Abnormal group identification method and device, equipment and storage medium

Abstract

The invention relates to the technical field of network security, in particular to an abnormal group identification method, device and equipment and a storage medium, and the method comprises the steps: constructing a user information set through the blog article information of a to-be-identified user, and analyzing the relation between users from the two directions of a social layer network dimension and a behavior layer network dimension, according to the method, the user classification accuracy is improved, so that a first similarity matrix of a social layer network dimension and a second similarity matrix of a behavior layer network dimension are constructed, and group division is performed on the users based on the first similarity matrix of the social layer network dimension and the second similarity matrix of the behavior layer network dimension to obtain a plurality of to-be-evaluated groups; and finally, by determining the suspicious value of each group to be evaluated, an abnormal group can be identified, accurate user classification and group identification are realized, and the technical problem that the abnormal group in the Internet is difficult to identify in the prior art is avoided.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an abnormal group identification method, device, equipment and storage medium. Background Art

[0002] With the development of Internet technology, people can freely express their views and opinions on a certain event or platform on the Internet. Especially when shopping online, the evaluation of a platform or product greatly affects the interests of the platform and the product. Therefore, some user groups that fake orders or maliciously fake reviews have emerged. The inflammatory remarks made by such user groups will seriously affect the normal interests of the platform, but it is difficult to identify these groups in traditional Internet applications or technologies.

[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of the present invention is to provide a method, device, equipment and storage medium for identifying abnormal groups, aiming to solve the technical problem that it is difficult to identify abnormal groups on the Internet in the prior art.

[0005] To achieve the above object, the present invention provides a method for identifying an abnormal group, the method comprising the following steps:

[0006] Obtaining blog post information of the user to be identified, and constructing a user information set based on the blog post information;

[0007] Constructing a first similarity matrix of a social layer network dimension and a second similarity matrix of a behavioral layer network dimension respectively according to the user information set;

[0008] Dividing each user into groups according to the first similarity matrix and the second similarity matrix to obtain a plurality of groups to be evaluated;

[0009] The suspicious value of each group to be evaluated is determined respectively, and abnormal groups are identified for each group to be evaluated according to the suspicious value.

[0010] In some embodiments, constructing a first similarity matrix of a social layer network dimension and a second similarity matrix of a behavioral layer network dimension respectively according to the user information set includes:

[0011] Extracting the following relationship, blog post forwarding relationship and blog post forwarding times between users in the user information set;

[0012] Construct a social layer network adjacency matrix based on the attention relationship between users;

[0013] Construct a behavior layer network adjacency matrix based on the blog post forwarding relationship and blog post forwarding times between users;

[0014] Determine the social similarity between users according to the social layer network adjacency matrix, and generate a first similarity matrix of the social layer network dimension according to the social similarity;

[0015] The behavior similarities between the users are determined according to the behavior layer network adjacency matrix, and a second similarity matrix of the behavior layer network dimension is generated according to the behavior similarities.

[0016] In some embodiments, determining the social similarity between users according to the social layer network adjacency matrix, and generating a first similarity matrix of the social layer network dimension according to the social similarity includes:

[0017] Determine a set of social dimension neighbor nodes of each node in the social layer network adjacency matrix;

[0018] Determine the intersection of neighbor node sets and the union of neighbor node sets on the social dimension according to the neighbor node sets of each node;

[0019] Calculate the social similarity between nodes according to the intersection of neighbor node sets and the union of neighbor node sets on the social dimension;

[0020] A first similarity matrix of the social layer network dimension is constructed according to the social similarity.

[0021] In some embodiments, determining the behavior similarity between users according to the behavior layer network adjacency matrix, and generating a second similarity matrix of the behavior layer network dimension according to the behavior similarity includes:

[0022] Determine a set of neighbor nodes in the behavior dimension of each node in the behavior layer network adjacency matrix;

[0023] Determine the intersection of neighbor node sets and the union of neighbor node sets on the behavior dimension according to the neighbor node sets of each node;

[0024] Determine the intersection weight of the node connection edges of the intersection of the neighbor node sets of each node on the behavior dimension and the union weight within the union of the neighbor node sets;

[0025] Calculate the behavior similarity between nodes according to the intersection weight and the union weight;

[0026] A second similarity matrix of the behavior layer network dimension is constructed according to the behavior similarities.

[0027] In some embodiments, the grouping of each user according to the first similarity matrix and the second similarity matrix to obtain a plurality of groups to be evaluated includes:

[0028] Determine an initial user node in the behavior layer network adjacency matrix, and determine a target neighbor node in the social layer network adjacency matrix according to the initial user node, wherein the initial user node is a user node having the largest sum of weights of adjacent edges in the current social layer network adjacency matrix;

[0029] Generate an initial community according to the initial user node and the target neighbor node;

[0030] Determine a first neighbor node set in the first similarity matrix and a second neighbor node set in the second similarity matrix based on the initial community;

[0031] Determine a candidate user node having the greatest similarity to the initial community from the first neighbor node set and the second neighbor node set;

[0032] The initial community is updated according to the candidate user nodes to construct a plurality of groups to be evaluated.

