A method and system for detecting abnormal users based on multi-layer features

Abstract

The application belongs to the technical field of user detection, and particularly relates to an abnormal user detection method and system based on multiple feature layers, which effectively fuse user behavior patterns, user attributes and user tweet features in social data, summarize social network user data into four levels of user statistical attributes, user behavior attributes, user network attributes and high-dimensional attributes, and use a composite neural network model based on an attention mechanism to classify and predict normal users and abnormal users, so that better abnormal user detection results can be obtained.

Description

Technical Field

[0001] This invention belongs to the field of user detection technology, specifically an abnormal user detection method and system based on multi-layer features. Background Technology

[0002] In the internet age, social networks serve as platforms for users to express their personal opinions and thoughts, and are also the primary channel for most people to receive social information. Whenever a major social emergency occurs, in addition to discussions by many normal users, social network platforms also contain malicious and misleading statements from some abnormal users, influencing public judgment and causing a series of adverse effects. Current methods for detecting abnormal users on social networks mostly rely on natural language processing algorithms to process user tweets or comments, extracting semantic features to train classifiers, thereby determining whether a user is abnormal. Taking the Chinese social network Weibo as an example, existing methods for detecting abnormal users typically obtain a training dataset from social network tweets or comments. Data cleaning is performed by removing duplicate content, hyperlinks, and emoticons to obtain pure text content. Feature matrices are constructed using feature extraction and word vectorization methods such as TF-IDF and word2vec. Finally, the feature matrix is ​​input into deep learning or machine learning classifiers such as RNN, LSTM, and SVM for training. After classifier training and filtering, the text is divided into malicious and normal text, thereby determining the user to whom the text belongs.

[0003] Social data is primarily text-based, but it also includes information such as user attributes and behaviors. While social text analysis can enable preliminary anomaly detection, social data is characterized by heterogeneity, dynamism, high noise levels, strong anonymity, and informality. Relying solely on text analysis makes it difficult to accurately characterize anomaly users or uncover their behavioral patterns and personalities. In recent years, multi-layer attention mechanisms have been widely used in anomaly detection, demonstrating superior performance compared to traditional neural networks and machine learning algorithms in uncovering hidden information in text. However, these mechanisms still focus primarily on analyzing comment text, neglecting user behavioral patterns and attribute information. Summary of the Invention

[0004] To address the problems existing in the prior art, the main objective of this invention is to propose an abnormal user detection method and system based on multi-layer features, which effectively integrates user behavior patterns, user attributes, and user tweet features from social data, and uses a composite neural network based on the attention mechanism to classify and predict normal and abnormal users.

[0005] To address the aforementioned technical problems, according to one aspect of the present invention, the present invention provides the following technical solution:

[0006] An abnormal user detection method based on multi-layer features includes the following steps:

[0007] S1. Collect social network data through web crawlers. The collected content includes user homepage information, social network information, and tweet information. The collected content is integrated to form a social network user dataset for training.

[0008] S2. Perform data cleaning operations on the data in the social network user dataset;

[0009] S3. Summarize the cleaned data into four levels of user characteristics: personal characteristics, network characteristics, tweet characteristics, and high-dimensional characteristics, and construct user profiles.

[0010] S4. Perform feature fusion on the four levels of user characteristics;

[0011] S5. Input the fused feature matrix into the classifier for training to complete the abnormal user detection based on multi-layer features.

[0012] Preferably, in step S1, during the social network data collection stage via web crawler, the web crawler automatically captures publicly available information on web pages by simulating a browser to send network requests to the server and receive request responses, according to pre-set rules.

[0013] Preferably, in step S2, data cleaning first removes training data with missing fields from the original dataset to obtain an original dataset without missing fields. Since there may be duplicate crawling during the crawling process, data cleaning uses the `content` field in the dataset as a comparison condition to remove duplicate data from the original dataset without missing fields, resulting in a clean and unique original dataset. Data with the field type `str` is unstructured text data that computers cannot recognize and requires processing. In the clean and unique dataset, for time fields such as `birth`, `year`, and `publish_time`, the `parse` method in the `dateutil` package converts the `str` information to `datetime` type. In the clean and unique dataset, for long text data such as `content` and `topic`, the `clean` method in the `harvesttext` library is used to remove links and emojis from the `str`, and then the `convert` method in the `zhconv` package converts traditional Chinese characters to simplified Chinese characters. After the above cleaning, the cleaned original dataset U is obtained.

