A method and system for identifying types of abnormal events in a social network

Abstract

A method and system for identifying types of abnormal events in a social network. The present invention relates to a method and system for identifying types of abnormal events in a social network, and belongs to the field of social network anomaly identification. The purpose of the present invention is to solve the problem that the existing methods have a low accuracy in detecting and identifying abnormal accounts in a social network. The process is as follows: constructing a social network account graph; selecting a number of labeled accounts from the social network and making a judgment on abnormal accounts. If it is a normal account, it is labeled with a normal label, and if it is an abnormal account, it is labeled with an abnormal label, so as to obtain labeled accounts; obtaining the text features of the attributes of the labeled accounts; generating an adjacency matrix of the social network according to the social network account graph; obtaining a trained attribute feature mapping network; obtaining a trained structural feature mapping network; detecting unlabeled accounts in the social network that need to be abnormally detected, and obtaining the probabilities that the unlabeled accounts are normal accounts and abnormal accounts.

Description

Technical Field

[0001] The present invention relates to a method and a system for identifying types of abnormal events in a social network, and belongs to the field of social network anomaly identification. Background Art

[0002] With the rapid development and wide application of Internet technology, social networks have gradually become an essential part of people's digital lives due to their convenience, entertainment, and real-time nature. Social networks are important platforms for people to communicate and interact. Today, with their growing influence, there are also a large number of abnormal users in the platform affecting the normal use of users, such as zombie users, spam information publishers, social robots, etc. It is necessary to detect and remove these users to ensure the normal use of social networks.

[0003] On the one hand, social networks carry a vast amount of media information and social information, and on the other hand, they also contain a large amount of privacy information and huge commercial value. Therefore, social networks attract a large number of malicious attackers. Malicious attackers create false accounts or steal normal accounts to carry out malicious acts such as malicious information publishing, financial transaction fraud, and launching cyberattacks in social networks, seriously threatening people's lives, property safety, and the rules, order, and trust relationships of social networks. These malicious attackers are collectively referred to as abnormal users.

[0004] In the real world, with the emergence of social tools such as Weibo, WeChat, and QQ, more and more users have their own social accounts. Social networks play an important role in people's lives. It has become a part of people's lives and has an inestimable impact on people's information acquisition, thinking, and life. Social networks have become a window for people to obtain information, show themselves, and conduct marketing and promotion. With the continuous increase in the number of social network users, stakeholders such as investors, advertisers, and program developers are also increasingly turning their attention to social websites. At the same time, more and more malicious attackers seek profits through social accounts. Attackers use illegal means to create multiple accounts and then achieve the purpose of making a profit by posting malicious information and directly recommending products to users through private messages. Compared with ordinary people's normal accounts, these abnormal accounts created by attackers seriously affect the harmonious communication environment initially established by social networks.

[0005] However, traditional social network abnormal account detection methods require a large amount of time and labor costs. The user base in social networks is large, the coverage is wide, and it covers various types of abnormal users. Moreover, the behavioral characteristics of abnormal users will also change dynamically over time. When abnormal users change their behavior patterns, traditional social network abnormal account detection methods cannot effectively handle them, resulting in a low accuracy rate for detecting and identifying abnormal accounts in social networks. Summary of the Invention

[0006] The object of the present invention is to solve the problem that in the existing social network, the user base is large, the coverage is wide, and there are various abnormal users, resulting in a low accuracy rate for detecting and identifying abnormal accounts in the social network, and to propose a method and a system for identifying abnormal event types in the social network.

[0007] The specific process of a method for identifying abnormal event types in the social network is as follows:

[0008] S1: Construct a social network account graph G = (V, E, X), where V represents the set composed of all labeled accounts in the social network, that is, the node set; E represents the set composed of all edges between the labeled accounts in the social network. When two accounts have an interaction behavior, an edge is generated between these two accounts. X represents the set composed of the attribute information of all labeled accounts, where the account attribute information is text information.

[0009] S2: Select several labeled accounts from the social network and judge whether they are abnormal accounts. If it is a normal account, mark it with a normal label. If it is an abnormal account, mark it with an abnormal label, so as to obtain the labeled accounts.

[0010] S3: Adopt a text feature extraction method to extract features from the attribute information of each labeled account, and obtain the text features of the attributes of the labeled accounts.

[0011] S4: Generate an adjacency matrix of the social network according to the social network account graph G = (V, E, X).

[0012] S5: Construct an attribute feature mapping network.

[0013] Input the text features of the attributes of each labeled account into the attribute feature mapping network to obtain the corresponding attribute vectors of each account, and then input the attribute vectors into a pre-set classifier to obtain the probabilities of the account being a normal account and an abnormal account; train the attribute feature mapping network to obtain a trained attribute feature mapping network.

[0014] S6: Construct a structural feature mapping network.

[0015] Construct a text feature matrix by using the text features of the attributes of each labeled account as row vectors, input the text feature matrix and the labeled adjacency matrix into the structural feature mapping network together to obtain a structural matrix composed of the structural vectors of all accounts, extract each row vector from the structural matrix as the structural vector of the corresponding account, and then input the structural vector into a pre-set classifier to obtain the probabilities of the account being a normal account and an abnormal account; train the structural feature mapping network to obtain a trained structural feature mapping network.

[0016] S7: Detect the unlabeled accounts in the social network that need to be detected for anomalies, and obtain the probabilities that the unlabeled accounts in the social network are normal accounts and abnormal accounts.

