Online social network abnormal propagation detection method and system

Abstract

The invention discloses an online social network anomaly propagation detection method and system, and relates to the field of social network anomaly detection. The invention aims to solve the problem that an existing social network abnormal propagation detection method cannot effectively identify bad information which is artificially spread and propagated. The method comprises the following steps: acquiring an influence value of a user, and initializing a user abnormal grade and an identified frequency according to the influence value of the user; and judging whether abnormal vocabularies exist in the message or not, obtaining the user who publishes the message with the abnormal vocabularies, obtaining the abnormal grade score of the current user, updating the identification frequency of the user, and respectively comparing the updated abnormal grade score and the identification frequency with a threshold value so as to identify the abnormal user. The method is used for detecting abnormal propagation of the social network and acquiring the abnormal user.

Description

Technical Field

[0001] The present invention relates to the field of social network anomaly detection, and in particular to a method and system for detecting abnormal propagation in an online social network. Background Art

[0002] With the rapid development of network technology, more and more people use the Internet to socialize. Therefore, the network records personal information and interpersonal relationship information. This kind of network that records personal information and interpersonal relationship information is called an online social network, such as Weibo social network. Online social networks have the characteristics of good convenience, high flexibility, and strong real-time performance. Online social networks have strengthened communication between people. However, with the increase in the number of online social network users, users who are not social for the purpose have also emerged. These users often use online networks to quickly spread false information, junk information, or harmful information, thereby guiding public opinion or making profits. The spread of these abnormal information reduces the social experience of other users in online social networks and even threatens the property safety of other users. Therefore, it is very important to detect the spread of abnormal information in social networks.

[0003] At present, the interactive online social network abnormal user detection method is a common method for social network abnormality detection. Before users use certain functions, the interactive online social network abnormal user detection method verifies the user's identity by setting preset questions or generating verification codes, thereby detecting and restricting abnormal users from making comments or performing abnormal operations. This method is low-cost. However, this method can only detect malicious users who use automatic programs, and cannot effectively identify those who spread bad information artificially. Summary of the invention

[0004] The purpose of the present invention is to solve the problem that the existing social network abnormal propagation detection method still cannot effectively identify the bad information spread artificially, and propose an online social network abnormal propagation detection method and system.

[0005] A method for detecting abnormal propagation in online social networks. The specific process is as follows:

[0006] Step 1: Obtain the influence value of users in online social networks;

[0007] Step 2: Initialize the user's abnormal level based on the user's influence value, and initialize the number of times the user is identified N i =0;

[0008] Step 3: Obtain the message m in the online social network;

[0009] Step 4: Determine whether there are abnormal words in message m. If there are abnormal words, obtain the user i who posted message m and use the influence value Y of user ii and the abnormal level of user i to obtain the abnormal level score of user i, and then execute step five; if there is no abnormal word in message m, execute step ten;

[0010] Step 5: Let the number of times user i is identified be N i =N i +1, judge N i Is it greater than the number of times user i is identified? i ; if N i >T i , then update the abnormality level score of user i to S i,k+1 , then execute step 6; otherwise, directly execute step 8;

[0011] Step 6: Determine whether the current abnormality level score of user i is greater than the abnormality level score threshold T S , if the current abnormality level score of user i is greater than T S , then mark user i as an abnormal user and execute step 10; otherwise, execute step 7;

[0012] Step 7: Obtain the number of messages N' that are identical to message m in the online social network within a preset time period m , if N' m is less than or equal to the message quantity threshold, execute step 10; if N' m If the number of messages is greater than the threshold, the abnormality level score of user i is updated to S i,k+2 ;

[0013] Then judge S i,k+2 Is it greater than the abnormal level score threshold T S , if S i,k+2 >T S , then mark user i as an abnormal user and execute step 10; otherwise, directly execute step 10;

[0014] Step 8: Determine whether the current abnormality level score of user i is greater than the abnormality level score threshold T S , if the current abnormality level score of user i is greater than T S , then mark user i as an abnormal user and execute step 10; otherwise, execute step 9;

[0015] Step 9: Obtain the number of messages N' that are identical to message m in the online social network within a preset time period m , if N' m is less than or equal to the message quantity threshold, execute step 10; if N' m If the number of messages is greater than the threshold, the abnormality level score of user i is updated to S i,k+1 ;

[0016] Then judge S i,k+1 Is it greater than the abnormal level score threshold T S , if S i,k+1 >T S , then mark user i as an abnormal user and execute step 10; otherwise, directly execute step 10;

[0017] Step 10: Set m=m+1 and return to step 3.

[0018] Furthermore, the step 1 of obtaining the influence value of the user in the online social network is specifically as follows:

[0019]

[0020] Among them, Y i is the influence value of user i, N fans is the number of fans of user i, N fans , N f is the number of messages published by user i within the preset time period Δt, N P User i publishes N f The total number of comments received by the message, N D User i publishes N f The total number of likes for a message, α is the preset comment weight, β is the preset like weight, N fans It is the preset weight of the number of fans.

[0021] Furthermore, the abnormal level of the user is initialized based on the user influence value in step 2, and the number of times the user is identified is initialized at the same time, specifically:

[0022] First, use the user influence value Y i Initialize the exception level of user i, specifically:

[0023] Set K successively increasing abnormal level thresholds {T1, T2, ...., T K}, thereby obtaining K+1 abnormal levels, using Y i With T k Compare and obtain the abnormal level of user i;

[0024] If T k ≤Y i <T k+1 Then the abnormal level of user i is k;

[0025] Among them, when k = 1, the abnormal level is the lowest, and when k = K, the abnormal level is the highest;

[0026] Then, initialize the number of times user i is identified N i =0.

