Social network abnormal event type identification method and identification system

Abstract

The invention discloses a social network abnormal event type identification method and identification system, relates to a social network abnormal event type identification method and identification system, and belongs to the field of social network abnormal identification. The objective of the invention is to solve the problem of low detection and identification accuracy of the abnormal account of the social network in the prior art. The method comprises the following steps: constructing a social network account graph; selecting a plurality of tagged accounts from the social network and performing abnormal account judgment, if the accounts are normal accounts, marking normal tags, and if the accounts are abnormal accounts, marking abnormal tags so as to obtain tagged accounts; obtaining text features with label account attributes; generating an adjacent matrix of the social network according to the social network account graph; obtaining a trained attribute feature mapping network; obtaining a trained structural feature mapping network; and detecting the unmarked tag account in the social network needing anomaly detection to obtain the probability that the unmarked tag account is a normal account or an abnormal account.

Description

Technical Field

[0001] The present invention relates to a method and a system for identifying abnormal event types in a social network, and belongs to the field of abnormal identification in a social network. Background Art

[0002] With the rapid development and widespread application of Internet technology, social networks have gradually become an indispensable part of people's digital life due to their convenience, entertainment and real-time nature. Social networks are an important platform for people to communicate. As their influence continues to grow, there are also a large number of abnormal users on the platform that affect the normal use of users, such as zombie users, spam publishers, social robots, etc. These users need to be detected and removed to ensure the normal use of social networks.

[0003] Social networks carry a vast amount of media and social information, and they also contain a large amount of private information and huge commercial value. Therefore, social networks attract a large number of malicious attackers. Malicious attackers create fake accounts or steal normal accounts to publish malicious information, commit financial transaction fraud, launch network attacks, and other malicious behaviors on social networks, which seriously threaten people's lives and property safety and the rules, order, and trust relationships of social networks. These malicious attackers are collectively referred to as abnormal users.

[0004] In the real world, with the emergence of social tools such as Weibo, WeChat, and QQ, more and more users have their own social accounts. Social networks play an important role in people's lives. They have become a part of people's lives and have an inestimable impact on people's information acquisition, thinking, and life. Social networks have become a window for people to obtain information, express themselves, and promote marketing. With the continuous increase in social network users, investors, advertisers, program developers and other stakeholders are increasingly turning their attention to social networking sites. At the same time, more and more malicious attackers are making profits through social accounts. Attackers use illegal means to create multiple accounts and then achieve profit by publishing malicious information and directly recommending products to users in private messages. Compared with normal accounts of ordinary people, these abnormal accounts created by attackers have seriously affected the harmonious communication environment originally established by social networks.

[0005] However, traditional methods for detecting abnormal accounts on social networks require a lot of time and manpower. Social networks have a large user base and a wide coverage, covering a variety of abnormal users, and the behavioral characteristics of abnormal users will also change dynamically over time. When abnormal users change their behavior patterns, traditional methods for detecting abnormal accounts on social networks cannot effectively handle them, and the accuracy of detecting and identifying abnormal accounts on social networks is low. Summary of the invention

[0006] The purpose of the present invention is to solve the problem that the existing social networks have a large user base, a wide coverage, and cover a variety of abnormal users, resulting in a low accuracy rate in detecting and identifying abnormal accounts on social networks, and to propose a method and system for identifying abnormal event types in social networks.

[0007] A method for identifying abnormal event types in social networks has the following specific steps:

[0008] S1: Construct a social network account graph G = (V, E, X), where V represents the set of all tagged accounts in the social network, i.e., the node set; E represents the set of all edges between tagged accounts in the social network. When two accounts interact, an edge is generated between the two accounts; X represents the set of attribute information of all tagged accounts, where the account attribute information is text information;

[0009] S2: Select several labeled accounts from the social network and judge abnormal accounts. If it is a normal account, it is marked with a normal label. If it is an abnormal account, it is marked with an abnormal label, so as to obtain labeled accounts;

[0010] S3: Using a text feature extraction method to extract features from the attribute information of each labeled account, and obtaining text features of the attributes of the labeled account;

[0011] S4: Generate an adjacency matrix of a social network according to the social network account graph G = (V, E, X);

[0012] S5: construct attribute feature mapping network;

[0013] Input the text features of each labeled account attribute into the attribute feature mapping network to obtain the attribute vector corresponding to each account, and then input the attribute vector into a pre-set classifier to obtain the probability of the account being a normal account or an abnormal account; train the attribute feature mapping network to obtain a trained attribute feature mapping network;

[0014] S6: constructing a structural feature mapping network;

[0015] The text features of each labeled account attribute are used as row vectors to construct a text feature matrix, and the text feature matrix and the labeled adjacency matrix are input into the structural feature mapping network together to obtain a structural matrix composed of structural vectors of all accounts, and each row vector is extracted from the structural matrix as the structural vector of the corresponding account, and then the structural vector is input into a pre-set classifier to obtain the probability of the account being a normal account and an abnormal account; the structural feature mapping network is trained to obtain a trained structural feature mapping network;

[0016] S7: Detect unlabeled accounts in the social network that need to be detected for anomalies, and obtain the probability that the unlabeled accounts in the social network are normal accounts and abnormal accounts.

[0017] Preferably, the text feature extraction method in step S3 adopts a text feature extraction method based on a bag-of-words model.