[0033] In some embodiments, determining the candidate user node having the greatest similarity to the initial community from the first neighbor node set and the second neighbor node set includes:

[0034] Determine a total similarity set of first neighbor nodes of each node in the first neighbor node set and each node in the initial community;

[0035] Determine a total similarity set of second neighbor nodes of each node in the second neighbor node set and each node in the initial community;

[0036] Generate a total similarity set according to the first neighbor node total similarity set and the second neighbor node total similarity set;

[0037] The user node with the greatest similarity in the total similarity set is determined as a candidate node.

[0038] In some embodiments, updating the initial community according to the candidate user node includes:

[0039] Determining a first modularity of the initial community and a second modularity of the updated initial community;

[0040] When the first modularity is less than the second modularity, a step of updating the initial community according to the candidate user nodes is performed.

[0041] In addition, to achieve the above-mentioned purpose, the present invention further proposes an abnormal group identification device, the abnormal group identification device comprising:

[0042] An acquisition module, used to acquire blog post information of a user to be identified, and construct a user information set based on the blog post information;

[0043] A construction module, used to construct a first similarity matrix of a social layer network dimension and a second similarity matrix of a behavioral layer network dimension respectively according to the user information set;

[0044] A division module, used for dividing each user into groups according to the first similarity matrix and the second similarity matrix to obtain a plurality of groups to be evaluated;

[0045] The identification module is used to determine the suspicious value of each group to be evaluated respectively, and identify abnormal groups for each group to be evaluated according to the suspicious value.

[0046] In addition, to achieve the above-mentioned purpose, the present invention also proposes an abnormal group identification device, which includes: a memory, a processor, and an abnormal group identification program stored in the memory and executable on the processor, and the abnormal group identification program is configured to implement the steps of the abnormal group identification method described above.

[0047] In addition, to achieve the above-mentioned purpose, the present invention further proposes a storage medium, on which an abnormal group identification program is stored, and when the abnormal group identification program is executed by a processor, the steps of the abnormal group identification method described above are implemented.

[0048] The invention discloses an abnormal group identification method, which comprises: obtaining blog information of a user to be identified, and constructing a user information set according to the blog information; constructing a first similarity matrix of a social layer network dimension and a second similarity matrix of a behavioral layer network dimension according to the user information set; dividing each user into groups according to the first similarity matrix and the second similarity matrix to obtain a plurality of groups to be evaluated; determining a suspicious value of each group to be evaluated respectively, and identifying an abnormal group for each group to be evaluated according to the suspicious value. The invention constructs a user information set through the blog information of the user to be identified, and analyzes the relationship between users from two directions of a social layer network dimension and a behavioral layer network dimension respectively, thereby improving the accuracy of user classification, thereby constructing a first similarity matrix of a social layer network dimension and a second similarity matrix of a behavioral layer network dimension, and dividing the users into groups based on the first similarity matrix of the social layer network dimension and the second similarity matrix of the behavioral layer network dimension to obtain a plurality of groups to be evaluated. Finally, by determining the suspicious value of each group to be evaluated, an abnormal group can be identified, and accurate user classification and group identification are achieved, thereby avoiding the technical problem of difficulty in identifying abnormal groups on the Internet in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is a flowchart of the first embodiment of the abnormal group identification method of the present invention;

[0050] Figure 2 It is a flow chart of the second embodiment of the abnormal group identification method of the present invention;

[0051] Figure 3 A schematic diagram of the social layer network and behavior layer network architecture of an embodiment of the abnormal group identification method of the present invention;

[0052] Figure 4 It is a flow chart of a third embodiment of the abnormal group identification method of the present invention;

[0053] Figure 5 It is a structural block diagram of the first embodiment of the abnormal group identification device of the present invention.

[0054] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0055] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0056] The embodiment of the present invention provides a method for identifying an abnormal group. Figure 1 , Figure 1 The figure is a flow chart of a first embodiment of an abnormal group identification method according to the present invention.

[0057] In this embodiment, the abnormal group identification method includes the following steps:

[0058] Step S10: Obtain blog post information of the user to be identified, and construct a user information set based on the blog post information.

[0059] In this embodiment, the executor of this embodiment is an abnormal group identification device, wherein the abnormal group identification device has functions such as data processing, data communication and program running. The abnormal group identification device can be a computer terminal device or other network device, and of course it can also be other devices with similar functions, and this embodiment does not limit this.

[0060] It should be noted that with the development of Internet technology, people can freely express their views and opinions on a certain event or platform on the Internet. Especially when shopping online, the evaluation of a platform or product greatly affects the interests of the platform and the product. Therefore, some user groups that place fake orders or maliciously post fake reviews have emerged. The inflammatory remarks made by such user groups will seriously affect the normal interests of the platform, but it is difficult to identify these groups in traditional Internet applications or technologies.

