A method for detecting spam comments on online social networks

Abstract

This invention relates to a method for detecting spam commenters on online social networks, comprising the following steps: Step 1, graph construction and preprocessing: A graph structure is constructed using online social platform users as nodes and user interaction relationships as edges, and an adjacency matrix is ​​built; some data is manually labeled, providing the node number and label, where 1 represents a spam commenter and 0 represents a normal user; a confidence vector is established; Step 2, graph neural network construction: The graph neural network consists of two layers, with the last layer having an output dimension of 2. The first dimension represents the confidence level of the neural network in classifying a node as a spam commenter, and the second dimension represents the confidence level of the neural network in classifying a node as a normal user. The graph neural network obtains the node's own features by aggregating the features of its neighbors, considering the category information of its neighbors when extracting node features, and implementing different feature aggregation strategies for different types of neighbors; Step 3, iterative optimization.

Description

Technical Field

[0001] This invention belongs to the field of data mining and relates to an anomaly detection method based on graph neural networks. This method models online social networks as graphs, considers spam commenters as anomalous nodes in the online social network, uses a graph neural network that incorporates edge information to extract features of online social network users, and inputs these features into a classifier for semi-supervised anomaly detection. Background Technology

[0002] With the development of the internet, more and more online platforms have emerged, such as Weibo, Dianping, and Douban. As the user base grows, so too do the number of meaningless and malicious comments on these platforms. Furthermore, some unscrupulous businesses hire specialized accounts to post positive reviews on their products in order to inflate their ratings. These malicious users severely damage the credibility of various online platforms. Manual review alone would consume a significant amount of manpower; therefore, the demand for intelligent detection of spam comments is increasing.

[0003] By modeling users as nodes and the various interactions between users as edges, online social networks can be built for online social platforms, allowing graph-based algorithms to detect spam senders. However, due to the complexity of graph data and the camouflage capabilities of spam senders, spam sender detection still faces several challenges.

[0004] Graph neural networks are widely used in various graph learning tasks due to their excellent performance in graph feature extraction. (FdGars) [1] This is one method that uses graph neural networks to detect spam commenters. However, to avoid detection by the algorithm, spam commenters may engage in deception, such as establishing normal interactions with a large number of legitimate users, or disguising their user attributes and comments to resemble those of normal users. Therefore, it is necessary to optimize the structure of the graph neural network to adapt to the spam commenter detection task when deception occurs.

[0005] [1]Wang J,Wen R,Wu C,et al.FdGars:Fraudster Detection via GraphConvolutionalNetworks in Online App Review System[C].In Companion of The 2019WorldWide Web Conference,2019:310–316 Summary of the Invention

[0006] The main objective of this invention is to provide a method for detecting spam commenters on online social networks, enabling more accurate detection of spam comment senders in social networks. The technical solution is as follows:

[0007] A method for detecting spam comments on online social networks includes the following steps:

[0008] Step 1: Graph Construction and Preprocessing

[0009] (1) Establish a graph structure with online social platform users as nodes and the interaction relationships between users as edges, and construct an adjacency matrix;

[0010] (2) Numericalize the user attributes and construct an attribute matrix, where each row of the attribute matrix represents the corresponding user's attribute;

[0011] (3) Manually annotate part of the data, give the node number and label of the annotated node, 1 represents spammers and 0 represents normal users, and divide the data into training set and test set;

[0012] (4) Establish a confidence vector Where N represents the number of nodes, and when the i-th bit is 0, it means that node i is more likely to be a normal user, and when the i-th bit is 1, it means that node i is more likely to be a spammer. The confidence vector is initialized such that the node with label 0 in the training set has a corresponding position of 0 in B, the node with label 1 in the training set has a corresponding position of 1 in B, and all other positions are 0.

[0013] Step 2, Graph Neural Network Construction

[0014] The graph neural network consists of two layers. The output dimension of the last layer is 2. The first dimension represents the confidence level of the neural network in classifying a node as a spammer, and the second dimension represents the confidence level of the neural network in classifying a node as a normal user. The graph neural network obtains the node's own features by aggregating the features of its neighbors. When extracting node features, it considers the category information of its neighbors and executes different feature aggregation strategies for different types of neighbors.

