A method and apparatus for tracing the source of a message.

Abstract

This invention provides a method and apparatus for tracing the source of propagated messages. The method includes: constructing a first social network based on test samples; deploying several observation points on the first social network to obtain a second social network; acquiring a network snapshot in the activated state of the propagation source locator program, as the first network snapshot, and supplementing it with edges to obtain a second network snapshot; acquiring first information received by the observation point that first receives the message on the second network snapshot; acquiring second information received by the observation point that first receives the message during the simulated propagation process of the second network snapshot; and determining the propagation source of the test sample based on the first information and the corresponding second information. The method provided by this invention, by considering the actual propagation process of the message during the observation point deployment stage and using quality-assured Monte Carlo simulation of propagation, achieves maximum coverage of observation points and solves the problem of low efficiency in information collection by observation points.

Description

Technical Field

[0001] This invention relates to the field of information processing technology, and in particular to a method and apparatus for tracing the source of disseminated messages. Background Technology

[0002] Social media platforms, as a medium for disseminating information, have greatly facilitated people's lives through their exponential growth. Therefore, identifying the source of information dissemination is extremely meaningful.

[0003] In recent years, various methods have been proposed from different perspectives to locate the propagation source of messages. These methods can be broadly classified into three types: complete observation, network snapshots, and observation points. Complete observation is less commonly used due to the difficulty of information acquisition. Observation point-based methods involve two stages: observation point deployment and propagation source localization. Observation point deployment refers to strategically deploying observation points in the network before the message propagation outbreak and recording key propagation information for subsequent propagation source localization. Pinto et al. introduced a random deployment method, which has low complexity but occasionally overlooks important nodes. Subsequently, various deployment methods based on node centrality were proposed, combining network structure. Degree centrality is based on local information, measuring the number of neighbors around a node; eigenvector centrality is based on global information, determining the centrality index of each node by calculating the eigenvector associated with the largest eigenvalue of the network adjacency matrix. For shortest paths, proximity centrality measures the reciprocal of the average shortest path distance to all reachable nodes. Betweenness centrality is calculated by summing the proportions of all shortest paths passing through a node. Subgraph centrality quantifies the sum of weighted closed walks starting and ending at a node. Finally, harmonic centrality is derived by summing the reciprocals of the shortest path distances from all other nodes to the given node.

[0004] However, the current method of locating the source of information still has the following shortcomings:

[0005] 1. During the observation point deployment phase, only network structure information was considered, while the propagation process was not taken into account, which reduced the efficiency of information collection at the observation points;

[0006] 2. Existing methods rely on a strong assumption: the complete network structure and the availability of observational information. In practice, obtaining a complete network snapshot within a short timeframe is challenging due to time constraints and considerations for user privacy. Incomplete network snapshots result in significant changes to network characteristics and propagation processes, leading to inaccurate localization. Summary of the Invention

[0007] This invention provides a method and apparatus for tracing the source of propagated messages, thereby addressing the shortcomings of insufficient accuracy in locating the propagation source in existing technologies.

[0008] This invention provides a method for tracing the source of propagated messages, comprising:

[0009] S1: Obtain user information and contact information between users for the test samples;

[0010] S2: Construct a first social network using the user information as nodes and the connection information between the users as edges;

[0011] S3: Deploy several observation points on the first social network to obtain the social network after the observation points are deployed, which is the second social network;

[0012] S4: Monitor the second social network until the propagation source locator is activated, and then obtain a network snapshot in the activated state as the first network snapshot;

[0013] S5: Supplement the missing edges in the first network snapshot to obtain a network snapshot with supplemented edges, which is the second network snapshot;

[0014] S6: Obtain the information received by the observation point on the second network snapshot when the message is first received, which is the first information; the first information includes: the message reception time t, the message sender's ID, and the number of message forwardings c;

[0015] S7: Using the affected ordinary nodes in the second network snapshot as the propagation source, simulate the message propagation process, and obtain the information received by the observation point that receives the message for the first time during the message propagation process, which is the second information;

[0016] The second information includes: message reception time, message sender ID, and message forwarding count c;

[0017] The ordinary node refers to all nodes in the network block except for the observation point; the affected ordinary node refers to the ordinary node that received the message.