[0027] Furthermore, in the step 4, it is determined whether there are abnormal words in the message m. If there are abnormal words, the user i who posted the message m is obtained, and the influence value Y of the user i is used i The abnormal level score of user i is obtained by summing the abnormal level of user i, and then executing step 5; if there is no abnormal word in message m, executing step 8, specifically:

[0028] Step 41: Determine whether there are abnormal words in the message m, specifically:

[0029] Step 4: Preprocess the message m to obtain the vocabulary vector in the message m:

[0030] First, the SnowNLP tool is used to divide the message m into the smallest unit structure;

[0031] The minimum unit structure includes: 1 character, 2 characters, 3 characters, 4 characters;

[0032] Then, remove meaningless words in the message m after it is divided into the smallest unit structure;

[0033] The meaningless words include: conjunctions, prepositions, modal particles;

[0034] Finally, one-hot encoding is used to encode the minimum unit structure after removing meaningless words, and the encoded minimum unit structures of different lengths are padded with 0 to the same length, thereby obtaining the vocabulary vector in the message m;

[0035] Step 4-2: Input the word vector in the message m into the trained abnormal word detection model to determine whether each word vector is an abnormal word;

[0036] Step 42: Based on the judgment result of step 41, the number n of abnormal words in the message m is obtained. m , if n m =0, then execute step 8. If n m ≠0, execute step 43;

[0037] Step 43: Get the user i who sent the message m, and use the influence value Y of user i i The abnormality level score of user i is obtained by summing the abnormality level of user i, and then executing step five.

[0038] Furthermore, the trained abnormal vocabulary detection model in step 412 is obtained by:

[0039] S1. Obtain historical message data from online social networks, and preprocess the historical message data to obtain historical message vocabulary vectors:

[0040] First, the SnowNLP tool is used to divide historical messages into the smallest unit structure;

[0041] Then, remove meaningless words from the historical messages divided into the smallest unit structure;

[0042] Finally, one-hot encoding is used to encode the minimum unit structure of the historical messages after removing meaningless words, and the encoded minimum unit structures of historical messages of different lengths are padded with 0 to make them of the same length, thereby obtaining the vocabulary vector of the historical messages;

[0043] S2, setting a label for each historical message vocabulary vector, and combining the label and the historical message vocabulary vector into a training set;

[0044] The label of the historical message vocabulary vector is 0 or 1; 0 means that the current vocabulary is not an abnormal vocabulary, and 1 means that the current vocabulary is an abnormal vocabulary;

[0045] The abnormal words include: offensive words, sales words, words that destroy unity, and violent words;

[0046] S3, using the training set to train the abnormal vocabulary detection model to obtain a trained abnormal vocabulary detection model;

[0047] The abnormal vocabulary detection model includes: an input layer, a convolution layer, a pooling layer, a fully connected layer, and a softmax layer;

[0048] The loss function of the abnormal vocabulary detection model is a cross entropy loss function.

[0049] Furthermore, the influence value Y of user i in step 43 is used i The abnormality level score of user i is obtained by combining the abnormality level of user i, specifically:

[0050]

[0051] Among them, ω k ∈[0,1],ω k is the weight of anomaly level k, N m is the total number of words in message m, n m is the number of abnormal words in message m.

[0052] Further

[0053] The identification threshold T of user i i , specifically:

[0054]

[0055] Where R is a constant, Is the round-up symbol.

[0056] An online social network abnormal communication detection system includes: an influence value acquisition module, an abnormal level and recognition number initialization module, a message acquisition module, and an abnormal user judgment module;

[0057] The influence value acquisition module is used to obtain the user influence in the social network, specifically:

[0058]

[0059] Among them, Y i is the influence value of user i, N fans is the number of fans of user i, N fans , N f is the number of messages published by user i within the preset time period Δt, N P User i publishes N f The total number of comments received by the message, N D User i publishes N f The total number of likes for a message, α is the preset comment weight, β is the preset like weight, N fans It is the preset weight of the number of fans;

[0060] The abnormal level and identification times initialization module is used to initialize the number of times a user is identified, and at the same time, initialize the user abnormal level using the user influence, specifically:

[0061] A201. Initialize the abnormal level of user i using the user influence value, specifically:

[0062] Set K successively increasing abnormal level thresholds {T1, T2, ...., T K}, thereby obtaining K+1 abnormal levels, using Y i With T k Compare and obtain the abnormal level of user i;

[0063] If T k ≤Y i <T k+1 Then the abnormal level of user i is k;

[0064] Among them, when k = 1, the abnormal level is the lowest, and when k = K, the abnormal level is the highest;

[0065] A202. Initialize the number of times N that user i is identified i =0;

[0066] The message acquisition module is used to acquire the message m in the social network;

[0067] The abnormal user judgment module detects abnormal users by using the number of times the user is identified, the user abnormality level, and the message m.