[0061] Based on this, this embodiment proposes an abnormal group identification method, which includes: obtaining blog information of the user to be identified, and constructing a user information set based on the blog information; constructing a first similarity matrix of the social layer network dimension and a second similarity matrix of the behavioral layer network dimension based on the user information set; dividing each user into groups based on the first similarity matrix and the second similarity matrix to obtain multiple groups to be evaluated; determining the suspicious value of each group to be evaluated, and identifying abnormal groups for each group to be evaluated based on the suspicious value, thereby dividing users of the social platform into groups, which solves the problem that abnormal groups cannot be identified in the prior art.

[0062] Specifically, the blog post information of the user to be identified may be a blog or article with evaluation, such as text, pictures, etc., posted by the user to be identified on a social platform.

[0063] Furthermore, the blog post information of the user to be identified is obtained, and a user information set is constructed according to the blog post information, including:

[0064] Get the blog post information of the user to be identified;

[0065] Screening the blog post information to obtain target blog post information;

[0066] A user information set is constructed according to the target blog post information.

[0067] The target blog information refers to non-repetitive user information. Since there may be a large amount of repeated information in the inflammatory speeches or comments released by abnormal groups, such as repeated orders and repeated comments, this embodiment removes these repeated blog information and retains only non-repetitive user information to form a user information set. Specifically, the public opinion information and blog information related to the platform are obtained on the social platform to obtain the blog set X = {x1,…,x m}, where x i represents the i-th blog post, extracting the non-repeated user information from it to form the user set U = {u1,…,u n}, where u i represents the i-th user.

[0068] Step S20: constructing a first similarity matrix of a social layer network dimension and a second similarity matrix of a behavioral layer network dimension respectively according to the user information set.

[0069] It should be understood that the purpose of constructing the first similarity matrix of the social layer network dimension is to improve the accuracy of user group division based on the social relationships of each user. In actual practice, some malicious order-brushing groups often follow or contact each other. Therefore, the first similarity matrix of the social layer network dimension can be constructed based on the user information set to improve the accuracy of subsequent group division and group anomaly analysis.

[0070] Similarly, the purpose of constructing the second similarity matrix of the behavioral layer network dimension is to improve the accuracy of user group division based on the behavioral relationships of each user. In actual practice, there may be some users who follow and contact each other, but they will not forward the blog posts of malicious order-brushing groups, and therefore cannot be classified as a member of the malicious group. Therefore, the second similarity matrix of the behavioral layer network dimension can be constructed based on the user information set to reduce the error in dividing user groups due to the social layer network dimension.

[0071] Specifically, constructing a social network dimension based on the user set U means constructing a social network A with the users in the set U as nodes. Let i and j be nodes in A respectively. If i follows j, then a ij =1, otherwise a ij =0.

[0072] The construction of the behavioral layer network dimension refers to constructing the behavioral layer network B with users in the set U as nodes. Let i and j be nodes in B. If there are k blog posts published by j in the set X, and i has forwarded these k blog posts t times, then b ij =t.

[0073] Step S30: Divide each user into groups according to the first similarity matrix and the second similarity matrix to obtain a plurality of groups to be evaluated.

[0074] It should be noted that the process of grouping each user is to divide the similarity of each user from the social layer network dimension and the behavioral layer network dimension, that is, to divide users with higher similarity into one category, thereby forming multiple groups to be evaluated, so as to improve the efficiency of identification when new users join abnormal groups later.

[0075] Step S40: respectively determining the suspicious value of each group to be evaluated, and identifying abnormal groups for each group to be evaluated according to the suspicious value.

[0076] In the specific implementation, the suspicious value of the group to be evaluated refers to the closeness of the relationship between the groups in the social layer network dimension and the closeness of the communication in the behavioral layer network dimension, where the closeness of the relationship between the groups in the social layer network dimension refers to the network density between the groups. Specifically, the calculation formula of the network density between the groups is as follows:

[0077]

[0078] Where s is the number of edges in the social layer network between groups, and n is the number of nodes in the social layer network.

[0079] At the behavioral level, the ratio of the sum of the weights of the network edges between groups to the number of possible edges represents the closeness of communication between them. The calculation formula is as follows:

[0080]

[0081] Among them, i and j are nodes in the network G, s ij is the weight of the edge between node i and node j (if there is no edge between them, it is 0), and n is the total number of nodes in G.

[0082] The social closeness set is obtained based on the closeness of the relationship between the social layer network dimension and the closeness of the communication between the behavioral layer network dimension. and behavior closeness set After standardizing the two sets, we can add them together to get the suspicious value V = {v1,…,v t}.

[0083] After sorting the groups from large to small according to the suspicious value, calculate the percentage reduction of the suspicious value between two adjacent groups from front to back. After the difference exceeds the set threshold T, stop traversing and output the group before the value appears as an abnormal group, that is, the abnormal group is the group whose adjacent difference exceeds a certain threshold.

