Online social media malicious user detection method based on user behavior data

Abstract

The present application belongs to the technical field of big data mining, and specifically relates to an online social media malicious user detection method based on user behavior data, wherein the main innovation point compared with existing work is that an interaction graph is constructed by using user historical behavior, and a structural hole theory is introduced to measure the importance of user nodes to identify malicious users. The algorithm of the present application comprises the following steps: constructing an online social media user behavior data sequence; using a recurrent neural network and an attention mechanism to perform vector representation on the fine-grained time sequence behavior of a user to obtain behavior sequence features; performing structural representation on the descriptive information of a user account to obtain descriptive features of the account; constructing a user social relationship graph according to the social relationship or behavior data of the user, and using the structural hole theory to obtain social relationship features of the user; and combining the behavior sequence probability features, the descriptive features and the social relationship features of the user into a classification algorithm to train a malicious user detection model. The algorithm of the present application has high detection accuracy.

Description

Technical Field

[0001] The present invention belongs to the technical field of big data mining, and in particular relates to a method for detecting malicious users in online social media based on user behavior data. Background Art

[0002] In recent years, online social networks (OSNs) have attracted billions of users worldwide. They have become indispensable platforms for people's work and daily lives, as well as crucial channels for news dissemination and public opinion, playing a vital role in social and economic development. However, the open nature of social networks makes it easier for malicious users to register accounts, allowing them to launch various types of attacks at a lower cost. Because information on social networks spreads widely, quickly, and to a wide audience, information released by malicious users on these platforms is more likely to be widely disseminated, causing adverse effects. These accounts can post reviews of businesses on the websites that are inconsistent with the actual situation, disrupting the normal review process and misleading users. Detecting malicious users on social network platforms has become a significant research area, garnering significant attention from both academia and industry in recent years.

[0003] To promptly and accurately detect malicious users on social networks and maintain information reliability and operational order, scholars from around the world have conducted a series of explorations and research on the problem of detecting malicious users on social networks. Graph segmentation theory, trust propagation models, Markov models, deep neural networks, and other theories and models have been widely applied to model and analyze the characteristics of social network user groups and individual malicious users. Malicious users on online social networks are diverse, and the use of large-scale network structure graph analysis and behavioral guidelines to identify common malicious users has become a primary method for detecting malicious users on online social networks. Summary of the Invention

[0004] The purpose of the present invention is to provide a method that can use the behavioral data generated by the user himself to accurately determine whether the user is a malicious user.

[0005] The present invention proposes a method for detecting malicious users in online social media based on user behavior data. The overall process is as follows: Figure 1As shown, it includes: using time series analysis methods to construct online social media user behavior data sequences; using recurrent neural networks to obtain vector representations of users' fine-grained time series behaviors in each time interval; using the attention mechanism to assign higher weights to the representation vectors that have a greater impact on the final malicious account discrimination based on the user's behavior vector representations in continuous time intervals; using a fully connected network to reduce the dimension of the user behavior representation vector sequence obtained by the attention mechanism, and obtain the probability characteristics of the user's behavior sequence characteristics reflecting that the user is a malicious user; by performing structured representation on the descriptive information of the user account, the descriptive characteristics of the account are obtained; constructing a user interaction relationship graph based on the user's interactive behavior data, and using a graph neural network to obtain the user's interactive relationship characteristics; constructing a user social relationship graph based on the user's interactive data, and using the structural hole theory to obtain the user's social relationship characteristics; merging the user behavior sequence probability characteristics, descriptive characteristics, interactive relationship characteristics, and social relationship characteristics into the classification algorithm to train a malicious user detection model.

[0006] The specific steps are:

[0007] Step 1: Extract fields and clean the public data generated by online social media users;

[0008] Step 2: For each user, construct a timeline sequence of historical behavior representations for the cleaned user data. Use a deep neural network to process this behavior sequence data to obtain fine-grained temporal behavior sequence features for each time interval. Use an attention mechanism to assign weights to user behavior features at different time intervals and aggregate them into a behavior sequence feature vector. Use a fully connected network to reduce the dimensionality of this feature vector and use the softmax activation function to convert it into a two-dimensional vector. This vector represents the probability of the user being malicious from the perspective of the behavior sequence, which serves as the time series feature.