[0018] Preferably, in S5, the text features of each labeled account attribute are input into an attribute feature mapping network to obtain an attribute vector corresponding to each account;

[0019] The specific process is:

[0020] The text feature A of the account attribute is input into the layer normalization layer, the output feature of the layer normalization layer is input into the multi-head collaborative attention, the multi-head collaborative attention output feature is added with the feature A to obtain the added feature B;

[0021] The feature B after the addition process is input into the normalization layer, and the output feature of the normalization layer is input into the multi-layer perceptron MLP. The output feature of the multi-layer perceptron MLP is added with the feature B after the addition process to obtain the feature C after the addition process as the attribute vector corresponding to each account.

[0022] Preferably, the text feature A of the account attribute is input into a layer normalization layer, the output feature of the layer normalization layer is input into the multi-head collaborative attention, and the output feature of the multi-head collaborative attention is summed with the feature A to obtain the summed feature B;

[0023] The specific process is:

[0024] 1) Input the text feature A of the account attribute into the normalization layer, and the normalization layer outputs the feature A′;

[0025] 2) Feature A′ is input into multi-head collaborative attention, and multi-head collaborative attention outputs feature A″;

[0026] 3) The multi-head collaborative attention output feature A″ is added to feature A to obtain the added feature B.

[0027] 5. A method for identifying abnormal event types in social networks according to claim 4, characterized in that: the feature A′ in 2) is input into multi-head collaborative attention, and the multi-head collaborative attention outputs feature A″;

[0028] The specific process is:

[0029] Based on the layer normalization layer output feature A′, we get the Q, K and V matrices; the expression is:

[0030]

[0031] Among them, linear means linearization processing; * means multiplication sign;

[0032] Input Q into the two-dimensional 1×1 convolution layer, ReLU activation layer, two-dimensional 1×1 convolution layer, ReLU activation layer in sequence to obtain feature Q I ;

[0033] Input K into the two-dimensional 1×1 convolution layer, ReLU activation layer, two-dimensional 1×1 convolution layer, ReLU activation layer in sequence to obtain feature K I ;

[0034] Input V into the two-dimensional 1×1 convolution layer, ReLU activation layer, two-dimensional 1×1 convolution layer, ReLU activation layer in sequence to obtain the feature V I ;

[0035] Calculate multi-head attention; the expression is:

[0036]

[0037] Among them, x SA represents the result of an attention head, attention(Q,K,V) represents scaled dot product attention, softmax(·) represents the normalization function, represents the square root of the dimension of K, · represents dot product multiplication, and the superscript T represents transposition;

[0038]

[0039] Among them, MHSA(·) represents multi-head attention, concat(·) represents cascade operation, represents the result of the first attention head, represents the result of the second attention head, represents the result of the h-th attention head;

[0040] Combining SE and MHSA to output feature A″ as the multi-head collaborative attention output feature can further improve the model’s understanding ability; the expression is:

[0041]

[0042] SE(A′)=σ s (linear(σ m (linear(avgpool(A′)+maxpool(A′)))))

[0043] Among them, SE(·) represents the squeeze-excitation attention function, linear(·) represents linear mapping, avgpool(·) represents average pooling, and maxpool(·) represents maximum pooling; σ m represents the Mish activation function; σ s (·) represents the Sigmoid function; Represents matrix multiplication.

[0044] Preferably, in step S6, the text features of the attributes of each labeled account are used as row vectors to construct a text feature matrix, the text feature matrix and the labeled adjacency matrix are input into a structural feature mapping network together to obtain a structural matrix composed of structural vectors of all accounts, and each row vector is extracted from the structural matrix as the structural vector of the corresponding account;

[0045] The specific process is:

[0046] Construct the adjacency matrix according to the weight matrix W; the calculation process is:

[0047] A1(n0,n1)=W(n0,n1)

[0048] A4(n3,n4)=1 / 4(W(n0,n1)+W(n1,n2)+W(n2,n3)+W(n3,n4))

[0049] Among them, n0, n1, n2, n3, n4 represent nodes respectively;

[0050] A1(n0,n1) represents the first-order jump graph adjacency matrix, A4(n3,n4) represents the fourth-order jump graph adjacency matrix, N represents the number of nodes;

[0051] W(n0,n1) represents the weight matrix between n0 and n1, W(n1,n2) represents the weight matrix between n1 and n2, W(n2,n3) represents the weight matrix between n2 and n3, and W(n3,n4) represents the weight matrix between n3 and n4;

[0052] Based on the adjacency matrices A1(n0,n1) and A4(n3,n4), a structure matrix consisting of the structure vectors of all accounts is obtained, and each row vector is extracted from the structure matrix as the structure vector of the corresponding account.

[0053] Preferably, the weight matrix W is expressed as:

[0054]

[0055] Where j represents node j, i represents node i, δ(i) represents the adjacent nodes of i, and ||ij|| represents the Euclidean distance between nodes i and j.

