A method and system for detecting abnormal comment users based on cross-domain graph

Abstract

The present application discloses a method and system for detecting abnormal comment users based on a cross-domain graph, and relates to the field of graph anomaly detection. The method comprises: using a source graph feature encoder to encode the node attributes of user nodes in a source comment graph to obtain user node features of the source comment graph; training a multi-layer neural network based on the user node features of the source comment graph and the labels of the user nodes to obtain a common anomaly scoring model; determining the common features of user nodes in a target comment graph based on graph migration; determining the unique features of user nodes in a target comment graph based on graph decoupling; decoding the unique features of user nodes to obtain a unique feature reconstruction adjacency matrix; reconstructing the adjacency matrix based on the common features of user nodes and the unique features, and using the common anomaly scoring model to determine the abnormal user nodes of the target comment graph to complete the detection of abnormal comment users. The present application can improve the detection efficiency and accuracy of abnormal users in a target comment graph.

Description

Technical Field

[0001] The present application relates to the field of graph anomaly detection, and in particular to a method and system for detecting abnormal comment users based on a cross-domain graph. Background Art

[0002] In a comment graph consisting of multiple users (nodes) and relationships (edges) between users, abnormal comments often disrupt the normal discussion atmosphere and have a negative impact on the overall communication quality. Therefore, timely identifying these abnormal comment users in a complex comment network is of great significance for maintaining a healthy interactive environment and promoting effective discussions. For real-world abnormal comment detection systems, it is usually unrealistic to obtain rich labeled data for each field (it takes a lot of time and manpower costs). Therefore, some researchers have proposed using the source graph (domain comment graph data with known labels) to guide the model to identify abnormal users in the target graph (domain comment graph data with unknown labels) (such as using the comment graph data of the history course online learning platform with known labels to guide the model to detect abnormal comment users on the comment graph data of the science course online learning platform with unknown labels), that is, the cross-domain graph abnormal comment user detection method. However, the existing cross-domain graph abnormal comment user detection method still has some defects: only considering the difference in the attribute-level distribution of user nodes between the source comment graph and the target comment graph, ignoring the structural-level difference between the source comment graph and the target comment graph, which leads to the learned domain common knowledge being one-sided, and thus unable to better detect domain common anomalies on the target comment graph. In addition, existing models do not mine domain-specific knowledge in the target review graph, which makes the model unable to efficiently detect domain-specific anomalies in the target review graph. Summary of the invention

[0003] The purpose of this application is to provide a method and system for detecting abnormal comment users based on a cross-domain graph, which can improve the detection efficiency and accuracy of abnormal users in a target comment graph.

[0004] To achieve the above objectives, this application provides the following solutions.

[0005] In a first aspect, the present application provides a method for detecting abnormal comment users based on a cross-domain graph, comprising the following steps.

[0006] The source graph feature encoder is used to encode the node attributes of the user nodes in the source comment graph to obtain the user node features of the source comment graph.

[0007] A multi-layer neural network is trained based on the user node features of the source comment graph and the labels of the user nodes in the source comment graph to obtain a public anomaly scoring model.

[0008] Determine the common features of user nodes in the target review graph based on graph migration.

[0009] Determine user node-specific features of target review graph based on graph decoupling.

[0010] The user node-specific features are decoded to obtain a unique feature-reconstructed adjacency matrix.

[0011] Based on the common features of the user nodes, the unique feature reconstructed adjacency matrix and the common anomaly scoring model, the abnormal user nodes of the target comment graph are determined to complete the detection of abnormal comment users.

[0012] In the second aspect, the present application provides an abnormal comment user detection system based on a cross-domain graph, comprising the following modules.

[0013] The encoding module is used to encode the node attributes of the user nodes in the source comment graph using the source graph feature encoder to obtain the user node features of the source comment graph.

[0014] The model training module is used to train a multi-layer neural network based on the user node features of the source comment graph and the labels of the user nodes in the source comment graph to obtain a public anomaly scoring model.

[0015] A user node common feature determination module is used to determine the user node common features of a target comment graph based on graph migration.

[0016] The user node-specific feature determination module is used to determine the user node-specific features of the target comment graph based on graph decoupling.

[0017] The decoding module is used to decode the unique features of the user node to obtain a unique feature reconstructed adjacency matrix.