[0017] Preferably, the text feature extraction method in step S3 adopts a text feature extraction method based on the bag-of-words model.

[0018] Preferably, in S5, the text features of each labeled account attribute are input into the attribute feature mapping network to obtain the attribute vector corresponding to each account;

[0019] The specific process is as follows:

[0020] Input the text feature A of the account attribute into the layer normalization layer, and the feature output by the layer normalization layer is input into the multi-head collaborative attention. The feature output by the multi-head collaborative attention is added to the feature A to obtain the feature B after the addition process;

[0021] Input the feature B after the addition process into the layer normalization layer, and the feature output by the layer normalization layer is input into the multi-layer perceptron MLP. The feature output by the multi-layer perceptron MLP is added to the feature B after the addition process to obtain the feature C after the addition process, which is used as the attribute vector corresponding to each account.

[0022] Preferably, input the text feature A of the account attribute into the layer normalization layer, and the feature output by the layer normalization layer is input into the multi-head collaborative attention. The feature output by the multi-head collaborative attention is added to the feature A to obtain the feature B after the addition process;

[0023] The specific process is as follows:

[0024] 1). Input the text feature A of the account attribute into the layer normalization layer, and the layer normalization layer outputs the feature A';

[0025] 2). The feature A' is input into the multi-head collaborative attention, and the multi-head collaborative attention outputs the feature A";

[0026] 3). The feature A" output by the multi-head collaborative attention is added to the feature A to obtain the feature B after the addition process.

[0027] 5. According to the method for identifying abnormal event types in a social network described in claim 4, wherein: in 2), the feature A' is input into the multi-head collaborative attention, and the multi-head collaborative attention outputs the feature A";

[0028] The specific process is as follows:

[0029] Based on the feature A' output by the layer normalization layer, obtain the Q, K, and V matrices; the expression is:

[0030]

[0031] Among them, "linear" represents linearization processing; "*" represents the multiplication sign;

[0032] Input Q into a two-dimensional 1×1 convolutional layer, a ReLU activation layer, a two-dimensional 1×1 convolutional layer, and a ReLU activation layer in sequence to obtain the feature Q I ;

[0033] Input K into a two-dimensional 1×1 convolutional layer, a ReLU activation layer, a two-dimensional 1×1 convolutional layer, and a ReLU activation layer in sequence to obtain the feature K I ;

[0034] Input V into a two-dimensional 1×1 convolutional layer, a ReLU activation layer, a two-dimensional 1×1 convolutional layer, and a ReLU activation layer in sequence to obtain the feature V I ;

[0035] Calculate the multi-head attention; the expression is:

[0036]

[0037] Among them, x SA represents the result on one attention head, attention(Q, K, V) represents the scaled dot-product attention, softmax(·) represents the normalization function, represents the square root of the dimension of K, · represents the dot-product multiplication, and the superscript T represents taking the transpose;

[0038]

[0039] Among them, MHSA(·) represents the multi-head attention, concat(·) represents the concatenation operation, represents the result on the first attention head, represents the result on the second attention head, represents the result on the h-th attention head;

[0040] Combine SE and MHSA synergistically and output the feature A″ as the output feature of the multi-head collaborative attention, which can further improve the understanding ability of the model; the expression is:

[0041]

[0042] SE(A′) = σ s (linear(σ m (linear(avgpool(A′)+maxpool(A′)))))

[0043] Among them, SE(·) represents the squeeze-and-excitation attention function, linear(·) represents the linear mapping, avgpool(·) represents the average pooling, and maxpool(·) represents the max pooling; σ m represents the Mish activation function; σ s (·) represents the Sigmoid function; represents matrix multiplication.

[0044] Preferably, in step S6, the text features of each labeled account attribute are used as row vectors to construct a text feature matrix. The text feature matrix and the labeled adjacency matrix are input into the structure feature mapping network to obtain a structure matrix composed of the structure vectors of all accounts, and each row vector is extracted from the structure matrix as the structure vector of the corresponding account;

[0045] The specific process is as follows:

[0046] Construct an adjacency matrix according to the weight matrix W; the calculation process is as follows:

[0047] A1(n0,n1) = W(n0,n1)

[0048] A4(n3,n4) = 1 / 4(W(n0,n1) + W(n1,n2) + W(n2,n3) + W(n3,n4))

[0049] Among them, n0, n1, n2, n3, n4 respectively represent nodes;

[0050] A1(n0,n1) represents the first-order jump graph adjacency matrix, A4(n3,n4) represents the fourth-order jump graph adjacency matrix, N represents the number of nodes;

[0051] W(n0,n,1) represents the weight matrix between n0 and n1, W(n1,n2) represents the weight matrix between n1 and n2, W(n2,n3) represents the weight matrix between n2 and n3, and W(n3,n4) represents the weight matrix between n3 and n4;

[0052] Based on the adjacency matrices A1(n0,n1) and A4(n3,n4), a structure matrix composed of the structure vectors of all accounts is obtained, and each row vector is extracted from the structure matrix as the structure vector of the corresponding account.

[0053] Preferably, the expression of the weight matrix W is:

[0054]

[0055] Among them, j represents node j, i represents node i, δ(i) represents the adjacent nodes of i, and ||i - j|| represents the Euclidean distance between nodes i and j.

