splicing operation, u N It is the attribute feature vector of the Nth user.

[0016] Furthermore, a graph convolutional neural network (GCN) is used to aggregate neighbor information to obtain a low-dimensional vector representation. Reconstructed attribute feature matrix in, I N It is the identity matrix. yes The degree matrix, W represents the parameter matrix of the graph convolutional neural network GCN. gLet be the parameter matrix trained in the deconvolution layer, and δ be the activation function of the decoder.

[0017] Furthermore, a unified and comprehensive user representation in, This represents the embedding representation of node i in the k-th single-view user attribute graph, and the attention weight of node i in the k-th single-view user attribute graph is... ω k It is the attention vector under the k-th single-view user attribute graph. It is the vector concatenation representation of node i under all single-view user attribute graphs.

[0018] Furthermore, clustering loss Among them, h ij It is Z i With the group center μ j Similarity between them h ik It is Z i With the group center μ k Similarities between them.

[0019] Furthermore, the information in the attribute feature vector includes the number of user groups, the total number of messages, the average message length, and the total message length.

[0020] Furthermore, the k-means algorithm is used to obtain the initial cluster center.

[0021] A server is characterized by comprising a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the steps of the methods described above.

[0022] A computer-readable storage medium having a computer program stored thereon, characterized in that the computer program, when executed by a processor, implements the steps of the above-described method.

[0023] This invention proposes a method for discovering deep dark web populations based on network representation learning. The method includes constructing a heterogeneous information network of deep dark webs and multi-view deep embedded clustering based on an autoencoder. The overall framework is as follows: Figure 1 As shown.

[0024] The construction of the deep dark web heterogeneous information network includes constructing various types of nodes and various types of relationships within the heterogeneous information network. Specifically, it includes the following sub-steps:

[0025] (a) The constructed attribute heterogeneous information network has multiple node types, defining five node types: user, group, message, topic entity, and sensitive entity. For the user node, its available attribute information is fully explored, and all attribute features are fused to form an attribute feature vector for each user.

[0026] (b) The construction of heterogeneous information networks of attributes defines five different types of edge relationships, including the subordinate relationship between users and groups, the publishing relationship between users and messages, the forwarding relationship between messages, the discussion relationship between users and topics, and the inclusion relationship between messages and sensitive entities.

[0027] Finally, based on the aforementioned 5 types of nodes and 5 different types of edge relationships, a deep dark web heterogeneous information network G is constructed, and its network pattern is as follows: Figure 1 As shown in the upper part.

[0028] The autoencoder-based multi-view deep embedding clustering includes meta-path-based user multi-view construction, autoencoder-based user embedding representation learning, and KL (Kullback-Leibler) divergence-based self-supervised clustering. Specifically, it includes the following sub-steps:

[0029] (a) The user multi-view construction based on meta-paths first defines and extracts multiple meta-paths between entity nodes. Different meta-paths describe the complex relationships between users from different perspectives. Based on these multiple meta-paths, a user multi-view network can be constructed, consisting of multiple single-view user attribute graphs. Each single-view user attribute graph is constructed based on a meta-path between users. This patent designs multiple different meta-paths, thereby obtaining multiple different views. By constructing multiple different single-view user attribute graphs, the complex relationships between users can be modeled from multiple perspectives. In each single-view user attribute graph, nodes represent users, and edges represent complex relationships based on meta-paths; that is, if two user nodes can be connected through a certain meta-path, then there is an edge between the two nodes. The network structure of each single-view user attribute graph can be expressed by its adjacency matrix, i.e. If in the current view G m There are edges between users, matrix A m The element in the i-th row and j-th column otherwise Assuming N is the number of users and X is the attribute feature matrix, then each single-view user attribute graph G m The attribute feature matrix X can be represented as:

[0030]

[0031] in It's a splicing operation, u i ∈Rd It is the d-dimensional attribute feature vector of the i-th user.

[0032] (b) The autoencoder-based user embedding representation learning mainly uses an autoencoder to unsupervisedly learn the low-dimensional vector representation of the user in each single-view user attribute graph. Specifically, given the attribute feature matrix X and the network structure matrix A under the m-th view... m First, we use an autoencoder to learn the encoding of both. To fully integrate attribute features and network structure, we use a graph convolutional neural network (GCN) to aggregate neighbor information during the encoding stage to obtain a low-dimensional vector representation Z of the latent space. m During the decoding stage, we simultaneously consider the reconstruction of network structure and attribute features, and combine the reconstruction errors of the two for unified optimization.