[0014] Preferably, in step S3, the social network user data is summarized into four levels: user statistical attributes, user behavioral attributes, user network attributes, and high-dimensional attributes.

[0015] Preferably, in step S3, the abnormal user profile problem is summarized as follows: given a user abnormal label lm ∈L={0,1} Select problem; where, u m U refers to any single user data record in the cleaned original dataset, where U is the cleaned original dataset, n is the total number of user data records in the cleaned original dataset, and the label is l. m =0 indicates a non-abnormal user, label l m =1 indicates an abnormal user.

[0016] Preferably, in step S3, for any data u m Features are constructed and selected according to the following rules:

[0017] (1) Personal characteristics: including five types: user_id_length, user_id_num, year, sex, and IP address;

[0018] user_id_length: The length of the nickname, calculated by counting user IDs. m The number of characters in the 'name' field is used to determine this.

[0019] user_id_num: The proportion of numbers in the nickname, calculated by... m The value is obtained by comparing the number of numeric characters in the "name" field with the total number of characters.

[0020] year: User's age, expressed via u m The year field can be directly obtained or by using the current time and u. m The difference is calculated by subtracting the birth field from the result.

[0021] sex: User's gender, indicated by u m The sex field in the middle is obtained directly;

[0022] IP: via u m The location field was obtained by searching and comparing it with the China Postal Code table;

[0023] (2) Tweet characteristics: including four types: publish_hour, is_origion, is_topic, and content_vec;

[0024] publish_hour: The time the Weibo post was published, as indicated by u m The `publish_time` field in the middle is directly obtained;

[0025] is_origin: Whether it is an original Weibo post, determined by u m The is_origin field in the middle is obtained directly;

[0026] is_topic: Whether the topic is present, indicated by u mThe is_topic field can be obtained directly;

[0027] content_vec: The tensor obtained from the text content, which is obtained through the BERT pre-trained model and used as input for the subsequent classifier;

[0028] (3) Network characteristics: including five types: forward_num, comment_num, like_num, followers_num, and following_num;

[0029] Network features can all be obtained through u m The field with the same name can be obtained directly;

[0030] (4) High-dimensional features: High-dimensional features l m This reflects attributes of social network user data that cannot be described with explicit meaning; the subscripts m and u... m In this context, 'm' corresponds to the user ID; the derivation of high-dimensional features involves eight steps:

[0031] 1) Sample a subset U of size k from the cleaned original dataset U. s Select U from tag set L s The corresponding tag set L s ;

[0032] 2) Obtain subset U according to the above rules for constructing user profiles. s Any user Feature vectors other than high-dimensional features

[0033] 3) To Feature fusion is performed to obtain a single input vector for the classifier.

[0034] 4) Using matrices As input, its corresponding label [l1,…l k-1 ,l k ] T As output, the first-layer classifier is trained and the classifier parameters are retained. The classifier can be any low-level classifier, including but not limited to Naive Bayes classifier, shallow neural network, etc.

[0035] 5) Obtain any user in set U according to the above rules for constructing user profiles. Feature vectors other than high-dimensional features

[0036] 6) To Feature fusion is performed, as described below, to obtain a single input vector for the classifier.

[0037] 7) Using input vectors As the prediction target, the pre-trained one-layer classifier is used to predict the output value.

[0038] 8) The predicted value of the classifier l m 'High-dimensional features are obtained after normalization l' m ”;

[0039] After user profile construction, a user feature vector containing high-dimensional features is obtained. User feature vector and its corresponding tag l m Store the dataset U in CSV format. profile ;wherein user feature vector Includes a single data entry u m The portrait yielded 15 features, totaling 14 + 768 = 782 values.

[0040] Preferably, in step S4, before the features are fed into the classifier, the 768-character tweet feature `content_vec` needs to be fused with more than ten other features. The feature fusion step exists in steps 3) and 6) of high-dimensional feature extraction, as well as in the abnormal user detection based on multi-layer features. The only difference is that the abnormal user detection based on multi-layer features has one more feature (high-dimensional feature l). m ”).