[0018] The abnormal user detection module is used to determine the abnormal user nodes of the target comment graph based on the common features of the user nodes, the unique feature reconstructed adjacency matrix and the common abnormal scoring model, and complete the detection of abnormal comment users.

[0019] According to the specific embodiments provided by the present application, the present application discloses the following technical effects: The present application provides a method and system for detecting abnormal comment users based on a cross-domain graph, which determines the common features of user nodes in a target comment graph based on graph migration, reduces the differences in user node-level distribution and structure-level differences between the source comment graph and the target comment graph, and learns more comprehensive domain public knowledge. On this basis, the user node-specific features of the target comment graph are determined based on graph decoupling, and the domain-specific knowledge of the target comment graph is learned. Finally, the unique feature-reconstructed adjacency matrix corresponding to the learned domain public knowledge (i.e., the common features of user nodes in the target comment graph) and the domain-specific knowledge (i.e., the unique features of user nodes in the target comment graph) will be used together to perform abnormal scoring on user nodes in the target comment graph, thereby realizing the detection of abnormal users. The present application detects abnormal users from both common anomalies and unique anomalies, which can improve the efficiency and accuracy of detecting abnormal users. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 A flowchart of a method for detecting abnormal comment users based on a cross-domain graph is provided for one embodiment of the present application.

[0022] Figure 2 A detailed flowchart of the abnormal user detection method for cross-domain graphs. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0024] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0025] In an exemplary embodiment, Figure 1-Figure 2As shown, a method for detecting abnormal comment users based on a cross-domain graph is provided. The method is executed by a computer device, and can be specifically executed by a computer device such as a terminal or a server alone, or by a terminal and a server together. In an embodiment of the present application, the method is applied to a server as an example for explanation, including the following steps S1 to S6.

[0026] S1: Use the source graph feature encoder to encode the node attributes of the user nodes in the source comment graph to obtain the user node features of the source comment graph.

[0027] The cross-domain review graph anomaly detection task aims to detect anomalies in the source review graph from labeled source review graphs. Extracting knowledge to guide the model in the unlabeled target review graph Anomaly detection is performed on and Represent the source comment graph and target review graph The user node set; and Represent the source comment graph The j-th user node and target comment graph The i-th user node of ; j=1,2,...,M, i=1,2,...,N; N represents the number of user nodes in the target comment graph, and M represents the number of user nodes in the source comment graph; Represents the source comment graph The edge set (relationships between user nodes) and the target comment graph The set of edges (relationships between user nodes); and Represent the source comment graph and target review graph The node attribute collection of and Represent the source comment graph The node attributes of the jth user node in and target review graph The i-th user node in Node attributes of Represents the source comment graph The label set of the user node, Represents the source comment graph The jth user node in In the target comment graph There are differences in behavior and source comment graph The abnormal comment users who are similar to the abnormal comment users of , are public abnormal users. Source Comments The data come from the comment fields of the history course online learning platform and the science course online learning platform, both of which contain some abnormal users who post comments unrelated to the course.

[0028] To detect the target review graph The public abnormal user nodes in the source comment graph are first Extract usable information from the source image. Using a source image feature encoder Encode the node attributes of the user nodes in the source comment graph and extract the corresponding user node features of the source comment graph , Represents the jth user node in the source comment graph Node features.

[0029] In order to meet the needs of large-scale graph data, this application uses GraphSage to implement the source graph feature encoder .

[0030] GraphSage achieves message aggregation by using the neighbors of user nodes. The k-th layer representation vector The general representation of the message passing mechanism can be expressed as follows.

[0031] (1)

[0032] in, represents the activation function, is the message passing aggregation coefficient matrix, It means about the user node The first-order neighbor aggregation function of , in particular, User Node The corresponding original node attributes This application adopts mean aggregation, as follows.

[0033] (2)

[0034] in, Represents a user node The first-order neighbors of .

[0035] S2: A multi-layer neural network is trained based on the user node features of the source comment graph and the labels of the user nodes in the source comment graph to obtain a common anomaly scoring model.

[0036] This application uses the user node features of the source comment graph The labels of the user nodes in the corresponding known source comment graph are used to train an MLP (Multilayer Perceptron) as a public anomaly scoring model. The model can output the anomaly score of each user node in the comment graph and ensure that the anomaly score of the abnormal user node is much larger than the anomaly score of the normal user node. Specifically, the present application maximizes the deviation loss To train this public anomaly scoring model, the formula can be described as follows.