[0033] During the encoding stage, the attribute feature matrix X and structural feature A are defined under a given m-view. m Using GCN as the encoder, the potential user representation Z can be obtained. m :

[0034]

[0035] in I N It is the identity matrix. yes The degree matrix, i.e. W represents the parameter matrix of the graph convolutional neural network (GCN).

[0036] In the decoding stage, not only is the inner product method used to reconstruct the structural relationships of nodes, but also the deconvolution method is used to reconstruct the attribute information of nodes. The reconstructed structural relationships of nodes are based on the latent representation Z obtained by the encoder. m If the structural relationships of nodes are reconstructed using the inner product method, then the reconstructed adjacency matrix will be... The attribute information of the reconstructed nodes is mainly calculated by amplifying the differences between the node and its neighbors, thus sharpening the neighbor features. The reconstructed node attribute features are then used to calculate the node's attribute features. Among them W g Let δ be the parameter matrix trained in the deconvolution layer, and δ be the activation function of the decoder, which can be the sigmoid function or the identity function.

[0037] After obtaining the reconstructed adjacency matrix and node attribute features, we optimize the errors between these and the original adjacency matrix and node attribute features. The structural error is optimized using the cross-entropy function, and the attribute error is optimized using the mean squared error. The unified loss function is then:

[0038]

[0039] After learning user representations for a single view using an autoencoder, we need to fuse user representations from a multi-view network to generate a unified and comprehensive user representation. Simple concatenation or averaging fusion cannot learn the impact of different meta-paths on the user representation. Therefore, we choose an attention mechanism for effective fusion, obtaining robust user representations by automatically learning the attention weights of different views.

[0040] The attention weight α for each node under different views is defined as follows: i,k as follows:

[0041]

[0042] Where ω k It is the attention vector under view k that needs to be trained. It is the concatenated vector representation of node i across all views. The larger the attention weight value, the greater the influence of that view on the node representation, meaning the higher the amount of information in that view.

[0043] Given the latent vector representation of a node in each single view, and combining the attention weights mentioned above, the latent representation of a user node that integrates all view information is as follows:

[0044]

[0045] in This represents the embedding representation of node i in view k.

[0046] (c) The self-supervised clustering based on KL divergence completes network group partitioning based on the latent representation of user nodes that integrates all view information. Inspired by deep embedded clustering, this invention introduces a self-training clustering module based on KL divergence, using "highly confident" nodes as soft labels to supervise graph clustering, thereby gradually optimizing the embedded representation and facilitating group discovery. Specifically, the latent representation of user nodes that integrates all view information is input into a deep embedded clustering module, which uses KL divergence, which aims to measure the difference between two probability distributions, as the optimized clustering loss Lc, specifically defined as:

[0047]

[0048] Where H is the soft label distribution of the cluster, h ij It is the latent representation Z i With the group center μ j The similarity between them can be calculated using the Student's T-distribution:

[0049]

[0050] E is the target distribution based on H, e ijIt can be calculated using the following formula:

[0051]

[0052] It should be noted that before joint training, we need to pre-train the autoencoder separately to obtain a meaningful latent embedding representation, and then use the k-means algorithm to obtain the initial cluster population.

[0053] Finally, this invention jointly learns the user embedding representation learning based on the autoencoder and the self-supervised clustering based on KL divergence, and jointly optimizes the reconstruction loss and clustering loss. The final objective function is defined as:

[0054]

[0055] Here, γ>0 is the balance coefficient controlling the relationship between the two, and m is the number of views in the multi-view network. This paper uses stochastic gradient descent and backpropagation to optimize the objective function and update the relevant parameters. Finally, the clustering result can be obtained from the final optimized H-label distribution, and the corresponding predicted label for user node i can be obtained through r. i =argmax j h ij get.

[0056] For a target deep dark web, multiple single-view user attribute graphs corresponding to the target deep dark web are generated; the attribute feature matrix and network structure matrix of each single-view user attribute graph are encoded using the encoder of the optimized autoencoder to obtain a low-dimensional vector representation of the user, which is then input into the optimized self-supervised clustering module based on KL divergence to obtain the soft label distribution of each user.