[0056] Preferably, based on the adjacency matrices A1(n0, n1) and A4(n3, n4), a structure matrix composed of the structure vectors of all accounts is obtained;

[0057] The specific process is as follows:

[0058] 1), Input the text feature matrix and the first-order jump graph adjacency matrix A1 into the graph convolution GCN. The local features extracted by the graph convolution GCN are input into BN, and BN outputs the node feature matrix B1; the expression is:

[0059] B1 = BN(GCN(B, A1))

[0060] Input the text feature matrix and the fourth-order jump graph adjacency matrix A4 into the graph convolution GCN. The local features extracted by the graph convolution GCN are input into BN, and BN outputs the node feature matrix B4; the expression is:

[0061] B4 = BN(GCN(B, A4))

[0062] Among them, GCN(·) represents graph convolution, and BN(·) is the batch normalization function;

[0063] 2), Input the node feature matrix B1 and the first-order jump graph adjacency matrix A1 into the graph convolution GCN. The local features extracted by the graph convolution GCN pass through a non-linear activation and output the node feature matrix B 11 ; the expression is:

[0064] B 11 = δ(GCN(B1, A1))

[0065] Input the node feature matrix B4 and the fourth-order jump graph adjacency matrix A4 into the graph convolution GCN. The local features extracted by the graph convolution GCN pass through a non-linear activation and output the node feature matrix B 44 ; the expression is:

[0066] B 44 = δ(GCN(B4, A4))

[0067] Among them, δ represents the rectified linear unit function;

[0068] 3), Input the node feature matrix B1 and the fourth-order jump graph adjacency matrix A4 into the graph convolution GCN. The local features extracted by the graph convolution GCN pass through a non-linear activation and output the Query1 vector and the Key1 vector; the expression is:

[0069] Query1, Key1 = δ(GCN(B1, A4))

[0070] Input the node feature matrix B4 and the first-order jump graph adjacency matrix A1 into the graph convolution GCN. The local features extracted by the graph convolution GCN are non-linearly activated, and the Query2 vector and the Key2 vector are output; the expression is:

[0071] Query2, Key2 = δ(GCN(B4, A1))

[0072] 4) Cross-multiply the Query1 vector and the Key1 vector to obtain the attention weight matrix 1;

[0073] Cross-multiply the Query2 vector and the Key2 vector to obtain the attention weight matrix 2;

[0074] Concatenate the attention weight matrix 1 and the attention weight matrix 2 to obtain the attention weight matrix;

[0075] 5) Cross-multiply the attention weight matrix with the node feature matrix B 11 to obtain the node feature matrix 1;

[0076] Cross-multiply the attention weight matrix with the node feature matrix B 44 to obtain the node feature matrix 2;

[0077] Concatenate the node feature matrix 1 and the node feature matrix 2 to obtain the structure matrix composed of the structure vectors of all accounts.

[0078] Preferably, in S7, the unlabeled accounts in the social network that need to be detected for anomalies are detected to obtain the probabilities that the unlabeled accounts in the social network are normal accounts and abnormal accounts;

[0079] The specific process is as follows:

[0080] Adopt a text feature extraction method to extract the feature of the attribute information of each unlabeled account to obtain the text feature of the unlabeled account attribute;

[0081] Input the text feature of the unlabeled account attribute into the trained attribute feature mapping network to obtain the attribute vector corresponding to the unlabeled account;

[0082] Construct a text feature matrix with the text feature of the unlabeled account attribute as the row vector, input the text feature matrix and the adjacency matrix into the trained structure feature mapping network together, obtain the structure matrix composed of the structure vectors of all accounts, and extract the structure vector corresponding to the unlabeled account from the structure matrix;

[0083] Input the attribute vector into a pre - set classifier to obtain the probabilities of the account being a normal account and an abnormal account;

[0084] Input the structure vector into a pre - set classifier to obtain the probabilities of the account being a normal account and an abnormal account;

[0085] Add the probability values of two normal accounts and take the mean as the final probability of the account being a normal account.

[0086] A social network abnormal event type recognition system is used to implement a social network abnormal event type recognition method.

[0087] The beneficial effects of the present invention are as follows:

[0088] In the present invention, Key and Value are split into their respective multi - head branches from the original features through a mapping operation, so that a certain correlation is formed between them. Query directly uses the multi - head information mapped from the original information and participates in the calculation process of the score matrix. In this way, each head in the Key branch can obtain the original feature input to varying degrees, thus realizing a more accurate matching calculation. Through this method, each score matrix can establish its dependence relationship with the original input, so as to better capture the features in the input sequence.

[0089] The present invention processes the input features through the squeeze and excitation (SE) attention mechanism to enhance the feature representation ability. To further improve the performance of the model, a max - pooling branch is added on the basis of SE. This improvement enables the model to focus more on the peaks in the input features, thus more accurately capturing the key information in the input sequence.

[0090] The present invention fuses the modified SE attention and multi - head attention. On the one hand, SE can enable the model to better focus on the important information in the input features, thereby improving the interpretability of the model and reducing the influence of noise interference. On the other hand, multi - head attention can calculate the score matrices between multiple heads in parallel, and each head can independently calculate the attention weights and generate output vectors. By synergistically combining SE and MHSA, the understanding ability of the model can be further improved.