[0009] Step 3: For each user in the cleaned user data, obtain their account descriptive data and historical behavior statistics to extract the user's descriptive features;

[0010] Step 4: For the cleaned user data, define the interaction behaviors between users based on their behavioral data. Connect an edge between users who have interacted with each other to form a user interaction relationship graph. Use a graph neural network to process the user interaction behavior network data and obtain a representation vector that characterizes the user interaction relationship as the interaction graph feature.

[0011] Step 5: For the cleaned user data, define the social behaviors between users based on their behavioral data. Connect an edge between users who have had social behaviors to form a user social relationship graph. Use the structural hole theory [2] to calculate the user's connection importance index as the social graph feature.

[0012] Step 6: Combine all the time series features, descriptive features, interaction graph features, and social graph features obtained in steps 2 to 5 and input them into a decision maker [3]. By training the decision maker, we can determine whether the user is a malicious user.

[0013] In the present invention, step 1 specifically includes:

[0014] Step 1-1: The data cleaning includes: removing all non-alphabetic characters, deleting all useless words, and deleting all missing rows;

[0015] Step 1-2: For the cleaned user data, filter out users who have posted more than 3 pieces of content on the social media.

[0016] In the present invention, step 2 specifically includes:

[0017] Step 2-1: For the cleaned user data, segment the user's behavior data along the timeline, aggregate the user's behavior data within a time unit, and extract descriptive features. For example, taking "one day" as the unit, aggregate the user's behavior data within one day and extract descriptive features.

[0018] Step 2-2: For the constructed user behavior descriptive feature sequence within a continuous time interval, use the staged long short-term memory neural network (PLSTM) [4] to process the constructed behavior representation sequence and obtain the vector representation of the behavior of each time interval from the level of the entire sequence behavior characteristics;

[0019] Step 2-3: The PLSTM network is used to process the user's behavioral features in each time interval to obtain a representation vector. The attention mechanism [1] is further used to increase the weight of the behavior vector for determining whether the user is a malicious user, and the user behavior representation vectors generated in consecutive time intervals are aggregated into one representation vector. For social media that can construct multiple time behavior sequences, the attention mechanism is used to aggregate the sequence features with correlation.

[0020] Step 2-4: Use a fully connected network to reduce the dimension of the aggregated user behavior sequence representation vector, and further use the softmax activation function to convert it into a two-dimensional probability. This represents the probability of whether the user is a malicious user at the level of fine-grained behavior analysis as a time series feature.

[0021] In the present invention, step 3 specifically includes:

[0022] Step 3-1: Based on the maintainable personal attribute information provided by social media, extract descriptive features from the user account field. Descriptive features include: the total number of characters in the username, the percentage of digits in the username, whether the user has filled out a personal profile, etc.

[0023] Step 3-2: Based on the user's historical behavior statistics, extract the user's statistical behavior characteristics, which include: the number of users followed, the number of fans following this account, the total number of content published, the average interval between content publications, etc.

[0024] In step 4, the graph neural network is used to process the user interaction behavior network data to obtain the representation vector that characterizes the user interaction relationship as the interaction graph feature. The graph neural network adopts the GraphSAGE graph neural network

[11] . Considering the effective number of layers of the interaction relationship, the number of iteration layers of the graph neural network is 3. Starting from the node of interest, the number of randomly selected neighbors in each iteration is 15, 10, and 5. Each iteration aggregates the current state vector of the selected neighbor node. The specific formula is:

[0025]

[0026] Aggregator is an aggregation function, and specifically, an average aggregation function can be used; is the state vector of node u at the kth iteration; N(v) is the set of neighbor nodes of node v.

[0027] Connect the aggregated neighbor state vector to the node's state vector and update the node's state vector to:

[0028]

[0029] Among them, σ is the activation function, W k is the weight variable in the k-th iteration, which obtains the optimal value in model training. The Concat function represents the concatenation of two vectors with the same dimension.

[0030] After iterating the three-layer network, the state vector of the node is reduced in dimensionality to obtain the two-dimensional interaction graph features, which are finally incorporated into the model training.