[0084] This embodiment constructs a user information set through the blog information of the user to be identified, and analyzes the relationship between users from two directions: the social layer network dimension and the behavioral layer network dimension, so as to improve the accuracy of user classification, thereby constructing a first similarity matrix of the social layer network dimension and a second similarity matrix of the behavioral layer network dimension, and dividing the users into groups based on the first similarity matrix of the social layer network dimension and the second similarity matrix of the behavioral layer network dimension to obtain multiple groups to be evaluated, and finally by determining the suspicious value of each group to be evaluated, it is possible to identify abnormal groups, achieve accurate user classification and group identification, and avoid the technical problem in the prior art that it is difficult to identify abnormal groups on the Internet.

[0085] refer to Figure 2 , Figure 2 It is a flow chart of a second embodiment of an abnormal group identification method of the present invention.

[0086] Based on the first embodiment, the abnormal group identification method of this embodiment includes, in step S20:

[0087] Step S201: extracting the attention relationship, blog post forwarding relationship and blog post forwarding times between the users in the user information set.

[0088] Step S202: constructing a social layer network adjacency matrix based on the attention relationship between users.

[0089] Step S203: constructing a behavior layer network adjacency matrix based on the blog post forwarding relationship and the number of blog post forwardings between users.

[0090] Step S204: determining the social similarity between users according to the social layer network adjacency matrix, and generating a first similarity matrix of the social layer network dimension according to the social similarity.

[0091] Step S205: determining the behavior similarity between users according to the behavior layer network adjacency matrix, and generating a second similarity matrix of the behavior layer network dimension according to the behavior similarity.

[0092] It should be noted that the following relationship between users can be an association relationship between user accounts. There are three types of following relationships. Taking the social platform as an example, if user A follows user B, and user B also follows user A, then the following relationship between user A and user B is mutual following; if user A follows user B, and user B does not follow user A, then the following relationship between user A and user B is A following B; if user A does not follow user B, and user B follows user A, then the following relationship between user A and user B is B following A.

[0093] In the specific implementation, refer to Figure 3The social layer network adjacency matrix refers to the construction of a social layer directed unweighted network A based on the attention between users, which is expressed as a social layer network adjacency matrix. The behavior layer directed weighted network B is constructed based on the forwarding relationship and forwarding times between user blog posts, which is expressed as a behavior layer network adjacency matrix. Specifically:

[0094]

[0095] Among them, a ii =0,a ij (i≠j) represents user u i Follow user u j If so, a ij =1, otherwise, a ij =0, b ii =0, b ij (i≠j) represents user u i For user u j The number of shares for all blog posts published.

[0096] The first similarity matrix refers to the social layer similarity matrix, and the second similarity matrix refers to the behavioral layer similarity matrix.

[0097] The specific process of constructing the social layer similarity matrix and the behavioral layer similarity matrix is ​​to calculate the social similarity and behavioral similarity between any two users based on the connection closeness and behavioral overlap between users, and obtain the social layer similarity matrix S A and the behavior layer similarity matrix S B , of the following form:

[0098]

[0099] in, For user u i With user u j Similarity at the social level, For user u i With user u j Similarity at the behavioral level.

[0100] Furthermore, determining the social similarity between users according to the social layer network adjacency matrix, and generating a first similarity matrix of the social layer network dimension according to the social similarity, includes:

[0101] Determine a set of social dimension neighbor nodes of each node in the social layer network adjacency matrix;

[0102] Determine the intersection of neighbor node sets and the union of neighbor node sets on the social dimension according to the neighbor node sets of each node;

[0103] Calculate the social similarity between nodes according to the intersection of neighbor node sets and the union of neighbor node sets on the social dimension;

[0104] A first similarity matrix of the social layer network dimension is constructed according to the social similarity.

[0105] Specifically, the process of constructing the social layer user similarity matrix is ​​as follows: let i and k be nodes in social network A. If a ik ≠0 or a ki ≠0, then add k to i’s neighbor node set N. i , similarly obtain the neighbor node set N of j j , for any i,j∈A, calculate its similarity Get the similarity matrix S A , the similarity between nodes i and j is defined as the ratio of the intersection and union of their neighbor sets, and the calculation formula is as follows:

[0106]

[0107] Among them, N i Refers to the set of neighbor nodes of node i, N j Refers to the set of neighbor nodes of node j.

[0108] Furthermore, determining the behavior similarity between users according to the behavior layer network adjacency matrix, and generating a second similarity matrix of the behavior layer network dimension according to the behavior similarity, includes:

[0109] Determine a set of neighbor nodes in the behavior dimension of each node in the behavior layer network adjacency matrix;

[0110] Determine the intersection of neighbor node sets and the union of neighbor node sets on the behavior dimension according to the neighbor node sets of each node;

[0111] Determine the intersection weight of the node connection edges of the intersection of the neighbor node sets of each node on the behavior dimension and the union weight within the union of the neighbor node sets;

[0112] Calculate the behavior similarity between nodes according to the intersection weight and the union weight;

[0113] A second similarity matrix of the behavior layer network dimension is constructed according to the behavior similarities.

