A short video abnormal behavior recognition method based on user behavior sequence

Abstract

The application discloses a short video abnormal behavior recognition method based on user behavior sequence, relates to the risk control technical field, and specifically comprises the following steps: obtaining a comprehensive behavior sequence of a user, containing various attribute features of the user on a short video social platform; adopting a deep interest network DIN as a training model, and dividing the user behavior sequence into continuous value behavior features and discrete value behavior features; the continuous value behavior features and the discrete value behavior features are sorted in time sequence, the id and the device of the user are taken as conditional input, and then the deep interest network DIN makes accurate classification according to different users under the behavior sequence features; obtaining the continuous value behavior features and the discrete value behavior features of the user, based on the short video user behavior sequence recognition network structure of the deep interest network DIN, performing associated learning between the user behavior sequence features through an Attention structure and a full connection FC structure, and identifying water army users through behavior similarity and characteristics.

Description

Technical Field

[0001] This invention relates to the field of risk control technology, and in particular to a method for identifying abnormal behavior in short videos based on user behavior sequences. Background Technology

[0002] On short video social media platforms such as Douyin, Weibo, and Kuaishou, black market operators manipulate key metrics like followers, likes, and comments through bots and hired accounts, leading to a deteriorating environment and serious consequences. The opacity and independence of these accounts make it difficult for platform administrators to manually determine whether an account is violating regulations.

[0003] Currently, most methods for identifying short video troll accounts (abnormal behavior) focus on data statistics and text analysis. Data statistics require a large amount of account data to analyze similarities, including time, location, and tools. However, with technological advancements, trolls can now simulate normal user information. Text-based identification methods rely on natural language processing to obtain text information, but text content in short videos is often scarce, appearing mostly in video format. Analyzing the text within videos would significantly increase the difficulty and time required for identification, making it increasingly difficult to identify trolls on short video platforms using traditional methods. However, troll groups in short videos generate a large amount of data over time based on their actions such as liking, saving, and viewing. These data are correlated, and the behavior of different troll accounts exhibits characteristics of group similarity and sequential periodicity / density. For example, the accounts followed and saved by the same troll group are largely similar, and the time difference for liking is shorter compared to normal users.

[0004] Therefore, it is feasible to identify online trolls by analyzing user behavior sequences. Based on the characteristics of user behavior sequences, a method for identifying online trolls in short videos based on user behavior sequences is invented, which can improve the effective monitoring of online troll users in short videos. Summary of the Invention

[0005] The technical problem to be solved by this invention is to effectively identify troll (abnormal behavior) users on short video social platforms, provide timely and efficient monitoring channels for platform administrators, improve the quality of the online social environment, and combat the illegal activities of troll groups.

[0006] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0007] A method for identifying abnormal behavior in short videos based on user behavior sequences, specifically including the following steps;

[0008] Step 1: Obtain a complete sequence of user behavior, including various attribute characteristics of the user on short video social platforms;

[0009] Step 2: Use the Deep Interest Network (DIN) as the training model to divide user behavior sequences into continuous value behavior features and discrete value behavior features. The continuous value behavior features and discrete value behavior features are ordered in chronological order. The user's ID and device are used as conditional inputs, so that the Deep Interest Network (DIN) can make accurate classifications based on different users under the behavior sequence features.

[0010] Step 3: Obtain the continuous and discrete behavioral features of users. Based on the Deep Interest Network (DIN) short video user behavior sequence recognition network structure, the association learning between user behavior sequence features is carried out through the Attention mechanism structure and the fully connected FC structure. The bots are identified by behavioral similarity and characteristics.

[0011] As a further preferred embodiment of the short video abnormal behavior identification method based on user behavior sequence of the present invention, in step 1, the various attribute features of the user on the short video social platform include user account, work account, work collection account, whether the work has been viewed, whether the work has been liked, login device, work publication time, work duration, and work viewing time.