[0037] (3)

[0038] in, Represents the jth user node in the source comment graph , a represents the minimum interval between the abnormal scores of normal user nodes and abnormal user nodes. Represents the jth user node in the source comment graph When the label , represents the jth user node in the source comment graph is an abnormal user node; otherwise, the user node is a normal user node. Is a normalization function based on Z-score.

[0039] (4)

[0040] in, Represents the jth user node in the source comment graph The anomaly score, and Represent the mean and standard deviation of the anomaly score, respectively. After training, the abnormal user nodes and normal user nodes in the source comment graph will be distinguished, and this public anomaly scoring model will be used to detect the abnormal user nodes in the target comment graph that are similar to those in the source comment graph, namely public anomalies.

[0041] S3: Determine the user node common features of the target comment graph based on graph migration. Specifically, it includes: S31: Use the target graph common feature encoder to encode the node attributes of the user nodes in the target comment graph to obtain the initial user node common features of the target comment graph; S32: Calculate the graph migration loss function based on the user node features and the initial user node common features; S33: Train the target graph common feature encoder based on the graph migration loss function; S34: Use the trained target graph common feature encoder to encode the node attributes of the user nodes in the target comment graph to obtain the user node common features of the target comment graph.

[0042] In order to detect abnormal users using a common anomaly scoring model on a target review graph, this application needs to mine domain common abnormal user knowledge shared with the source review graph on the target review graph.

[0043] This application uses a structurally homologous graph feature encoder Common feature encoder for similar target graphs (Still implemented using GraphSage), encode the node attributes of the user nodes in the target comment graph, and train the graph migration loss to make the learned user node common features Include as many user node features as possible from the source comment graph Similar knowledge, i.e. domain common abnormal user knowledge, Represents the i-th user node in the target comment graph Common features. Specifically, the present application achieves this goal through the designed graph migration. Different from the existing methods, they only learn common knowledge by narrowing the differences in user node feature levels and ignore the structural differences between the source comment graph and the target comment graph. The graph migration designed in the present application aligns the source comment graph and the target comment graph by simultaneously narrowing the user node-level distribution differences and structural-level differences between the source comment graph and the target comment graph, thereby driving the target graph common feature encoder to more effectively extract user node common features from the target comment graph. Graph migration mainly includes two parts: one is point migration, which is mainly used to narrow the user node-level distribution differences between the target comment graph and the source comment graph; the other is edge migration, which is mainly used to narrow the structural-level differences between the target comment graph and the source comment graph.

[0044] 1. Migration.

[0045] Point transfer is achieved by minimizing the user node features of the source review graph Initial user common node features of the target review graph The Wasserstein distance (optimal transmission distance) between the target comment graph and the source comment graph is used to achieve this, thereby reducing the difference in user node-level distribution between the target comment graph and the source comment graph. The Wasserstein distance is a mathematical distance whose size is defined as the minimum cost required to transform one distribution into two distributions, and is often used to measure the difference between two distributions. For computational feasibility, this application uses the Sinkhorn distance to estimate the Wasserstein distance, and defines the following point migration loss function.

[0046] (5)

[0047] in, represents the point migration loss function, Indicates that Migrate to All feasible spaces in Representing the common features of user nodes in the target review graph The probability measure vector of User node features representing the source comment graph The probability measure vector of represents the migration matrix, Represents the i-th user node in the target comment graph Migrate to the jth user node in the source comment graph The migration weight of =0, indicating no migration; Indicates that the i-th user node in the target comment graph Migrate to the jth user node in the source comment graph The cost required, cosine similarity, Euclidean distance and other common distances can be used to implement the cost. and Respectively represent the i-th user node in the target comment graph The common features of the j-th user node in the source comment graph Node features.

[0048] (B) Side migration.

[0049] Similarly, this application uses the Gromov-Wasserstein distance to achieve edge migration from the target comment graph to the source comment graph, thereby reducing the structural differences between the target comment graph and the source comment graph. The Gromov-Wasserstein distance does not directly measure the difference in user node distribution between the target comment graph and the source comment graph, but indirectly measures the migration cost from the target comment graph to the source comment graph through the similarity of the relationship (edge) between the user nodes in the graph. The specific edge migration loss function can be expressed as follows.