[0041] Preferably, in step S5, a composite neural network model based on the attention mechanism is used for training, specifically including the following steps:

[0042] 1) First, the dataset U after extracting portrait features... profile The dataset is divided into a training set and a test set in an 8:2 ratio. Assume that the training set has s data points.

[0043] 2) Take s data points from the training set Feature fusion is performed to obtain This leads to the input of the model.

[0044] 3) Feature extraction is performed using CNN, with ReLU selected as the activation function in the convolutional layers. Max pooling is used, and the output is finally obtained through sigmoid activation. The representation is as follows:

[0045]

[0046] P = max(Z) + b p

[0047]

[0048] Where Z is the output of a convolutional layer, P is the output of a pooling layer, and W... c It is the convolutional layer weight, W o It is the output layer weight, b c It is the convolutional layer bias, b p It is the pooling layer bias, b o It is the output layer bias;

[0049] 4) Use LSTM to extract text features and output h. t It is expressed as follows:

[0050] h t =LSTM(O c,t-1 O c,t ),t∈[1,i]

[0051] Among them, O c,t For O c The value at time t, where i is O. c Length;

[0052] 5) Use the output of the LSTM as the input to the attention layer, assign weights probabilistically, and the attention layer outputs o. t It is expressed as follows:

[0053] e t =utanh(wh) t +b)

[0054]

[0055] Where u and w are weights; b is the bias; e t It is a probability distribution;

[0056] 6) Obtain the abnormal user prediction result y through the sigmoid activation function, where y is represented as follows:

[0057] y = sigmoid(ws t +b)

[0058] Where w is the weight and b is the bias.

[0059] According to another aspect of the present invention, the present invention provides the following technical solution:

[0060] An abnormal user detection system based on multi-layer features, used to implement the above-mentioned abnormal user detection method based on multi-layer features, includes:

[0061] Data acquisition module: Collects social network data through web crawlers. The collected content includes user homepage information, social network information, and tweet information. The collected content is integrated to form the social network user dataset used for training.

[0062] Data cleaning module: Performs data cleaning operations on social network user datasets, such as deduplication, delinking, removing emojis, and deleting useless data;

[0063] The user profile building module summarizes the cleaned data into four levels of user characteristics: personal characteristics, network characteristics, tweet characteristics, and high-dimensional characteristics, and builds user profiles accordingly.

[0064] Feature fusion module: fuses user features from four levels;

[0065] Abnormal User Detection Module: Input the fused feature matrix into the classifier for training to complete abnormal user detection based on multi-layer features.

[0066] The beneficial effects of this invention are as follows:

[0067] This invention proposes an abnormal user detection method and system based on multi-layer features, which effectively integrates user behavior patterns, user attributes, and user tweet features in social data. It summarizes social network user data into four levels: user statistical attributes, user behavioral attributes, user network attributes, and high-dimensional attributes. It uses a composite neural network model based on the attention mechanism to classify and predict normal and abnormal users, which can obtain better abnormal user detection results. Attached Figure Description

[0068] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the structures shown in these drawings without creative effort.

[0069] Figure 1 This is a flowchart illustrating the abnormal user detection method based on multi-layer features of the present invention.

[0070] Figure 2 This is a schematic diagram of the feature fusion process of the present invention.

[0071] Figure 3 This is a schematic diagram of the training process for the composite neural network model of the present invention.

[0072] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0073] The technical solutions described below in conjunction with the embodiments will be clearly and completely described. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0074] This invention proposes an abnormal user detection method and system based on multi-layer features, which has the following advantages:

[0075] (1) It provides a method for independently collecting user data from social networking platforms (taking Weibo as an example). By changing the seed URL, it is possible to collect user homepage information, social network information and tweet information, instead of relying on existing web crawler tools to collect data within a limited scope.

[0076] (2) In addition to text, a user profile construction method that incorporates user behavior patterns and attribute information is proposed when constructing user profiles. Social network user data is summarized into four levels: user statistical attributes, user behavioral attributes, user network attributes and high-dimensional attributes, which enriches the input of the classifier and can obtain better results than the abnormal user detection based on pure text.

[0077] (3) High-dimensional features use the idea of ​​stacking strategy. Stacking is often used in classification model training to avoid the model being affected by the inherent defects of a single algorithm, which can enhance the robustness of the prediction method.

