A method for detecting gambling accounts based on social networks

Abstract

This invention discloses a method for detecting gambling accounts based on social networks, comprising: constructing a social network graph; extracting social network features using the social network graph; extracting textual features of the accounts; extracting behavioral features of the accounts; training a classification model using the features; and detecting gambling accounts using the trained classification model. This invention, based on the textual and behavioral features of accounts and combined with the social network features of gambling accounts, achieves higher accuracy compared to traditional gambling account detection methods. It can also detect gambling information hidden in garbled text or images, and can detect a large number of previously undetectable gambling accounts, thus contributing to a cleaner online environment.

Description

Technical Field

[0001] This invention belongs to the field of network technology, specifically relating to a method for detecting gambling accounts based on social networks. Background Technology

[0002] Today, more and more people enjoy communicating online, leading to a surge in social networking applications. One type of application is the forum app, where people like to share their thoughts and opinions, comment on social hot topics, and follow their interests. However, the anonymity and ease of access of these applications bring many risks. Some people hide website URLs in gibberish or images. Furthermore, to enhance authenticity, they use multiple accounts to reply to each other, disguising themselves as legitimate accounts. These gambling-related messages are often difficult to detect directly.

[0003] For the detection of these gambling accounts, industry and academia have designed several solutions. These solutions mainly fall into two categories: plain text analysis and account behavior analysis. Plain text analysis primarily utilizes NLP techniques to detect the text associated with these gambling accounts. This method has significant limitations, especially in detecting information hidden within images and garbled text. Account behavior analysis focuses on analyzing the account's behavior within these applications. This type of analysis typically requires complex algorithms, and the necessary data is often difficult to obtain. Summary of the Invention

[0004] To address the aforementioned problems, this invention discloses a method for detecting gambling accounts based on social networks, which utilizes social networks to improve the accuracy of gambling account detection.

[0005] Social network analysis can help us better detect gambling accounts. By leveraging social network analysis, we can uncover a wealth of information and data that is not readily available through direct observation. Using this data, we can discover some difficult-to-detect illegal accounts within hidden networks. These accounts conceal themselves by replying to each other, and it is precisely this mechanical replying that exposes them to social network analysis. This is because the reply patterns of these gambling accounts, whether in terms of the frequency and number of replies or the recipients of those replies, often exhibit subtle differences compared to normal accounts. Based on this, this invention designs a model that uses accounts in social applications as nodes and the replying action between accounts as edges to construct a social network. By mining social features from this network and combining them with textual features and account behavior features, an ensemble learning model is constructed to detect gambling accounts with relatively accurate identification results.

[0006] To achieve the above objectives, the technical solution of the present invention is as follows:

[0007] A method for detecting gambling accounts based on social networks includes the following steps:

[0008] Step 1, Social Network Graph Construction

[0009] Data is obtained by web crawling, and the obtained data is parsed to extract the relationships between accounts. Accounts are used as nodes and the reply relationships between accounts are used as edges to construct a social network graph.

[0010] Step 2: Extract social network features using social network graphs.

[0011] Extract relevant social network features from the social network graph for use in training subsequent models;

[0012] Step 3: Extract text features of the account

[0013] Analyze the text in the content posted by users and extract relevant text features for subsequent model training;

[0014] Step 4: Extract account behavioral characteristics

[0015] Analyze user behavior and extract relevant behavioral features for subsequent model training;

[0016] Step 5: Train the classification model using features.

[0017] The extracted social network features, text features, and user behavior features are used to train an ensemble learning model for subsequent gambling account detection.

[0018] Step 6: Use the model to detect gambling accounts

[0019] Use a trained classification model to make predictions and detect gambling accounts.

[0020] Furthermore, in step 1, the crawler obtains data in two ways:

[0021] (1) Using BFS, add the URLs of the pages to the queue in sequence, and then add the URLs of the first page to the queue in sequence;

[0022] (2) Starting with a betting account, get all the content posted by that account, then get all the replying accounts from that content, add the content posted by those accounts to the queue, and repeat the process until you get the required number of pages.