[0015] Each layer of a graph neural network includes the following process:

[0016] (1) Use a fully connected layer to integrate the features h of user u u Dimensionality reduction yields the reduced user features z. u The formula is as follows:

[0017] z u =W t h u

[0018] in, Let d be the weight matrix of the fully connected layer. inLet d be the input dimension for this layer. out This is the output dimension for this layer;

[0019] (2) Treat node v as the central node. For each neighbor u of node v under relation r, calculate its importance coefficient according to its relationship with the central node. The formula is as follows:

[0020]

[0021] in, These are trainable weight vectors;

[0022] (3) Determine whether the neighbors of a node are of the same class based on the confidence vector B, and put the neighbors of the same class of node v under relation r into the set. In the middle, different neighbors are placed into a set. middle;

[0023] (4) Normalize the importance coefficients of the two types of neighbors to obtain the attention scores used for aggregation; for a neighbor u of node v under relation r, if node u is of the same type as node v, then its attention score is... It can be obtained from the following formula:

[0024]

[0025] in, Let be the set of similar neighbors of node v; exp is the natural exponential function; σ is the nonlinear activation function; similarly, if a neighboring node is dissimilar to node v, then its attention score is... It can be obtained from the following formula:

[0026]

[0027] in, Let v be the set of heterogeneous neighbors of node v;

[0028] (5) Calculate the embeddings of the same type of neighbors of the central node v under relation r based on the attention scores obtained in the previous step. Embedding of heterogeneous neighbors of central node v The calculation formula is as follows:

[0029]

[0030]

[0031] (6) For each node v, with its feature z v The k-nearest neighbor graph is constructed by obtaining the k-nearest neighbor nodes based on the Euclidean distance of the node's features to other nodes.

[0032] (7) According to Perform an aggregation operation to obtain the k-nearest neighbor embedding h for each node v. knn,v The formula is as follows:

[0033]

[0034] Where K is the number of neighbors selected from the k nearest neighbors; This is the weight matrix; Let v be the set of k nearest neighbors of node v;

[0035] (8) For each node v, embed its similar neighbors. Heterogeneous Neighbor Embedding and k nearest neighbor embedding h knn,v The fusion yields the comprehensive embedding of node v under relation r.

[0036] (9) Introduce a multi-head attention mechanism, repeat steps (1) to (8) a total of H times, and then... After concatenating the features of node v under multi-head attention in relation r, we obtain the following features.

[0037] (10) Employing splicing and linear transformation operations to transform multiple relations Integrate into h′ v ;

[0038] The output h of the last layer is obtained by stacking two graph neural network layers. v,out The output is a two-dimensional vector; the first dimension represents the confidence level of node v for spammers, and the second dimension represents the confidence level of node v for legitimate users; for h v,out After performing the softmax operation, the probability value of a node being a normal node or an abnormal node can be represented; when h v,out When the value of the 0th dimension is greater than the value of the 1st dimension, the node is determined to be a normal node; when h v,out When the value of the first dimension is greater than the value of the zeroth dimension, the node is determined to be an abnormal node;

[0039] Step 3, Iterative Optimization

[0040] (1) Input the entire graph into the graph neural network and obtain the output result h. out , It is all of h v,out Vertical splicing;

[0041] (2) Undersample the training labels to obtain the set of nodes participating in the loss calculation. This ensures that the number of normal nodes participating in the loss calculation is close to the number of abnormal nodes, in order to avoid the impact of label 0-1 imbalance.

[0042] (3) Calculate according to the following formula loss

[0043]

[0044] Among them, y v The label representing node v;

[0045] (4) Output h based on the model out Update the confidence vector B so that h out In B, the row whose first dimension is greater than the second dimension is represented by a 1, and the rest are represented by 0.

[0046] (5) Based on the loss Execute the gradient descent algorithm;

[0047] (6) When loss Stop training when convergence occurs;

[0048] Step 4: Output unlabeled user categories

[0049] (1) Obtain the model output h out Extract the rows corresponding to the nodes without labels;

[0050] (2) If node i is in h out If the value of the first dimension of the corresponding row is greater than the value of the second dimension, then the node is a spammer; otherwise, it is a normal user.