[0056] Preferably, the structure matrix consisting of the structure vectors of all accounts is obtained based on the adjacency matrices A1(n0,n1) and A4(n3,n4);

[0057] The specific process is:

[0058] 1) Text feature matrix And the first-order skip graph adjacency matrix A1 are input into the graph convolution GCN, the local features extracted by the graph convolution GCN are input into BN, and BN outputs the node feature matrix B1; the expression is:

[0059] B1=BN(GCN(B,A1))

[0060] The text feature matrix And the fourth-order skip graph adjacency matrix A4 are input into the graph convolution GCN, the local features extracted by the graph convolution GCN are input into BN, and BN outputs the node feature matrix B4; the expression is:

[0061] B4=BN(GCN(B,A4))

[0062] Among them, GCN(·) represents graph convolution, BN(·) is the batch normalization function;

[0063] 2) Input the node feature matrix B1 and the first-order skip graph adjacency matrix A1 into the graph convolution GCN. The local features extracted by the graph convolution GCN are nonlinearly activated to output the node feature matrix B 11 ; The expression is:

[0064] B 11 =δ(GCN(B1,A1))

[0065] The node feature matrix B4 and the fourth-order skip graph adjacency matrix A4 are input into the graph convolution GCN. The local features extracted by the graph convolution GCN are nonlinearly activated and the node feature matrix B is output. 44 ; The expression is:

[0066] B 44 =δ(GCN(B4,A4))

[0067] Where δ represents the linear rectification function;

[0068] 3) Input the node feature matrix B1 and the fourth-order skip graph adjacency matrix A4 into the graph convolution GCN. The local features extracted by the graph convolution GCN are nonlinearly activated to output the Query1 vector and the Key1 vector. The expression is:

[0069] Query1,Key1=δ(GCN(B1,A4))

[0070] The node feature matrix B4 and the first-order skip graph adjacency matrix A1 are input into the graph convolution GCN. The local features extracted by the graph convolution GCN are nonlinearly activated and the Query2 vector and Key2 vector are output. The expression is:

[0071] Query2,Key2=δ(GCN(B4,A1))

[0072] 4) Cross-multiply the Query1 vector and the Key1 vector to obtain the attention weight matrix 1;

[0073] Cross-multiply the Query2 vector and the Key2 vector to get the attention weight matrix 2;

[0074] Concatenate the attention weight matrix 1 and the attention weight matrix 2 to obtain the attention weight matrix;

[0075] 5) Combine the attention weight matrix with the node feature matrix B 11 Perform cross multiplication to obtain node feature matrix 1;

[0076] The attention weight matrix and the node feature matrix B 44 Perform cross multiplication to obtain node feature matrix 2;

[0077] The node feature matrix 1 and the node feature matrix 2 are concatenated to obtain a structural matrix consisting of the structural vectors of all accounts.

[0078] Preferably, in S7, unlabeled tagged accounts in the social network that need to be detected for anomaly are detected to obtain the probability that the unlabeled tagged accounts in the social network are normal accounts and abnormal accounts;

[0079] The specific process is:

[0080] A text feature extraction method is used to extract the attribute information of each unlabeled account to obtain the text features of the unlabeled account attributes;

[0081] Input the text features of the unlabeled account attributes into the trained attribute feature mapping network to obtain the attribute vector corresponding to the unlabeled account;

[0082] The text features of the unlabeled account attributes are used as row vectors to construct a text feature matrix. The text feature matrix and the adjacency matrix are input into the trained structural feature mapping network to obtain a structural matrix composed of the structural vectors of all accounts. The structural vectors corresponding to the unlabeled account are extracted from the structural matrix.

[0083] Input the attribute vector into the pre-set classifier to obtain the probability of the account being a normal account or an abnormal account;

[0084] Input the structure vector into a pre-set classifier to obtain the probability of the account being a normal account or an abnormal account;

[0085] Add the probability values ​​of the two normal accounts and take the average as the final probability of the normal account.

[0086] A social network abnormal event type identification system is used to implement a social network abnormal event type identification method.

[0087] The beneficial effects of the present invention are:

[0088] The present invention separates the respective multi-head branches of Key and Value from the original features through mapping operations, so that a certain correlation is formed between them. Query directly uses the multi-head information mapped out from the original information to participate in the calculation process of the score matrix. In this way, each head in the Key branch can obtain the original feature input to varying degrees, thereby achieving more accurate matching calculations. In this way, each score matrix can establish a dependency relationship between itself and the original input, thereby better capturing the features in the input sequence.

[0089] The present invention processes input features through the squeeze and excitation attention mechanism (SE) to enhance the representation ability of features. In order to further improve the performance of the model, a maximum pooling branch is added on the basis of SE. This improvement enables the model to focus more on the peak value in the input features, thereby more accurately capturing the key information in the input sequence.

[0090] The present invention fuses the modified SE attention with multi-head attention. On the one hand, SE can enable the model to better focus on the important information in the input features, thereby improving the interpretability of the model and reducing the impact of noise interference. On the other hand, multi-head attention can calculate the score matrix between multiple heads in parallel, and each head can independently calculate the attention weight and generate an output vector. By combining SE and MHSA synergistically, the model's understanding ability can be further improved.