[0031] In the present invention, the structural hole theory is used in step 5 to calculate the user's connection importance index as a social graph feature. The user's connection importance index mainly includes constraint degree and effective scale. The calculation formula is:

[0032] Constraint:

[0033] This formula can be understood as, node u x The degree of constraint is the sum of the degree of constraint imposed on it by all its neighboring nodes. xy is the neighbor node u x to u y The cost of transmitting information can be 1\|N(x)| in an unweighted graph, that is, the cost of transmitting information can be 1\|N(x)| in an unweighted graph, that is, the cost of transmitting information can be 1\|N(x)| in a ... x The inverse of the number of neighbors.

[0034] Effective size:

[0035] Where |N(v)| represents the node u x The number of neighbor nodes, d j Represents neighbor node u j The degree (excluding the degree to the central node u i connection).

[0036] In the present invention, the decision maker is trained in step 6 to determine whether the user is a malicious user. The loss function used in the decision maker training is the log loss function, and the specific formula is as follows:

[0037]

[0038] Among them, S is the number of samples in the data set, p i For user u i The probability of being correctly judged by the model, y i For user u i Whether it is a label of malicious user.

[0039] The model proposed in the present invention is based on the public data generated by users of online social networks, including basic attribute information of user accounts, statistical behavior information, fine-grained historical behavior sequences, user interaction relationships, and social relationships, to determine whether they are malicious users. For social media with relatively sparse network connections generated by attention, friend relationships, etc., the present invention proposes to construct heterogeneous interaction relationship graphs and social relationship graphs through users' historical behaviors, and based on the characteristics of the corresponding composition, use graph neural network tools to process the associations between users and interaction elements (behavior objects, locations, etc.) to obtain the user's interaction graph features; use structural hole theory to process the associations between users to obtain the user's social graph features. The present invention also introduces a time series behavior analysis method to analyze and obtain the user's behavior sequence features. Finally, these feature subsets are integrated to effectively detect malicious users in online social media. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1This is an overall flow chart of the online social media malicious user detection algorithm based on user behavior data of the present invention.

[0041] Figure 2 This is a model structure diagram of the online social media malicious user detection algorithm based on user behavior data of the present invention. DETAILED DESCRIPTION

[0042] In order to make the above-mentioned objectives and innovations of this aspect easier to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific implementation cases.

[0043] according to Figure 2 As shown in the figure, for the online platform GitHub, user-generated public data is divided into two parts: basic account information and user behavior data. The processing of these two parts of data consists of four modules: user behavior sequence analysis, user-project interaction graph analysis, user-user relationship graph analysis, and descriptive feature extraction. The user behavior sequence analysis module constructs behavior sequences for user behaviors on the social media platform. Considering the diversity of behaviors (a total of 42 types), it constructs behavior type sequences and behavior interval sequences, analyzes and obtains fine-grained user behavior features, and reduces the dimensionality into two-dimensional vectors. The user-project interaction graph is constructed. Considering that user behavior on the social platform is mainly operations on projects, the associations generated by user operations on projects are constructed into a heterogeneous graph consisting of user nodes and project nodes, and a graph neural network is used for modeling and analysis. The user-user relationship graph is also derived from user interaction behaviors. It establishes edges between users who have operated on projects created by a user, and uses structural hole theory to measure the importance of users in the global network as its features. The descriptive information feature extraction of user accounts is integrated to finally train a classifier that can determine whether GitHub users are malicious.

[0044] Step 1: Extract fields and clean the public data generated by online social media users;

[0045] Step 1-1: The data cleaning includes: removing all non-alphabetic characters, deleting all useless words, and deleting all missing rows;

[0046] Step 1-2: For the cleaned user data, filter out users who have posted more than 3 pieces of content on the social media.

[0047] Step 2: For each user, we construct a historical behavior representation sequence for the cleaned user data and analyze it to obtain two-dimensional fine-grained behavioral features. This module uses labeled user data to independently train the parameters of the PLSTM and attention mechanisms used.