[0051] This patent first models users as nodes and the interactions between users as edges to establish a graph structure. Simultaneously, a small number of spam comment senders are manually labeled. Then, a graph neural network is built, mainly consisting of three parts: neighborhood feature extraction, global feature extraction, and feature fusion. The graph neural network ultimately outputs a two-dimensional vector. The first dimension can be considered the probability that a user is a spam comment sender, and the second dimension can be considered the probability that a user is a legitimate user. Then, a gradient descent algorithm is used for iterative optimization. In each iteration, the loss of the neural network is calculated using label information and cross-entropy, and the neural network parameters are updated using gradient descent according to the loss. Finally, after the loss converges, the output of the neural network is obtained as the detection result. This invention has the following characteristics: less manually labeled information is required; and it has a high detection capability for disguised spam comment senders. Attached Figure Description

[0052] Appendix Figure 1 Flowchart of implementation steps. Detailed Implementation

[0053] Users on online social platforms have various interactive relationships. For example, on Dianping (a Chinese review platform), users may interact through mutual reviews or by jointly reviewing the same item. Therefore, this invention mainly addresses the problem of detecting spam comment senders on multi-relationship graphs. For a multi-relationship graph... in, Represents a set of nodes. This represents the set of node attributes. For each relation r∈{1,2,…,R}, there is a set of edges. in, Representative node v i and node v j There is an edge under relation r. The specific steps of this invention are as follows:

[0054] 1) Graph construction and preprocessing

[0055] The first step is to build a graph structure with users as nodes and the interaction relationships between users as edges, and construct an adjacency matrix.

[0056] The second step is to quantify the user attributes and construct an attribute matrix, where each row of the matrix represents the corresponding user's attribute.

[0057] The third step involves manually labeling 3% of the data, providing the node number and label for each labeled node. 1 represents a spammer, and 0 represents a legitimate user.

[0058] The fourth step is to divide the training set and the test set according to manual annotation, with a ratio of 7:3.

[0059] Fifth step, establish a confidence vector. Where N represents the number of nodes, and a 0 in the i-th position indicates that node i is more likely to be a normal user, while a 1 in the i-th position indicates that node i is more likely to be a spammer. Initialize this confidence vector such that the position corresponding to a node with a label of 0 in the training set is 0 in B, and the position corresponding to a node with a label of 1 in the training set is 1 in B. All other positions are 0.

[0060] 2) Construction of Graph Neural Networks

[0061] The graph neural network consists of two layers. The output dimension of the last layer is 2. The first dimension represents the confidence level of the neural network in identifying a node as a spammer, and the second dimension represents the confidence level of the neural network in identifying a node as a normal user.

[0062] Previous methods for detecting spam commenters often overlooked the possibility of spammers disguising themselves. Graph neural networks aggregate features from a node's neighbors to extract its own features. If a spammer interacts with a large number of legitimate users, the spammer's features might resemble those of legitimate users after passing through the graph neural network. Therefore, this invention considers the category information of its neighbors when extracting node features, applying different feature aggregation strategies for different types of neighbors.

[0063] Each layer of the neural network includes the following process:

[0064] Algorithm 1: Graph Neural Network with Fusion Edge Types

[0065] The first step is to use a fully connected layer to extract the features h of user u. u Dimensionality reduction yields the reduced user features z. u The specific formula is as follows:

[0066] z u =W t h u

[0067] in, Let d be the weight matrix of the fully connected layer. in Let d be the input dimension for this layer. out This is the output dimension for this layer;

[0068] The second step is to treat node v as the central node, and for each neighbor u of node v under relation r, calculate its importance coefficient according to its relationship with the central node. The specific formula is as follows:

[0069]

[0070] in, These are trainable weight vectors.

[0071] The third step is to determine whether a node's neighbors are of the same class based on the confidence vector B, and then add the neighbors of node v under relation r to the set. In the middle, different neighbors are placed into a set. middle.

[0072] The fourth step is to normalize the importance coefficients of the two types of neighbors to obtain the attention scores used for aggregation. For a neighbor u of node v under relation r, if node u is of the same type as node v, then its attention score is... It can be obtained from the following formula:

[0073]

[0074] in, Let be the set of similar neighbors of node v; exp is the natural exponential function; σ is an arbitrary nonlinear activation function. Similarly, if a neighboring node is dissimilar to node v, then its attention score is... It can be obtained from the following formula:

[0075]

[0076] in, Let v be the set of heterogeneous neighbors of node v.

[0077] Fifth, based on the attention scores calculated in the previous step, calculate the embeddings of the same type of neighbors of the central node v under relation r. Embedding of heterogeneous neighbors of central node v The calculation formula is as follows:

[0078]

[0079]

[0080] Step 6: For each node v, use its feature z v The k-nearest neighbor graph is constructed by obtaining the k-nearest neighbor nodes based on the Euclidean distance of the node's features to other nodes.