[0091] The GCN of the present invention can well extract local features of the image by utilizing the spatial relationship and topological structure of the image. Since GCN extracts features based on the graph structure, the receptive field of each node only includes several adjacent nodes, which makes the receptive field of GCN relatively narrow. In order to expand the receptive field of GCN and enable GCN to capture global contextual information. The present invention proposes multi-hop graph attention. A larger receptive field is obtained through a high-order skip graph, and then the features extracted under the first-order skip graph are weighted by attention correction. BRIEF DESCRIPTION OF THE DRAWINGS

[0092] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0093] Specific implementation method 1: The specific process of a method for identifying abnormal event types in a social network in this implementation method is as follows:

[0094] S1: When it is necessary to perform anomaly detection on an account in a social network, obtain the account information of the social network and construct a social network account graph G = (V, E, X), where V represents the set of all tagged accounts in the social network, i.e., the node set; E represents the set of all edges between tagged accounts in the social network. When two accounts interact (such as likes, forwarding, etc.), an edge is generated between the two accounts; X represents the set of attribute information of all tagged accounts, where the account attribute information is text information, and its specific content can be set as needed, for example, it can include the account's personal self-description, personal message, personal forwarding, etc.

[0095] The attribute information of the account cannot be directly used as the input of the deep learning model and needs to be preprocessed;

[0096] S2: Select several labeled accounts from the social network and judge abnormal accounts. If it is a normal account, it is marked with a normal label. If it is an abnormal account, it is marked with an abnormal label, so as to obtain labeled accounts;

[0097] Select several accounts from the social network and judge abnormal accounts. At this time, the judgment is generally made based on the historical behavior of the account, such as posting content, sending private messages to other users, etc. If it is a normal account, it is marked with a normal label. If it is an abnormal account, it is marked with an abnormal label, thereby obtaining a labeled account.

[0098] S3: Using a text feature extraction method to extract features from the attribute information of each labeled account, and obtaining text features of the attributes of the labeled account;

[0099] Account attribute information in social networks is often represented by text or words, and deep learning models cannot directly process text data. Therefore, the present invention first processes the original account attributes into feature vector representations that can be processed by deep learning models, that is, uses a text feature extraction method to extract features from the attribute information of each account to obtain text features of the account attributes.

[0100] In practical applications, the text feature extraction method can be set according to actual needs. In this embodiment, a text feature extraction method based on the bag-of-words model is adopted. The bag-of-words model is a common technology used for information retrieval and text mining. The bag-of-words model is a method of representing text data when modeling text using a machine learning algorithm. Under this model, a piece of text (such as a sentence or a document) can be represented by a bag containing these words. This representation method does not consider grammar and the order of words. The bag-of-words model can convert a sentence into a vector representation. It is a relatively simple and straightforward method. It does not consider the order of words in a sentence, but only considers the number of occurrences of words in the vocabulary in this sentence. The first step of the bag-of-words model is to build a word list. After counting all the words that appear in the text, and then removing useless symbols and some stop words, a word list is obtained. The next step is to record the words in each document. The purpose is to convert each document of free text into a text vector. If the corresponding word appears in the attributes of the user account, its corresponding vector position is 1. In this way, text features of account attributes suitable for input into subsequent deep learning models can be obtained.

[0101] S4: Generate an adjacency matrix of a social network according to the social network account graph G = (V, E, X);

[0102] S5: construct attribute feature mapping network;

[0103] Input the text features of each labeled account attribute into the attribute feature mapping network to obtain the attribute vector corresponding to each account, and then input the attribute vector into a pre-set classifier to obtain the probability of the account being a normal account or an abnormal account; train the attribute feature mapping network to obtain a trained attribute feature mapping network;

[0104] The attribute feature mapping network is used to map the text features of the labeled account attributes to obtain the account attribute vector;

[0105] S6: constructing a structural feature mapping network;

[0106] The text features of each labeled account attribute are used as row vectors to construct a text feature matrix, and the text feature matrix and the labeled adjacency matrix are input into the structural feature mapping network together to obtain a structural matrix composed of structural vectors of all accounts, and each row vector is extracted from the structural matrix as the structural vector of the corresponding account, and then the structural vector is input into a pre-set classifier to obtain the probability of the account being a normal account and an abnormal account; the structural feature mapping network is trained to obtain a trained structural feature mapping network;

[0107] The structural feature mapping network is used to map the text feature matrix composed of the text features of the labeled account attributes and the adjacency matrix of the labeled social network to obtain the account structural features;

[0108] S7: Detect unlabeled accounts in the social network that need to be detected for anomalies, and obtain the probability that the unlabeled accounts in the social network are normal accounts and abnormal accounts.

[0109] Specific implementation method 2: This implementation method is different from specific implementation method 1 in that the text feature extraction method in step S3 adopts a text feature extraction method based on a bag-of-words model.

[0110] The other steps and parameters are the same as those in the first embodiment.

[0111] Specific implementation method three: This implementation method is different from specific implementation methods one or two in that in S5, the text features of each labeled account attribute are input into the attribute feature mapping network to obtain the attribute vector corresponding to each account;

[0112] The specific process is:

[0113] The text feature A of the account attribute is input into the layer normalization layer, the output feature of the layer normalization layer is input into the multi-head collaborative attention, the multi-head collaborative attention output feature is added with the feature A to obtain the added feature B;

[0114] The feature B after the addition process is input into the normalization layer, and the output feature of the normalization layer is input into the multi-layer perceptron MLP. The output feature of the multi-layer perceptron MLP is added with the feature B after the addition process to obtain the feature C after the addition process as the attribute vector corresponding to each account.

[0115] The other steps and parameters are the same as those in the first or second embodiment.