[0078] (4) Feature fusion is required before the features are fed into the classifier. Since the length of the tweet feature content_vec is 768 and the other features total 14, directly feeding them into the classifier for training will cause a few features to be submerged by the network. Therefore, a feature fusion method to upgrade the 14 features is proposed.

[0079] According to one aspect of the present invention, the present invention provides the following technical solution:

[0080] like Figure 1 As shown, an abnormal user detection method based on multi-layer features includes the following steps:

[0081] S1. Collect social network data through web crawlers. The collected content includes user homepage information, social network information, and tweet information. The collected content is integrated to form a social network user dataset for training.

[0082] S2. Perform data cleaning operations on the social network user dataset, such as deduplication, delinking, removing emojis, and deleting useless data;

[0083] S3. Summarize the cleaned data into four levels of user characteristics: personal characteristics, network characteristics, tweet characteristics, and high-dimensional characteristics, and construct user profiles.

[0084] S4. Perform feature fusion on the four levels of user characteristics;

[0085] S5. Input the fused feature matrix into the classifier for training to complete the abnormal user detection based on multi-layer features.

[0086] In one embodiment of the present invention, in step S1, during the social network collection stage via web crawler, according to pre-set rules, the web crawler automatically captures public information on web pages by simulating a browser to send network requests to the server and receive request responses.

[0087] In one embodiment of the present invention, in step S1, right-click on the original page to be crawled and select [Inspect] to enter the web developer tools. In the [Network] mode, obtain the request URL and web page request method of the original page from the [Headers]. Use the request method to request the web page and parse the URL address to obtain the web page information. Use web page parsing methods such as xpath / bs4 / re to parse the web page. Add the parsed URL to the collection list according to the preset rules, and then select the next page URL to be crawled according to a specific strategy until the collection list is empty or sufficient data is collected. Store the valid information after parsing the web page information as the original dataset.

[0088] In one embodiment of the present invention, in step S1, the original page URL for the user homepage information crawling task is https: / / s.weibo.com / user, where user refers to the unique identifier uid of the Weibo user. The list of URLs to be crawled contains seed URLs of the users to be crawled, and each URL is distinguished by user. The webpage information is stored in HTML format and needs to be obtained by parsing the webpage to crawl the content. The structured information (nickname, gender, number of followers, IP address, etc.) in the crawled webpage is structured and can be directly read after being converted to JSON format by response.json(). The remaining unstructured information is extracted using XPath.

[0089] In one embodiment of the present invention, in step S1, the task of crawling user tweet information and network information targets Weibo topics, and the original page URL is https: / / s.weibo.com / weibo?q=%23%E6%9D%8E%E8%8D%A3%E6%B5%A9%23, where q represents the Unicode encoding of Weibo topic keywords; the web page information obtained by parsing the URL address is extracted through XPath and related text processing APIs of Python's String library.

[0090] In one embodiment of the present invention, in step S1, the fields of the original dataset obtained by crawling are as follows:

[0091]

[0092] In one embodiment of the present invention, in step S2, due to the sparsity of social network platform data, missing values ​​in the original dataset obtained by crawling can affect network performance. Data cleaning first removes training data with missing fields from the original dataset to obtain an original dataset without missing fields. Since there may be duplicate crawling during crawling, data cleaning uses the content field in the dataset as a comparison condition to remove duplicate data from the original dataset without missing fields, resulting in an original dataset without missing or duplicate fields. Data with the field type str is unstructured text data that cannot be recognized by computers and needs to be processed. In the dataset without missing or duplicate fields, for time fields such as birth, year, and publish_time, the str information is converted to datetime type using the parse method in the dateutil package. In the dataset without missing or duplicate fields, for long text data such as content and topic, the links and emoticons in str are first removed using the clean method in the harvesttext library, and then the traditional Chinese characters are converted to simplified Chinese characters using the convert method in the zhconv package. After the above cleaning, the cleaned original dataset U is obtained.

[0093] In one embodiment of the present invention, in step S3, the social network user data can be summarized into four levels: user statistical attributes (age, gender, IP address, etc.), user behavioral attributes (posting comments, tweets, topics, etc.), user network attributes (following and being followed, egocentric network structure, etc.), and high-dimensional attributes. The social network user data attributes at these four levels can enrich the input of the classifier, as user behavior patterns and attribute information are input in addition to text analysis, which theoretically can enhance the effect of abnormal user detection.