[0048] Step 2-1: Construct two sequences for GitHub user data, including a behavior time interval sequence and a behavior type sequence;

[0049] Step 2-2: Use the PLSTM network to process the constructed behavior representation sequence and add an attention mechanism to assign weights to the user behavior features obtained by processing the sequence elements and aggregate them into a behavior sequence feature vector;

[0050] Step 2-3: Use a fully connected network to reduce the dimensionality of the feature vector and use the softmax activation function to convert it into a two-dimensional vector. This represents the probability that the user is a malicious user from the perspective of the behavior sequence, which serves as the behavior sequence feature.

[0051] Step 3: For each user, take their account descriptive data and historical behavior statistical indicators to extract the user's descriptive characteristics, which mainly include two categories: account characteristics and behavioral statistical characteristics; account characteristics include: the number of characters in the username, the number of digits in the username, the proportion of digits in the username, whether the user uses a nickname, whether the user fills out a personal profile, whether the user verifies the email address, whether the user publishes a personal homepage, whether the user is looking for a job, whether the user discloses the company and address, and the account type; statistical characteristics include: the number of fans, the number of users followed, the ratio of the two, the number of public projects published, the mean, variance, maximum, minimum, and median of the time intervals between adjacent behaviors.

[0052] Step 4: Considering that GitHub users mainly generate behaviors by operating on projects, we construct a user-project-user interaction heterogeneous graph based on the user's operations on projects;

[0053] Step 4-1: Based on the user's project operation records, connect an edge between the user node and the project node on which the user has operated;

[0054] Step 4-2: Use the GraphSAGE model to analyze the heterogeneous network and obtain the interaction graph features of user nodes.

[0055] Step 5: Considering that GitHub users mainly generate behaviors through project operations, build a user-user social relationship graph based on the user's operations on the project;

[0056] Step 5-1: Based on the user's project operation records, connect an edge between a node and the user node that has operated the project created by the node to build a user-user social relationship graph;

[0057] Step 5-2: Based on the structural hole theory, calculate the structural hole measurement indicators of each node, including the constraint degree and effective estimation value, to obtain the social relationship graph characteristics of the user node.

[0058] Step 6: Combine all the time series features, descriptive features, interaction graph features, and social graph features obtained in steps 2-5 and input them into a decision maker. The decision maker is trained to determine whether the user is a malicious user. In this example, a CatBoost classifier is used as the decision maker. After training, it can be used to determine whether a GitHub user is a malicious user.

[0059] During model training, we used TensorFlow to implement the PLSTM neural network in the sequence analysis module. The state variable dimension was set to 64, and the learning rate was set to 0.01. The weight vector of the attention mechanism was set to 50 dimensions. We also used PyTorch to implement the three-layer GrapSAGE graph neural network. The number of aggregated sampled neighbor nodes in the first, second, and third layers was 15, 10, and 5, respectively. Node vectors were initialized to 3D random vectors. The dimension of the aggregated weight vectors in the first and second layers was set to 16, and in the third layer to 2. The batch size parameter for data input was set to 256, and the learning rate was 0.01. To avoid overfitting, we set the dropout parameter to 0.5 during training. We used scikit-learn to implement the classification algorithm in the decision maker.

[0060] This paper takes GitHub users who registered accounts before December 31, 2017 as the research objects, obtains 57,790 malicious users and 2,955,783 normal users, and obtains their behavioral data generated between January 1, 2015 and May 31, 2018. Then, 10,000 users were randomly selected from them, with 21.5% of malicious users and 78.5% of normal users, for experimental verification.

[0061] We compared existing work that focused on analyzing user behavior with existing work that used graph neural network methods, with the results shown in Table 1. We used the AUC metric to measure algorithm performance, and the results showed that our method outperformed existing methods, demonstrating its superiority in detecting malicious users on online social media.

[0062] Table 1

[0063]

[0064]

[0065] References:

[0066] [1]Zhu Zhangli, Rao Yuan, Wu Yuan, Qi Jiangnan, Zhang Yu. Research progress of attention mechanism in deep learning[J]. Journal of Chinese Information Science, 2019, 33(06): 1-11.

[0067] [2] Sheng Ya, Fan Dongliang. Structural hole classification theory and its application in innovation networks[J]. Journal of Science of Science, 2009, 27(09): 1407-1411. DOI: 10.16192 / j.cnki.1003-2053.2009.09.013.