[0116] Specific implementation method 4: This implementation method is different from any one of specific implementation methods 1 to 3 in that the text feature A of the account attribute is input into a layer normalization layer, the output feature of the layer normalization layer is input into the multi-head collaborative attention, and the output feature of the multi-head collaborative attention is summed with the feature A to obtain the summed feature B;

[0117] The specific process is:

[0118] 1) Input the text feature A of the account attribute into the normalization layer, and the normalization layer outputs the feature A′;

[0119] 2) Feature A′ is input into multi-head collaborative attention, and multi-head collaborative attention outputs feature A″;

[0120] 3) The multi-head collaborative attention output feature A″ is added to feature A to obtain the added feature B.

[0121] The other steps and parameters are the same as those in Specific Embodiments 1 to 3.

[0122] Specific implementation method five: This implementation method is different from any one of the specific implementation methods one to four in that the feature A′ in 2) is input into the multi-head collaborative attention, and the multi-head collaborative attention outputs the feature A″;

[0123] The specific process is:

[0124] Based on the layer normalization layer output feature A′, we get the Q, K and V matrices; the expression is:

[0125]

[0126] Among them, linear means linearization processing; * means multiplication sign;

[0127] Input Q into the two-dimensional 1×1 convolution layer, ReLU activation layer, two-dimensional 1×1 convolution layer, ReLU activation layer in sequence to obtain feature Q I ;

[0128] Input K into the two-dimensional 1×1 convolution layer, ReLU activation layer, two-dimensional 1×1 convolution layer, ReLU activation layer in sequence to obtain feature K I ;

[0129] Input V into the two-dimensional 1×1 convolution layer, ReLU activation layer, two-dimensional 1×1 convolution layer, ReLU activation layer in sequence to obtain the feature V I ;

[0130] Key and Value split their own multi-head branches from the original features through mapping operations, so that there is a certain correlation between them. Query directly uses the multi-head information mapped from the original information to participate in the calculation process of the score matrix. In this way, each head in the Key branch can get the original feature input to varying degrees, thereby achieving more accurate matching calculations. In this way, each score matrix can establish a dependency relationship between itself and the original input, thereby better capturing the features in the input sequence.

[0131] Calculate multi-head attention; the expression is:

[0132]

[0133] Among them, x SA represents the result of an attention head, attention(Q,K,V) represents scaled dot product attention, softmax(·) represents the normalization function, represents the square root of the dimension of K, · represents dot product multiplication, and the superscript T represents transposition;

[0134]

[0135] Among them, MHSA(·) represents multi-head attention, concat(·) represents cascade operation, represents the result of the first attention head, represents the result of the second attention head, represents the result of the h-th attention head;

[0136] Combining SE and MHSA to output feature A″ as the multi-head collaborative attention output feature can further improve the model’s understanding ability; the expression is:

[0137]

[0138] SE(A′)=σ s (linear(σ m (linear(avgpool(A′)+maxpool(A′)))))

[0139] Among them, SE(·) represents the squeeze-excitation attention function, linear(·) represents linear mapping, avgpool(·) represents average pooling, and maxpool(·) represents maximum pooling; σ m represents the Mish activation function; σ s (·) represents the Sigmoid function; Represents matrix multiplication.

[0140] The input features are processed by the squeeze and excitation attention mechanism (SE) to enhance the representation ability of the features. In order to further improve the performance of the model, a maximum pooling branch is added on the basis of SE. This improvement enables the model to focus more on the peaks in the input features, thereby more accurately capturing the key information in the input sequence.

[0141] Afterwards, the modified SE attention is fused with multi-head attention. On the one hand, SE can enable the model to better focus on the important information in the input features, thereby improving the interpretability of the model and reducing the impact of noise interference. On the other hand, multi-head attention can calculate the score matrix between multiple heads in parallel, and each head can independently calculate the attention weights and generate output vectors. By synergistically combining SE and MHSA, the model's understanding ability can be further improved.

[0142] The other steps and parameters are the same as those in Specific Embodiments 1 to 4.

[0143] Specific implementation method six: This implementation method is different from any one of specific implementation methods one to five in that in step S6, the text features of each labeled account attribute are used as row vectors to construct a text feature matrix, the text feature matrix and the labeled adjacency matrix are input into the structural feature mapping network together, and a structural matrix composed of structural vectors of all accounts is obtained, and each row vector is extracted from the structural matrix as the structural vector of the corresponding account;

[0144] The specific process is:

[0145] Construct the adjacency matrix according to the weight matrix W; the calculation process is:

[0146] A1(n0,n1)=W(n0,n1)

[0147] A4(n3,n4)=1 / 4(W(n0,n1)+W(n1,n2)+W(n2,n3)+W(n3,n4))

[0148] Among them, n0, n1, n2, n3, n4 represent nodes respectively;

[0149] A1(n0,n1) represents the first-order jump graph adjacency matrix, A4(n3,n4) represents the fourth-order jump graph adjacency matrix, N represents the number of nodes;

[0150] W(n0,n1) represents the weight matrix between n0 and n1, W(n1,n2) represents the weight matrix between n1 and n2, W(n2,n3) represents the weight matrix between n2 and n3, and W(n3,n4) represents the weight matrix between n3 and n4;

[0151] Based on the adjacency matrices A1(n0,n1) and A4(n3,n4), a structure matrix consisting of the structure vectors of all accounts is obtained, and each row vector is extracted from the structure matrix as the structure vector of the corresponding account.