[0012] As a further preferred embodiment of the short video abnormal behavior identification method based on user behavior sequence of the present invention, in step 2, the continuous value behavior features on the short video platform include the account of the work, the account of the work collection, whether the work has been viewed, whether the work has been liked, the work publication time, the work duration, and the viewing time of the work.

[0013] Based on user accounts, the above continuous value behaviors under the same user are clustered and then sorted in chronological order to obtain the continuous value behavior sequence of a user over a period of time.

[0014] Con_act_seq={actions1,actions2,actions3,Lactions t}

[0015] actions t =(f1(t),f2(t),f3(t),Lf n (t))

[0016] Where t represents a certain moment, and Con_act_seq represents the continuous value behavior sequence features over a period of time; actions t f represents the set of all behavioral sequences generated by a user at time t; n (t) represents the value of different behaviors at time t, and n is the sequence number of the different behaviors;

[0017] Since the aforementioned continuous numerical values ​​mostly represent frequency or time points, when constructing the dataset, it is necessary to map the sorted values ​​sequentially to continuous real values, i.e.

[0018] To fully understand the relationships between continuous user behaviors across different time periods, the entire time period is divided into k sub-time periods, which can overlap, with d representing the overlap length, as detailed below:

[0019]

[0020] As a further preferred embodiment of the short video abnormal behavior recognition method based on user behavior sequence of the present invention, in step 2, the discrete value behavior sequence in the short video platform is the user account and login device. The discrete behavior sequence is constructed as a conditional input as an auxiliary condition for continuous value behavior features, as follows:

[0021] Dis_act_seq = {h1,h2,Lh} n}

[0022] Where Dis_act_seq represents all discrete actions h n The set of (t) values.

[0023] As a further preferred embodiment of the short video abnormal behavior recognition method based on user behavior sequences of the present invention, continuous value and discrete value user behavior sequence features are constructed from continuous value behavior features and discrete value behavior features, respectively, and combined according to the same user u_id.

[0024] Right now

[0025] The corresponding behavior sequence for all users in the data is as follows:

[0026] Where u represents users with different u_id, label l This represents the tag corresponding to each user, where l = 0, 1, 2... Different types of troll groups have different tags, including bot trolls, fake likes, and malicious comments, providing a more detailed breakdown of troll group types.

[0027] As a further preferred embodiment of the short video abnormal behavior recognition method based on user behavior sequence of the present invention, the network structure of the Deep Interest Network (DIN) is as follows:

[0028] The model input consists of continuous action sequence features (Con_act_seq) and discrete action sequence features (Dis_act_seq). These are then processed by an embedding layer to extract embedded features. These embedded features serve as the two inputs to the Attention module. The Attention module first multiplies the continuous action sequence feature set (actions) and the discrete action feature set (h), then concatenates them into a one-dimensional vector through a connection layer. This vector is then connected to three fully connected layers (FC), with each layer containing 128, 64, and 1 activation function and 1 neuron, respectively.

[0029] Obtain the weight parameters actionsweights for continuous action sequence features under the condition of discrete action sequence features;

[0030] The weight parameters obtained by the Attention module are multiplied by the corresponding input sequences to obtain the high-dimensional features of the final user behavior sequence. The SUM Pooling layer reduces the dimensionality of the high-dimensional features and concatenates them with the discrete behavior sequence features as the input to the three fully connected output layers (FC). The activation function is PReLU, and the neural networks are 512, 512, and 256, respectively. The output results are used to calculate the loss with the label, where the cross-entropy loss function is used.

[0031] As a further preferred embodiment of the short video abnormal behavior recognition method based on user behavior sequences of the present invention, the training parameters of the Deep Interest Network (DIN) are specifically set as follows:

[0032] When training the Deep Interest Network (DIN), the learning rate, batch size, number of iterations, behavior sequence length, neuron inactivation rate, and loss function are adjusted; the learning rate is set to 0.0001, the batch size to 10000, and the number of iterations to 50-100.