[0057] The advantages of this invention are as follows:

[0058] 1. This method can perform unsupervised deep dark web group discovery in an end-to-end manner, effectively alleviating the problem of difficulty in grouping caused by the sparse social connections and lack of label information of deep dark web users.

[0059] 2. This method uses attribute heterogeneous information networks to model them and utilizes meta-paths to capture potential relationships between users, which can fully explore user attribute features and relationships in the hidden social networks of the deep dark web.

[0060] 3. This method proposes a multi-view deep embedded clustering model based on an autoencoder, which learns the user's low-dimensional vector representation and cluster assignment simultaneously, enabling group mining without label guidance.

[0061] 4. The proposed model integrates user attribute features and network structure features, and simultaneously considers clustering objectives, which can achieve better group discovery results. Attached Figure Description

[0062] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0063] The present invention will now be described in further detail with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0064] This invention proposes a deep dark web group discovery method based on network representation, applicable to group discovery in social networks. This example uses real data from encrypted Telegram communications to illustrate the specific application of this invention, completing the group discovery in the deep dark web. Table 1 presents the statistics of relevant entities. To verify the effectiveness of the proposed method, we manually divided 560 users in the dataset into groups. Through manual analysis and annotation, these users were labeled into 7 groups based on their social goals and associations: sellers, buyers, casual chatters, consultants, promoters, private chatters, and other groups.

[0065] This method can be used to divide users in social network groups into different groups. The specific steps are as follows:

[0066] 1. Construction of a heterogeneous information network in the deep dark web, specifically including the following sub-steps:

[0067] (a) Constructing heterogeneous information networks with various node types

[0068] The collected Telegram data initially contained three types of node information: user profile information, group profile information, and user message information. Protected by the anonymity mechanism of the deep dark web, only the username and group name in the user profile and group profile information could be used as attribute information. For the user message data, we performed data cleaning, including icon conversion and punctuation removal. For each user, we extracted and statistically analyzed their basic attribute information, mainly including the number of user groups, total number of messages, average message length, and total message length. To enrich user attribute features, we concatenated all of a user's messages to generate text attribute features. This invention utilizes the BERT model to convert user message content of different lengths into fixed-length text attribute feature vectors. Finally, all attribute features were merged to form an attribute feature vector for each user.

[0069] To enrich the heterogeneous information network of the deep dark web, this invention introduces two additional types of node information: topic entities and sensitive entities. Topic entities are topic information mined from all user message data using a topic modeling model, representing coarse-grained entity information oriented towards the user. Sensitive entities are sensitive entities mined from each message using a sensitive entity identification method, representing fine-grained entity information oriented towards the message.

[0070] (b) Constructing heterogeneous information networks with various types of relationships

[0071] After obtaining information on users, messages, groups, subject entities, and sensitive entities, we can define and extract various relationships between them. To represent the relationships between users and groups, we construct a "user belongs to group" matrix S, where each element s i,j ∈{0,1} indicates whether user i belongs to group j; to describe the relationship between users and messages, we construct a "user-posted message" matrix P, where each element p i,j ∈{0,1} indicates whether user i has published message j; to describe the relationship between messages, we construct a matrix F of "message forwarded from a certain message" and a matrix R of "message replied to a certain message", where element f i,j ∈{0,1} indicates whether message i is forwarded from message j, and element r i,j ∈{0,1} indicates whether message i responds to message j; to represent the relationship between users and topics, and the relationship between messages and sensitive entities, construct a "user discussion topic" matrix D and a "message contains sensitive entities" matrix SE, where each element d in the former... i,j ∈{0,1} indicates whether topic j is discussed using i, where each element SE in the latter... i,j ∈{0,1} indicates whether message i contains sensitive information j. Finally, we construct a deep dark web heterogeneous information network G containing 5 types of entity nodes and 5 different types of edge relationships, with the network pattern as follows: Figure 1 As shown in the upper part.

[0072] 2. Multi-view deep embedded clustering based on autoencoders, specifically including the following sub-steps:

[0073] (a) Construction of a user multi-view network based on metapath

[0074] The heterogeneous information network of the deep dark web reveals that there are not many direct connections between users. Therefore, it is necessary to construct higher-order semantic relationships between users by leveraging other entities and relationships to enrich user connections. This paper utilizes meta-paths to capture complex relationships between users. Through data observation and analysis, we designed five meaningful meta-paths, as shown in Table 2.