[0152] The other steps and parameters are the same as those in Specific Implementation Methods 1 to 5.

[0153] Specific implementation method 7: This implementation method is different from any one of specific implementation methods 1 to 6 in that the weight matrix W is expressed as:

[0154]

[0155] Where j represents node j, i represents node i, δ(i) represents the adjacent nodes of i, and ||ij|| represents the Euclidean distance between nodes i and j.

[0156] The other steps and parameters are the same as those in Specific Embodiments 1 to 6.

[0157] Specific implementation eight: This implementation differs from any one of specific implementations one to seven in that, based on the adjacency matrix A1 (n0, n1) and A4 (n3, n4), a structure matrix consisting of structure vectors of all accounts is obtained;

[0158] The specific process is:

[0159] 1) Text feature matrix And the first-order skip graph adjacency matrix A1 are input into the graph convolution GCN, the local features extracted by the graph convolution GCN are input into BN, and BN outputs the node feature matrix B1; the expression is:

[0160] B1=BN(GCN(B,A1))

[0161] The text feature matrix And the fourth-order skip graph adjacency matrix A4 are input into the graph convolution GCN, the local features extracted by the graph convolution GCN are input into BN, and BN outputs the node feature matrix B4; the expression is:

[0162] B4=BN(GCN(B,A4))

[0163] Among them, GCN(·) represents graph convolution, BN(·) is the batch normalization function;

[0164] 2) Input the node feature matrix B1 and the first-order skip graph adjacency matrix A1 into the graph convolution GCN. The local features extracted by the graph convolution GCN are nonlinearly activated to output the node feature matrix B 11 ; The expression is:

[0165] B 11 =δ(GCN(B1,A1))

[0166] The node feature matrix B4 and the fourth-order skip graph adjacency matrix A4 are input into the graph convolution GCN. The local features extracted by the graph convolution GCN are nonlinearly activated and the node feature matrix B is output. 44 ; The expression is:

[0167] B44 =δ(GCN(B4,A4))

[0168] Where δ represents the linear rectification function;

[0169] 3) Input the node feature matrix B1 and the fourth-order skip graph adjacency matrix A4 into the graph convolution GCN. The local features extracted by the graph convolution GCN are nonlinearly activated to output the Query1 vector and the Key1 vector. The expression is:

[0170] Query1,Key1=δ(GCN(B1,A4))

[0171] The node feature matrix B4 and the first-order skip graph adjacency matrix A1 are input into the graph convolution GCN. The local features extracted by the graph convolution GCN are nonlinearly activated and the Query2 vector and Key2 vector are output. The expression is:

[0172] Query2,Key2=δ(GCN(B4,A1))

[0173] 4) Cross-multiply the Query1 vector and the Key1 vector to obtain the attention weight matrix 1;

[0174] Cross-multiply the Query2 vector and the Key2 vector to get the attention weight matrix 2;

[0175] Concatenate the attention weight matrix 1 and the attention weight matrix 2 to obtain the attention weight matrix;

[0176] 5) Combine the attention weight matrix with the node feature matrix B 11 Perform cross multiplication to obtain node feature matrix 1;

[0177] The attention weight matrix and the node feature matrix B 44 Perform cross multiplication to obtain node feature matrix 2;

[0178] The node feature matrix 1 and the node feature matrix 2 are concatenated to obtain a structural matrix consisting of the structural vectors of all accounts.

[0179] The other steps and parameters are the same as those in Specific Embodiments 1 to 7.

[0180] Specific implementation method 9: This implementation method is different from any one of specific implementation methods 1 to 8 in that in S7, the unlabeled tagged accounts in the social network that need to be detected for anomaly detection are detected to obtain the probability that the unlabeled tagged accounts in the social network are normal accounts and abnormal accounts;

[0181] The specific process is:

[0182] A text feature extraction method is used to extract the attribute information of each unlabeled account to obtain the text features of the unlabeled account attributes;

[0183] Input the text features of the unlabeled account attributes into the trained attribute feature mapping network to obtain the attribute vector corresponding to the unlabeled account;

[0184] The text features of the unlabeled account attributes are used as row vectors to construct a text feature matrix. The text feature matrix and the adjacency matrix are input into the trained structural feature mapping network to obtain a structural matrix composed of the structural vectors of all accounts. The structural vectors corresponding to the unlabeled account are extracted from the structural matrix.

[0185] Input the attribute vector into the pre-set classifier to obtain the probability of the account being a normal account or an abnormal account;

[0186] Input the structure vector into a pre-set classifier to obtain the probability of the account being a normal account or an abnormal account;

[0187] Add the probability values ​​of the two normal accounts and take the average as the final probability of the normal account.

[0188] The other steps and parameters are the same as those in Specific Embodiments 1 to 8.

[0189] Specific implementation method 10: In this implementation method, a social network abnormal event type identification system is used to execute a social network abnormal event type identification method.

[0190] The present invention may also have many other embodiments. Without departing from the spirit and essence of the present invention, those skilled in the art may make various corresponding changes and modifications based on the present invention, but these corresponding changes and modifications should all fall within the scope of protection of the claims attached to the present invention.