[0033] As a further preferred embodiment of the short video abnormal behavior recognition method based on user behavior sequence of the present invention, a random deactivation Dropout layer with a deactivation rate of 0.3 is added to the output of the deep interest network DIN; at the same time, the cross-entropy loss function is used to calculate the backpropagation error for each training.

[0034] Compared with the prior art, the present invention, employing the above technical solution, has the following technical effects:

[0035] 1. The user behavior sequence data used in this invention is not limited to a few pieces of information such as time, location, and device. Instead, it constructs data by incorporating various information such as users' likes, favorites, follows, dwell time, like interval time, and types of accounts they are interested in, thereby obtaining a comprehensive user behavior sequence and providing more information for subsequent model training.

[0036] 2. This invention uses Deep Interest Network (DIN) as the training model to divide user behavior sequences into continuous value behavior features and discrete value behavior features. The features are sorted in chronological order, and the user's ID and device are used as conditional inputs. This enables DIN to make accurate classifications based on different users under a series of behavior sequence features.

[0037] 3. This invention does not require statistical analysis of user data or semantic analysis of text. It only needs to obtain continuous and discrete behavioral sequence data of users as input. The entire model focuses on the order and duration of behaviors, which serves as the basis for distinguishing between different users. Attached Figure Description

[0038] Figure 1 This invention is a network diagram for short video user behavior sequence recognition based on DIN. Detailed Implementation

[0039] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings:

[0040] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0041] like Figure 1 As shown, a method for identifying abnormal behavior in short videos based on user behavior sequences specifically includes the following steps;

[0042] Step 1: Obtain a complete sequence of user behavior, including various attribute characteristics of the user on short video social platforms;

[0043] Step 2: Use the Deep Interest Network (DIN) as the training model to divide user behavior sequences into continuous value behavior features and discrete value behavior features. The continuous value behavior features and discrete value behavior features are ordered in chronological order. The user's ID and device are used as conditional inputs, so that the Deep Interest Network (DIN) can make accurate classifications based on different users under the behavior sequence features.

[0044] Step 3: Obtain the continuous and discrete behavioral features of users. Based on the Deep Interest Network (DIN) short video user behavior sequence recognition network structure, the association learning between user behavior sequence features is carried out through the attention mechanism structure and the fully connected (FC) structure. The bot users are identified by behavioral similarity and characteristics.

[0045] 1. User behavior sequence

[0046] User behavior sequence data includes various attribute features of users on short video social platforms. Since most short video platforms are similar, they mainly include user account (u_id), content account (item_id), content collection account (collect_id), whether the content has been viewed (finish), whether the content has been liked (like), login device (device), content publication time (time), content duration (dura_time), and viewing time (interval_time).

[0047] Therefore, it is necessary to first combine and feature-represent various user behavior sequence data in order to fully explore the correlations between behavioral features in subsequent model recognition. Based on time, behavioral sequences can be divided into continuous-value behavioral sequences and discrete-value behavioral sequences. Continuous-value behavioral sequences refer to behavioral sequences whose values ​​change over time, such as likes, favorites, and browsing time; these values ​​reflect the user's behavior over a continuous period. Discrete-value behavioral sequences, on the other hand, are independent features whose values ​​do not change over time, such as user accounts and login devices; these sequences do not exhibit differences in adjacent changes. Therefore, it is necessary to construct continuous-value behavioral features and discrete-value behavioral features separately. The main tasks of each sub-task are as follows:

[0048] (1) Characteristics of continuous value behavior

[0049] Continuous behavioral features on short video platforms mainly include the account name of the video (item_id), the account name of the user who collected the video (collect_id), whether the video was viewed completely (finish), whether the video was liked (like), the video's posting time (time), the video's duration (dura_time), and the viewing time (interval_time). These behavioral values ​​are dynamically changing. In particular, the time difference between adjacent behaviors is important information reflecting the account's status and is key for the model to determine whether there is group activity. First, using the user account (u_id) as the basis, the above behaviors under the same user are clustered, and then sorted chronologically to obtain the continuous behavioral sequence of a user over a period of time. Here, t represents a specific moment, Con_act_seq represents the continuous behavioral sequence features over a period of time; actions tf represents the set of all behavioral sequences generated by a user at time t; n (t) represents the value of different behaviors at time t, and n is the sequence number of different behaviors.