[0075] Different meta-paths describe the complex relationships between users from different perspectives. Based on the five meta-paths mentioned above, we can construct a user multi-view network, consisting of five single-view user attribute graphs. In each single-view user attribute graph, nodes represent users, and edges represent complex relationships based on meta-paths; that is, if two user nodes can be connected by a certain meta-path, then an edge exists between the two nodes. The network structure of each single-view user attribute graph can be expressed by its adjacency matrix, i.e. If there are edges between users in the current view m, otherwise Assuming N is the number of users and X is the user feature vector matrix, then each single-view user attribute graph G m The attribute characteristics can be represented as:

[0076]

[0077] in It's a splicing operation, u i ∈R d It is the d-dimensional attribute feature vector of the i-th user.

[0078] (b) User embedding representation learning based on autoencoder and attention mechanism

[0079] Given the attribute feature matrix X and the network structure matrix A under the m-th view m First, the encoder of an autoencoder is used to learn the encoding of both. To fully integrate attribute features and network structure, a GCN is used as the encoder during the encoding stage to obtain potential user representations. in I N It is the identity matrix. yes The degree matrix, i.e. W represents the parameter matrix. During the decoding phase, the structural relationships between nodes are reconstructed using the inner product method, resulting in the reconstructed adjacency matrix. The node attribute information is reconstructed using the deconvolution method, and the reconstructed node attribute features are... Among them W g Let be the parameter matrix trained in the deconvolution layer, and δ be the activation function of the decoder, which can be either the sigmoid function or the identity function. Finally, the reconstruction errors from both are combined, and the unified loss function is:

[0080]

[0081] After learning the user representation under a single view using an autoencoder, an attention mechanism is selected to effectively fuse user representations from a multi-view network to generate a unified and comprehensive user representation. Robust user representations are obtained by automatically learning the attention weights of different views.

[0082] The attention weight α for each node under different views is defined as follows: i,k as follows:

[0083]

[0084] Where ω k It is the attention vector under view k that needs to be trained. It is the concatenated vector representation of node i across all views. The larger the attention weight value, the greater the influence of that view on the node representation, meaning the higher the amount of information in that view.

[0085] Given the latent vector representation of a node in each single view, and combining the attention weights mentioned above, the latent representation of a user node that integrates all view information is as follows:

[0086]

[0087] in This represents the embedding representation of node i in view k.

[0088] (c) Self-supervised clustering based on KL divergence

[0089] The latent representations of user nodes, incorporating all view information, are input into a deep embedding clustering module. This module uses KL divergence, optimized to measure the difference between two probability distributions, as the clustering loss L. c Specifically defined as:

[0090]

[0091] Where H is the soft label distribution of the cluster, h ij It is the latent representation Z i With the group center μ j The similarity between them can be calculated using the Student's T-distribution:

[0092]

[0093] E is the target distribution based on H, e ij It can be calculated using the following formula:

[0094]

[0095] It should be noted that before joint training, we need to pre-train the autoencoder separately to obtain a meaningful latent embedding representation, and then use the k-means algorithm to obtain the initial cluster center.

[0096] Finally, by jointly learning user embedding representation based on autoencoder and self-supervised clustering based on KL divergence, this invention obtains the final objective function as follows:

[0097]

[0098] Here, γ>0 is the balance coefficient controlling the relationship between the two, and m is the number of views in the multi-view network. This paper uses stochastic gradient descent and backpropagation to optimize the objective function and update the relevant parameters. Finally, the clustering result can be obtained from the final optimized H-label distribution, and the corresponding predicted label for user node i can be obtained through r. i =argmax j h ij get.

[0099] To verify the effectiveness of the proposed deep dark web population detection method, two types of comparative experiments were designed to evaluate its performance. One type is a performance comparison experiment, evaluating the clustering effects of multiple methods on the user population detection task; the other type is an ablation experiment, which verifies the impact of each module in the proposed model by removing some modules. The experimental results of both types of comparative experiments were evaluated using the standard mutual information (NMI) and module degree (Q) as evaluation metrics. The specific calculation formulas for these metrics are as follows:

[0100] (a) Standard Mutual Information (NMI) is an information theory-based measure of community detection that can assess the accuracy of community segmentation given the known structure of the network's actual communities. The NMI calculation formula is defined as follows:

[0101]

[0102] Among them, C and C * Let N represent the set of real communities and the set of predicted communities. C and N represents the number of real communities and the number of predicted communities. ij Subcommunity C i and The number of public nodes, and The value of NMI ranges from [0,1], and the larger the value, the better the population detection results.