[0094] In one embodiment of the present invention, in step S3, the abnormal user profiling problem can be summarized as follows: given a user abnormal label l m ∈L={0,1} Select problem; where, u m U refers to any single user data record in the cleaned original dataset, where U is the cleaned original dataset, n is the total number of user data records in the cleaned original dataset, and the label is l. m =0 indicates a non-abnormal user, label l m =1 indicates an abnormal user.

[0095] In one embodiment of the present invention, in step S3, for any data u m Features are constructed and selected according to the following rules:

[0096] (1) Personal characteristics: including five types: user_id_length, user_id_num, year, sex, and IP address;

[0097] user_id_length: The length of the nickname, calculated by counting user IDs. m The number of characters in the "name" field indicates that research shows a certain correlation between nickname length and user activity. Longer non-default numeric nicknames generally belong to non-abnormal users.

[0098] user_id_num: The proportion of numbers in the nickname, calculated by... m The ratio of numeric characters in the "name" field to the total number of characters is used to obtain the value. Since the initial nicknames of Weibo users are garbled numeric characters, an excessively high proportion of numeric characters in the nickname can, to some extent, reflect abnormal users such as "smurf accounts" or "paid trolls".

[0099] year: User's age, expressed via u m The year field can be directly obtained or by using the current time and u. m The difference between the birth field and the year feature is calculated. The year feature may be unknown. Among users with unknown year features, the proportion of abnormal users is higher than that among users with known year features.

[0100] sex: User's gender, indicated by u m The sex field is directly obtained and divided into {male, female, unknown}. The proportion of abnormal users among users with unknown sex features is higher than the proportion of abnormal users among users with known sex features.

[0101] IP: via u m The location field was compared with the China Postal Code table to confirm that the user was classified as {within China, outside China, unknown}.

[0102] (2) Tweet characteristics: including four types: publish_hour, is_origion, is_topic, and content_vec;

[0103] publish_hour: The time the Weibo post was published, as indicated by u m The `publish_time` field directly provides the data; the publication time largely reflects a user's behavioral habits and lifestyle, and in some cases, it can also indicate whether the user is within the Beijing time range.

[0104] is_origin: Whether it is an original Weibo post, determined by u m The `is_origin` field directly confirms that tweets are categorized as {original, non-original}; original tweets reflect users' social and sharing habits.

[0105] is_topic: Whether the topic is present, indicated by u m The `is_topic` field can be obtained directly; if the field is empty, it can be matched using a regular expression like `re`. m The `content` field determines whether a tweet contains a topic by checking if it contains "#.*?". The matching principle is that ".*?" refers to characters of any length and content. This categorizes tweets into {containing a topic, not containing a topic}. This feature reflects a user's level of attention to real-time trending topics; abnormal users' `is_topic` features are mostly those containing topics.

[0106] `content_vec`: A tensor obtained from the text content, acquired through a BERT pre-trained model, used as input for the subsequent classifier; specifically, it imports `BertModel` from `transformers`, loads the 'bert_base_chinese' pre-trained model from `BertModel` using the `from_pretrained` method, and finally uses the `bert` method to transform the data. m The `content` field is transformed into the output of the last hidden layer of the bert_base_chinese model. This output is a 3D tensor of length 768, meaning u m The sentence-level representation of the content sequence in the middle field can be used as input for classifiers in downstream tasks;

[0107] (3) Network features: including five types: forward_num, comment_num, like_num, followers_num, and following_num.

[0108] Network characteristics, also known as degree characteristics, are important statistical indicators reflecting a user's popularity, activity level, and online influence; network characteristics can all be obtained through um The field with the same name can be obtained directly;

[0109] (4) High-dimensional features: High-dimensional features l m This reflects attributes of social network user data that cannot be described by explicit meaning; the subscript m (1≤m≤n) and u m In this context, 'm' corresponds to the user ID; the derivation of high-dimensional features involves eight steps:

[0110] 1) Sample a subset U of size k (0≤k≤n) from the cleaned original dataset U. s Select U from tag set L s The corresponding tag set L s ;

[0111] 2) Obtain subset U according to the above rules for constructing user profiles. s Any user in China Feature vectors other than high-dimensional features

[0112] 3) To Feature fusion is performed, as described below, to obtain a single input vector for the classifier.