[0050] Con_act_seq={actions1,actions2,actions3,Lactions t}

[0051] actions t =(f1(t),f2(t),f3(t),Lf n (t))

[0052] Where t represents a certain moment, and Con_act_seq represents the continuous value behavior sequence features over a period of time; actions t f represents the set of all behavioral sequences generated by a user at time t; n (t) represents the value of different behaviors at time t, and n is the sequence number of the different behaviors;

[0053] Furthermore, since the aforementioned continuous numerical values ​​mostly represent frequencies, time points, etc., it is necessary to map the sorted values ​​sequentially to continuous real values ​​when constructing the dataset.

[0054] To fully learn the relationships between continuous user behaviors across different time periods, the entire time period is divided into k sub-time periods, which can overlap, with d representing the overlap length.

[0055]

[0056] (2) Characteristics of discrete value behavior

[0057] Discrete behavior sequences on short video platforms mainly consist of relatively stable sequences with minimal changes, such as user accounts (u_id) and login devices (device). These discrete values ​​cannot be ordered in continuous time and therefore cannot be mapped to continuous values. Therefore, learning the relationships between them through a model is not very meaningful. Instead, these discrete behavior sequences are constructed as conditional inputs, serving as auxiliary conditions for continuous behavior features. Here, Dis_act_seq represents all discrete behaviors h. n The set of (t) values.

[0058] Dis_act_seq = {h1,h2,Lh} n}

[0059] Where Dis_act_seq represents all discrete actions h n The set of (t) values.

[0060] (3) User behavior sequence dataset

[0061] User behavior sequence features with continuous and discrete values ​​are constructed from (1) and (2) respectively, and then combined according to the same user u_id, i.e. The corresponding behavior sequence for all users in the data is as follows:

[0062] Where u represents users with different u_id, label l This represents the tag corresponding to each user, where l = 0, 1, 2... Different types of troll groups have different tags, including bot trolls, fake likes, and malicious comments, providing a more detailed breakdown of troll group types.

[0063] 2. DIN Online Troll Account Identification Model

[0064] DIN networks have shown promising results in the field of interest-based recommendation, demonstrating significant effectiveness in extracting relationships from user behavior sequences over continuous time. However, on short-video social platforms, the behavior sequences of user accounts differ from those on e-commerce platforms, and the identification target shifts from recommending potentially interesting products to potentially violating "water army" accounts (accounts associated with online trolls or spammers). Therefore, this invention incorporates corresponding improvements at the input and output ends. The specific model structure is illustrated in the attached diagram. Figure 1 .

[0065] (1) DIN network structure

[0066] The model input consists of continuous action sequence features (Con_act_seq) and discrete action sequence features (Dis_act_seq). These are then processed by an embedding layer to extract embedded features. These embedded features serve as the two inputs to the Attention module. The Attention module first multiplies the continuous action sequence feature set (actions) and the discrete action feature set (h), then concatenates them into a one-dimensional vector through a connection layer. This vector is then connected to three fully connected layers (FC), with each layer containing 128, 64, and 1 activation function and 1 neuron, respectively.

[0067] Obtain the weight parameters actionsweights for continuous action sequence features under the condition of discrete action sequence features;

[0068] The weight parameters obtained by the Attention module are multiplied by the corresponding input sequences to obtain the high-dimensional features of the final user behavior sequence. The SUM Pooling layer reduces the dimensionality of the high-dimensional features and concatenates them with the discrete behavior sequence features as the input to the three fully connected output layers (FC). The activation function is PReLU, and the neural networks are 512, 512, and 256, respectively. The output results are used to calculate the loss with the label, where the cross-entropy loss function is used.