[0018] S8: Traverse all affected ordinary nodes to obtain the second information corresponding to the different nodes;

[0019] S9: Compare the similarity between the first information and the corresponding second information, so that the affected ordinary node with the highest similarity is used as the propagation source of the test sample.

[0020] According to the method for tracing the source of a propagated message provided by the present invention, step S3, which involves deploying several observation points on the first social network, includes:

[0021] The first social network is simulated using Monte Carlo simulation for several iterations until the number of affected observation points reaches a preset threshold. The simulation is then stopped, and the observation points are deployed using the social network after the simulation has stopped. The number of observation points is determined by the following formula:

[0022]

[0023]

[0024]

[0025] Where O represents the set of observation points, V represents the set of users, and m represents the number of observation points; f h (O) represents the target observation point that needs to be deployed. Indicates the actual deployment observation point; the For the approximate solution obtained from the Monte Carlo simulation of the first social network, i.e., the actual deployed observation points; H ij d(s,j) represents the state of observation point j in the i-th simulation; N is the number of iterations when using Monte Carlo simulation; s represents the propagation source; d(s,j) represents the distance between observation point j and propagation source s when the first message is received; h represents the expected distance.

[0026] According to a method for tracing the source of a propagated message provided by the present invention, step S4, monitoring the second social network until the propagation source location procedure is activated, includes:

[0027] The number of observation points receiving messages on the second social network is obtained in real time;

[0028] The propagation source localization procedure is activated when the number of observation points receiving the message exceeds a certain preset threshold.

[0029] According to a method for tracing the source of a propagated message provided by the present invention, step S5 includes:

[0030] Obtain information recorded by observation points deployed on the first network snapshot; the information recorded by the observation points includes their neighbor IDs;

[0031] Based on the information recorded by the observation point, determine whether there is an edge between the corresponding observation point and its recorded neighbors. If there is no edge, add the corresponding edge.

[0032] According to the method for tracing the source of a propagated message provided by the present invention, the propagation source of the test sample in S8 is determined according to the following formula:

[0033]

[0034] Where i is a normal node; G' + O represents all affected nodes in the second network snapshot; O represents the set of observation points; i∈G' + O represents a regular node that received the message; P(i) represents the first observation point to receive the message during the observation point deployment phase. The probability of the corresponding distance between the source s and the propagation source; The message reception time in the first information; η represents the message reception time in the second information; η∈[0,1] represents the penalty factor. If the neighbor ID recorded in the first information is not equal to the neighbor ID recorded in the second information, then η∈(0,1); otherwise, η=1.

[0035] According to the method for tracing the propagation of messages provided by the present invention, the propagation source of a test sample is determined by fusing the number of message forwardings:

[0036]

[0037] in, This is the observation point where the first message was received. Record the IDs of neighboring nodes. This indicates the number of times the message has been forwarded.

[0038] The present invention also provides a device for tracing the source of a transmitted message, comprising:

[0039] The acquisition unit is used to acquire user information and contact information between users of the test sample.

[0040] A construction unit is used to construct a first social network using the user information as nodes and the connection information between the users as edges.

[0041] The deployment unit is used to deploy a number of observation points on the first social network to obtain a social network after the deployment of the number of observation points, which is the second social network.

[0042] The activation unit is used to monitor the second social network until the propagation source locator is activated, then obtain a network snapshot in the activated state, which is the first network snapshot;

[0043] The supplementation unit is used to supplement the missing edges in the first network snapshot to obtain a network snapshot with supplemented edges, which is the second network snapshot.

[0044] The acquisition unit is further configured to acquire information received by the observation point on the second network snapshot when the message is first received, which is the first information; the first information includes: the message reception time t, the message sender's ID, and the message forwarding count c;

[0045] The acquisition unit is further configured to simulate the message propagation process using the affected ordinary nodes in the second network snapshot as the propagation source, and acquire the information received by the observation point that receives the message for the first time during the message propagation process, which is the second information; the second information includes: message reception time, message sender ID, and message forwarding count c; the ordinary node is a node that is not an observation point; the affected ordinary node is an ordinary node that receives the message;

[0046] The loop unit is used to traverse all affected ordinary nodes;

[0047] The acquisition unit is further configured to acquire the second information obtained in each traversal;

[0048] The source tracing unit is used to compare the similarity between the first information and the corresponding second information, so that the affected ordinary node with the highest similarity is used as the propagation source of the test sample.