[0091] The GCN of the present invention can well extract local features of an image by utilizing the spatial relationship and topological structure of the image. Since the GCN extracts features based on a graph structure, the receptive field of each node only includes several adjacent nodes, which makes the receptive field of the GCN relatively narrow. To expand the receptive field of the GCN and enable the GCN to capture global context information, the present invention proposes multi-hop graph attention. A larger receptive field is obtained through high-order hop graphs, and then the features extracted under the first-order hop graphs are attention-weighted in an attention-corrected manner. Description of the Drawings

[0092] Figure 1 This is the flowchart of the present invention. Detailed Embodiments

[0093] Detailed Embodiment 1: The specific process of a method for identifying abnormal event types in a social network in this embodiment is as follows:

[0094] S1: When abnormal detection needs to be performed on an account in a certain social network, obtain the account information of the social network and construct a social network account graph G=(V, E, X), where V represents the set composed of all labeled accounts in the social network, that is, the node set; E represents the set composed of all edges between labeled accounts in the social network. When two accounts have interaction behaviors (such as liking, forwarding, etc.), an edge is generated between these two accounts. X represents the set composed of the attribute information of all labeled accounts, where the account attribute information is text information, and its specific content can be set according to needs. For example, it can include the personal self-description, personal messages, personal forwards, etc. of the account.

[0095] The attribute information of the account cannot be directly used as the input of the deep learning model and needs to be preprocessed;

[0096] S2: Select several labeled accounts from the social network and perform abnormal account judgment. If it is a normal account, mark it with a normal label. If it is an abnormal account, mark it with an abnormal label, so as to obtain labeled accounts;

[0097] Select several accounts from the social network and perform abnormal account judgment. At this time, it is generally judged according to the historical behaviors of the accounts, such as the content published, private messages sent to other users, etc. If it is a normal account, mark it with a normal label. If it is an abnormal account, mark it with an abnormal label, so as to obtain labeled accounts.

[0098] S3: Use a text feature extraction method to extract features from the attribute information of each labeled account to obtain the text features of the labeled account attributes;

[0099] In a social network, account attribute information is often represented by text or words, and deep learning models cannot directly process text data. Therefore, in the present invention, the original account attributes are first processed into feature vector representations that can be processed by deep learning models, that is, a text feature extraction method is used to extract features from the attribute information of each account to obtain the text features of the account attributes.

[0100] In practical applications, the text feature extraction method can be set according to actual needs. In this embodiment, a text feature extraction method based on the bag-of-words model is adopted. The bag-of-words model is a commonly used technique for information retrieval and text mining. The bag-of-words model is a method for representing text data when modeling text using machine learning algorithms. Under this model, a piece of text (such as a sentence or a document) can be represented by a bag containing these words, and this representation method does not consider grammar and the order of words. The bag-of-words model can convert a sentence into a vector representation, which is a relatively simple and straightforward method. It does not consider the order of words in the sentence, but only considers the number of occurrences of words in the vocabulary in this sentence. The first step of the bag-of-words model is to construct a word list. After counting all the words that appear in the text, and then removing useless symbols and some stop words, a word list is obtained. The next step is to record the words in each document, aiming to convert each document of free text into a text vector. If the corresponding word appears in the attributes of the user account, the corresponding vector position is 1, so that the text features of the account attributes suitable for inputting into the subsequent deep learning model can be obtained.

[0101] S4: Generate the adjacency matrix of the social network according to the social network account graph G=(V, E, X);

[0102] S5: Construct an attribute feature mapping network;

[0103] Input the text features of each labeled account attribute into the attribute feature mapping network to obtain the attribute vector corresponding to each account, and then input the attribute vector into a pre-set classifier to obtain the probabilities of the account being a normal account and an abnormal account; train the attribute feature mapping network to obtain a trained attribute feature mapping network;

[0104] The attribute feature mapping network is used to map the text features of the labeled account attributes to obtain the account attribute vector;

[0105] S6: Construct a structural feature mapping network;

[0106] Construct a text feature matrix by using the text features of each labeled account attribute as row vectors. Input the text feature matrix and the labeled adjacency matrix into the structure feature mapping network to obtain a structure matrix composed of the structure vectors of all accounts. Extract each row vector from the structure matrix as the structure vector of the corresponding account, and then input the structure vector into a pre-set classifier to obtain the probabilities of the account being a normal account and an abnormal account; train the structure feature mapping network to obtain a trained structure feature mapping network.

[0107] The structure feature mapping network is used to map the text feature matrix composed of the text features of the labeled account attributes and the adjacency matrix of the labeled social network to obtain the account structure features.

[0108] S7: Detect the unlabeled accounts in the social network that need to be detected for anomalies, and obtain the probabilities of the unlabeled accounts in the social network being normal accounts and abnormal accounts.

[0109] Specific implementation method 2: The difference between this implementation method and the first implementation method is that the text feature extraction method in step S3 adopts a text feature extraction method based on the bag-of-words model.

[0110] Other steps and parameters are the same as those in the first implementation method.

[0111] Specific implementation method 3: The difference between this implementation method and the first or second implementation method is that in S5, the text features of each labeled account attribute are input into the attribute feature mapping network to obtain the attribute vectors corresponding to each account.

[0112] The specific process is as follows:

[0113] Input the text feature A of the account attribute into the layer normalization layer. The output feature of the layer normalization layer is input into the multi-head collaborative attention. The output feature of the multi-head collaborative attention is added to the feature A to obtain the feature B after the addition process.