[0114] In the specific implementation, the process of constructing the user similarity matrix at the behavior layer is as follows: let i and j be nodes in the behavior network B, N i and N j are the neighbor node sets of nodes i and j respectively, and the intersection of the two is denoted as I = N i ∩N j , the union of the two is U=Ni ∪N j , the similarity between nodes i and j is defined as the sum of the weights of the edges connecting i and j with the nodes in I divided by the sum of the weights of the edges connecting i and j with the nodes in U, and the calculation formula is as follows:

[0115]

[0116] For any i,j∈B, calculate its similarity Get the similarity matrix S B .

[0117] Among them, i and j are nodes in the behavior network B, I is the intersection of the neighbor node set of node i and the neighbor node set of node j in the behavior network B, p is a node in the intersection set I, and a ip is the weight of the edge from node i to node p in the behavior network B, a pi is the weight of the edge from node p to node i in the behavior network B, b jp is the weight of the edge from node j to node p in the behavior network B, b pj is the weight of the edge from node p to node j in the behavior network B, U is the union of the neighbor node set of node i and the neighbor node set of node j in the behavior network B, q is the node in the union set, a iq is the weight of the edge from node i to node q in the behavior network B, a qi is the weight of the edge from node q to node i in the behavior network B, b qj is the weight of the edge from node q to node j in the behavior network B, b jq is the weight of the edge from node j to node q in the behavior network B.

[0118] In this embodiment, a first similarity matrix of the social layer network dimension is constructed according to the attention relationship between users, and then a second similarity matrix of the behavioral layer network dimension is constructed according to the forwarding relationship between users. By calculating the similarity between users at the social layer and the behavioral layer respectively, a similarity matrix is ​​constructed, thereby improving the accuracy of user group division based on the social relationship of each user, reducing the error in dividing user groups due to the social layer network dimension, and improving the accuracy of subsequent group division.

[0119] refer to Figure 4 , Figure 4 It is a flow chart of a third embodiment of an abnormal group identification method of the present invention.

[0120] Based on the above second embodiment, the abnormal group identification method of this embodiment includes, in step S30:

[0121] Step S301: determine an initial user node in the behavior layer network adjacency matrix, and determine a target neighbor node in the social layer network adjacency matrix based on the initial user node, wherein the initial user node is a user node with the largest sum of weights of adjacent edges in the current social layer network adjacency matrix.

[0122] Step S302: generating an initial community according to the initial user node and the target neighbor node.

[0123] Step S303: determining a first neighbor node set in the first similarity matrix and a second neighbor node set in the second similarity matrix based on the initial community.

[0124] Step S304: determining a candidate user node having the greatest similarity to the initial community from the first neighbor node set and the second neighbor node set.

[0125] Step S305: updating the initial community according to the candidate user nodes, and constructing a plurality of groups to be evaluated.

[0126] It should be noted that, since the spread of events on social platforms is mainly based on forwarding behavior, abnormal groups need others to constantly forward their blog posts and constantly forward other people's blog posts to spread their influence. Therefore, this embodiment determines the initial user node from the behavior layer network adjacency matrix to improve the practicality of group division.

[0127] Specifically, when selecting the initial user node, the sum of the weights of the adjacent edges of each node in the behavior layer network adjacency matrix can be calculated, and the node with the largest value can be selected as the initial node. If there are multiple nodes with the same maximum value, one can be selected from them. The initial node is recorded as c B In addition, since most of the abnormal groups will choose to follow each other in order to quickly transfer and spread messages, we consider selecting nodes from the social layer network to construct the initial group. Let the node corresponding to the initial user node in the social layer be c A , select c A The neighbor nodes of c A The node with the greatest similarity to c A Constitute the initial community C.

[0128] It is understandable that after the initial community is determined, the first neighbor node set in the first similarity matrix and the second neighbor node set in the second similarity matrix are determined based on the initial community, so that the social relationships and behavioral similarities and overlaps between groups can be comprehensively considered to improve the accuracy of group division.

[0129] Furthermore, determining the candidate user node having the greatest similarity to the initial community from the first neighbor node set and the second neighbor node set includes:

[0130] Determine a total similarity set of first neighbor nodes of each node in the first neighbor node set and each node in the initial community;

[0131] Determine a total similarity set of second neighbor nodes of each node in the second neighbor node set and each node in the initial community;

[0132] Generate a total similarity set according to the first neighbor node total similarity set and the second neighbor node total similarity set;

[0133] The user node with the greatest similarity in the total similarity set is determined as a candidate node.