[0049] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the source tracing method for propagating messages as described above.

[0050] The method and apparatus for tracing the source of propagated messages provided by this invention, by considering the actual propagation process of the message during the observation point deployment phase and using quality-assured Monte Carlo simulation of propagation, achieves maximum coverage of observation points and solves the problem of low efficiency in information collection at observation points. Furthermore, by using a method for determining the propagation source based on Bayesian estimation, it solves the problem of propagation source localization under conditions of incomplete network structure information. Attached Figure Description

[0051] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0052] Figure 1 A schematic diagram illustrating the information propagation process on an incomplete social network.

[0053] Figure 2 A general framework diagram of the method for tracing the source of propagated messages provided by the present invention;

[0054] Figure 3 A flowchart illustrating the method for tracing the source of propagated messages provided by this invention;

[0055] Figure 4(a) shows a comparison of the test results of our method and existing methods on social network A;

[0056] Figure 4(B) shows a comparison of the test results of our method and existing methods on social network B;

[0057] Figure 5 This is a comparison chart of the performance test results of this method and other observation-based methods during the observation point deployment phase;

[0058] Figure 6 The figures show a comparison of test results between the method of this invention and existing methods under different network structure information loss levels; where (a) is an Enron network; and (b) is a DBLP network.

[0059] Figure 7 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0061] Many influential methods have been proposed in the field of propagation source localization. Utilizing network snapshots, LPSI employs label propagation to aggregate neighbor information, thereby identifying prominent local nodes as sources. EPA assumes source nodes are "older," thus iteratively calculating the age of each node. On the other hand, EC+CC uses classic metrics such as eccentricity and proximity centrality to determine source nodes. However, Paluch et al. theoretically and experimentally demonstrated the effectiveness of observation-based methods. MLE-P calculates the probability of each node being a source through maximum likelihood estimation. Furthermore, DISGE considers the propagation direction information recorded by the observation point, thus narrowing down the range of candidate source nodes. Unlike these heuristic methods based on breadth-first search trees, GSSI uses parameter family optimization of the Gromov matrix to consider different propagation paths, while PBSI and GRSL estimate the source by recording the IDs of neighbors at the observation point.

[0062] Although the above methods have good performance, they still have shortcomings described in the background art, and the purpose of this invention is to overcome these shortcomings:

[0063] 1. By considering the information propagation process, a quality-assured observation point deployment method is proposed to enhance network monitoring.

[0064] 2. For incomplete network structure information, a source detection method based on Bayesian estimation is proposed, which improves the applicability of the source detection method in real-world scenarios.

[0065] Figure 1 A schematic diagram illustrating the information propagation process on an incomplete social network. Figure 2 A general framework diagram of the method for tracing the source of propagated messages provided by the present invention; Figure 3 The flowchart of the message tracing method provided by the present invention is as follows: Figure 3 As shown, the method includes the following steps:

[0066] S1: Obtain user information and contact information between users for the test samples.

[0067] S2: Construct a first social network using the user information as nodes and the connection information between the users as edges.

[0068] Specifically, for a given social platform, abstracting each user as a node and the connections between users as edges yields a social network G(V,E), where V = {v1, v2, ..., v...} n} and E={(v i ,v j )|v i ,v j ∈V,i≠j} represent the sets of users and relations, respectively, and vi,vj represent user i and user j, respectively.

[0069] S3: Deploy several observation points on the first social network to obtain a social network after deploying the several observation points, which is the second social network.

[0070] Specifically, observation points are a subset of nodes on a social network. Their function is to record relevant information during message propagation, such as the time it takes for the message to travel from its source to the observation point and the recipient. This invention determines the message source by analyzing the information recorded by the observation points and the network topology.

[0071] Traditional methods for deploying observation points determine their location based on the number of edges connected to them; a node with more connected edges is considered an observation point. However, this traditional method reduces the efficiency of information collection by neglecting message propagation. This invention, however, uses Monte Carlo simulation to model message propagation during observation point deployment. By combining the number of observation points with the simulation of message propagation, the quality of observation points can be guaranteed, thereby improving the accuracy of network monitoring.

