An abnormal user detection method in an online dating app

Abstract

The application discloses an abnormal user detection method in an online dating APP, first, a trust model of a user is comprehensively constructed; the result output by the trust model is processed again through data balancing; then, normal users and malicious users are labeled, and a data set suitable for a graph neural network is constructed; the constructed data set is trained by using a GraphSage method in the graph neural network, a random sampling of neighbors is adopted to control the size of a K-order subgraph of a node, and on this basis, the sampled subgraphs are randomly combined to complete the training; finally, the trained graph neural network model is used for detecting new user data. The method fully combines personal information, conversation information and interaction information of a user to construct a trust model, and by using the powerful recognition function of the graph neural network, the malicious user in the online dating APP can be automatically distinguished. The recognition accuracy is obviously improved.

Description

Technical Field

[0001] This invention belongs to the field of social networks and uses deep learning methods to identify malicious users in online dating apps. Background Technology

[0002] Graphs, as a general-purpose data structure, are widely used to represent complex structured data. Compared to other data structures, they can better store and express entities and their relationships. Graph anomaly detection refers to searching for structures containing "unfamiliar" or "unusual" patterns in a large graph or massive graph database, and it has a wide range of applications. Compared to traditional anomaly detection methods, graph-based anomaly detection, due to the powerful expressive capabilities of graphs, can not only present complex data intuitively but also incorporate implicit correlations within the data into the anomaly detection process.

[0003] As malicious users on social networks become increasingly sophisticated and covert in their disguises, effectively identifying them has become increasingly important. Malicious user detection systems based on trust models and graph neural networks can quickly and effectively detect malicious users, which is of great significance for maintaining network order and creating a healthy online environment.

[0004] Unlike other identification methods based on traditional machine learning, this invention fully integrates users' basic personal information, user interaction information, and user dialogue information to construct a trust model. The graph neural network can then fully utilize the information from this trust model to output the user's suspiciousness level. This also results in a significant improvement in identification accuracy. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing technologies and, in order to fully leverage the powerful recognition capabilities of graph neural networks in social networks and improve the accuracy of identifying malicious users in dating apps, propose a malicious user identification method based on a trust model and graph neural networks.

[0006] The technical solution adopted by the present invention to solve its technical problem includes: constructing a trust model and using graph neural networks for detection.

[0007] A method for detecting abnormal users in an online dating app, the steps of which are as follows:

[0008] Step 1: Calculate the completeness of user personal information using user personal information, calculate the abnormality of user interaction using user interaction information, calculate the abnormality of user dialogue using user dialogue information, and comprehensively construct the user's trust model.

[0009] Step 2: Perform data balancing and reprocessing on the results output by the trust model.

[0010] Step 3: Label normal users and malicious users to build a dataset suitable for graph neural networks.

[0011] Step 4: Train the constructed dataset using the GraphSage method in graph neural networks. Starting from a group of central nodes, the size of the K-order subgraph of the node is controlled by randomly sampling the neighbors. On this basis, the sampled subgraphs are randomly combined to complete the training.

[0012] Step 5: Use the trained graph neural network model to detect new user data.

[0013] The beneficial effects of this invention are as follows:

[0014] This invention fully integrates the experience of online dating experts in identifying malicious users. It constructs a trust model by combining user information, conversation data, and interaction information, and utilizes the powerful recognition capabilities of graph neural networks to automatically identify malicious users in online dating apps. It also significantly improves recognition accuracy. Attached Figure Description

[0015] Figure 1 This is a structural diagram of the abnormal user detection method proposed in this invention. Detailed Implementation

[0016] The method of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0017] The data source is active users from the online dating platform "Xiéhù Sīnián" in November, December, and January 2018. A total of 6,230 users were selected, including 6,152 normal users and 78 abnormal users. User information data is 30MB in size and mainly includes users' gender, height, weight, age, and education level. User chat data is 70MB in size, including 100,000 conversations. User interaction data is 50MB in size, including the number of user conversations, the duration of each conversation, and the frequency of user browsing.

[0018] like Figure 1 As shown, a method for detecting abnormal users in an online dating app includes the following steps:

[0019] Step 1: Calculate the completeness of user personal information using user personal information, calculate the abnormality of user interaction using user interaction information, calculate the abnormality of user dialogue using user dialogue information, and comprehensively construct the user's trust model.

[0020] The specific steps for constructing the trust model are as follows:

[0021] User information completeness is calculated based on whether and how complete the user's personal information has been provided. Let the user information completeness be represented by Info, and the specific calculation formula is as follows:

[0022]

[0023] Where *complete* represents the number of entries filled in by the user in the basic information section, and *length* represents the total number of basic information entries; together, they constitute the completeness of the basic information. Similarly, *Kcomplete* represents the number of entries filled in by the user in the important information section, and *Klength* represents the total number of important information entries; together, they constitute the completeness of the important information. α∈(0,1) is a user-defined parameter. For the calculation of user information completeness, the impact of the completeness of important information is greater than that of the completeness of basic information; therefore, a higher impact factor is set for the completeness of important information. In this method, α = 0.75.