[0113] 4) Using matrices As input, its corresponding label [l1,…l k-1 ,l k ] T As output, the first-layer classifier is trained and the classifier parameters are retained. The classifier can be any low-level classifier, including but not limited to Naive Bayes classifier, shallow neural network, etc.

[0114] 5) Obtain any user in set U according to the above rules for constructing user profiles. Feature vectors other than high-dimensional features

[0115] 6) To Feature fusion is performed to obtain a single input vector for the classifier.

[0116] 7) Using input vectors As the prediction target, the pre-trained one-layer classifier is used to predict the output value.

[0117] 8) The predicted value of the classifier l m 'High-dimensional features are obtained after normalization l' m ”;

[0118] After user profile construction, a user feature vector containing high-dimensional features is obtained. User feature vector and its corresponding tag l m Store the dataset U in CSV format. profile ;wherein user feature vector Includes a single data entry u m The portrait yielded 15 features, totaling 14 + 768 = 782 values.

[0119] In one embodiment of the present invention, in step S4, before the features are fed into the classifier, the tweet feature content_vec of length 768 needs to be fused with more than ten other features; the feature fusion step exists in steps 3) and 6) of high-dimensional feature derivation and in abnormal user detection based on multi-layer features, the only difference being that abnormal user detection based on multi-layer features has one more feature (high-dimensional feature l). m ”).

[0120] In one embodiment of the present invention, in step S4, the feature fusion step is as follows: Figure 2 As shown in the diagram, the squares represent any row of the characteristic matrix. There are two ways to represent feature fusion: concat is for concatenating features, which directly concatenates two 768-dimensional features into a 1536-dimensional fused feature; add is for adding features, which adds each feature in sequence to obtain a new 768-dimensional fused feature.

[0121] In one embodiment of the present invention, in step S5, in order to achieve a better recognition effect, a composite neural network model based on the attention mechanism is used for training, and its flowchart is as follows. Figure 3 As shown, the specific steps include:

[0122] 1) First, the dataset U after extracting portrait features... profile The dataset is divided into a training set and a test set in an 8:2 ratio. Assume that the training set has s data points.

[0123] 2) Take s data points from the training set Feature fusion is performed to obtain This leads to the input of the model.

[0124] 3) Feature extraction is performed using CNN, with ReLU selected as the activation function in the convolutional layers. Max pooling is used, and the output is finally obtained through sigmoid activation. The representation is as follows:

[0125]

[0126] P = max(Z) + b p

[0127]

[0128] Where Z is the output of a convolutional layer, P is the output of a pooling layer, and W... c It is the convolutional layer weight, W o It is the output layer weight, b c It is the convolutional layer bias, b p It is the pooling layer bias, b o It is the output layer bias;

[0129] 4) Use LSTM to extract text features and output h. t It is expressed as follows:

[0130] h t =LSTM(O c,t-1 O c,t ),t∈[1,i]

[0131] Among them, O c,t For O c The value at time t, where i is O. c Length;

[0132] 5) Use the output of the LSTM as the input to the attention layer, assign weights probabilistically, and the attention layer outputs o. t It is expressed as follows:

[0133] e t =utanh(wh) t +b)

[0134]

[0135] Where u and w are weights; b is the bias; e t It is a probability distribution;

[0136] 6) Obtain the abnormal user prediction result y through the sigmoid activation function, where y is represented as follows:

[0137] y = sigmoid(ws t +b)

[0138] Where w is the weight and b is the bias.

[0139] According to another aspect of the present invention, the present invention provides the following technical solution:

[0140] An abnormal user detection system based on multi-layer features, used to implement the above-mentioned abnormal user detection method based on multi-layer features, includes:

[0141] Data acquisition module: Collects social network data through web crawlers. The collected content includes user homepage information, social network information, and tweet information. The collected content is integrated to form the social network user dataset used for training.