[0072] The following is a detailed explanation of how to deploy observation points:

[0073] The propagation process in a social network can be represented by a time series {X(t), t≥0}, where X(t) represents the state of a node in the social network at time t; when t=0, it indicates that only one node is affected, i.e., the propagation source s. Given a set of observation points... set D O Defined as: an observation point that has already received the message. Therefore, the detectability of propagation can be expressed as:

[0074] The observation point deployment problem can be expressed as: given a desired distance h≥0, select a set of O as observation points, such that when propagation is detected, the first observation point to receive the message will be the first to receive the message. The observation point that is closest to the propagation source s, and the first to receive the message, records its propagation target (i.e., the node preceding it to which the message was propagated). Therefore, this invention utilizes the first observation point to receive the message. Distance from the source s The observation point is determined by maximizing the probability of receiving the message, and this is the first observation point to receive the message. Determining the source of a message can not only improve the accuracy of locating the source, but also improve the efficiency of locating the source.

[0075] Specifically, it can be expressed as:

[0076]

[0077] Where m is the number of observation points, the objective function of the above optimization problem is defined as: The problem can then be expressed as:

[0078]

[0079] Since the complexity of finding the optimal solution to this problem increases exponentially, this invention can use a quality-assured Monte Carlo simulation to search for f in formula (2). h Approximate solution of (O) f h (O) represents the target observation points to be deployed, calculated from the results. To this end, a message propagation process on a social network is simulated using a propagation model (e.g., a heterogeneous SI model). N simulations are performed, and the propagation process terminates when a specified number α (a preset threshold) of observation nodes are affected. The observation points are then determined through this propagation process. To determine the observation points, this invention constructs an N×n matrix H to record information from the N message propagation simulations (N is the number of iterations using Monte Carlo simulation; n is the number of nodes in the social network), where the element H... ijIndicate the state of observation point j in the i-th simulation:

[0080]

[0081] Where d(s,j) represents the distance between observation node j and source s when the observation node j first receives the message, and given matrix H, h represents the desired distance. It can be represented as:

[0082]

[0083] Where O represents the set of observation points, V represents the set of users, and m represents the number of observation points; f h (O) represents the target observation point that needs to be deployed. Indicates the actual deployment observation point; the H represents the approximate solution obtained from the Monte Carlo simulation of the first social network, i.e., the actual deployed observation points; H is a matrix recording the message propagation process, H = N × n, where N is the number of iterations in the Monte Carlo simulation; n is the number of nodes; H ij d(s,j) represents the state of observation point j in the i-th simulation; d(s,j) represents the distance between observation point j and the propagation source s when the first message is received; h represents the expected distance.

[0084] Formula 4 means: Select the node whose distance from the source node to the propagation source is less than or equal to h the most times in N simulations as the observation point to obtain the maximum coverage.

[0085] S4: Monitor the second social network until the source locator is activated, then obtain a network snapshot in the activated state, which is the first network snapshot.

[0086] Specifically, a network snapshot is a snapshot of a social network at a given moment, capturing the state of the network at that specific instant. This snapshot includes information such as the network topology and the status of each user (whether they are infected). In this invention, the first network snapshot is a snapshot captured when the propagation source location program is activated. Through this first network snapshot, information such as the propagation source, infected nodes, and ordinary nodes can be obtained.

[0087] The following describes how to activate the propagation source localization procedure, which includes:

[0088] First, the number of observation points receiving messages on the second social network is acquired in real time; second, if the number of observation points receiving messages exceeds a certain preset threshold, the propagation source location procedure is activated.

[0089] During message propagation, deployed observation points record key information, including: reception time t, message sender ID, and message forwarding count c. When a certain number (α, i.e., a preset threshold) of observation nodes in the social network are affected, i.e., when the propagation reaches a certain scale, the propagation source localization procedure is activated.

[0090] S5: Supplement the missing edges in the first network snapshot to obtain the network snapshot with the missing edges, which is the second network snapshot.