[0024] Based on user interaction information, a user behavior anomaly score is calculated. The calculation results are derived from three indicators: the number of conversations (NumTalkAB), the duration of conversations (TimeAB), and the frequency of user browsing (FrequencyAB).

[0025] Evaluation=α*NumTalkAB+β*TimeAB+γ*FrequencyAB

[0026] In this experiment, α was set to 0.2, β was set to 0.8, and γ was set to 0.5.

[0027] Based on user chat information, an LDA topic model is used to identify abnormal user conversation topics. First, all user chat texts are preprocessed, then the LDA topic model is trained to extract information from the conversations, thereby determining the probability that a user's chat data belongs to a malicious topic.

[0028] By combining three indicators—the completeness of the user's personal information, the rating scores between users, and the abnormality of user conversations—a user trust model is constructed.

[0029] Step two, the process of data balancing and reprocessing the results output by the trust model, is as follows:

[0030] 2-1. Use the DBSCAN algorithm to cluster all users. First, determine all core user objects in the dataset based on the given neighborhood parameters. Then, starting from any core object, find the cluster set composed of related user samples until all core objects have been visited. Finally, determine all cluster partitions.

[0031] 2-2. Using the KNN algorithm, with anomalous users within a cluster as the center, calculate the average Euclidean distance between all normal users and anomalous users within that cluster, and sort the results in ascending order. Finally, select the top 70% of normal user samples from each cluster to form a new set of normal users.

[0032] 2-3. Use the BSMOTE oversampling algorithm to enrich the set of anomalous users.

[0033] 2-4. The abnormal user set processed by the BSMOTE algorithm and the normal user set clustered by the KNN algorithm in 2-2 are combined to form the training set in this experiment. The remaining data is the test set, that is, the ratio of the training set to the test set is 7:3.

[0034] Step 3: Label normal users and malicious users to build a dataset suitable for graph neural networks.

[0035] Domain experts synthesize the results from steps one and two, combining them with their own domain experience to identify malicious user data, and then construct a graph dataset based on user activity information within the app. Each user is treated as a node in the graph dataset, and their activity information serves as the edges.

[0036] Step 4: Train the constructed dataset using the GraphSage method in graph neural networks. Starting from a group of central nodes, control the size of the K-order subgraph of the node by randomly sampling the neighbors. On this basis, randomly combine the sampled subgraphs to complete the training.

[0037] The specific process of using GraphSage for relation aggregation is described below:

[0038] 4-1. Sample the neighboring nodes of each vertex in the graph. In this method, let K=5, that is, each vertex can learn its own graph embedding representation based on the information of its 5-hop neighboring nodes at most. In the loop i of each layer, for each vertex v, first use the (i-1)th layer embedding representation of v's neighboring nodes to generate the i-th layer aggregate representation of its neighboring vertices. After that The (i-1)th layer representation of vertex v is concatenated with the representation of vertex v at level i, and a nonlinear transformation is performed to generate the embedding representation of vertex v at level i.

[0039] 4-2. Aggregate the information contained in neighboring vertices using an aggregation function. Since the vertices in the graph are unordered, the aggregation function should ideally be symmetric and have high expressive power. This method uses a pooling aggregation function, which involves first performing a linear transformation on the embeddings of all neighboring nodes using a fully connected layer, followed by max pooling. Specifically, the neighboring node representation vectors of the target vertex undergo a non-linear transformation, followed by a pooling operation. The result is concatenated with the target vertex's representation vector, and finally, a non-linear transformation is performed again to obtain the k-th layer representation vector of the target vertex. The pooling formula is as follows:

[0040]

[0041] in, W represents the embedding of node v's neighbor node u in level k-1. pool is the pooling aggregator, and b is one of its parameters.

[0042] 4-3. Define the cross-entropy loss function to optimize the weight coefficients W of GraphSage. Assume the training set is Q, and for each node v∈Q, the true label is Yv, and the predicted label is the prediction matrix Z∈Rn*c. Represent all nodes in the training set using the cross-entropy loss function as follows:

[0043]

[0044] Finally, the sampled subgraphs are randomly combined to complete the training of GraphSage.

[0045] Step 5: Use the trained graph neural network model to detect new user data.

[0046] The above description, in conjunction with specific / preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. Those skilled in the art can make various substitutions or modifications to these described embodiments without departing from the inventive concept, and all such substitutions or modifications should be considered within the scope of protection of the present invention.