[0023] Furthermore, the centrality in step 2 includes: degree centrality, proximity centrality, and betweenness centrality; each social network feature is calculated in the following way:

[0024] Using formula Calculate the degree centrality of each node; use the formula Calculate the proximity centrality of each node, where Represents the shortest distance from the current node to other nodes; using the formula Calculate the betweenness centrality of each node, where This indicates that the shortest path from j to k passes through i, meaning i is on the shortest path from j to k, where i, j, and k are nodes; calculate the average of the shortest distances between all pairs of nodes as the average shortest distance; calculate the number of possible edges formed by all nodes connected to the current node, i.e., The number of edges is used as the denominator, and the actual number of edges is used as the numerator. The ratio is then used to obtain the clustering coefficient. The PageRank value is calculated using the webpage importance ranking algorithm. The density is calculated as the ratio of the actual number of edges in the social network graph to the total number of possible edges. The total number of possible edges is... .

[0025] Furthermore, the specific process of step 3 is as follows:

[0026] In the negative sample dataset, high-frequency words were statistically analyzed, and the M most frequent words were selected. The presence or absence of these high-frequency words, their frequency, and their TF-IDF values ​​were used as features. Next, all content posted by the account was merged into a long text, and keywords were extracted using the TF-IDF algorithm. Finally, some high-frequency characters were statistically analyzed, including characters in URLs, the abbreviations QQ and VX for QQ and WeChat, homophones, pictographs, and emojis; the presence or absence of these special characters was also used as features.

[0027] Furthermore, the specific process of step 4 is as follows:

[0028] We extract these behavioral characteristics of users by using whether an account hides its following list as one feature, the total registration time and total number of posts as two features, and the difference in reply time as another feature.

[0029] Furthermore, the specific process of step 5 is as follows:

[0030] Regular accounts were used as positive samples, and gambling accounts as negative samples. The extracted features were used to train the model. The model was constructed as follows: ensemble learning was used to build the model, and a stacking method was used to add another layer of learners to the results of the weak learners. In the first layer of learners, XGBoost was used as a weak learner for social network features, Random Forest was used as a weak learner for text features, and XGBoost was used as a weak learner for account behavior features. In the second layer of learners, XGBoost was used as the learner.

[0031] Furthermore, the specific process of step 6 is as follows:

[0032] For an account to be detected, construct the social network graph of the account, extract the social network features of the account using the social network graph, then extract the text features and behavioral features of the account, and use the classification model trained in step 5 to make a prediction to detect whether the account is a gambling account and obtain the result.

[0033] The beneficial effects of this invention are as follows:

[0034] 1. Based on the textual and behavioral characteristics of accounts, this invention combines the social network characteristics of gambling accounts. Compared with traditional gambling account detection methods, it has a higher accuracy rate and can also detect gambling information hidden in garbled text or images. It can detect a large number of gambling accounts that were previously undetectable, which is conducive to purifying the online environment.

[0035] 2. This invention employs an ensemble learning model. Compared to ordinary models, ensemble learning can integrate different types of features, resulting in higher accuracy. Attached Figure Description

[0036] Figure 1 This is a schematic diagram of the process for detecting gambling accounts based on social networks, as provided by the present invention.

[0037] Figure 2 A diagram illustrating data acquisition when constructing a social network graph.

[0038] Figure 3 This is a schematic diagram of the prediction model structure. Detailed Implementation

[0039] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0040] This method utilizes social network technology to extract the social network features of accounts, and combines this with the textual features and behavioral features of the account's posted content to train a classification model. Finally, the trained model is used to predict and detect gambling accounts. The process of the social network-based gambling account detection method provided by this invention is as follows: Figure 1 As shown, it includes the following steps:

[0041] Step 100: Obtain data from forum-like applications, using accounts as nodes and reply relationships between accounts as edges to construct a social network graph. Data is obtained through web crawling; the flowchart for the data acquisition is shown below. Figure 2As shown, gambling accounts are used as negative samples in the dataset. The crawler employs two crawling strategies: Breadth-First Search (BFS), which sequentially adds URLs from pages to a queue, then adds the URLs from the first page to the queue. The other strategy, XXX, starts with a gambling account, retrieves all content posted by that account, then retrieves all replying accounts from that content, adds their content to a queue, and repeats this process until the desired number of pages are obtained. After data acquisition, these pages are parsed, extracting the accounts and reply relationships between them. Accounts are treated as nodes, and the reply relationships between accounts as edges, constructing a social network graph.