[0091] Specifically, during the process of obtaining network snapshots, due to time constraints and considerations for user privacy, some edges in the network snapshots are missing. Therefore, before locating the propagation source, this invention needs to fill in the missing edges in the network snapshots.

[0092] The following explains how to supplement the missing edges in the first network snapshot:

[0093] First, obtain the information recorded by the observation points deployed on the first network snapshot; the information recorded by the observation points includes their neighbor IDs; second, determine whether there is an edge between the corresponding observation point and its recorded neighbor IDs based on the information, and add the corresponding edge if there is no edge. That is: obtain the existing observation information G'(V,E,O), including part of the network topology and all record information from the observation points, and add the edge if there is no edge between the observation point and its recorded neighbor IDs.

[0094] S6: Obtain the first information received by the observation point that first received the message on the second network snapshot; the first information includes: the message reception time t, the message sender's ID, and the message forwarding count c.

[0095] Specifically, this first information refers to the information recorded at observation points during the actual transmission of the message.

[0096] S7: Simulate the message propagation process using the affected ordinary nodes in the second network snapshot as the propagation source, and obtain the second information received by the observation point that first received the message during the message propagation process; the second information includes: message reception time, message sender ID, and message forwarding count c; the ordinary node is a node that is not an observation point; the affected ordinary node is an ordinary node that received the message.

[0097] Specifically, to simulate the message propagation process, it is necessary to use the network topology corresponding to the second network snapshot as a basis, assuming that the message has not yet started propagating, and then use an affected ordinary node as the propagation source to simulate the message propagation process. Therefore, this second information, relative to the first information, is virtual information, that is, information obtained by simulating the propagation process, while the first information is information recorded during the actual propagation of the message.

[0098] It is important to note that the model used in this step to simulate message propagation is the same model used in the stage of deploying observation points. This is to ensure that the two are the same model, so that when using the observation point of the first received message to infer the propagation source, it can be guaranteed that they are based on the same network structure, and the location of the propagation source can be accurate.

[0099] Furthermore, to pinpoint the source of propagation, it's crucial to understand that the observation point cannot be the source; the source can only appear on ordinary nodes. Among ordinary nodes, only those nodes that receive the message (affected ordinary nodes) can be the source. Therefore, this invention uses affected ordinary nodes as the source to simulate the message propagation process, avoiding the use of non-source nodes, thereby improving the efficiency of simulated message propagation.

[0100] S8: Traverse all affected ordinary nodes to obtain the second information corresponding to the different nodes;

[0101] S9: Compare the similarity between the first information and the corresponding second information, so that the affected ordinary node with the highest similarity is used as the propagation source of the test sample.

[0102] Specifically, for all affected ordinary nodes i in the social network, the purpose of propagation source localization is to identify a node, assume it to be the propagation source, and simulate propagation such that the second information recorded by the observation point that receives the message for the first time during the propagation process has the highest similarity to the first information recorded by the observation point that receives the message for the first time in the actual propagation.

[0103]

[0104] in, G' represents the calculated final propagation source; P(i) represents the probability that the observation point receiving the message for the first time during the observation point deployment period is at a distance (first-order neighbor, second-order neighbor, third-order neighbor, higher-order neighbor) from the propagation source; + Let P(i|G') represent all affected nodes in the second network snapshot G'. P(i|G') is the conditional probability that an affected ordinary node i is a propagation source given the network snapshot G'. P(G'|i) is the conditional probability of simulating propagation by assuming that the affected ordinary node i is a propagation source, and finally obtaining the network snapshot G'. Since P(G') is a constant, formula (5) can be further simplified to:

[0105]

[0106] The present invention determines P(i) in the following manner:

[0107] Identify the observation point where the message is first received. Assume this is the observation point where the message is received for the first time. If the recorded node is x, the analysis is as follows:

[0108] First-order: If any node i is a recording node (i.e., i is x). Assume node i is the source node and triggers the propagation process. Subsequently, the affected ordinary nodes decide whether to forward the information to their neighboring nodes with a probability of p (p ~ U(0,1)). Similar to the actual propagation process, the observation point that receives the message for the first time... Upon receiving the message, record the relevant information and stop propagating. Since any node i is the first observation point to receive the message. The first-order neighbor, therefore P(i) in equation (6) refers to the first-order neighbor during the observation point deployment.