[0068] Furthermore, the abnormal user judgment module detects abnormal users using the number of times the user is identified, the user abnormality level, and the message m, specifically:

[0069] A301, determining whether there are abnormal words in the message m;

[0070] A302. Obtain the number n of abnormal words in message m based on the judgment result of A301. m , if n m =0, execute A309. If n m ≠0, execute A303;

[0071] A303. Get the user i who sent the message m, and use the influence value Y of user i i Obtain the abnormality level score of user i, and then execute A304;

[0072] The influence value Y of user i i Get the abnormality level score of user i, specifically:

[0073]

[0074] Among them, ω k ∈[0,1],ω k is the weight of anomaly level k, N m is the total number of words in message m, n m is the number of abnormal words in message m;

[0075] A304, order N i =N i +1, judge N i Is it greater than the number of times user i is identified? i ; if N i >T i , then update the abnormality level score of user i to S i,k+1 , then execute A305; otherwise, directly execute A307;

[0076] The identification threshold T of user i i , specifically:

[0077]

[0078] Where R is a constant, is the round-up symbol;

[0079] A305: Determine whether the current user's abnormality level score is greater than the abnormality level score threshold T S, if the current abnormal level score is greater than T S , user i is considered an abnormal user, and then execute A309; otherwise, execute A306;

[0080] A306. Obtain the number of messages N' identical to message m in the online social network within a preset time period. m , if N' m Less than or equal to the message quantity threshold, execute A309; if N' m If the number of messages is greater than the threshold, the abnormality level score of user i is updated to S i,k+2 ;

[0081] Then judge S i,k+2 Is it greater than the abnormal level score threshold T S , if S i,k+2 >T S , then mark user i as an abnormal user and execute A309; otherwise, execute A309 directly;

[0082] A307: Determine whether the current abnormality level score of user i is greater than the abnormality level score threshold T S , if the current abnormality level score of user i is greater than T S , then mark user i as an abnormal user, and then execute A309; otherwise, execute step A308;

[0083] A308. Obtain the number of messages N' identical to message m in the online social network within a preset time period. m , if N' m Less than or equal to the message quantity threshold, execute A309; if N' m If the number of messages is greater than the threshold, the abnormality level score of user i is updated to S i,k+1 ;

[0084] Then judge S i,k+1 Is it greater than the abnormal level score threshold T S , if S i,k+1 >T S , then mark user i as an abnormal user and execute A309; otherwise, execute A309 directly;

[0085] A309. Set m=m+1 and return to the message acquisition module.

[0086] Furthermore, the determination in A301 whether there are abnormal words in the message m is specifically as follows:

[0087] A301. Determine whether there are abnormal words in the message m, specifically:

[0088] A301-1. Preprocess the message m to obtain the vocabulary vector in the message m, specifically:

[0089] First, the SnowNLP tool is used to divide the message m into the smallest unit structure;

[0090] The minimum unit structure includes: 1 character, 2 characters, 3 characters, 4 characters;

[0091] Then, remove meaningless words in the message m after it is divided into the smallest unit structure;

[0092] The meaningless words include: conjunctions, prepositions, modal particles;

[0093] Finally, one-hot encoding is used to encode the minimum unit structure after removing meaningless words, and the encoded minimum unit structures of different lengths are padded with 0 to the same length, thereby obtaining the vocabulary vector in the message m;

[0094] A301-2, inputting the vocabulary vector in the message m into the trained abnormal vocabulary detection model to determine whether each vocabulary vector is an abnormal vocabulary;

[0095] The trained abnormal vocabulary detection model is obtained in the following way:

[0096] B1. Obtain historical message data from online social networks, and preprocess the historical message data to obtain historical message vocabulary vectors:

[0097] First, the SnowNLP tool is used to divide historical messages into the smallest unit structure;

[0098] Then, remove meaningless words from the historical messages divided into the smallest unit structure;

[0099] Finally, one-hot encoding is used to encode the minimum unit structure of the historical messages after removing meaningless words, and the encoded minimum unit structures of historical messages of different lengths are padded with 0 to make them of the same length, thereby obtaining the vocabulary vector of the historical messages;

[0100] B2. Set a label for each historical message vocabulary vector, and combine the label and the historical message vocabulary vector into a training set;

[0101] The label of the historical message vocabulary vector is 0 or 1; 0 means that the current vocabulary is not an abnormal vocabulary, and 1 means that the current vocabulary is an abnormal vocabulary;

[0102] The abnormal words include: offensive words, sales words, words that destroy unity, and violent words;

[0103] B3. Use the training set to train the abnormal vocabulary detection model to obtain a trained abnormal vocabulary detection model;

[0104] The abnormal vocabulary detection model includes: an input layer, a convolution layer, a pooling layer, a fully connected layer, and a softmax layer;

[0105] The loss function of the abnormal vocabulary detection model is a cross entropy loss function.

[0106] The beneficial effects of the present invention are:

[0107] The present invention first evaluates the influence of users in online social networks, and then divides users into different abnormal levels according to their influence, and sets different abnormal level scores for different users according to their influence and abnormal level, so that users with great influence have large abnormal level scores, and are more likely to reach the abnormal level score threshold later, thereby weakening the influence of users with great influence in spreading abnormal messages. The present invention identifies whether a message in an online social network has abnormal words and the number of abnormal words. If the current message has abnormal words, the user who sent the abnormal message is identified, and determines whether the abnormal level score needs to be updated based on the number of times the user is identified, and at the same time determines the number of the same messages within a preset time period, thereby determining whether to update the abnormal level score again. The present invention can effectively identify abnormal messages actively spread by humans, thereby locking abnormal users, thereby avoiding the large-scale dissemination of abnormal messages in online social networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0108] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0109] Specific implementation method 1: Figure 1 As shown, the specific process of the method for detecting abnormal propagation in an online social network in this embodiment is as follows:

[0110] Step 1: Obtain the influence value of users in online social networks, specifically:

[0111] Step 1. Get the number of fans N of user i in the online social network fans , the number of messages N published by user i within the preset time period Δt f , user i publishes N f The total number of comments received by the message N P And the total number of likes N D ;

[0112] Step 12: Use the number of fans N of user i fans 、N number of messages published by user i f 、User i publishes N f The total number of comments received by the message N P 、User i publishes N f The total number of likes a message received is N D Get the influence value Y of user ii :

[0113]

[0114] Among them, α is the preset comment weight, β is the preset like weight, and N fans It is the preset weight of the number of fans;

[0115] In this step, the user's influence value Y is obtained through the user's active data (likes, comments, number of fans, number of posts) within a fixed time period. i , Y i The larger the value, the larger the influence of user i is, and the faster the user with great influence spreads abnormal information, so when setting different abnormal levels in the future, a higher abnormal level is set for the user with great influence, so that the user with high abnormal level is more likely to reach the abnormal level score threshold, so that the user with great influence is more likely to be discovered when spreading abnormal information. The online social network in the present invention is Weibo.

[0116] Step 2: Initialize the abnormal level of user i based on the user influence value, and initialize the number of times user i is identified N i , specifically:

[0117] First, the abnormal level of user i is initialized using the user influence value, specifically:

[0118] Set K increasing abnormal level thresholds {T1, T2, ...., T K}, thereby obtaining K+1 abnormal levels, using Y i With T k Compare and obtain the abnormal level of user i;

[0119] If T k ≤Y i <T k+1 Then the abnormal level of user i is k;

[0120] Among them, when k = 1, the abnormal level is the lowest, and when k = K, the abnormal level is the highest;

[0121] Then, initialize the number of times user i is identified N i =0.

[0122] This step sets multiple abnormality levels, and different abnormality levels are set with different weights. The present invention can obtain abnormality level scores of different abnormality levels by using the abnormality level weights. In the present invention, the higher the abnormality level, the greater the abnormality level weight.

[0123] Step 3: Obtain the message m in the online social network;

[0124] Step 4: Determine whether there are abnormal words in message m. If there are abnormal words, obtain the user i who posted message m and use the influence value Y of user i i The abnormal level score of user i is obtained by summing the abnormal level of user i, and then executing step 5; if there is no abnormal word in message m, executing step 10, which is specifically:

[0125] Step 41: Determine whether there are abnormal words in the message m, specifically:

[0126] Step 4: Preprocess the message m to obtain the vocabulary vector in the message m:

[0127] First, the SnowNLP tool is used to divide the message m into the smallest unit structure;

[0128] The minimum unit structure includes: 1 character (single word), 2 characters (words), 3 characters (words), 4 characters (idioms);

[0129] Then, remove meaningless words in the message m after it is divided into the smallest unit structure;

[0130] Meaningless words include: conjunctions (just, then, then, for example), prepositions (of, to, to), modal particles (ah, ya);

[0131] Finally, one-hot encoding is used to encode the remaining minimum unit structure, and the encoded minimum unit structures of different lengths are padded with 0 to make them of the same length, thereby obtaining the vocabulary vector in the message m;

[0132] Step 4-2: Input the word vector in the message m into the trained abnormal word detection model to determine whether each word vector is an abnormal word;

[0133] The trained abnormal vocabulary detection model is obtained in the following way:

[0134] S1. Obtain historical message data from online social networks within a historical period, and preprocess the historical message data to obtain historical message vocabulary vectors:

[0135] First, the SnowNLP tool is used to divide historical messages into the smallest unit structure;

[0136] The minimum unit structure includes: 1 character (single word), 2 characters (words), 3 characters (words), 4 characters (idioms);

[0137] Then, remove meaningless words from the historical messages divided into the smallest unit structure;

[0138] The meaningless words include: conjunctions (just, then, then, for example), prepositions (of, to, get), modal particles (ah, ya);

[0139] Finally, one-hot encoding is used to encode the minimum unit structure of historical messages after removing meaningless words to obtain the encoded minimum unit structure of historical messages, and the encoded minimum unit structures of historical messages of different lengths are padded with 0 to make them of the same length, thereby obtaining the vocabulary vector of historical messages;

[0140] S2, setting a label for each historical message vocabulary vector, and combining the label and the historical message vocabulary vector into a training set;

[0141] The historical message vocabulary vector label is 0 or 1; 0 indicates that the current vocabulary is not an abnormal vocabulary, and 1 indicates that the current vocabulary is an abnormal vocabulary;

[0142] The offensive words are words that are insulting or abusive;

[0143] Sales vocabulary such as: stocks, financial management, payment, account, online banking, remittance, super profit;

[0144] Words that destroy unity such as: **Independence;

[0145] The violent words are words related to beating, such as: bomb, beat to death, fight;

[0146] S3, using the training set to train the abnormal vocabulary detection model to obtain a trained abnormal vocabulary detection model;

[0147] The abnormal vocabulary detection model is a TextCNN network including: an input layer, a convolutional layer, a pooling layer, a fully connected layer, and a softmax layer;

[0148] The loss function of the abnormal vocabulary detection model is a cross entropy loss function;

[0149] Step 42: Based on the judgment result of step 41, the number n of abnormal words in the message m is obtained. m , if n m =0, then execute step 8. If n m ≠0, execute step 43;

[0150] Step 43: Get the user i who sent the message m, and use the influence value Y of user i i Obtain the abnormality level score of user i, and then execute step 5;

[0151] The influence value Y of user i i Get the abnormal level score of user i as follows:

[0152]

[0153] Among them, ω k ∈[0,1],ω k is the weight of anomaly level k, N m is the total number of words in message m, n m is the number of abnormal words in message m; the weight of the abnormal level is set according to experience, the higher the abnormal level, the greater the weight.