[0134] Specifically, in the social layer, the set of neighbor nodes of the initial community C is Calculate the sum of similarities between each neighbor node and the nodes in C respectively Get the total similarity set of neighbor nodes Similarly, in the behavior layer, the total similarity set of neighbor nodes is obtained

[0135] Furthermore, there may be differences in the dimensions of the social layer network dimension and the behavioral layer network dimension. For example, the number of followers of a user may be much smaller than the number of his forwarded blog posts. In the actual similarity calculation process, this will affect the result of the final similarity calculation. Therefore, in this embodiment, before generating the total similarity set according to the first neighbor node total similarity set and the second neighbor node total similarity set, the following is also included:

[0136] Performing normalization processing on the total similarity set of the first neighboring nodes and the total similarity set of the second neighboring nodes;

[0137] Accordingly, generating a total similarity set according to the first neighbor node total similarity set and the second neighbor node total similarity set includes:

[0138] A total similarity set is generated from the standardized first neighbor node total similarity set and the second neighbor node total similarity set.

[0139] Specifically, the normalization process of the first neighbor node total similarity set and the second neighbor node total similarity set may be performed using the following formula:

[0140]

[0141] Among them, x i is an element in the set, x i ′ is the element after normalization, and n is the total number of elements in the set. The normalized total similarity set of the first neighbor nodes in the social layer is obtained and the total similarity set of the second neighbor nodes in the behavior layer Add the two together to get the final total similarity set. The calculation formula is as follows:

[0142]

[0143] Among them, ss i is the total similarity between the ith node in the final determined neighbor node set and the nodes in community C, for An element in for In the corresponding position elements, w1 and w2 are the weighted proportions of the standardized total similarity set of the first neighbor node in the social layer and the total similarity set of the second neighbor node in the behavioral layer, w1+w2=1, w1,w2∈[0,1].

[0144] If a node is a neighbor node of the initial community C in the social layer but not in the behavioral layer, then w1=1; Similarly, if it is a neighbor node of the initial community C in the behavioral layer but not in the social layer, then w2=1.

[0145] Further, updating the initial community according to the candidate user node includes:

[0146] Determining a first modularity of the initial community and a second modularity of the updated initial community;

[0147] When the first modularity is less than the second modularity, a step of updating the initial community according to the candidate user nodes is performed.

[0148] In the specific implementation, the user node with the largest similarity in the total similarity set is selected as the candidate node and added to the candidate set. Before that, in order to reduce the error of group division, it can be calculated whether adding the node in the candidate set to the community will reduce the modularity of the divided group community. If so, the node will not be included in the community, otherwise it will be added to community C. The calculation formula of multi-layer modularity is as follows:

[0149]

[0150] Where μ is the number of connections in the multilayer network, γ is the resolution parameter, and A ijα is the connection weight between nodes i and j in the adjacency matrix of the αth layer network, δ αβ =1 means that the αth layer and the βth layer are the same layer, otherwise δ αβ =0,δ ij =1 means nodes i and j are nodes in the same layer, otherwise δ ij =0, Cjαβ is the number of inter-layer edges between the αth layer and the βth layer and node j, k iα =∑ i A ijα , m α =∑ i k iα ,δ(g iα ,g iβ )=1 means the community distribution of nodes i and j is the same, otherwise it is 0.

[0151] If the modularity of the initial community is smaller than the community group after adding the candidate user node, the nodes in the candidate set that can join community C can be merged into C, and all nodes in C can be deleted in the social layer and network layer to avoid duplicate users in each group and affect the final group evaluation. The groups are continuously divided until all social layer network dimensions and behavioral layer network dimensions are empty sets.

[0152] This embodiment divides the initial community, and determines the first neighbor node set in the first similarity matrix and the second neighbor node set in the second similarity matrix based on the initial community; determines the candidate user node with the greatest similarity to the initial community from the first neighbor node set and the second neighbor node set, thereby realizing the classification of user nodes, realizing the group division of user nodes, and comprehensively performing group division from the social layer network dimension and the behavior layer network dimension, thereby improving the accuracy of group division.

[0153] In addition, an embodiment of the present invention further provides a storage medium, on which an abnormal group identification program is stored. When the abnormal group identification program is executed by a processor, the steps of the abnormal group identification method described above are implemented.

[0154] Reference Figure 5 , Figure 5 It is a structural block diagram of the first embodiment of the abnormal group identification device of the present invention.

[0155] like Figure 5 As shown, the abnormal group identification device proposed in the embodiment of the present invention includes:

[0156] The acquisition module 10 is used to acquire blog post information on the social platform and construct a user information set based on the blog post information.

[0157] The construction module 20 is used to construct a first similarity matrix of a social layer dimension and a second similarity matrix of a behavioral layer dimension according to the user information set.

[0158] The division module 30 is used to divide each user into groups according to the first similarity matrix and the second similarity matrix to obtain a plurality of groups to be evaluated.

[0159] The identification module 40 is used to determine the suspicious value of each group to be evaluated respectively, and identify abnormal groups for each group to be evaluated according to the suspicious value.