[0042] Step 200: Extract the social network features of the accounts based on the social network graph. These include centrality, average shortest distance, eccentricity, clustering coefficient, PageRank value, and density. Degree centrality refers to the number of edges connecting nodes; important nodes are those with many connections, and the more social relationships a node has, the stronger its influence. Gambling accounts, through mutual replies, typically contain some influential nodes, and the calculation formula is as follows:

[0043]

[0044] in, Let be the number of direct connections between node i and the other j nodes. Proximity centrality is calculated by taking the reciprocal of the average sum of the shortest distances from a node to all other nodes. In other words, the closer a node is to other nodes, the higher its proximity centrality. Proximity centrality utilizes the characteristics of the entire network, reflecting whether a node is in a core position and its ability to transmit messages. Betting accounts also conform to this characteristic, and its calculation formula is as follows. Represents the shortest distance from the current node to other nodes:

[0045]

[0046] in, Let be the number of nodes in a social network graph. Betweenness centrality refers to the number of times a node appears on the shortest path between any two other nodes. Betweenness centrality reflects the ability to control the flow of information. Mutual replies between gambling accounts are actually a method of public opinion control, therefore their ability to control the flow of information is very strong, and their betweenness centrality is very high. The calculation formula is as follows: This indicates that the shortest path from j to k passes through i, meaning i is on the shortest path from j to k.

[0047]

[0048] The average shortest distance refers to the average of the shortest distances between all pairs of nodes, which most directly describes the tightness of the social network graph. The eccentricity represents the maximum distance from the current node to other nodes.

[0049] The clustering coefficient can be used to discover people in the social network who are not yet connected but may become friends. When calculating, first calculate the number of edges that may be formed among all the nodes connected to the current node, that is , as the denominator, and then calculate the number of actually formed edges as the numerator. Calculating the ratio can obtain the clustering coefficient.

[0050] PageRank is an algorithm invented by Google for ranking the importance of web pages. This algorithm is based on two assumptions. One is that the more incoming links a web page receives from other web pages, the more important this web page is; the other is that when a high-quality web page points to a web page, it means the quality of the pointed-to web page is also high. For a social network, if there are many edges pointing to a certain node or a certain node pointing to many edges, it means this node is very important, and a gambling account conforms to such characteristics.

[0051] The density refers to the ratio of the number of actually existing edges in the social network graph to the number of all possible edges. The number of all possible edges is . Due to the existence of mutual replies, the network density of gambling accounts is usually greater.

[0052] Step 300: Extract the text features of the content published by each account. First, count the high-frequency words in the negative sample dataset. The process is to first tokenize all the sentences in the dataset and then perform word frequency statistics. When performing word frequency statistics, some stop words such as "de", "le", "shi", etc. also need to be removed. Select the 50 high-frequency words with the highest occurrence frequencies, and use whether these high-frequency words appear, the number of high-frequency words that appear, and the TF-IDF values of the high-frequency words as features. Subsequently, extract the keywords of the content published by the account. Combine all the content published by the account into a long text. A long text can extract keywords better than a short text. When extracting keywords, use the TF-IDF algorithm. Finally, since gambling accounts will hide the addresses of gambling websites in garbled codes or guide the accounts to add some communication accounts, we have counted some high-frequency characters. These characters are mainly divided into the following categories: (1) Characters in the URL: "https: / / " and "."; (2) The two major communication software in China, QQ and WeChat, which are usually abbreviated as "QQ" and "VX"; (3) Homophonic characters: The homophonic character of "add" in adding an account is "+", and the homophonic character of "WeChat account" is "wei"; (4) Pictographic characters and emojis: For example, the pictographic character of WeChat account is " ", and whether these special characters appear is also used as a feature.

[0053] Step 400: Extract behavioral characteristics of each account. An account will have a following list, and they can choose to hide it. Whether or not the following list is hidden is used as a feature because the default option for forum applications is not to hide the following list, and some accounts will actively hide it for privacy. For gambling accounts, it's common for one person to log into a large number of accounts, using only the simplest post-reply functions, without actively hiding their following list. Gambling accounts are typically short-registered accounts that post a large amount of content in a short period, usually indicating recent high activity. Normal accounts typically post at a more dispersed timeframe, not concentrated within a single period; therefore, the total registration time and total number of posts are used as two features. Gambling accounts are often replied to by the same person or team within a short period to conceal their true behavior; therefore, the difference in reply times between these accounts is usually small, and this difference is also used as a feature.

[0054] Step 500: Train the classification model using the extracted features. Ordinary accounts are used as positive samples, and gambling accounts as negative samples. The model is trained using the features extracted in the previous steps. To improve the model's accuracy, ensemble learning is used to build the model. This invention employs a stacking approach to add another layer of learners to the results of the weak learners. In the first layer, an XGBoost model is used as a weak learner for social network features, a random forest model as a weak learner for text features, and an XGBoost model as a weak learner for account behavior features. In the second layer, an XGBoost model is used. Experimental comparisons show that this model achieves the best recognition results. The final model structure is as follows: Figure 3 As shown.