[0109] The observation point where the first message is received. The probability that the distance to the propagation source s is 1 when the information is received during the deployment phase, while P(G'|i) is the conditional probability of simulating propagation by assuming that node i is the propagation source and finally obtaining network snapshot G′; P(G'|i) is determined by the reception time t recorded by the observation point and the ID of the neighbor.

[0110] Second order: If any node i is not the first observation point to receive a message. If the recorded node is i ≠ x, then it is necessary to reconnect the edge between any node i and x so that any node i becomes The second-order neighbor process is similar to the first-order case. However, here P(i) represents the probability that the observation point that first received the message is 2 units away from the propagation source s when it receives the information during the deployment phase.

[0111] Third-order: After calculating the likelihood probability of second-order neighbors, the third-order neighbors are calculated based on this. x is redefined as the node in the second-order neighbors that maximizes the likelihood probability. Then, for any node i, it is assumed that there is an edge between any node i and node x, triggering the propagation process. Subsequent steps are the same as in the second-order case. However, at this point, P(i) represents the probability that the observation point that first receives the message has a distance of 3 from the propagation source s when receiving information during the deployment phase, i.e.

[0112] Higher Order: The likelihood probability calculation for higher-order nodes continues in a similar manner. If most simulations (over 95%) during the observation point deployment process indicate that the distance s between the observation point and the source node is less than or equal to γ, the detection process can terminate after γ iterations. Furthermore, considering computation time and complexity, the process can terminate after a certain number of iterations (≥γ).

[0113] In conclusion, The calculation is as follows:

[0114]

[0115] Where i is a normal node; G' + O represents all nodes that received messages in the second network snapshot; O represents the set of observation points; i∈G' + O represents a regular node that received the message; P(i) represents the first observation point to receive the message during the observation point deployment phase. The probability of the corresponding distance between the observer and the source s, i.e., the observation point at which the message is first received. The probability that there are several edges between the source s and the propagation source s; The message reception time in the first information; η represents the message reception time in the second information; η∈[0,1] represents the penalty factor. If the neighbor ID recorded in the first information is not equal to the neighbor ID recorded in the second information, then η∈(0,1); otherwise, η=1.

[0116] Furthermore, this invention also determines the propagation source by integrating the number of information forwardings:

[0117] When the first message is received, the observation point When the number of times the recorded information is forwarded, c, equals 1, it can be known that... The recorded neighbors are the source nodes; if the number of forwards c is not equal to 1, the detection process is as shown in steps S6-S9. Therefore, the final propagation source... The calculation formula can be expressed as:

[0118]

[0119] in, The observation point for receiving the first message. Record the IDs of neighboring nodes, G' + Let P(i) represent all nodes that received messages in the second network snapshot, and let P(i) represent the observation point that first received a message during the deployment of the observation point. The probability of the corresponding distance between the source s and the propagation source; and Tables are presented in actual and simulated propagation respectively. The recorded reception time; η∈[0,1] represents the penalty factor. If the neighbor ID recorded in the simulated propagation is not equal to the neighbor ID recorded in the actual propagation, then η∈(0,1); otherwise, η=1.

[0120] Test Analysis:

[0121] The test compares the method with existing methods to verify the effectiveness of the proposed method in both the observation point deployment and propagation source localization stages. The propagation source localization method mentioned above is selected as the comparison method. First, S is defined as the actual set of propagation sources. This is the set of propagation sources obtained through localization. Here, we introduce two widely used evaluation metrics for propagation source localization methods: Error hops and F-Score. Error hops refers to the length of the shortest path between the localized propagation source and the actual propagation source on network G. The formula for calculating F-Score is shown in Equation (9), where Accuracy represents the proportion of correctly classified samples among all samples, Precision represents the proportion of real propagation sources in the localized propagation source set, Recall represents the proportion of correctly localized propagation sources in the real propagation source set, and γ is taken as 1 here.