[0154] Step 5: Let N i =N i +1, judge N i Is it greater than the number of times user i is identified? i ; if N i >T i , then update the abnormality level score of user i to S i,k+1 , then execute step 6; otherwise, directly execute step 8;

[0155]

[0156] The identification times threshold T of the user i i Obtained in the following way:

[0157]

[0158] Where R is a sufficiently large constant. is the round-up symbol;

[0159] Step 6: Determine whether the current user's abnormal level score is greater than the abnormal level score threshold T S , if the current abnormal level score is greater than T S , then user i is marked as an abnormal user, and then step 10 is executed; otherwise, step 7 is executed;

[0160] Step 7: Obtain the number of messages N' that are identical to message m in the online social network within a preset time period m , if N' m is less than or equal to the message quantity threshold, execute step 10; if N' m If the number of messages is greater than the threshold, the abnormality level score of user i is updated to S i,k+2 ;;

[0161] Then judge S i,k+2 Is it greater than the abnormal level score threshold T S , if S i,k+2 >T S , then user i is marked as an abnormal user, and then step 10 is executed; otherwise, step 10 is executed directly;

[0162] Step 8: Determine whether the current abnormality level score of user i is greater than the abnormality level score threshold T S , if the current abnormality level score of user i is greater than T S , then mark user i as an abnormal user and execute step 10; otherwise, execute step 9;

[0163] Step 9: Obtain the number of messages N' that are identical to message m in the online social network within a preset time period m , if N' m is less than or equal to the message quantity threshold, execute step 10; if N' m If the number of messages is greater than the threshold, the abnormality level score of user i is updated to S i,k+1 ;

[0164] Then judge S i,k+1 Is it greater than the abnormal level score threshold T S , if S i,k+1 >T S , then mark user i as an abnormal user and execute step 10; otherwise, directly execute step 10;

[0165] Step 10: Set m=m+1 and return to step 3.

[0166] Specific implementation method 2: An online social network abnormal communication detection system includes: an influence value acquisition module, an abnormal level and identification number initialization module, a message acquisition module, and an abnormal user judgment module;

[0167] The influence value acquisition module is used to obtain the user influence in the social network, specifically:

[0168] A101. Obtain the number of fans N of user i in the online social network within a preset time period fans 、N number of messages published by user i f , user i publishes N f The total number of comments received by the message N P And the total number of likes N D ;

[0169] A102. Use the number of fans N of user i fans 、N number of messages published by user i f 、User i publishes N f The total number of comments received by the message N P 、User i publishes N f The total number of likes a message received is N D Get the influence value Y of user i i :

[0170]

[0171] Among them, α is the preset comment weight, β is the preset like weight, and N fans It is the preset weight of the number of fans.

[0172] The abnormal level and identification times initialization module is used to initialize the number of times a user is identified, and at the same time, initialize the user abnormal level using the user influence, specifically:

[0173] A201. Initialize the abnormal level of user i using the user influence value, specifically:

[0174] Set K increasing abnormal level thresholds {T1, T2, ...., T K}, thereby obtaining K+1 abnormal levels, using Y i With T k Compare and obtain the abnormal level of user i;

[0175] If T k ≤Y i <T k+1 Then the abnormal level of user i is k;

[0176] Among them, when k = 1, the abnormal level is the lowest, and when k = K, the abnormal level is the highest;

[0177] A202. Initialize the number of times N that user i is identified i =0.

[0178] The message acquisition module is used to acquire the message m in the social network;

[0179] The abnormal user judgment module detects abnormal users by using the number of times the user is identified, the user abnormality level, and the message m, specifically:

[0180] A301. Determine whether there are abnormal words in the message m, specifically:

[0181] A301-1. Preprocess the message m to obtain the vocabulary vector in the message m:

[0182] First, the SnowNLP tool is used to divide the message m into the smallest unit structure;

[0183] The minimum unit structure includes: 1 character (single word), 2 characters (words), 3 characters (words), 4 characters (idioms);

[0184] Then, remove meaningless words in the message m after it is divided into the smallest unit structure;

[0185] Meaningless words include: conjunctions (just, then, then, for example), prepositions (of, to, to), modal particles (ah, ya);

[0186] Finally, one-hot encoding is used to encode the remaining minimum unit structure, and the encoded minimum unit structures of different lengths are padded with 0 to make them of the same length, thereby obtaining the vocabulary vector in the message m;

[0187] A301-2, inputting the vocabulary vector in the message m into the trained abnormal vocabulary detection model to determine whether each vocabulary vector is an abnormal vocabulary;

[0188] The trained abnormal vocabulary detection model is obtained in the following way:

[0189] B1. Obtain historical message data from online social networks within a historical period, and preprocess the historical message data to obtain historical message vocabulary vectors:

[0190] First, the SnowNLP tool is used to divide historical messages into the smallest unit structure;

[0191] The minimum unit structure includes: 1 character (single word), 2 characters (words), 3 characters (words), 4 characters (idioms);

[0192] Then, remove meaningless words from the historical messages divided into the smallest unit structure;