[0142] Data cleaning module: Performs data cleaning operations on social network user datasets, such as deduplication, delinking, removing emojis, and deleting useless data;

[0143] The user profile building module summarizes the cleaned data into four levels of user characteristics: personal characteristics, network characteristics, tweet characteristics, and high-dimensional characteristics, and builds user profiles accordingly.

[0144] Feature fusion module: fuses user features from four levels;

[0145] Abnormal User Detection Module: Input the fused feature matrix into the classifier for training to complete abnormal user detection based on multi-layer features.

[0146] It should be noted that the BERT model used in content_vec is not limited to BERT_base_chinese; the choice of low-level trainers in high-dimensional features covers a variety of existing machine learning and deep learning classifiers; and the algorithms used in the abnormal user detection method based on multi-layer features are not limited to convolutional neural networks.

[0147] This invention effectively integrates user behavior patterns, user attributes, and user tweet features from social data, summarizing social network user data into four levels: user statistical attributes, user behavioral attributes, user network attributes, and high-dimensional attributes. It also uses a composite neural network model based on the attention mechanism to classify and predict normal and abnormal users, which can obtain better abnormal user detection results.

[0148] The above description is merely a preferred embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural transformations made using the contents of the present invention under the inventive concept of the present invention, or direct / indirect applications in other related technical fields, are included within the patent protection scope of the present invention.

Claims

1. An abnormal user detection method based on multi-layer features, characterized in that, Includes the following steps: S1. Collect social network data through web crawlers. The collected content includes user homepage information, social network information, and tweet information. The collected content is integrated to form a social network user dataset for training. S2. Perform data cleaning operations on the data in the social network user dataset; S3. Summarize the cleaned data into four levels of user characteristics: personal characteristics, network characteristics, tweet characteristics, and high-dimensional characteristics, and construct user profiles. S4. Perform feature fusion on the four levels of user characteristics; S5. Use a composite neural network model based on the attention mechanism to train and complete the abnormal user detection based on multi-layer features; In step S3, the abnormal user profiling problem is summarized as follows: given a user abnormal tags Select the problem; where u m U refers to any single user data record in the cleaned original dataset, where U is the cleaned original dataset, n is the total number of user data records in the cleaned original dataset, and the label is l. m =0 indicates a non-abnormal user, label l m =1 indicates an abnormal user; In step S3, for any data u m Features are constructed and selected according to the following rules: (1) Personal characteristics: including five types: user_id_length, user_id_num, year, sex, and IP address; user_id_length: The length of the nickname, calculated by counting user IDs. m The number of characters in the 'name' field is used to determine this. user_id_num: The proportion of numbers in the nickname, calculated by... m The value is obtained by comparing the number of numeric characters in the "name" field with the total number of characters. year: User's age, expressed via u m The year field can be directly obtained or by using the current time and u. m The difference is calculated by subtracting the birth field from the result. sex: User's gender, indicated by u m The sex field in the middle is obtained directly; IP: via u m The location field was obtained by searching and comparing it with the China Postal Code table; (2) Tweet characteristics: including four types: publish_hour, is_origion, is_topic, and content_vec; publish_hour: The time the Weibo post was published, as indicated by u m The `publish_time` field in the middle is directly obtained; is_origin: Whether it is an original Weibo post, determined by u m The is_origin field in the middle is obtained directly; is_topic: Whether the topic is present, indicated by u m The is_topic field can be obtained directly; content_vec: The tensor obtained from the text content, which is obtained through the BERT pre-trained model and used as input for the subsequent classifier; (3) Network characteristics: including five types: forward_num, comment_num, like_num, followers_num, and following_num; Network features are all obtained through u m The field with the same name can be obtained directly; (4) High-dimensional features: High-dimensional features l m '' reflects attributes of social network user data that cannot be described with explicit meaning; the subscripts m and u m In this context, 'm' corresponds to the user ID; the derivation of high-dimensional features involves eight steps: 1) Sample a subset U of size k from the cleaned original dataset U. s Select U from tag set L s The corresponding tag set L s ; 2) Obtain subset U according to the above rules for constructing user profiles. s Any user Feature vectors other than high-dimensional features ; 3) To Feature fusion is performed to obtain a single input vector for the classifier. ; 4) Using matrices As input, its corresponding label As output, the first layer classifier is trained and the classifier parameters are retained. The classifier includes a Naive Bayes classifier and a shallow neural network. 5) Obtain the set according to the above rules for constructing user profiles. Any user Feature vectors other than high-dimensional features ; 6) To Feature fusion is performed to obtain a single input vector for the classifier. ; 7) Use the input vector obtained in step 6) As the prediction target, the pre-trained one-layer classifier is used to predict the output value. ; 8) The predicted value of the classifier l m 'High-dimensional features are obtained after normalization l' m ''; After user profile construction, a user feature vector containing high-dimensional features is obtained. , user feature vector and its corresponding tag l m Store the dataset U in CSV format. profile ;wherein user feature vector Includes a single data entry u m The portrait yielded 15 features, totaling 14 + 768 = 782 values.