[0114] Input the feature B after the addition process into the layer normalization layer. The output feature of the layer normalization layer is input into the multi-layer perceptron MLP. The output feature of the multi-layer perceptron MLP is added to the feature B after the addition process to obtain the feature C after the addition process, which is used as the attribute vector corresponding to each account.

[0115] Other steps and parameters are the same as those in the first or second implementation method.

[0116] Specific implementation method 4: The difference between this implementation method and one of the first to third implementation methods is that the text feature A of the account attribute is input into the layer normalization layer. The output feature of the layer normalization layer is input into the multi-head collaborative attention. The output feature of the multi-head collaborative attention is added to the feature A to obtain the feature B after the addition process.

[0117] The specific process is as follows:

[0118] 1), Input the text feature A of the account attribute into the layer normalization layer, and the layer normalization layer outputs the feature A';

[0119] 2), Input the feature A' into the multi-head collaborative attention, and the multi-head collaborative attention outputs the feature A";

[0120] 3), Add and process the feature A" output by the multi-head collaborative attention and the feature A to obtain the feature B after the addition process.

[0121] Other steps and parameters are the same as those in any one of the first to third specific embodiments.

[0122] Specific embodiment five: The difference between this embodiment and any one of the first to fourth specific embodiments is that in the above 2), the feature A' is input into the multi-head collaborative attention, and the multi-head collaborative attention outputs the feature A";

[0123] The specific process is as follows:

[0124] Based on the feature A' output by the layer normalization layer, obtain the Q, K, and V matrices; the expression is:

[0125]

[0126] Among them, linear represents linearization processing; * represents the multiplication sign;

[0127] Input Q into the two-dimensional 1×1 convolutional layer, ReLU activation layer, two-dimensional 1×1 convolutional layer, and ReLU activation layer in sequence to obtain the feature Q I ;

[0128] Input K into the two-dimensional 1×1 convolutional layer, ReLU activation layer, two-dimensional 1×1 convolutional layer, and ReLU activation layer in sequence to obtain the feature K I ;

[0129] Input V into the two-dimensional 1×1 convolutional layer, ReLU activation layer, two-dimensional 1×1 convolutional layer, and ReLU activation layer in sequence to obtain the feature V I ;

[0130] Key and Value are split from the original features through mapping operations to form their respective multi-head branches, so that a certain correlation is formed between them. Query directly uses the multi-head information mapped from the original information and participates in the calculation process of the score matrix. In this way, each head in the Key branch can obtain the original feature input to varying degrees, thus achieving more accurate matching calculations. Through this method, each score matrix can establish its dependence relationship with the original input, thereby better capturing the features in the input sequence.

[0131] Calculate the multi - head attention; the expression is:

[0132]

[0133] where, \(x\) SA represents the result on one attention head, \(attention(Q, K, V)\) represents the scaled dot - product attention, \(softmax(\cdot)\) represents the normalization function, \(\sqrt{d_k}\) represents the square root of the dimension of \(K\), \(\cdot\) represents the dot - product multiplication, and the superscript \(T\) represents taking the transpose;

[0134]

[0135] where, \(MHSA(\cdot)\) represents the multi - head attention, \(concat(\cdot)\) represents the concatenation operation, \(x_1\) represents the result on the first attention head, \(x_2\) represents the result on the second attention head, \(x_h\) represents the result on the \(h\) - th attention head;

[0136] Combine SE and MHSA synergistically to output the feature \(A''\) as the multi - head collaborative attention output feature, which can further improve the model's understanding ability; the expression is:

[0137]

[0138] \(SE(A')=\sigma\) s (linear(\sigma m (linear(avgpool(A') + maxpool(A')))))

[0139] where, \(SE(\cdot)\) represents the squeeze - and - excitation attention function, \(linear(\cdot)\) represents the linear mapping, \(avgpool(\cdot)\) represents the average pooling, \(maxpool(\cdot)\) represents the max pooling; \(\sigma\) m represents the Mish activation function; \(\sigma\) s (\cdot)\) represents the Sigmoid function; represents the matrix multiplication.

[0140] Process the input features through the squeeze - and - excitation attention mechanism (SE) to enhance the feature representation ability. To further improve the model's performance, a max - pooling branch is added on the basis of SE. This improvement enables the model to focus more on the peaks in the input features, thereby more accurately capturing the key information in the input sequence.

[0141] After that, the corrected SE attention is fused with the multi-head attention. On the one hand, SE can enable the model to better focus on the important information in the input features, thereby improving the interpretability of the model and reducing the impact of noise interference. On the other hand, multi-head attention can calculate the score matrices between multiple heads in parallel, and each head can independently calculate the attention weights and generate output vectors. By synergistically combining SE and MHSA, the understanding ability of the model can be further improved.

[0142] Other steps and parameters are the same as those in any one of the first to fourth specific embodiments.