[0069] (2) DIN training parameter settings

[0070] This invention primarily adjusts the learning rate, batch size, number of iterations, behavior sequence length, neuron inactivation rate, and loss function when training the DIN network. The learning rate is set to 0.0001, the batch size to 10000, and the number of iterations to 50-100. To prevent overfitting, a Dropout layer is added to the model's output, with an inactivation rate of 0.3. Cross-entropy loss is used to calculate the backpropagation error for each training iteration. Furthermore, the behavior sequence length is set based on the amount of user-generated data.

[0071] This document provides a detailed implementation guide based on publicly available (decrypted) user behavior sequence data provided by the Douyin platform. Figure 1 The implementation process involves constructing training data from the publicly available Douyin dataset and testing the recognition performance.

[0072] 1. First, in the data preprocessing stage, the public data of the Douyin platform is processed into continuous value behavior sequence and discrete value behavior sequence data. The continuous behavior is selected from the account that collects the work (collect_id), whether it likes the work (like), the duration of the work (dura_time), and the duration of viewing the work (interval_time); the discrete behavior is selected from the user account (u_id) and the login device (device), with a total of 67,893 user data.

[0073] Then, training data is combined according to the preset labels [normal users: 0, bots: 1, likes boosting: 2], where the behavior sequence length is set to 150 and the overlap length d is set to 1.

[0074] The obtained data was split into training and testing sets in an 8:2 ratio, resulting in 5,648,815 training samples and 41,775 testing samples. Some of these samples are shown in Table 1.

[0075] Table 1. Continuous value behavior sequence features, discrete value behavior sequence features, and tags extracted by a user.

[0076]

[0077]

[0078] 2. Then follow Figure 1 The network structure and parameters utilize a deep learning framework to construct a Deep Interest Recognition Network (DIN). Input data is first embedded using an embedding operation to extract features with a dimension of 32. This is followed by an Attention module consisting of a product operator and three fully connected layers (FC). The activation functions and number of neurons in each layer are PRelu, PRelu, and Linear, and 128, 64, and 1, respectively. The output weights are then multiplied by the input data to obtain weighted features, which are then dimensionality-reduced using SUMPooling. These dimensionality-reduced features are concatenated with the conditional input and passed through three fully connected FC layers for classification. All activation functions are PRelu, and the neural network sizes are 512, 512, and 256. A Dropout layer is added at the end to prevent overfitting, with a dropout rate of 0.3. The training phase uses a learning rate of 0.0001, a batch size of 1000, and 50 iterations. The Adam optimizer is used to calculate the gradient of the loss function.

[0079] The test set data was fed into the trained model for prediction. In this embodiment, the recognition rate of Douyin (TikTok) bot accounts reached 77.48%, demonstrating good ability to identify different types of bot accounts. The model's accuracy will be further improved with larger datasets.

Claims

1. A method for identifying abnormal behavior in short videos based on user behavior sequences, characterized in that: Specifically, it includes the following steps; Step 1: Obtain a complete sequence of user behavior, including various attribute characteristics of the user on short video social platforms; Step 2: Use the Deep Interest Network (DIN) as the training model to divide user behavior sequences into continuous value behavior features and discrete value behavior features. The continuous value behavior features and discrete value behavior features are ordered in chronological order. The user's ID and device are used as conditional inputs, so that the Deep Interest Network (DIN) can make accurate classifications based on different users under the behavior sequence features. Step 3: Obtain continuous and discrete behavioral features of users. Based on the Deep Interest Network (DIN) short video user behavior sequence recognition network structure, the association learning between user behavior sequence features is carried out through the Attention mechanism structure and the fully connected FC structure. The bot users are identified by behavioral similarity and characteristics. In step 2, the continuous value behavioral features on the short video platform include the account of the work, the account that collected the work, whether the work has been viewed, whether the work has been liked, the time of publication of the work, the duration of the work, and the duration of viewing the work. Based on user accounts, the above continuous value behaviors under the same user are clustered and then sorted in chronological order to obtain the continuous value behavior sequence of a user over a period of time. Con_act_seq={actions1,actions2,actions3,…actions t } actions t =(f1(t),f2(t),f3(t),…f n (t)) Where t represents a certain moment, and Con_act_seq represents the continuous value behavior sequence features over a period of time; actions t f represents the set of all behavioral sequences generated by a user at time t; n (t) represents the value of different behaviors at time t, and n is the sequence number of the different behaviors; Since the aforementioned continuous numerical values ​​mostly represent frequency or time points, when constructing the dataset, it is necessary to map the sorted values ​​sequentially to continuous real values, i.e. To fully understand the relationships between continuous user behaviors across different time periods, the entire time period is divided into k sub-time periods, which can overlap, with d representing the overlap length, as detailed below:

2. The method for identifying abnormal behavior in short videos based on user behavior sequences according to claim 1, characterized in that: In step 1, the various attribute characteristics of users on short video social platforms include user account, work account, account that has collected works, whether the work has been viewed, whether the work has been liked, login device, work publication time, work duration, and viewing time of the work.

3. The method for identifying abnormal behavior in short videos based on user behavior sequences according to claim 1, characterized in that: In step 2, the discrete-value behavior sequence in the short video platform refers to the user account and login device. The discrete-value behavior sequence is constructed as a conditional input, serving as an auxiliary condition for the continuous-value behavior features, as follows: Dis_act_seq={h1,h2,…h n } Where Dis_act_seq represents all discrete actions h n The set of (t) values.

4. The method for identifying abnormal behavior in short videos based on user behavior sequences according to claim 1, characterized in that: Continuous and discrete user behavior sequence features are constructed from continuous and discrete behavioral features respectively, and then combined according to the same user u_id. Right now The corresponding behavior sequence for all users in the data is as follows: Where u represents users with different u_id, label l This represents the tag corresponding to each user, where l = 0, 1, 2... Different types of troll groups have different tags, including bot trolls, fake likes, and malicious comments, providing a more detailed breakdown of troll group types.

5. The method for identifying abnormal behavior in short videos based on user behavior sequences according to claim 1, characterized in that: The specific network structure of the Deep Interest Network (DIN) is as follows: The model input consists of continuous action sequence features (Con_act_seq) and discrete action sequence features (Dis_act_seq). These are then processed by an embedding layer to extract embedded features. These embedded features serve as the two inputs to the Attention module. The Attention module first multiplies the continuous action sequence feature set (actions) and the discrete action feature set (h), then concatenates them into a one-dimensional vector through a connection layer. This vector is then connected to three fully connected layers (FC), with each layer containing 128 activation functions (PReLU), 64 activation functions (Linear), and 1 neuron. Obtain the weight parameters (actions weights) of continuous action sequence features under the condition of discrete action sequence features; The weight parameters obtained by the Attention module are multiplied by the corresponding input sequences to obtain the high-dimensional features of the final user behavior sequence. The SUM Pooling layer reduces the dimensionality of the high-dimensional features and concatenates them with the discrete behavior sequence features as the input to the three fully connected output layers (FC). The activation function is PReLU, and the neural networks are 512, 512, and 256, respectively. The output results are used to calculate the loss with the label, where the cross-entropy loss function is used.

6. The method for identifying abnormal behavior in short videos based on user behavior sequences according to claim 5, characterized in that: The training parameters for the Deep Interest Network (DIN) are set as follows: When training the Deep Interest Network (DIN), the learning rate, batch size, number of iterations, behavior sequence length, neuron inactivation rate, and loss function are adjusted; the learning rate is set to 0.0001, the batch size to 10000, and the number of iterations to 50-100.

7. The method for identifying abnormal behavior in short videos based on user behavior sequences according to claim 6, characterized in that: A random deactivation Dropout layer with a deactivation rate of 0.3 was added to the output of the deep interest network DIN; at the same time, the cross-entropy loss function was used to calculate the backpropagation error for each training session.

Images