[0081] Step 7, according to Perform an aggregation operation to obtain the k-nearest neighbor embedding h for each node v. knn,v The formula is as follows:

[0082]

[0083] Where K is the number of neighbors selected from k nearest neighbors, which is usually 2; This is the weight matrix; Let v be the set of k nearest neighbors of node v.

[0084] Step 8: For each node v, embed its similar neighbors. Heterogeneous Neighbor Embedding and k nearest neighbor embedding h knn,v The fusion yields the comprehensive embedding of node v under relation r.

[0085]

[0086] in, It is a linear transformation matrix used to integrate the node's own embedding, similar neighbor embedding, dissimilar neighbor embedding, and k-nearest neighbor embedding into d. out A vector of dimension; || is the concatenation operation.

[0087] Step nine, introduce a multi-head attention mechanism, repeat steps one through eight a total of H times, and then... After concatenating the features of node v under multi-head attention in relation r, we obtain the following features. The recommended value for H is 4.

[0088] Step 10: Under multiple relationships Integrate into h′ v This can be achieved directly using concatenation and linear transformation operations. The formula is as follows:

[0089]

[0090] in, This is the weight matrix, used to weight Rd out Dimensionality reduction of node features from 1D to d out .

[0091] The above describes the operation flow of a single-layer graph neural network. The output is a two-dimensional vector. The first dimension represents the confidence level of node v for spammers, and the second dimension represents the confidence level of node v for legitimate users. For h... v,out After performing the softmax operation, the probability value of a node being a normal node or an abnormal node can be represented. When h v,out When the value of the 0th dimension is greater than the value of the 1st dimension, the node is determined to be a normal node; when h v,out When the value of the first dimension is greater than the value of the 0th dimension, the node is determined to be an abnormal node.

[0092] 3) Iterative optimization

[0093] The first step is to input the entire graph into the graph neural network and obtain the output result h. out . It is all of h v,out Vertical splicing.

[0094] The second step is to undersample the training labels to obtain the set of nodes that participate in the loss calculation. This ensures that the number of normal nodes participating in the loss calculation is close to the number of abnormal nodes, thus avoiding the impact of label 0-1 imbalance.

[0095] Third step, calculate according to the following formula loss

[0096]

[0097] Among them, y v The label representing node v.

[0098] Fourth step, output h based on the model. out Update the confidence vector B so that h outIn B, the row whose first dimension is greater than the second dimension has a corresponding position of 1, and the rest have a position of 0.

[0099] Fifth step, based on the loss Execute the gradient descent algorithm.

[0100] Step 6, when losses Stop training when convergence occurs.

[0101] 4) Output of unlabeled user categories

[0102] The first step is to obtain the model output h. out Extract the rows corresponding to nodes that are not labeled.

[0103] The second step is to check if node i is in h. out If the value of the first dimension of the corresponding row is greater than the value of the second dimension, then the node is a spammer; otherwise, it is a normal user.

[0104] The third step, if it is necessary to obtain various metrics such as the model's accuracy, is to use the labels of the test set and their corresponding output results for the appropriate calculations.

[0105] This invention is applicable to spam sender detection tasks on various online platforms. Furthermore, the method of this invention can effectively detect disguised spam senders. In Amazon's musical instrument product review data, this invention constructs a graph structure with users as nodes, user interactions as edges, and user attributes as node features. After iterative training using a graph neural network, a candidate list of spam senders is output. Its recall rate can reach 90%.