[0055] Step 600: Use the trained model to make predictions and detect gambling accounts. For an account to be detected, construct the social network graph of the account, extract the social network features of the account using the social network graph, then extract the text features and behavioral features of the account, and use the classification model trained in step 500 to make predictions to detect whether the account is a gambling account, and obtain the results.

[0056] It should be noted that the above content merely illustrates the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. For those skilled in the art, various improvements and modifications can be made without departing from the principle of the present invention, and all such improvements and modifications fall within the scope of protection of the claims of the present invention.

Claims

1. A method for detecting gambling accounts based on social networks, characterized in that, Includes the following steps: Step 1, Social Network Graph Construction Data is obtained by web crawling, and the obtained data is parsed to extract the relationships between accounts. Accounts are used as nodes and the reply relationships between accounts are used as edges to construct a social network graph. Step 2: Extract social network features using social network graphs. Relevant social network features are extracted from the social network graph, including centrality, average shortest distance, eccentricity, clustering coefficient, PageRank value, and density, for subsequent model training. The centrality includes degree centrality, proximity centrality, and betweenness centrality. Each social network feature is calculated in the following manner: Using formula Calculate the degree centrality of each node; use the formula Calculate the proximity centrality of each node, where Represents the shortest distance from the current node to other nodes; using the formula Calculate the betweenness centrality of each node, where This indicates that the shortest path from j to k passes through i, meaning i is on the shortest path from j to k, where i, j, and k are nodes; calculate the average of the shortest distances between all pairs of nodes as the average shortest distance; calculate the number of possible edges formed by all nodes connected to the current node, i.e., The number of edges is used as the denominator, and the actual number of edges is used as the numerator. The ratio is then used to obtain the clustering coefficient. The PageRank value is calculated using the webpage importance ranking algorithm. The density is calculated as the ratio of the actual number of edges in the social network graph to the total number of possible edges. The total number of possible edges is... ; Step 3: Extract text features of the account The analysis of user-posted content extracts relevant text features for subsequent model training. Specifically, this involves: identifying high-frequency words in the negative sample dataset, selecting the M most frequent words, and using their presence, frequency, and TF-IDF values ​​as features; then, merging all posted content into a long text and using the TF-IDF algorithm to extract keywords; finally, identifying high-frequency characters, including characters in URLs, abbreviations for QQ and WeChat (QQ and VX), homophones, pictographs, and emojis, and using their presence as features. Step 4: Extract account behavioral characteristics Analyze user behavior and extract relevant behavioral features for subsequent model training; specifically, this includes: using whether an account hides its following list as a feature, the total registration time and total number of posts as two features, and the difference in reply time as a feature; extract these user behavioral features. Step 5: Train the classification model using features. The extracted social network features, text features, and user behavior features are used to train an ensemble learning model for subsequent gambling account detection; specifically including: Regular accounts were used as positive samples, and gambling accounts as negative samples. The extracted features were used to train the model. The model was constructed as follows: ensemble learning was used to build the model, and a stacking method was used to add another learner layer to the results of the weak learners. In the first learner layer, an XGBoost model was used as a weak learner for social network features, a random forest model was used as a weak learner for text features, and an XGBoost model was used as a weak learner for account behavior features. In the second learner layer, an XGBoost model was used as the learner. Step 6: Use the model to detect gambling accounts Use a trained classification model to make predictions and detect gambling accounts.

2. The method for detecting gambling accounts based on social networks according to claim 1, characterized in that, In step 1, the crawler obtains data in two ways: (1) Using BFS, add the URLs of the pages to the queue in sequence, and then add the URLs of the first page to the queue in sequence; (2) Starting with a betting account, get all the content posted by that account, then get all the replying accounts from that content, add the content posted by those accounts to the queue, and repeat the process until you get the required number of pages.

3. The method for detecting gambling accounts based on social networks according to claim 1, characterized in that, The specific process of step 6 is as follows: For an account to be detected, construct the social network graph of the account, extract the social network features of the account using the social network graph, then extract the text features and behavioral features of the account, and use the classification model trained in step 5 to make a prediction to detect whether the account is a gambling account and obtain the result.

Images