Claims

1. A method for identifying abnormal event types in social networks, characterized by: The specific process of the method is: S1: Construct a social network account graph G = (V, E, X), where V represents the set of all tagged accounts in the social network, i.e., the node set; E represents the set of all edges between tagged accounts in the social network. When two accounts interact, an edge is generated between the two accounts; X represents the set of attribute information of all tagged accounts, where the account attribute information is text information; S2: Select several labeled accounts from the social network and judge abnormal accounts. If it is a normal account, it is marked with a normal label. If it is an abnormal account, it is marked with an abnormal label, so as to obtain labeled accounts; S3: Using a text feature extraction method to extract features from the attribute information of each labeled account, and obtaining text features of the attributes of the labeled account; S4: Generate an adjacency matrix of a social network according to the social network account graph G = (V, E, X); S5: construct attribute feature mapping network; Input the text features of each labeled account attribute into the attribute feature mapping network to obtain the attribute vector corresponding to each account, and then input the attribute vector into a pre-set classifier to obtain the probability of the account being a normal account or an abnormal account; train the attribute feature mapping network to obtain a trained attribute feature mapping network; S6: constructing a structural feature mapping network; The text features of each labeled account attribute are used as row vectors to construct a text feature matrix, and the text feature matrix and the labeled adjacency matrix are input into the structural feature mapping network together to obtain a structural matrix composed of structural vectors of all accounts, and each row vector is extracted from the structural matrix as the structural vector of the corresponding account, and then the structural vector is input into a pre-set classifier to obtain the probability of the account being a normal account and an abnormal account; the structural feature mapping network is trained to obtain a trained structural feature mapping network; S7: Detect unlabeled accounts in the social network that need to be detected for anomalies, and obtain the probability that the unlabeled accounts in the social network are normal accounts and abnormal accounts.

2. A method for identifying abnormal event types in a social network according to claim 1, characterized in that: The text feature extraction method in step S3 adopts a text feature extraction method based on the bag-of-words model.

3. A method for identifying abnormal event types in social networks according to claim 2, characterized in that: In S5, the text features of each labeled account attribute are input into the attribute feature mapping network to obtain the attribute vector corresponding to each account; The specific process is: The text feature A of the account attribute is input into the layer normalization layer, the output feature of the layer normalization layer is input into the multi-head collaborative attention, the multi-head collaborative attention output feature is added with the feature A to obtain the added feature B; The feature B after the addition process is input into the normalization layer, and the output feature of the normalization layer is input into the multi-layer perceptron MLP. The output feature of the multi-layer perceptron MLP is added with the feature B after the addition process to obtain the feature C after the addition process as the attribute vector corresponding to each account.

4. A method for identifying abnormal event types in social networks according to claim 3, characterized in that: The text feature A of the account attribute is input into the layer normalization layer, the output feature of the layer normalization layer is input into the multi-head collaborative attention, the output feature of the multi-head collaborative attention is added with the feature A to obtain the added feature B; The specific process is: 1) Input the text feature A of the account attribute into the normalization layer, and the normalization layer outputs the feature A′; 2) Feature A′ is input into multi-head collaborative attention, and multi-head collaborative attention outputs feature A″; 3) The multi-head collaborative attention output feature A″ is added to feature A to obtain the added feature B.

5. A method for identifying abnormal event types in social networks according to claim 4, characterized in that: In 2), feature A′ is input into multi-head collaborative attention, and multi-head collaborative attention outputs feature A″; The specific process is: Based on the layer normalization layer output feature A′, we get the Q, K and V matrices; the expression is: Among them, linear means linearization processing; * means multiplication sign; Input Q into the two-dimensional 1×1 convolution layer, ReLU activation layer, two-dimensional 1×1 convolution layer, ReLU activation layer in sequence to obtain feature Q I ; Input K into the two-dimensional 1×1 convolution layer, ReLU activation layer, two-dimensional 1×1 convolution layer, ReLU activation layer in sequence to obtain feature K I ; Input V into the two-dimensional 1×1 convolution layer, ReLU activation layer, two-dimensional 1×1 convolution layer, ReLU activation layer in sequence to obtain the feature V I ; Calculate multi-head attention; the expression is: Among them, x SA represents the result of an attention head, attention(Q,K,V) represents scaled dot product attention, softmax(·) represents the normalization function, represents the square root of the dimension of K, · represents dot product multiplication, and the superscript T represents transposition; Among them, MHSA(·) represents multi-head attention, concat(·) represents cascade operation, represents the result of the first attention head, represents the result of the second attention head, represents the result of the h-th attention head; Combining SE and MHSA to output feature A″ as the multi-head collaborative attention output feature can further improve the model’s understanding ability; the expression is: SE(A′)=σ s (linear(σ m (linear(avgpool(A′)+maxpool(A′))))) Where SE(·) represents the squeeze-excitation attention function, linear(·) represents linear mapping, avgpool(·) represents average pooling, and maxpool(·) represents maximum pooling; σ m represents the Mish activation function; σ s (·) represents the Sigmoid function; Represents matrix multiplication.