[0143] Specific Embodiment Six: The difference between this embodiment and any one of the first to fifth specific embodiments is that in step S6, the text features of each labeled account attribute are used as row vectors to construct a text feature matrix, and the text feature matrix and the labeled adjacency matrix are input into the structure feature mapping network to obtain a structure matrix composed of the structure vectors of all accounts, and each row vector is extracted from the structure matrix as the structure vector of the corresponding account;

[0144] The specific process is as follows:

[0145] Construct an adjacency matrix according to the weight matrix W; the calculation process is as follows:

[0146] A1(n0,n1) = W(n0,n1)

[0147] A4(n3,n4) = 1 / 4(W(n0,n1) + W(n1,n2) + W(n2,n3) + W(n3,n4))

[0148] Where n0, n1, n2, n3, n4 respectively represent nodes;

[0149] A1(n0,n1) represents the first-order jump graph adjacency matrix, A4(n3,n4) represents the fourth-order jump graph adjacency matrix, N represents the number of nodes;

[0150] W(n0,n1) represents the weight matrix between n0 and n1, W(n1,n2) represents the weight matrix between n1 and n2, W(n2,n3) represents the weight matrix between n2 and n3, and W(n3,n4) represents the weight matrix between n3 and n4;

[0151] Based on the adjacency matrices A1(n0,n1) and A4(n3,n4), a structure matrix composed of the structure vectors of all accounts is obtained, and each row vector is extracted from the structure matrix as the structure vector of the corresponding account.

[0152] Other steps and parameters are the same as those in any one of the first to fifth specific embodiments.

[0153] Embodiment 7: The difference between this embodiment and any one of Embodiments 1 to 6 is that the expression of the weight matrix W is as follows:

[0154]

[0155] where j represents node j, i represents node i, δ(i) represents the adjacent nodes of i, and ||i - j|| represents the Euclidean distance between nodes i and j.

[0156] Other steps and parameters are the same as those in any one of Embodiments 1 to 6.

[0157] Embodiment 8: The difference between this embodiment and any one of Embodiments 1 to 7 is that based on the adjacency matrices A1(n0, n1) and A4(n3, n4), a structure matrix composed of the structure vectors of all accounts is obtained;

[0158] The specific process is as follows:

[0159] 1), Input the text feature matrix and the first-order jump graph adjacency matrix A1 into the graph convolution GCN. The local features extracted by the graph convolution GCN are input into BN, and BN outputs the node feature matrix B1; the expression is:

[0160] B1 = BN(GCN(B, A1))

[0161] Input the text feature matrix and the fourth-order jump graph adjacency matrix A4 into the graph convolution GCN. The local features extracted by the graph convolution GCN are input into BN, and BN outputs the node feature matrix B4; the expression is:

[0162] B4 = BN(GCN(B, A4))

[0163] where GCN(·) represents graph convolution, and BN(·) is the batch normalization function;

[0164] 2), Input the node feature matrix B1 and the first-order jump graph adjacency matrix A1 into the graph convolution GCN. The local features extracted by the graph convolution GCN pass through a non-linear activation and output the node feature matrix B 11 ; the expression is:

[0165] B 11 = δ(GCN(B1, A1))

[0166] Input the node feature matrix B4 and the fourth-order jump graph adjacency matrix A4 into the graph convolution GCN. The local features extracted by the graph convolution GCN pass through a non-linear activation and output the node feature matrix B 44 ; the expression is:

[0167] B44 = δ(GCN(B4, A4))

[0168] Where δ represents the rectified linear unit function;

[0169] 3), Input the node feature matrix B1 and the fourth-order skip graph adjacency matrix A4 into the graph convolution GCN. The local features extracted by the graph convolution GCN are non-linearly activated to output the Query1 vector and the Key1 vector; The expression is:

[0170] Query1, Key1 = δ(GCN(B1, A4))

[0171] Input the node feature matrix B4 and the first-order skip graph adjacency matrix A1 into the graph convolution GCN. The local features extracted by the graph convolution GCN are non-linearly activated to output the Query2 vector and the Key2 vector; The expression is:

[0172] Query2, Key2 = δ(GCN(B4, A1))

[0173] 4), Cross-multiply the Query1 vector and the Key1 vector to obtain the attention weight matrix 1;

[0174] Cross-multiply the Query2 vector and the Key2 vector to obtain the attention weight matrix 2;

[0175] Concatenate the attention weight matrix 1 and the attention weight matrix 2 to obtain the attention weight matrix;

[0176] 5), Cross-multiply the attention weight matrix with the node feature matrix B 11 to obtain the node feature matrix 1;

[0177] Cross-multiply the attention weight matrix with the node feature matrix B 44 to obtain the node feature matrix 2;

[0178] Concatenate the node feature matrix 1 and the node feature matrix 2 to obtain the structure matrix composed of the structure vectors of all accounts.

[0179] Other steps and parameters are the same as one of the specific embodiments one to seven.

[0180] Specific embodiment nine: The difference between this embodiment and one of the specific embodiments one to eight is that in S7, the unlabeled accounts in the social network that need to be detected for anomalies are detected to obtain the probabilities that the unlabeled accounts in the social network are normal accounts and abnormal accounts;

[0181] The specific process is:

[0182] Use the text feature extraction method to extract the feature of the attribute information of each unlabeled tag account, and obtain the text feature of the unlabeled tag account attribute;

[0183] Input the text feature of the unlabeled tag account attribute into the trained attribute feature mapping network to obtain the attribute vector corresponding to the unlabeled tag account;

[0184] Construct a text feature matrix with the text feature of the unlabeled tag account attribute as a row vector, input the text feature matrix and the adjacency matrix into the trained structure feature mapping network together, obtain the structure matrix composed of the structure vectors of all accounts, and extract the structure vector corresponding to the unlabeled tag account from the structure matrix;

[0185] Input the attribute vector into the pre-set classifier to obtain the probabilities of the account being a normal account and an abnormal account;

[0186] Input the structure vector into the pre-set classifier to obtain the probabilities of the account being a normal account and an abnormal account;

[0187] Add the probability values of the two normal accounts and take the average as the final probability of the normal account.