[0122]

[0123] Test result analysis: such as Figures 4(a)-6 As shown, where, Figure 4(a) , 4(b) The SDNI-S algorithm is based on SDNI and considers the number of information forwardings. Formula (8) describes the SDNI-S algorithm. This method has achieved competitive results under different propagation models and different network structures with varying degrees of information loss, proving its high applicability in reality. Specifically, in small-scale networks, this method (SDNI and SDNI-S) outperforms other observation-based methods by 13%-25% and 21%-34%, respectively, and outperforms other snapshot-based methods by 17%-26% and 25%-37%, respectively. Their advantages become more pronounced in large-scale networks, with accuracy approximately twice that of other baseline methods.

[0124] The method provided by this invention differs from existing observation-point-based propagation source localization methods. This invention considers the actual information propagation process during the observation point deployment phase and uses quality-assured Monte Carlo simulation to achieve maximum coverage of observation points for effective network monitoring. Furthermore, it proposes a propagation source localization method based on Bayesian estimation, which solves the problem that incomplete network structure hinders propagation source localization and improves the applicability of propagation source localization methods in real-world scenarios. In addition, it combines the number of times information is forwarded on social networks to further improve the accuracy of propagation source tracing.

[0125] The present invention also provides a device for tracing the source of a transmitted message, comprising:

[0126] The acquisition unit is used to acquire user information and contact information between users of the test sample.

[0127] A construction unit is used to construct a first social network using the user information as nodes and the connection information between the users as edges.

[0128] The deployment unit is used to deploy a number of observation points on the first social network to obtain a social network after the deployment of the number of observation points, which is the second social network.

[0129] The activation unit is used to monitor the second social network until the propagation source locator is activated, then obtain a network snapshot in the activated state, which is the first network snapshot;

[0130] The supplementation unit is used to supplement the missing edges in the first network snapshot to obtain a network snapshot with supplemented edges, which is the second network snapshot.

[0131] The acquisition unit is further configured to acquire first information received by the observation point on the second network snapshot when the message is first received; the first information includes: message reception time t, message sender ID, and message forwarding count c;

[0132] The acquisition unit is further configured to simulate a message propagation process using an affected ordinary node in the second network snapshot as the propagation source, and acquire the second information received by the observation point that first received the message during the message propagation process; the second information includes: message reception time, message sender ID, and message forwarding count c; the ordinary node is a node that is not an observation point; the affected ordinary node is an ordinary node that received the message;

[0133] The loop unit is used to traverse all affected ordinary nodes;

[0134] The acquisition unit is further configured to acquire the second information obtained in each traversal;

[0135] The source tracing unit is used to compare the similarity between the first information and the corresponding second information, so that the affected ordinary node with the highest similarity is used as the propagation source of the test sample.

[0136] Figure 7 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 7 As shown, the electronic device may include a processor 710, a communications interface 720, a memory 730, and a communication bus 740. The processor 710, communications interface 720, and memory 730 communicate with each other via the communication bus 740. The processor 710 can call logical instructions in the memory 730 to execute a message propagation tracing method.

[0137] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0138] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for tracing the source of a transmitted message, characterized in that, include: S1: Obtain user information and contact information between users for the test samples; S2: Construct a first social network using the user information as nodes and the connection information between the users as edges; S3: Deploy several observation points on the first social network to obtain the social network after the observation points are deployed, which is the second social network; S4: Monitor the second social network until the propagation source locator is activated, and then obtain a network snapshot in the activated state as the first network snapshot; S5: Supplement the missing edges in the first network snapshot to obtain a network snapshot with supplemented edges, which is the second network snapshot; S6: Obtain the information received by the observation point on the second network snapshot when the message is first received, which is the first information; the first information includes: the message reception time t, the message sender's ID, and the number of message forwardings c; S7: Using the affected ordinary nodes in the second network snapshot as the propagation source, simulate the message propagation process, and obtain the information received by the observation point that receives the message for the first time during the message propagation process, which is the second information; The second information includes: message reception time, message sender ID, and message forwarding count c; The ordinary node refers to all nodes in the network block except for the observation point; the affected ordinary node refers to the ordinary node that received the message. S8: Traverse all affected ordinary nodes to obtain the second information corresponding to the different nodes; S9: Compare the similarity between the first information and the corresponding second information, so that the affected ordinary node with the highest similarity is used as the propagation source of the test sample; The propagation source of the test sample described in S9 is determined according to the following formula: Where i is a regular node; O represents all affected nodes in the second network snapshot; O represents the set of observation points. For ordinary nodes that receive messages; The first observation point to receive a message during the deployment phase. The probability of a corresponding distance from the propagation source s; The message reception time in the first information; The message reception time in the second information; ∈[0,1] represents the penalty factor. If the neighbor ID recorded in the first information is not equal to the neighbor ID recorded in the second information, then... ∈(0,1); otherwise, = 1.