[0047] The parts of this invention not described in detail are well-known to those skilled in the art.

Claims

1. A method for detecting abnormal users in an online dating app, characterized in that, The steps are as follows: Step 1: Calculate the completeness of user personal information using user personal information, calculate the abnormality of user interaction using user interaction information, calculate the abnormality of user dialogue using user dialogue information, and comprehensively construct the user's trust model. Step 2: Perform data balancing and reprocessing on the results output by the trust model; the specific method is as follows: 2-1. Use the DBSCAN algorithm to cluster all users. First, determine all core user objects in the dataset based on the given neighborhood parameters. Then, starting from any core object, find the cluster set composed of related user samples until all core objects have been visited. Finally, determine all cluster partitions. 2-2. Using the KNN algorithm, with the abnormal users within the cluster range as the center, calculate the average Euclidean distance between all normal users and abnormal users within the cluster range, and sort the results from smallest to largest; finally, select the top 70% of normal user samples within each cluster range to form a new set of normal users. 2-3. Use the BSMOTE oversampling algorithm to enrich the set of anomalous users; 2-4. The set of abnormal users processed by the BSMOTE algorithm and the set of normal users clustered by the KNN algorithm in 2-2 are combined to form the training set in this experiment, and the remaining data is the test set; Step 3: Based on the data processed in Step 2, label normal users and malicious users, and use each user as a node in the graph dataset, with the user's operation information as the edge of the graph, to construct a dataset suitable for graph neural networks. Step 4: Train the constructed dataset using the GraphSage method in graph neural networks. Starting from multiple central nodes, randomly sample the neighbors to control the size of the node's K-order subgraph. On this basis, randomly combine the sampled subgraphs to complete the training. Step 5: Use the trained graph neural network model to detect new user data.

2. The method for detecting abnormal users in an online dating app according to claim 1, characterized in that, The specific steps for constructing the trust model are as follows: User information completeness is calculated based on whether and how complete the user's personal information has been provided. Let the user information completeness be represented by Info, and the specific calculation formula is as follows: Info = (1-a) * + a * Where complete represents the number of entries filled in by the user in the basic information, and length represents the total number of basic information entries, together constituting the completeness of the basic information; Kcomplete represents the number of entries filled in by the user in the important information, and Klength represents the total number of important information entries, together constituting the completeness of the important information, and α∈ (0,1) is a user-defined parameter; for the calculation of user information completeness, the impact of the completeness of important information is greater than that of the completeness of basic information, therefore a higher impact factor is set for the completeness of important information; The rating score between users is calculated based on user interaction information. The calculation results are derived from three indicators: the number of conversations (NumTalkAB), the duration of the conversation (TimeAB), and the frequency of the user being viewed (FrequencyAB). Evaluation = α* NumTalkAB + β* TimeAB + γ* FrequencyAB Where α is set to 0.2, β to 0.8, and γ to 0.5; Based on users' chat information, an LDA topic model is used to identify abnormal user conversation topics. First, the conversation text of all users is preprocessed, and then the LDA topic model is trained to obtain information in the conversation, thereby determining the probability that the user's chat data belongs to a malicious topic. By combining three indicators—the completeness of the user's personal information, the rating scores between users, and the abnormality of user conversations—a user trust model is constructed.

3. The method for detecting abnormal users in an online dating app according to claim 1, characterized in that, The specific method for step four is as follows: 4-1. Sample the neighboring nodes of each vertex in the graph; Let K=5, each vertex can learn its own graph embedding representation based on information from its neighbors at most 5 hops; in each loop i of the layer, for each vertex v, the i-1 layer embedding representations of v's neighbors are first used to generate the i-th layer aggregate representation of its neighboring vertices. , then The (i-1)th layer representation of vertex v is concatenated with the representation of vertex v at level i, and a nonlinear transformation is performed to generate the embedding representation of vertex v at level i. ; 4-2. Aggregate the information contained in neighboring vertices using aggregation functions; The aggregation function used is the pooling aggregation function. First, a fully connected layer is used to perform a linear transformation on the embeddings of all neighboring nodes, and then max pooling is performed. Specifically, a non-linear transformation is first performed on the representation vectors of the neighboring nodes of the target vertex, followed by a pooling operation. The result is concatenated with the representation vector of the target vertex, and finally a non-linear transformation is performed to obtain the k-th layer representation vector of the target vertex. The pooling formula is as follows: = max({σ( + b),∀u∈N(v)}) in, ∀u∈N(v) represents the embedding of node u, a neighboring node of node v in level k-1. pool For pooling aggregators, b is one of their parameters; 4-3. Define the cross-entropy loss function, optimize the weight coefficients W of GraphSage, and finally perform random combination of the sampled subgraphs to complete the training of GraphSage.

Images