[0103] (b) Moduleity Q is a widely used measure of community partitioning quality, capable of evaluating partitioning results even when the standard community structure of a network is unknown. The formula for calculating moduleity is defined as follows:

[0104]

[0105] Where A ij This represents the elements in the reconstructed network adjacency matrix A, where m represents the number of edges in the network, and d... i and d j c represents the degree of node i and node j. i This represents the community label to which node i belongs. I(c i ,c j The modularity value is an indicative function; it is 1 when node i and node j are in the same community, and 0 otherwise. A higher modularity value indicates a stronger community structure and better group discovery results.

[0106] In the performance comparison experiment, the k-means method, Louvain method, GraphEncoder method, AGE method, and our proposed DGDMAGAE method were compared, and standard mutual information (NMI) and modularity (Q) were used as evaluation metrics. Specific results are shown in Table 3. The DGDMAGAE method shows a significant performance improvement. Compared to traditional single-dimensional population discovery methods K-means and Louvain based on attribute features or network features, the DGDMAGAE method exhibits a substantial performance improvement, specifically in NMI (29.1% and 42.6% improvement, respectively) and modularity (Q) (17.7% and 25.8% improvement, respectively). Compared to other deep learning-based network representation learning methods GraphEncoder and AGE, the DGDMAGAE method also shows a significant performance improvement.

[0107] In the ablation experiments, we conducted two comparative experiments, one involving removing different sub-modules of the model and the other involving removing different meta-paths, focusing on both the entire autoencoder-based multi-view deep embedded clustering model and multiple associated meta-paths. Tables 4 and 5 present the specific experimental results for removing different sub-modules and different meta-paths from the overall model, respectively.

[0108] First, by comparing the experimental results in Table 4, we can find that: (1) The model performance drops the most when the self-supervised clustering module is removed, with a decrease of nearly 10% in the NMI index. This shows that the self-supervised clustering module plays a very important role in the whole model, and user representation learning and optimization oriented towards clustering goals is beneficial to user group discovery. It also proves the necessity of using the self-supervised clustering module in this paper. (2) Removing the user multi-view construction module also brings about a 9% decrease in the NMI index of the model. This proves that the user multi-view based on meta-path can explore the potential of users from different perspectives and can provide strong support for group discovery. It also verifies the effectiveness of using attribute heterogeneous information network to represent deep dark web users in this paper. (3) The model without the user representation fusion module also shows a significant decrease in the NMI and Q indices. This is because the attention mechanism can fully model the interaction between user representations under different views, thus explaining the rationality of using the attention mechanism in this paper.

[0109] Secondly, comparing the experimental results in Table 5, we can find that: (1) The five meta-paths have different influences on user group discovery, and their importance is ranked as follows: message reply meta-path > topic association meta-path > sensitive entity meta-path > group association meta-path > message forwarding meta-path. Through analysis of the constructed deep dark web heterogeneous information network, we found that the main reason is that the number of edges or nodes based on different meta-paths is different, resulting in different scales of user association relationships mined, which in turn affects the experimental results differently. (2) The model performance drops significantly after removing the message reply meta-path. This is because removing the message reply-based meta-path in the multi-view construction module is equivalent to not considering the user relevance under message reply. Communication reply is the main way of user interaction within the group, with a strong one-to-one correspondence between users. After removal, the user association becomes weaker, thus affecting the group discovery effect. (3) Removing the sensitive entity meta-path also brings a significant performance drop to the model. This is because sensitive entities, as a kind of custom user label, can effectively enhance the relevance of users with the same sensitive entity interests, which is convenient for group discovery. Similarly, this also verifies the effectiveness of the deep dark web sensitive entity identification technology.

[0110] Table 1 Overview of User Group Dataset

[0111]

[0112] Table 2. Description of different metapaths

[0113]

[0114] Table 3 Comparison of Deep Dark Web Population Discovery Results

[0115]

[0116] Table 4 Ablation Experiment of Deep Dark Web Population Discovery Model

[0117]

[0118] Table 5 Ablation experiments using different metapaths

[0119]

[0120] Although specific embodiments of the invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, the invention should not be limited to the content disclosed in the preferred embodiments, and the scope of protection claimed by the invention is defined by the claims.