6. A method for identifying abnormal event types in social networks according to claim 5, characterized in that: In step S6, the text features of the attributes of each labeled account are used as row vectors to construct a text feature matrix, the text feature matrix and the labeled adjacency matrix are input into the structural feature mapping network together to obtain a structural matrix composed of structural vectors of all accounts, and each row vector is extracted from the structural matrix as the structural vector of the corresponding account; The specific process is: Construct an adjacency matrix based on the weight matrix W; The calculation process is: A1(n0,n1)=W(n0,n1) A4(n3,n4)=1 / 4(W(n0,n1)+W(n1,n2)+W(n2,n3)+W(n3,n4)) Among them, n0, n1, n2, n3, n4 represent nodes respectively; A1(n0,n1) represents the first-order jump graph adjacency matrix, A4(n3,n4) represents the fourth-order jump graph adjacency matrix, N represents the number of nodes; W(n0,n1) represents the weight matrix between n0 and n1, W(n1,n2) represents the weight matrix between n1 and n2, W(n2,n3) represents the weight matrix between n2 and n3, and W(n3,n4) represents the weight matrix between n3 and n4; Based on the adjacency matrices A1(n0,n1) and A4(n3,n4), a structure matrix consisting of the structure vectors of all accounts is obtained, and each row vector is extracted from the structure matrix as the structure vector of the corresponding account.

7. A method for identifying abnormal event types in a social network according to claim 6, characterized in that: The weight matrix W is expressed as: Where j represents node j, i represents node i, δ(i) represents the adjacent nodes of i, and ||ij|| represents the Euclidean distance between nodes i and j.

8. A method for identifying abnormal event types in social networks according to claim 7, characterized in that: Based on the adjacency matrices A1(n0,n1) and A4(n3,n4), a structure matrix consisting of the structure vectors of all accounts is obtained; The specific process is: 1) Text feature matrix And the first-order skip graph adjacency matrix A1 is input into the graph convolution GCN, the local features extracted by the graph convolution GCN are input into BN, and BN outputs the node feature matrix B1; expression for: B1=BN(GCN(B,A1)) The text feature matrix And the fourth-order skip graph adjacency matrix A4 is input into the graph convolution GCN, the local features extracted by the graph convolution GCN are input into BN, and BN outputs the node feature matrix B4; expression for: B4=BN(GCN(B,A4)) Among them, GCN(·) represents graph convolution, BN(·) is the batch normalization function; 2) Input the node feature matrix B1 and the first-order skip graph adjacency matrix A1 into the graph convolution GCN. The local features extracted by the graph convolution GCN are nonlinearly activated to output the node feature matrix B 11 ; The expression is: B 11 =δ(GCN(B1,A1)) The node feature matrix B4 and the fourth-order skip graph adjacency matrix A4 are input into the graph convolution GCN. The local features extracted by the graph convolution GCN are nonlinearly activated and the node feature matrix B is output. 44 ; The expression is: B 44 =δ(GCN(B4,A4)) Where δ represents the linear rectification function; 3) Input the node feature matrix B1 and the fourth-order skip graph adjacency matrix A4 into the graph convolution GCN. The local features extracted by the graph convolution GCN are nonlinearly activated to output the Query1 vector and the Key1 vector. The expression is: Query1,Key1=δ(GCN(B1,A4)) The node feature matrix B4 and the first-order skip graph adjacency matrix A1 are input into the graph convolution GCN. The local features extracted by the graph convolution GCN are nonlinearly activated and the Query2 vector and Key2 vector are output. The expression is: Query2,Key2=δ(GCN(B4,A1)) 4) Cross-multiply the Query1 vector and the Key1 vector to obtain the attention weight matrix 1; Cross-multiply the Query2 vector and the Key2 vector to get the attention weight matrix 2; Concatenate the attention weight matrix 1 and the attention weight matrix 2 to obtain the attention weight matrix; 5) Combine the attention weight matrix with the node feature matrix B 11 Perform cross multiplication to obtain node feature matrix 1; The attention weight matrix and the node feature matrix B 44 Perform cross multiplication to obtain node feature matrix 2; The node feature matrix 1 and the node feature matrix 2 are concatenated to obtain a structural matrix consisting of the structural vectors of all accounts.

9. The method for identifying abnormal event types in a social network according to claim 8, characterized in that: In S7, the unlabeled tagged accounts in the social network that need to be detected for anomaly are detected to obtain the probability that the unlabeled tagged accounts in the social network are normal accounts and abnormal accounts; The specific process is: A text feature extraction method is used to extract the attribute information of each unlabeled account to obtain the text features of the unlabeled account attributes; Input the text features of the unlabeled account attributes into the trained attribute feature mapping network to obtain the attribute vector corresponding to the unlabeled account; The text features of the unlabeled account attributes are used as row vectors to construct a text feature matrix. The text feature matrix and the adjacency matrix are input into the trained structural feature mapping network to obtain a structural matrix composed of the structural vectors of all accounts. The structural vectors corresponding to the unlabeled account are extracted from the structural matrix. Input the attribute vector into the pre-set classifier to obtain the probability of the account being a normal account or an abnormal account; Input the structure vector into a pre-set classifier to obtain the probability of the account being a normal account or an abnormal account; Add the probability values ​​of the two normal accounts and take the average as the final probability of the normal account.

10. A social network abnormal event type identification system, characterized by: The system is used to implement a method for identifying abnormal event types in a social network as described in any one of claims 1 to 9.

Images