[0160] This embodiment constructs a user information set through the blog information of the user to be identified, and analyzes the relationship between users from two directions: the social layer network dimension and the behavioral layer network dimension, so as to improve the accuracy of user classification, thereby constructing a first similarity matrix of the social layer network dimension and a second similarity matrix of the behavioral layer network dimension, and dividing the users into groups based on the first similarity matrix of the social layer network dimension and the second similarity matrix of the behavioral layer network dimension to obtain multiple groups to be evaluated, and finally by determining the suspicious value of each group to be evaluated, it is possible to identify abnormal groups, achieve accurate user classification and group identification, and avoid the technical problem in the prior art that it is difficult to identify abnormal groups on the Internet.

[0161] In some embodiments, the construction module 20 is also used to extract the attention relationship, blog forwarding relationship and blog forwarding times between each user in the user information set; construct a social layer network adjacency matrix based on the attention relationship between each user; construct a behavior layer network adjacency matrix based on the blog forwarding relationship and blog forwarding times between each user; determine the social similarity between each user according to the social layer network adjacency matrix, and generate a first similarity matrix of the social layer dimension according to the social similarity; determine the behavioral similarity between each user according to the behavioral layer network adjacency matrix, and generate a second similarity matrix of the behavioral layer dimension according to the behavioral similarity.

[0162] In some embodiments, the construction module 20 is also used to determine the social dimension neighbor node set of each node in the social layer network adjacency matrix; determine the intersection of the neighbor node set and the union of the neighbor node set on the social dimension based on the neighbor node set of each node; calculate the social similarity between each node based on the intersection of the neighbor node set and the union of the neighbor node set on the social dimension; and construct a first similarity matrix of the social layer dimension based on the social similarity.

[0163] In some embodiments, the construction module 20 is also used to determine the neighbor node set of the behavior dimension of each node in the behavior layer network adjacency matrix; determine the intersection of the neighbor node set and the union of the neighbor node set on the behavior dimension based on the neighbor node set of each node; determine the intersection weight of the node connection edges of the intersection of the neighbor node set of each node on the behavior dimension and the union weight within the union of the neighbor node sets; calculate the behavior similarity between each node based on the intersection weight and the union weight; and construct a second similarity matrix of the behavior layer dimension based on the behavior similarity.

[0164] In some embodiments, the partitioning module 30 is also used to determine an initial user node in a social layer network adjacency matrix, and determine a target neighbor node in the social layer network adjacency matrix based on the initial user node, wherein the initial user node is a user node with the largest sum of weights of adjacent edges in the current social layer network adjacency matrix; generate an initial community based on the initial user node and the target neighbor node; determine a first neighbor node set in the first similarity matrix and a second neighbor node set in the second similarity matrix based on the initial community; determine a candidate user node with the greatest similarity to the initial community from the first neighbor node set and the second neighbor node set; update the initial community based on the candidate user node, and construct multiple groups to be evaluated.

[0165] In some embodiments, the partitioning module 30 is also used to determine a total similarity set of first neighbor nodes between each node in the first neighbor node set and each node in the initial community; determine a total similarity set of second neighbor nodes between each node in the second neighbor node set and each node in the initial community; generate a total similarity set based on the total similarity set of the first neighbor nodes and the total similarity set of the second neighbor nodes; and determine a user node with the greatest similarity in the total similarity set as a candidate node.

[0166] In some embodiments, the partitioning module 30 is further used to determine a first modularity of the initial community and a second modularity of the updated initial community; when the first modularity is less than the second modularity, the step of updating the initial community according to the candidate user node is performed.

[0167] An embodiment of the present application also provides an abnormal group identification device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus, and the memory is used to store computer programs; the processor is used to implement the above-mentioned abnormal group identification method when executing the program stored in the memory.

[0168] The communication bus mentioned in the abnormal group identification device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0169] The communication interface is used for communication between the abnormal group identification device and other devices.

[0170] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0171] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, and discrete hardware components.

[0172] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0173] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0174] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0175] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0176] It should be understood that the above is only an example and does not constitute any limitation on the technical solution of the present invention. In specific applications, technicians in this field can make settings as needed, and the present invention does not limit this.

[0177] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of them according to actual needs to achieve the purpose of the present embodiment, and no limitation is made here.

[0178] In addition, for technical details not fully described in this embodiment, reference can be made to the abnormal group identification method provided in any embodiment of the present invention, and will not be repeated here.

[0179] In addition, it should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0180] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0181] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory (ROM) / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0182] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0183] It is understandable that the system provided by the embodiment of the present invention corresponds to the method provided by the embodiment of the present invention, and the explanation, examples and beneficial effects of the relevant contents can refer to the corresponding parts in the above method.