2. The method for tracing the source of a propagated message according to claim 1, characterized in that, Step S3, which involves deploying several observation points on the first social network, includes: The first social network is simulated using Monte Carlo simulation for several iterations until the number of affected observation points reaches a preset threshold. The simulation is then stopped, and the observation points are deployed using the social network after the simulation has stopped. The number of observation points is determined by the following formula: Where O represents the set of observation points, V represents the set of users, and m represents the number of observation points; This indicates the target observation points that need to be deployed. Indicates the actual deployment observation point; the The approximate solution obtained from the Monte Carlo simulation of the first social network is the actual observation point of the deployment. d(s,j) represents the state of observation point j in the i-th simulation; N is the number of iterations when using Monte Carlo simulation; s represents the propagation source; d(s,j) represents the distance between observation point j and propagation source s when the first message is received; h represents the expected distance.

3. The method for tracing the source of a propagated message according to claim 2, characterized in that, Monitoring the second social network in step S4 until the propagation source location procedure is activated includes: The number of observation points receiving messages on the second social network is obtained in real time; The propagation source localization procedure is activated when the number of observation points receiving the message exceeds a certain preset threshold.

4. The method for tracing the source of a propagated message according to claim 1, characterized in that, S5 includes: Obtain information recorded by observation points deployed on the first network snapshot; the information recorded by the observation points includes their neighbor IDs; Based on the information recorded by the observation point, determine whether there is an edge between the corresponding observation point and its recorded neighbors. If there is no edge, add the corresponding edge.

5. The method for tracing the source of a propagated message according to claim 1, characterized in that, The propagation source of the test sample was determined by merging the number of message forwardings. in, This is the observation point where the first message was received. Record the IDs of neighboring nodes. This indicates the number of times the message has been forwarded.

6. A device for tracing the source of a transmitted message, characterized in that, include: The acquisition unit is used to acquire user information and contact information between users of the test sample. A construction unit is used to construct a first social network using the user information as nodes and the connection information between the users as edges. The deployment unit is used to deploy a number of observation points on the first social network to obtain a social network after the deployment of the number of observation points, which is the second social network. The activation unit is used to monitor the second social network until the propagation source locator is activated, then obtains a network snapshot in the activated state, which is the first network snapshot; The supplementation unit is used to supplement the missing edges in the first network snapshot to obtain a network snapshot with supplemented edges, which is the second network snapshot. The acquisition unit is further configured to acquire information received by the observation point on the second network snapshot when the message is first received, which is the first information; the first information includes: the message reception time t, the message sender's ID, and the message forwarding count c; The acquisition unit is further configured to simulate the message propagation process using the affected ordinary nodes in the second network snapshot as the propagation source, and acquire the information received by the observation point that receives the message for the first time during the message propagation process, which is the second information; the second information includes: message reception time, message sender ID, and message forwarding count c; the ordinary node is a node that is not an observation point; the affected ordinary node is an ordinary node that receives the message; The loop unit is used to traverse all affected ordinary nodes; The acquisition unit is further configured to acquire the second information obtained in each traversal; The source tracing unit is used to compare the similarity between the first information and the corresponding second information, so that the affected ordinary node with the highest similarity is used as the propagation source of the test sample. The propagation source of the test sample in the tracing unit is determined according to the following formula: Where i is a regular node; O represents all affected nodes in the second network snapshot; O represents the set of observation points. For ordinary nodes that receive messages; The first observation point to receive a message during the deployment phase. The probability of a corresponding distance from the propagation source s; The message reception time in the first information; The message reception time in the second information; ∈[0,1] represents the penalty factor. If the neighbor ID recorded in the first information is not equal to the neighbor ID recorded in the second information, then... ∈(0,1); otherwise, = 1.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the tracing method for propagating messages as described in any one of claims 1 to 5.

Images