[0068] [3] Liu Hongyan, Chen Jian, Chen Guoqing. A review of data classification algorithms in data mining[J]. Journal of Tsinghua University (Science and Technology), 2002(06):727-730. DOI:10.16511 / j.cnki.qhdxxb.2002.06.005.

[0069] [4]Daniel Neil,Michael Pfeiffer,Shih-Chii Liu.Phased LSTM: Accelerating Recurrent Network Training for Long or Event-based Sequences.InProceedings of NIPS2016:3882-3890

[0070] [5]Q.Gong, Y.Chen, X.He, Z.Zhuang, T.Wang, H.Huang,

[0071] [6] M.Al-Qurishi, MSHossain, MAAlRubaian, SMMRahman, and A.Alamri, “Leveraging analysis of user behavior to identify malicious activities in large-scale social networks,” IEEE Transac-tions on Industrial Informatics, vol.14, no.2, pp.799–813, 2018.

[0072] [7] B. Viswanath, MA Bashir, M. Crovella, S. Guha, K P Gummadi, B. Krishnamurthy, and A. Mislove, "Towards detecting anomalous user behavior in online social networks," in Proc. of USENIX Security, 2014.

[0073] [8] Z. Liu, C. Chen, X. Yang, J. Zhou, X. Li and L. Song. Heterogeneous graphneural networks for malicious account detection. In Proceedings of CIKM, 2018.

[0074] [9] G. Zhang, J. Wu, J. Yang, A. Beheshti, S. Xue, C. Zhou, and QZSheng, FRAUDRE: fraud detection dual-resistant to graph inconsistency and imbalance. In Proceedings of ICDM, 2021.

[0075]

[10] Y.Liu,

[0076]

[11] Zou Changkuan, Tian Xiaoping, Zhang Xiaoyan, Zhang Yuqing, Du Lei. Research on network node classification based on GraphSage node degree importance aggregation[J]. Science Technology and Engineering, 2022, 22(32): 14306-14312.

Claims

1. A method for detecting malicious users in online social media based on user behavior data, characterized in that: include: Use time series analysis methods to construct online social media user behavior data series; Using a recurrent neural network, we obtain a vector representation of the user's fine-grained time series behavior in each time interval. Using an attention mechanism, we assign higher weights to the vector representations of user behavior in consecutive time intervals that have a greater impact on the final identification of malicious accounts. Using a fully connected network, we perform dimensionality reduction on the user behavior representation vector sequence obtained through the attention mechanism to obtain the probabilistic characteristics of the user's behavior sequence that reflect malicious users. By structurally representing the descriptive information of the user account, we obtain the descriptive characteristics of the account. Build a user interaction relationship graph based on the user's interactive behavior data, and use the graph neural network to obtain the user's interactive relationship features; Build a user social relationship graph based on user interaction data and use structural hole theory to obtain user social relationship characteristics; The user behavior sequence probability features, descriptive features, interaction relationship features, and social relationship features are combined and input into the classification algorithm to train a malicious user detection model. The specific steps are as follows: Step 1: Extract fields and clean the public data generated by online social media users; Step 2: For each user, construct a timeline sequence of historical behavior representations for the cleaned user data. Use a deep neural network to process this behavior sequence data to obtain fine-grained temporal behavior sequence features for each time interval. Use an attention mechanism to assign weights to user behavior features at different time intervals and aggregate them into a behavior sequence feature vector. Use a fully connected network to reduce the dimensionality of this feature vector and use the softmax activation function to convert it into a two-dimensional vector. This vector represents the probability of the user being malicious from the perspective of the behavior sequence, which serves as the time series feature. Step 3: For each user in the cleaned user data, obtain their account descriptive data and historical behavior statistics to extract the user's descriptive features; Step 4: For the cleaned user data, define the interaction behaviors between users based on their behavior data. Connect an edge between users who have interacted with each other to form a user interaction relationship graph. Utilize graph neural networks to process user interaction behavior network data and obtain representation vectors that characterize user interaction relationships as interaction graph features; Step 5: For the cleaned user data, define the social behaviors between users based on their behavioral data. Connect users who have engaged in social behaviors with an edge to form a user social relationship graph. Using the structural hole theory, calculate the user's connection importance index as a social graph feature. Step 6: Combine all the time series features, descriptive features, interaction graph features, and social graph features obtained in steps 2-5 and input them into a decision maker. By training the decision maker, a judgment is made as to whether the user is a malicious user.