Claims

1. A method for detecting spam comments on online social networks, comprising the following steps: Step 1: Graph Construction and Preprocessing (1) Establish a graph structure with online social platform users as nodes and the interaction relationships between users as edges, and construct an adjacency matrix; (2) Numericalize the user attributes and construct an attribute matrix, where each row of the attribute matrix represents the corresponding user's attribute; (3) Manually annotate part of the data, give the node number and label of the annotated node, 1 represents spammers and 0 represents normal users, and divide the data into training set and test set; (4) Establish a confidence vector Where N represents the number of nodes, and when the i-th bit is 0, it means that node i is more likely to be a normal user, and when the i-th bit is 1, it means that node i is more likely to be a spammer. Initialize the confidence vector such that the node with label 0 in the training set has a corresponding position of 0 in B, the node with label 1 in the training set has a corresponding position of 1 in B, and all other positions are 0. Step 2, Graph Neural Network Construction The graph neural network consists of two layers. The output dimension of the last layer is 2. The first dimension represents the confidence level of the neural network in classifying a node as a spammer, and the second dimension represents the confidence level of the neural network in classifying a node as a normal user. The graph neural network obtains the node's own features by aggregating the features of its neighbors. When extracting node features, it considers the category information of its neighbors and executes different feature aggregation strategies for different types of neighbors. Each layer of a graph neural network includes the following process: (1) Use a fully connected layer to transfer the features h of user u u Dimensionality reduction yields the reduced user features z. u The formula is as follows: z u =W t h u in, Let d be the weight matrix of the fully connected layer. in Let d be the input dimension for this layer. out This is the output dimension for this layer; (2) Treat node v as the central node. For each neighbor u of node v under relation r, calculate its importance coefficient according to its relationship with the central node. The formula is as follows: in, These are trainable weight vectors; (3) Determine whether the neighbors of a node are of the same class based on the confidence vector B, and put the neighbors of the same class of node v under relation r into the set. In the middle, different neighbors are placed into a set. middle; (4) Normalize the importance coefficients of the two types of neighbors to obtain the attention scores used for aggregation; for a neighbor u of node v under relation r, if node u is of the same type as node v, then its attention score is... It can be obtained from the following formula: in, Let be the set of similar neighbors of node v; exp is the natural exponential function; σ is the nonlinear activation function; similarly, if a neighboring node is dissimilar to node v, then its attention score is... It can be obtained from the following formula: in, Let v be the set of heterogeneous neighbors of node v; (5) Calculate the embeddings of the same type of neighbors of the central node v under relation r based on the attention scores obtained in the previous step. Embedding of heterogeneous neighbors of central node v The calculation formula is as follows: (6) For each node v, with its feature z v The k-nearest neighbor graph is constructed by obtaining the k-nearest neighbor nodes based on the Euclidean distance of the node's features to other nodes. (7) According to Perform an aggregation operation to obtain the k-nearest neighbor embedding h for each node v. knn,v The formula is as follows: Where K is the number of neighbors selected from the k nearest neighbors; This is the weight matrix; Let v be the set of k nearest neighbors of node v; (8) For each node v, embed its similar neighbors. Heterogeneous Neighbor Embedding and k nearest neighbor embedding h knn,v The fusion yields the comprehensive embedding of node v under relation r. (9) Introduce a multi-head attention mechanism, repeat steps (1) to (8) a total of H times, and then... After concatenating the features of node v under multi-head attention in relation r, we obtain the following features. (10) Using splicing and linear transformation operations to transform multi-relational relationships Integrate into h ′ v ; The output h of the last layer is obtained by stacking two graph neural network layers. v,out The output is a two-dimensional vector; the first dimension represents the confidence level of node v for spammers, and the second dimension represents the confidence level of node v for legitimate users; for h v,out After performing the softmax operation, the probability value of a node being a normal node or an abnormal node can be represented; when h v,out When the value of the 0th dimension is greater than the value of the 1st dimension, the node is determined to be a normal node; when h v,out When the value of the first dimension is greater than the value of the zeroth dimension, the node is determined to be an abnormal node; Step 3, Iterative Optimization (1) Input the entire graph into the graph neural network and obtain the output result h. out , It is all of h v,out Vertical splicing; (2) Undersample the training labels to obtain the set of nodes participating in the loss calculation. This ensures that the number of normal nodes participating in the loss calculation is close to the number of abnormal nodes, in order to avoid the impact of the imbalance between labels 0 and 1; (3) Calculate according to the following formula loss Among them, y v The label representing node v; (4) Output h based on the model out Update the confidence vector B so that h out In B, the row whose first dimension is greater than the second dimension is represented by a 1, and the rest are represented by 0. (5) Based on the loss Execute the gradient descent algorithm; (6) When loss Stop training when convergence occurs; Step 4: Output unlabeled user categories (1) Obtain the model output h out Extract the rows corresponding to the nodes that are not labeled; (2) If node i is in h out If the value of the first dimension of the corresponding row is greater than the value of the second dimension, then the node is a spammer; otherwise, it is a normal user.

Images