[0188] Other steps and parameters are the same as one of the specific embodiments 1 to 8.

[0189] Specific embodiment 10: A social network abnormal event type recognition system in this embodiment is used to execute a social network abnormal event type recognition method.

[0190] The present invention may also have many other embodiments. Without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and deformations according to the present invention, but these corresponding changes and deformations should all fall within the protection scope of the appended claims of the present invention.

Claims

1. A method for identifying types of abnormal events in a social network, characterized in that: The specific process of the method is as follows: S1: Construct a social network account graph G=(V, E, X), where V represents the set of all labeled accounts in the social network, i.e., the node set; E represents the set of all edges between labeled accounts in the social network. An edge is generated between two accounts when they have an interaction behavior. X represents the set of attribute information of all labeled accounts, and the account attribute information is text information; S2: Select several labeled accounts from the social network and perform abnormal account judgment. If it is a normal account, mark it with a normal label. If it is an abnormal account, mark it with an abnormal label, so as to obtain labeled accounts; S3: Use a text feature extraction method to extract features from the attribute information of each labeled account, and obtain the text features of the labeled account attributes; S4: Generate an adjacency matrix of the social network according to the social network account graph G=(V, E, X); S5: Construct an attribute feature mapping network; Input the text features of the attributes of each labeled account into the attribute feature mapping network to obtain the attribute vectors corresponding to each account. Then input the attribute vectors into a pre-set classifier to obtain the probabilities that the account is a normal account and an abnormal account; Train the attribute feature mapping network to obtain a trained attribute feature mapping network; S7: Construct a structural feature mapping network; Construct a text feature matrix by using the text features of the attributes of each labeled account as row vectors. Input the text feature matrix and the labeled adjacency matrix into the structural feature mapping network to obtain a structural matrix composed of the structural vectors of all accounts. Extract each row vector from the structural matrix as the structural vector corresponding to the account. Then input the structural vector into a pre-set classifier to obtain the probabilities that the account is a normal account and an abnormal account; Train the structural feature mapping network to obtain a trained structural feature mapping network; S7: Detect the unlabeled accounts in the social network that need to be detected for anomalies, and obtain the probabilities that the unlabeled accounts in the social network are normal accounts and abnormal accounts; In step S3, the text feature extraction method uses a text feature extraction method based on the bag-of-words model; In step S5, input the text features of the attributes of each labeled account into the attribute feature mapping network to obtain the attribute vectors corresponding to each account; The specific process is as follows: Input the text feature A of the account attribute into a layer normalization layer. The output feature of the layer normalization layer is input into a multi-head collaborative attention. The output feature of the multi-head collaborative attention is added to the feature A to obtain a feature B after the addition process; Input the feature B after the addition process into a layer normalization layer. The output feature of the layer normalization layer is input into a multi-layer perceptron MLP. The output feature of the multi-layer perceptron MLP is added to the feature B after the addition process to obtain a feature C after the addition process, which is used as the attribute vector corresponding to each account; Input the text feature A of the account attribute into a layer normalization layer. The output feature of the layer normalization layer is input into a multi-head collaborative attention. The output feature of the multi-head collaborative attention is added to the feature A to obtain a feature B after the addition process; The specific process is as follows: 1), Input the text feature A of the account attribute into the layer normalization layer, and the layer normalization layer outputs the feature A'; 2), Input the feature A' into the multi-head collaborative attention, and the multi-head collaborative attention outputs the feature A"; 3), Add the feature A" output by the multi-head collaborative attention and the feature A, and obtain the feature B after the addition process; In the above 2), the feature A' is input into the multi-head collaborative attention, and the multi-head collaborative attention outputs the feature A"; The specific process is as follows: Based on the output feature A' of the layer normalization layer, obtain the Q, K, and V matrices; the expression is: Among them, linear represents linearization processing; * represents the multiplication sign; Input Q into a two-dimensional 1×1 convolutional layer, a ReLU activation layer, a two-dimensional 1×1 convolutional layer, and a ReLU activation layer in sequence to obtain the feature Q I ; Input K into a 2D 1×1 convolutional layer, a ReLU activation layer, a 2D 1×1 convolutional layer, and a ReLU activation layer in sequence to obtain the feature K I ; Input V into a two-dimensional 1×1 convolutional layer, a ReLU activation layer, a two-dimensional 1×1 convolutional layer, and a ReLU activation layer in sequence to obtain the feature V I ; Calculate the multi-head attention; the expression is: where x SA represents the result of an attention head, attention(Q, K, V) represents scaled dot - product attention, and softmax(·) represents a normalization function, represents the square root of the dimension of K, · represents dot - product multiplication, and the superscript T represents transpose; Among them, MHSA(·) represents multi-head attention, and concat(·) represents a concatenation operation. represents the result of the first attention head. represents the result of the second attention head. represents the result of the h-th attention head. Combine SE and MHSA