[0193] The meaningless words include: conjunctions (just, then, then, for example), prepositions (of, to, get), modal particles (ah, ya);

[0194] Finally, one-hot encoding is used to encode the minimum unit structure of the historical messages after removing meaningless words, and the encoded minimum unit structures of historical messages of different lengths are padded with 0 to make them of the same length, thereby obtaining the vocabulary vector of the historical messages;

[0195] B2. Set a label for each historical message vocabulary vector, and combine the label and the historical message vocabulary vector into a training set;

[0196] The historical message vocabulary vector label is whether the current vocabulary is an abnormal vocabulary;

[0197] The label of the historical message vocabulary vector is 0 or 1; 0 means that the current vocabulary is not an abnormal vocabulary, and 1 means that the current vocabulary is an abnormal vocabulary;

[0198] The abnormal words include: offensive words, sales words, words that destroy unity, and violent words;

[0199] The offensive words are words that are insulting or abusive;

[0200] Sales vocabulary such as: stocks, financial management, payment, account, online banking, remittance, super profit;

[0201] Words that destroy unity such as: **Independence;

[0202] The violent words are words related to beating, such as: bomb, beat to death, fight;

[0203] B3. Use the training set to train the abnormal vocabulary detection model to obtain a trained abnormal vocabulary detection model;

[0204] The abnormal vocabulary detection model includes: an input layer, a convolution layer, a pooling layer, a fully connected layer, and a softmax layer;

[0205] The abnormal vocabulary detection model adopts a cross entropy loss function.

[0206] A302. Obtain the number n of abnormal words in message m based on the judgment result of A301. m , if n m =0, execute A309. If n m ≠0, execute step A303;

[0207] A303. Get the user i who sent the message m, and use the influence value Y of user i i Obtain the abnormality level score of user i, and then execute A304;

[0208] The influence value Y of user i i Get the abnormal level score of user i as follows:

[0209]

[0210] Among them, ω k ∈[0,1],ω k is the weight of anomaly level k, N m is the total number of words in message m, n m is the number of abnormal words in message m;

[0211] A304, order N i =N i +1, judge N i Is it greater than the number of times user i is identified? i ; if N i >T i , then update the abnormality level score of user i to S i,k+1 , then execute step A305; otherwise, directly execute A307;

[0212] S i,k+1 Specifically:

[0213]

[0214] The identification times threshold T of the user i i Obtained in the following way:

[0215]

[0216] Where R is a sufficiently large constant. is the round-up symbol;

[0217] A305: Determine whether the current user's abnormality level score is greater than the abnormality level score threshold T S , if the current abnormal level score is greater than T S , then user i is marked as an abnormal user, and then A309 is executed; otherwise, A306 is executed;

[0218] A306. Obtain the number of messages N' identical to message m in the online social network within a preset time period. m , if N' m Less than or equal to the message quantity threshold, execute A309; if N' m If the number of messages is greater than the threshold, the abnormality level score of user i is updated to S i,k+2 ;

[0219] Then judge S i,k+2 Is it greater than the abnormal level score threshold T S , if S i,k >T S , then mark user i as an abnormal user and execute A309; otherwise, execute A309 directly;

[0220] A307: Determine whether the current abnormality level score of user i is greater than the abnormality level score threshold T S , if the current abnormality level score of user i is greater than T S , then mark user i as an abnormal user, and then execute A309; otherwise, execute step A308;

[0221] A308. Obtain the number of messages N' identical to message m in the online social network within a preset time period. m , if N' m Less than or equal to the message quantity threshold, execute A309; if N' m If the number of messages is greater than the threshold, the abnormality level score of user i is updated to S i,k+1 ;

[0222] Then judge S i,k+1 Is it greater than the abnormal level score threshold T S , if S i,k+1 >T S , then mark user i as an abnormal user and execute A309; otherwise, execute A309 directly;

[0223] A309. Set m=m+1 and return to the message acquisition module.

Claims

1. A method for detecting abnormal propagation in online social networks, characterized in that The specific process of the method is: Step 1: Obtain the influence value of users in online social networks; Step 2: Initialize the user's abnormal level based on the user's influence value, and initialize the number of times the user is identified N i =0; Step 3: Obtain the message m in the online social network; Step 4: Determine whether there are abnormal words in message m. If there are abnormal words, obtain the user i who posted message m and use the influence value Y of user i i and the abnormal level of user i to obtain the abnormal level score of user i, and then execute step five; if there is no abnormal word in message m, execute step ten; Step 5: Let the number of times user i is identified be N i =N i +1, judge N i Is it greater than the number of times user i is identified? i ; if N i >T i , then update the abnormality level score of user i to S i,k+1 , then execute step 6; otherwise, directly execute step 8; Step 6: Determine whether the current abnormality level score of user i is greater than the abnormality level score threshold T S , if the current abnormality level score of user i is greater than T S , then mark user i as an abnormal user, and then execute step 10; Otherwise, go to step 7; Step 7: Obtain the number of messages N' that are identical to message m in the online social network within a preset time period m , if N' m is less than or equal to the message quantity threshold, execute step 10; if N' m If the number of messages is greater than the threshold, the abnormality level score of user i is updated to S i,k+2 ; Then judge S i,k+2 Is it greater than the abnormal level score threshold T S , if S i,k+2 >T S , then mark user i as an abnormal user, and then execute step 10; Otherwise, go directly to step 10; Step 8: Determine whether the current abnormality level score of user i is greater than the abnormality level score threshold T S , if the current abnormality level score of user i is greater than T S , then mark user i as an abnormal user, and then execute step 10; Otherwise, go to step nine; Step 9: Obtain the number of messages N' that are identical to message m in the online social network within a preset time period m , if N' m is less than or equal to the message quantity threshold, execute step 10; if N' m If the number of messages is greater than the threshold, the abnormality level score of user i is updated to S i,k+1 ; Then judge S i,k+1 Is it greater than the abnormal level score threshold T S , if S i,k+1 >T S , then mark user i as an abnormal user, and then execute step 10; Otherwise, go directly to step 10; Step 10: Set m=m+1 and return to step 3.