2. The method for detecting malicious users in online social media according to claim 1, characterized in that: Step 1 specifically includes: Step 1-1: The data cleaning includes: removing all non-alphabetic characters, deleting all useless words, and deleting all missing rows; Step 1-2: For the cleaned user data, filter out users who have posted more than 3 pieces of content on the social media.

3. The method for detecting malicious users in online social media according to claim 1, wherein: Step 2 specifically includes: Step 2-1: For the cleaned user data, segment the user's behavior data along the timeline, aggregate the user's behavior data generated within a time unit, and extract descriptive features; Step 2-2: For the constructed sequence of descriptive features of the user's behavior within a continuous time interval, use a staged long short-term memory neural network (PLSTM) to process the constructed behavior representation sequence, obtaining a vector representation of the behavior of each time interval from the perspective of the entire sequence behavior characteristics; Step 2-3: For the representation vectors obtained by processing the user's behavioral features in each time interval, the attention mechanism is further used to increase the weight of the behavior vector that determines whether the user is malicious. The user behavior representation vectors generated in consecutive time intervals are aggregated into a single representation vector. For social media that can construct multiple time behavior sequences, the attention mechanism is used to aggregate the sequence features with related relationships. Step 2-4: Use a fully connected network to reduce the dimension of the aggregated user behavior sequence representation vector, and further use the softmax activation function to convert it into a two-dimensional probability. This represents the probability of whether the user is a malicious user at the level of fine-grained behavior analysis as a time series feature.

4. The method for detecting malicious users in online social media according to claim 1, wherein: Step 3 specifically includes: Step 3-1: Extract descriptive features from the user account field based on the maintainable personal attribute information provided by social media to users; Step 3-2: Based on the user's historical behavior statistics, extract the user's statistical behavior characteristics, including the number of users followed, the number of fans following this account, the total number of content published, and the average interval between content publications.

5. The method for detecting malicious users in online social media according to claim 1, wherein: In step 4, the graph neural network is used to process the user interaction behavior network data to obtain the representation vector that characterizes the user interaction relationship as the interaction graph feature, where: The graph neural network adopts GraphSAGE graph neural network. Considering the effective number of layers of interactive relationships, the number of iteration layers of the graph neural network is set to 3. Starting from the node of interest, the number of randomly selected neighbors in each iteration is 15, 10, and 5. Each iteration aggregates the current state vector of the selected neighbor node. The specific formula is: Among them, Aggregator is the aggregation function; is the state vector of node u at the kth iteration; N(v) is the set of neighbor nodes of node v; Connect the aggregated neighbor state vector to the node's state vector and update the node's state vector to: Among them, σ is the activation function, W k is the weight variable in the k-th iteration, which obtains the optimal value in model training; the Concat function represents the concatenation of two vectors with the same dimension; After iterating the three-layer network, the state vector of the node is reduced in dimensionality to obtain the two-dimensional interaction graph features, which are finally incorporated into the model training.

6. The method for detecting malicious users in online social media according to claim 5, characterized in that: In step 5, the structural hole theory is used to calculate the user's connection importance index as a social graph feature. The user's connection importance index includes constraint degree and effective scale. The calculation formula is: Constraint: This formula indicates that node u x The degree of constraint is the sum of the degrees of constraint imposed on it by all its neighboring nodes; where p xy is the neighbor node u x to u y The cost of transmitting information, in an unweighted graph, is 1\|N(x)|, that is, the cost of transmitting information ... x The inverse of the number of neighbors; Effective size: Where |N(v)| represents the node u x The number of neighbor nodes, d j Represents neighbor node u j degree.

7. The method for detecting malicious users in online social media according to claim 1, wherein: In step 6, the decision maker is trained to determine whether the user is a malicious user. The loss function used in the decision maker training is the log loss function, and the specific formula is as follows: Among them, S is the number of samples in the data set, p i For user u i The probability of being correctly judged by the model, y i For user u i Whether it is a label of malicious user.

Images