Claims

1. A method for identifying abnormal groups, characterized in that: The abnormal group identification method comprises: Obtaining blog post information of the user to be identified, and constructing a user information set based on the blog post information; Constructing a first similarity matrix of a social layer network dimension and a second similarity matrix of a behavioral layer network dimension respectively according to the user information set; Dividing each user into groups according to the first similarity matrix and the second similarity matrix to obtain a plurality of groups to be evaluated; The suspicious value of each group to be evaluated is determined respectively, and abnormal groups are identified for each group to be evaluated according to the suspicious value.

2. The method according to claim 1, characterized in that The step of constructing a first similarity matrix of a social layer network dimension and a second similarity matrix of a behavioral layer network dimension respectively according to the user information set includes: Extracting the following relationship, blog post forwarding relationship and blog post forwarding times between users in the user information set; Construct a social layer network adjacency matrix based on the attention relationship between users; Construct a behavior layer network adjacency matrix based on the blog post forwarding relationship and blog post forwarding times between users; Determine the social similarity between users according to the social layer network adjacency matrix, and generate a first similarity matrix of the social layer network dimension according to the social similarity; The behavior similarities between the users are determined according to the behavior layer network adjacency matrix, and a second similarity matrix of the behavior layer network dimension is generated according to the behavior similarities.

3. The method according to claim 2, characterized in that The step of determining the social similarity between users according to the social layer network adjacency matrix and generating a first similarity matrix of the social layer network dimension according to the social similarity includes: Determine a set of social dimension neighbor nodes of each node in the social layer network adjacency matrix; Determine the intersection of neighbor node sets and the union of neighbor node sets on the social dimension according to the neighbor node sets of each node; Calculate the social similarity between nodes according to the intersection of neighbor node sets and the union of neighbor node sets on the social dimension; A first similarity matrix of the social layer network dimension is constructed according to the social similarity.

4. The method according to claim 2, characterized in that Determining the behavior similarity between users according to the behavior layer network adjacency matrix, and generating a second similarity matrix of the behavior layer network dimension according to the behavior similarity, includes: Determine a set of neighbor nodes in the behavior dimension of each node in the behavior layer network adjacency matrix; Determine the intersection of neighbor node sets and the union of neighbor node sets on the behavior dimension according to the neighbor node sets of each node; Determine the intersection weight of the node connection edges of the intersection of the neighbor node sets of each node on the behavior dimension and the union weight within the union of the neighbor node sets; Calculate the behavior similarity between nodes according to the intersection weight and the union weight; A second similarity matrix of the behavior layer network dimension is constructed according to the behavior similarities.

5. The method according to claim 1, characterized in that The step of dividing each user into groups according to the first similarity matrix and the second similarity matrix to obtain a plurality of groups to be evaluated includes: Determine an initial user node in the behavior layer network adjacency matrix, and determine a target neighbor node in the social layer network adjacency matrix according to the initial user node, wherein the initial user node is a user node having the largest sum of weights of adjacent edges in the current social layer network adjacency matrix; Generate an initial community according to the initial user node and the target neighbor node; Determine a first neighbor node set in the first similarity matrix and a second neighbor node set in the second similarity matrix based on the initial community; Determine a candidate user node having the greatest similarity to the initial community from the first neighbor node set and the second neighbor node set; The initial community is updated according to the candidate user nodes to construct a plurality of groups to be evaluated.

6. The method according to claim 5, characterized in that The determining, from the first neighbor node set and the second neighbor node set, a candidate user node having the greatest similarity to the initial community includes: Determine a total similarity set of first neighbor nodes of each node in the first neighbor node set and each node in the initial community; Determine a total similarity set of second neighbor nodes of each node in the second neighbor node set and each node in the initial community; Generate a total similarity set according to the first neighbor node total similarity set and the second neighbor node total similarity set; The user node with the greatest similarity in the total similarity set is determined as a candidate node.

7. The method according to claim 5, characterized in that The updating of the initial community according to the candidate user node comprises: Determining a first modularity of the initial community and a second modularity of the updated initial community; When the first modularity is less than the second modularity, a step of updating the initial community according to the candidate user nodes is performed.

8. An abnormal group identification device, characterized in that: The abnormal group identification device comprises: An acquisition module, used to acquire blog post information of a user to be identified, and construct a user information set based on the blog post information; A construction module, used to construct a first similarity matrix of a social layer network dimension and a second similarity matrix of a behavioral layer network dimension respectively according to the user information set; A division module, used for dividing each user into groups according to the first similarity matrix and the second similarity matrix to obtain a plurality of groups to be evaluated; The identification module is used to determine the suspicious value of each group to be evaluated respectively, and identify abnormal groups for each group to be evaluated according to the suspicious value.

9. An abnormal group identification device, characterized in that: The abnormal group identification device comprises: a memory, a processor, and an abnormal group identification program stored in the memory and executable on the processor, wherein the abnormal group identification program is configured to implement the steps of the abnormal group identification method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores an abnormal group identification program, and when the abnormal group identification program is executed by the processor, the steps of the abnormal group identification method according to any one of claims 1 to 7 are implemented.

Images