collaboratively and output the feature A", as the output feature of the multi-head collaborative attention, which can further improve the understanding ability of the model; the expression is: SE(A′) = σ s (linear(σ m (linear(avgpool(A′)+maxpool(A′))))) Among them, SE(·) represents the squeeze-and-excitation attention function, linear(·) represents the linear mapping, avgpool(·) represents the average pooling, and maxpool(·) represents the max pooling; σ m represents the Mish activation function; σ s (·) represents the Sigmoid function; represents matrix multiplication; In the above step S6, construct the text feature matrix by using the text features of each labeled account attribute as row vectors, input the text feature matrix and the labeled adjacency matrix into the structure feature mapping network, obtain the structure matrix composed of the structure vectors of all accounts, and extract each row vector from the structure matrix as the structure vector of the corresponding account; The specific process is as follows: Construct the adjacency matrix according to the weight matrix W; the calculation process is: A1(n0,n1) = W(n0,n1) A4(n3,n4) = 1 / 4(W(n0,n1)+W(n1,n2)+W(n2,n3)+W(n3,n4)) Among them, n0, n1, n2, n3, n4 respectively represent nodes; A1(n0,n1) represents the first-order jump graph adjacency matrix, A4(n3,n4) represents the fourth-order jump graph adjacency matrix, N represents the number of nodes; W(n0,n1) represents the weight matrix between n0 and n1, W(n1,n2) represents the weight matrix between n1 and n2, W(n2,n3) represents the weight matrix between n2 and n3, and W(n3,n4) represents the weight matrix between n3 and n4; Based on the adjacency matrices A1(n0,n1) and A4(n3,n4), obtain the structure matrix composed of the structure vectors of all accounts, and extract each row vector from the structure matrix as the structure vector of the corresponding account; The expression of the weight matrix W is: Among them, j represents the node j, i represents the node i, δ(i) represents the adjacent node of i, and ||i - j|| represents the Euclidean distance between the nodes i and j; Based on the adjacency matrices A1(n0,n1) and A4(n3,n4), obtain the structure matrix composed of the structure vectors of all accounts; The specific process is as follows: 1), Input the text feature matrix and the first-order jump graph adjacency matrix A1 into the graph convolutional network GCN. The local features extracted by the graph convolutional network GCN are input into BN, and BN outputs the node feature matrix B1. The expression is: B1 = BN(GCN(B,A1)) Input the text feature matrix and the fourth-order jump graph adjacency matrix A4 into the graph convolutional network GCN. The local features extracted by the graph convolutional network GCN are input into BN, and BN outputs the node feature matrix B4. The expression is as follows: B4 = BN(GCN(B,A4)) Among them, GCN(·) represents graph convolution, and BN(·) is the batch normalization function; 2), Input the node feature matrix B1 and the first-order jump graph adjacency matrix A1 into the graph convolution GCN. The local features extracted by the graph convolution GCN are non-linearly activated, and the node feature matrix B is output 11 ; The expression is: B 11 = δ(GCN(B1, A1)) Input the node feature matrix B4 and the fourth-order skip graph adjacency matrix A4 into the graph convolution GCN. The local features extracted by the graph convolution GCN are non-linearly activated and the node feature matrix B is output 44 ; The expression is: B 44 = δ(GCN(B4, A4)) Among them, δ represents the rectified linear unit function; 3), Input the node feature matrix B1 and the fourth-order jump graph adjacency matrix A4 into the graph convolution GCN, and the local features extracted by the graph convolution GCN are non-linearly activated to output the Query1 vector and the Key1 vector; the expression is: Query1,Key1 = δ(GCN(B1,A4)) Input the node feature matrix B4 and the first-order jump graph adjacency matrix A1 into the graph convolution GCN. The local features extracted by the graph convolution GCN are non-linearly activated, and the Query2 vector and the Key2 vector are output; the expression is: Query2, Key2 = δ(GCN(B4, A1)) 4) Cross-multiply the Query1 vector and the Key1 vector to obtain the attention weight matrix 1; Cross-multiply the Query2 vector and the Key2 vector to obtain the attention weight matrix 2; Concatenate the attention weight matrix 1 and the attention weight matrix 2 to obtain the attention weight matrix; 5), cross-multiply the attention weight matrix with the node feature matrix B 11 to obtain the node feature matrix 1; Multiply the attention weight matrix and the node feature matrix B 44 to obtain the node feature matrix 2; Concatenate the node feature matrix 1 and the node feature matrix 2 to obtain the structure matrix composed of the structure vectors of all accounts; In S7, detect the unlabeled accounts in the social network that need to be detected for anomalies, and obtain the probabilities that the unlabeled accounts in the social network are normal accounts and abnormal accounts; The specific process is as follows: Adopt a text feature extraction method to extract features from the attribute information of each unlabeled account, and obtain the text features of the attributes of the unlabeled account; Input the text features of the attributes of the unlabeled account into the trained attribute feature mapping network to obtain the attribute vector corresponding to the unlabeled account; Construct a text feature matrix with the text features of the attributes of the unlabeled account as row vectors, and input the text feature matrix and the adjacency matrix into the trained structure feature mapping network to obtain the structure matrix composed of the structure vectors of all accounts, and extract the structure vector corresponding to the unlabeled account from the structure matrix; Input the attribute vector into the pre-set classifier to obtain the probabilities that the account is a normal account and an abnormal account; Input the structure vector into the pre-set classifier to obtain the probabilities that the account is a normal account and an abnormal account; Add the probability values of the two normal accounts and take the average as the final probability of the normal account.

2. A social network abnormal event type recognition system, characterized in that: The system is used to implement a method for identifying abnormal event types in a social network as described in claim 1.

Images