2. The abnormal user detection method based on multi-layer features according to claim 1, characterized in that, In step S1, during the social network data collection stage via web crawler, the web crawler automatically captures public information on web pages by simulating a browser to send network requests to the server and receive request responses, according to pre-set rules.

3. The abnormal user detection method based on multi-layer features according to claim 1, characterized in that, In step S2, data cleaning first removes training data with missing fields from the original dataset to obtain an original dataset without missing fields. Since there may be duplicate crawling during the crawling process, data cleaning uses the content field in the dataset as a comparison condition to remove duplicate data from the original dataset without missing fields, resulting in an original dataset without missing or duplicate data. Data with the field type str is unstructured text data that cannot be recognized by computers and needs to be processed. In the clean and unique dataset, for time fields such as birth, year, and publish_time, the str information is converted to datetime type using the parse method in the dateutil package. In the clean and unique dataset, for long text data such as content and topic, links and emojis in the str are first removed using the clean method in the harvesttext library, and then traditional Chinese characters are converted to simplified Chinese characters using the convert method in the zhconv package. After the above cleaning, the cleaned original dataset U is obtained.

4. The abnormal user detection method based on multi-layer features according to claim 1, characterized in that, In step S3, social network user data is summarized into four levels: user statistical attributes, user behavioral attributes, user network attributes, and high-dimensional attributes.

5. The abnormal user detection method based on multi-layer features according to claim 1, characterized in that, In step S5, a composite neural network model based on the attention mechanism is used for training, which specifically includes the following steps: 1) First, the dataset U after extracting portrait features... profile The dataset is divided into a training set and a test set in an 8:2 ratio. Assume that the training set has s data points. 2) Take s data points from the training set Feature fusion is performed to obtain This leads to the input of the model. ; 3) Feature extraction is performed using CNN, with ReLU selected as the activation function in the convolutional layers. Max pooling is used, and the output is finally obtained through sigmoid activation. The representation is as follows: Where Z is the output of a convolutional layer, P is the output of a pooling layer, and W... c It is the convolutional layer weight, W o It is the output layer weight, b c It is the convolutional layer bias, b p It is the pooling layer bias, b o It is the output layer bias; 4) Use LSTM to extract text features and output h. t It is expressed as follows: h t =LSTM(O c,t-1 ,O c,t ),t [1,r] Among them, O c,t For O c The value at time t, r is O. c Length; 5) Use the output of the LSTM as the input to the attention layer, assign weights probabilistically, and the attention layer outputs o. t It is expressed as follows: Where u and w are weights; b is the bias; e t It is a probability distribution; 6) Obtain the abnormal user prediction result y through the sigmoid activation function, where y is represented as follows: y=sigmoid(wo t +b) Where w is the weight and b is the bias.

6. An abnormal user detection system based on multi-layer features, used to implement the abnormal user detection method based on multi-layer features according to any one of claims 1-5, characterized in that, include: Data acquisition module: Collects social network data through web crawlers. The collected content includes user homepage information, social network information, and tweet information. The collected content is integrated to form the social network user dataset used for training. Data cleaning module: Performs data cleaning operations on social network user datasets, including deduplication, delinking, removing emojis, and deleting useless data. The user profile building module summarizes the cleaned data into four levels of user characteristics: personal characteristics, network characteristics, tweet characteristics, and high-dimensional characteristics, and builds user profiles accordingly. Feature fusion module: fuses user features from four levels; Abnormal User Detection Module: This module uses a composite neural network model based on the attention mechanism for training to perform abnormal user detection based on multi-layer features.

Images