Claims

1. A method for detecting deep dark web populations based on network representation learning, comprising the following steps: 1) Obtain users, messages, and groups from the deep dark web, extract sensitive entities from each message, and extract topic entities based on message data using a topic modeling model; then use the obtained users, groups, messages, topic entities, and sensitive entities as nodes in the heterogeneous information network of the deep dark web; then establish edge connections between corresponding nodes according to the relationship between each node to generate the heterogeneous information network of the deep dark web. The relationships include the subordinate relationship between users and groups, the publishing relationship between users and messages, the forwarding relationship between messages, the discussion relationship between users and topics, and the inclusion relationship between messages and sensitive entities; 2) Extract multiple meta-paths from the heterogeneous information network of the deep dark web; different meta-paths describe the complex relationships between users from different perspectives; A single-view user attribute graph is constructed based on each meta-path, and an attribute feature matrix is ​​generated for each single-view user attribute graph; the nodes in the single-view user attribute graph are users, and the edges are complex relationships based on meta-paths. 3) The autoencoder encoder encodes the attribute feature matrix and network structure matrix of each single-view user attribute graph to obtain a low-dimensional vector representation of the user; then the autoencoder decoder decodes each low-dimensional vector representation of the user to reconstruct the corresponding network structure matrix and attribute feature matrix. 4) Select an attention mechanism to fuse the obtained low-dimensional vector representations of each user to generate a unified and comprehensive user representation; 5) Input the user representation obtained in step 4) into a self-supervised clustering module based on KL divergence to obtain the soft label distribution for each user; 6) Based on the objective function The autoencoder and the self-supervised clustering module based on KL divergence are optimized; where γ is the balance coefficient, m is the number of single-view user attribute graphs, and L is the clustering loss function. c =KL(E||H), where H is the soft label distribution of the cluster, and E is the target distribution based on H; the m-th single-view user attribute graph G m The corresponding attribute feature matrix is ​​X, and the network structure matrix is ​​A. m The corresponding low-dimensional user vector is represented by Z. m Based on Z m Reconstruct G using the inner product method m Corresponding network structure matrix Based on Z m , Reconstruct G using the deconvolution method m Corresponding attribute feature matrix G m The corresponding loss function for optimizing the autoencoder is: Cross-entropy function Mean square error 7) For a target deep dark web, generate multiple single-view user attribute graphs corresponding to the target deep dark web; use the encoder of the optimized autoencoder to encode the attribute feature matrix and network structure matrix of each single-view user attribute graph to obtain a low-dimensional vector representation of the user and input it into the optimized self-supervised clustering module based on KL divergence to obtain the soft label distribution of each user.

2. The method according to claim 1, characterized in that, The network structure of the single-view user attribute graph is expressed using an adjacency matrix. The m-th single-view user attribute graph G m adjacency matrix If the single-view user attribute diagram G m If there are edges between users, then... otherwise Let N be a single-view user attribute graph G. m The number of users in the single-view user attribute graph G m The attribute feature matrix is in It's a splicing operation, u N It is the attribute feature vector of the Nth user.

3. The method according to claim 2, characterized in that, Graph Convolutional Neural Networks (GCNs) are used to aggregate neighbor information to obtain low-dimensional vector representations. Reconstructed attribute feature matrix in, I N It is the identity matrix. yes The degree matrix, W represents the parameter matrix of the graph convolutional neural network GCN. g This is the parameter matrix trained in the deconvolution layer. δ is the activation function of the decoder.

4. The method according to claim 2, characterized in that, Unified and comprehensive user representation in, This represents the embedding representation of node i in the k-th single-view user attribute graph, and the attention weight of node i in the k-th single-view user attribute graph is... ω k It is the attention vector under the k-th single-view user attribute graph. It is the vector concatenation representation of node i under all single-view user attribute graphs.

5. The method according to claim 4, characterized in that, Clustering loss Among them, h ij It is Z i With the group center μ j Similarity between them h ik It is Z i With the group center μ k Similarities between them.

6. The method according to claim 2, characterized in that, The information in the attribute feature vector includes the number of user groups, the total number of messages, the average message length, and the total message length.

7. The method according to claim 1, characterized in that, The k-means algorithm is used to obtain the initial cluster center.

8. A server, characterized in that, The method includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing each step of the method of any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images