2. The method for detecting abnormal propagation in online social networks according to claim 1, characterized in that: The step 1 of obtaining the influence value of the user in the online social network is specifically as follows: Among them, Y i is the influence value of user i, N fans is the number of fans of user i, N fans , N f is the number of messages published by user i within the preset time period Δt, N P User i publishes N f The total number of comments received by the message, N D User i publishes N f The total number of likes for a message, α is the preset comment weight, β is the preset like weight, N fans It is the preset weight of the number of fans.

3. The method for detecting abnormal propagation in online social networks according to claim 2, characterized in that: The abnormal level of the user is initialized based on the user influence value in step 2, and the number of times the user is identified is initialized at the same time, specifically: First, use the user influence value Y i Initialize the exception level of user i, specifically: Set K successively increasing abnormal level thresholds {T1, T2, ...., T K }, thereby obtaining K+1 abnormal levels, using Y i With T k Compare and obtain the abnormal level of user i; If T k ≤Y i <T k+1 Then the abnormal level of user i is k; Among them, when k = 1, the abnormal level is the lowest, and when k = K, the abnormal level is the highest; Then, initialize the number of times user i is identified N i =0.

4. The method for detecting abnormal propagation in online social networks according to claim 3, characterized in that: In the step 4, it is determined whether there are abnormal words in the message m. If there are abnormal words, the user i who posted the message m is obtained, and the influence value Y of the user i is used. i The abnormal level score of user i is obtained by summing the abnormal level of user i, and then executing step 5; if there is no abnormal word in message m, executing step 8, specifically: Step 41: Determine whether there are abnormal words in the message m, specifically: Step 4: Preprocess the message m to obtain the vocabulary vector in the message m: First, the SnowNLP tool is used to divide the message m into the smallest unit structure; The minimum unit structure includes: 1 character, 2 characters, 3 characters, 4 characters; Then, remove meaningless words in the message m after it is divided into the smallest unit structure; The meaningless words include: conjunctions, prepositions, modal particles; Finally, one-hot encoding is used to encode the minimum unit structure after removing meaningless words, and the encoded minimum unit structures of different lengths are padded with 0 to the same length, thereby obtaining the vocabulary vector in the message m; Step 4-2: Input the word vector in the message m into the trained abnormal word detection model to determine whether each word vector is an abnormal word; Step 42: Based on the judgment result of step 41, the number n of abnormal words in the message m is obtained. m , if n m =0, then execute step 8. If n m ≠0, execute step 43; Step 43: Get the user i who sent the message m, and use the influence value Y of user i i The abnormality level score of user i is obtained by summing the abnormality level of user i, and then executing step five.

5. The method for detecting abnormal propagation in online social networks according to claim 4, characterized in that: The trained abnormal vocabulary detection model in step 412 is obtained by: S1. Obtain historical message data from online social networks, and preprocess the historical message data to obtain historical message vocabulary vectors: First, the SnowNLP tool is used to divide historical messages into the smallest unit structure; Then, remove meaningless words from the historical messages divided into the smallest unit structure; Finally, one-hot encoding is used to encode the minimum unit structure of the historical messages after removing meaningless words, and the encoded minimum unit structures of historical messages of different lengths are padded with 0 to make them of the same length, thereby obtaining the vocabulary vector of the historical messages; S2, setting a label for each historical message vocabulary vector, and combining the label and the historical message vocabulary vector into a training set; The label of the historical message vocabulary vector is 0 or 1; 0 means that the current vocabulary is not an abnormal vocabulary, and 1 means that the current vocabulary is an abnormal vocabulary; The abnormal words include: offensive words, sales words, words that destroy unity, and violent words; S3, using the training set to train the abnormal vocabulary detection model to obtain a trained abnormal vocabulary detection model; The abnormal vocabulary detection model includes: an input layer, a convolution layer, a pooling layer, a fully connected layer, and a softmax layer; The loss function of the abnormal vocabulary detection model is a cross entropy loss function.

6. The method for detecting abnormal propagation in online social networks according to claim 5, characterized in that: The influence value Y of user i in step 43 is used i The abnormality level score of user i is obtained by combining the abnormality level of user i, specifically: Among them, ω k ∈[0,1],ω k is the weight of anomaly level k, N m is the total number of words in message m, n m is the number of abnormal words in message m.

7. The method for detecting abnormal propagation in online social networks according to claim 6, characterized in that: Step 5 The identification threshold T of user i i , specifically: Where R is a constant, Is the round-up symbol.

8. An online social network abnormal communication detection system, characterized by: The system includes: an influence value acquisition module, an abnormal level and identification times initialization module, a message acquisition module, and an abnormal user judgment module; The influence value acquisition module is used to obtain the user influence in the social network, specifically: Among them, Y i is the influence value of user i, N fans is the number of fans of user i, N fans , N f is the number of messages published by user i within the preset time period Δt, N P User i publishes N f The total number of comments received by the message, N D User i publishes N f The total number of likes for a message, α is the preset comment weight, β is the preset like weight, N fans It is the preset weight of the number of fans; The abnormal level and identification times initialization module is used to initialize the number of times a user is identified, and at the same time, initialize the user abnormal level using the user influence, specifically: A201. Initialize the abnormal level of user i using the user influence value, specifically: Set K successively increasing abnormal level thresholds {T1, T2, ...., T K }, thereby obtaining K+1 abnormal levels, using Y i With T k Compare and obtain the abnormal level of user i; If T k ≤Y i <T k+1 Then the abnormal level of user i is k; Among them, when k = 1, the abnormal level is the lowest, and when k = K, the abnormal level is the highest; A202. Initialize the number of times N that user i is identified i =0; The message acquisition module is used to acquire the message m in the social network; The abnormal user judgment module detects abnormal users by using the number of times the user is identified, the user abnormality level, and the message m.

9. The online social network abnormal communication detection system according to claim 8, characterized in that: The abnormal user judgment module detects abnormal users by using the number of times the user is identified, the user abnormality level, and the message m, specifically: A301, determining whether there are abnormal words in the message m; A302. Obtain the number n of abnormal words in message m based on the judgment result of A301. m , if n m =0, execute A309. If n m ≠0, execute A303; A303. Get the user i who sent the message m, and use the influence value Y of user i i Obtain the abnormality level score of user i, and then execute A304; The influence value Y of user i i Get the abnormality level score of user i, specifically: Among them, ω k ∈[0,1],ω k is the weight of anomaly level k, N m is the total number of words in message m, n m is the number of abnormal words in message m; A304, order N i =N i +1, judge N i Is it greater than the number of times user i is identified? i ; if N i >T i , then update the abnormality level score of user i to S i,k+1 , then execute A305; otherwise, directly execute A307; The identification threshold T of user i i , specifically: Where R is a constant, is the ceiling symbol; A305: Determine whether the current user's abnormality level score is greater than the abnormality level score threshold T S , if the current abnormal level score is greater than T S , user i is considered an abnormal user, and then execute A309; otherwise, execute A306; A306. Obtain the number of messages N' identical to message m in the online social network within a preset time period. m , if N' m Less than or equal to the message quantity threshold, execute A309; if N' m If the number of messages is greater than the threshold, the abnormality level score of user i is updated to S i,k+2 ; Then judge S i,k+2 Is it greater than the abnormal level score threshold T S , if S i,k+2 >T S , then mark user i as an abnormal user and execute A309; otherwise, execute A309 directly; A307: Determine whether the current abnormality level score of user i is greater than the abnormality level score threshold T S , if the current abnormality level score of user i is greater than T S , then mark user i as an abnormal user, and then execute A309; otherwise, execute step A308; A308. Obtain the number of messages N' identical to message m in the online social network within a preset time period. m , if N' m Less than or equal to the message quantity threshold, execute A309; if N' m If the number of messages is greater than the threshold, the abnormality level score of user i is updated to S i,k+1 ; Then judge S i,k+1 Is it greater than the abnormal level score threshold T S , if S i,k+1 >T S , then mark user i as an abnormal user and execute A309; otherwise, execute A309 directly; A309. Set m=m+1 and return to the message acquisition module.

10. The online social network abnormal communication detection system according to claim 9, characterized in that: The determination in A301 whether there is an abnormal word in the message m is specifically as follows: A301. Determine whether there are abnormal words in the message m, specifically: A301-1. Preprocess the message m to obtain the vocabulary vector in the message m, specifically: First, the SnowNLP tool is used to divide the message m into the smallest unit structure; The minimum unit structure includes: 1 character, 2 characters, 3 characters, 4 characters; Then, remove meaningless words in the message m after it is divided into the smallest unit structure; The meaningless words include: conjunctions, prepositions, modal particles; Finally, one-hot encoding is used to encode the minimum unit structure after removing meaningless words, and the encoded minimum unit structures of different lengths are padded with 0 to the same length, thereby obtaining the vocabulary vector in the message m; A301-2, inputting the vocabulary vector in the message m into the trained abnormal vocabulary detection model to determine whether each vocabulary vector is an abnormal vocabulary; The trained abnormal vocabulary detection model is obtained in the following way: B1. Obtain historical message data from online social networks, and preprocess the historical message data to obtain historical message vocabulary vectors: First, the SnowNLP tool is used to divide historical messages into the smallest unit structure; Then, remove meaningless words from the historical messages divided into the smallest unit structure; Finally, one-hot encoding is used to encode the minimum unit structure of the historical messages after removing meaningless words, and the encoded minimum unit structures of historical messages of different lengths are padded with 0 to make them of the same length, thereby obtaining the vocabulary vector of the historical messages; B2. Set a label for each historical message vocabulary vector, and combine the label and the historical message vocabulary vector into a training set; The label of the historical message vocabulary vector is 0 or 1; 0 means that the current vocabulary is not an abnormal vocabulary, and 1 means that the current vocabulary is an abnormal vocabulary; The abnormal words include: offensive words, sales words, words that destroy unity, and violent words; B3. Use the training set to train the abnormal vocabulary detection model to obtain a trained abnormal vocabulary detection model; The abnormal vocabulary detection model includes: an input layer, a convolution layer, a pooling layer, a fully connected layer, and a softmax layer; The loss function of the abnormal vocabulary detection model is a cross entropy loss function.

Images