[0050] (6)

[0051] in, represents the edge migration loss function, Represents the kth user node in the target comment graph Migrate to the lth user node in the source comment graph The migration weight of represents the edge e in the target review graph ik To the edge e in the source comment graph jl The migration weight of and They represent the edge e in the target comment graph respectively. ikand edge e in the source comment graph jl , and Respectively represent the kth user node in the target comment graph The common features of the l-th user node in the source comment graph The node characteristics of Represents the migration cost between edges.

[0052] Combining the above two migration loss functions, the graph migration loss function is determined as follows.

[0053] (7)

[0054] In the above formula, represents the graph transfer loss function, D node represents the point migration loss, D edge represents the edge migration loss, and λ represents the balance factor between the point migration loss and the edge migration loss. By training the target graph common feature encoder Continuously shrinking , the differences in user node distribution and structure between the target comment graph and the source comment graph will become smaller and smaller, which will drive the trained target graph common feature encoder Learned user common node features Include as much domain common abnormal user knowledge as possible, and increase the compatibility between the previously trained common anomaly detection model and the user's common node features, so as to better detect common abnormal users in the target comment graph.

[0055] S4: Determine the user node-specific features of the target comment graph based on graph decoupling. Specifically, it includes: S41: Use a common feature decoder to decode the common features of the user nodes in the target comment graph to obtain the common feature reconstruction adjacency matrix; S42: Use a target comment graph-specific feature encoder to encode the node attributes of the user nodes in the target comment graph to obtain the initial user node-specific features of the target comment graph; S43: Use a specific feature decoder to decode the initial user node-specific features to obtain the specific feature reconstruction adjacency matrix; S44: Calculate the decoupling loss function based on the common feature reconstruction adjacency matrix and the specific feature reconstruction adjacency matrix; S45: Based on the initial user node-specific features, the specific feature encoder is used to encode the node attributes of the user nodes in the target comment graph to obtain the initial user node-specific features of the target comment graph; S46: Decode the initial user node-specific features using a specific feature decoder to obtain the specific feature reconstruction adjacency matrix; S47: Decode the initial user node-specific features using a specific feature decoder to obtain the specific feature reconstruction adjacency matrix; S48: Decode the initial user node-specific features using a specific feature decoder to obtain the specific feature reconstruction adjacency matrix; S49: Decode the initial user node-specific features using a specific feature decoder to obtain the specific feature reconstruction adjacency matrix; S50: Decode the initial user node-specific features using a specific feature decoder to obtain the specific feature reconstruction adjacency matrix; S51: Decode the initial user node-specific features using a specific feature decoder to obtain the specific feature reconstruction adjacency matrix; S52: Decode the initial user node-specific features using a specific feature decoder to obtain the specific feature reconstruction adjacency matrix; S53: Decode the initial user node-specific features using a specific feature decoder to obtain the specific feature reconstruction adjacency matrix; S54: Decouple the initial user node-specific features using a specific feature decoder to obtain the specific feature reconstruction adjacency matrix; S55: Decouple S46: Calculate the structure reconstruction loss function based on the original adjacency matrix of the target comment graph and the reconstructed adjacency matrix based on the specific features; S47: Determine the final loss function based on the decoupling loss function, the graph contrast learning loss function and the structure reconstruction loss function; S48: Train the target comment graph specific feature encoder based on the final loss function; S49: Use the trained target comment graph specific feature encoder to encode the node attributes of the user nodes in the target comment graph to obtain the user node specific features of the target comment graph.

[0056] The target comment graph not only contains common abnormal comment users with similar abnormal behaviors to those in the source comment graph, but also contains unique abnormal comment users that are not found in the source comment graph. Take the comment domain of the history course online learning platform as the source comment graph and the comment domain of the science course online learning platform as the target comment graph as an example. In the target comment graph, there are users who post misleading comments related to experimental operations or scientific tools, which do not exist in the comment domain of the history course online learning platform. In order to detect such unique abnormal comment users in the target comment graph, this application introduces a target graph-specific feature encoder (Still implemented using GraphSage) Re-encode the node attributes of the user nodes in the target comment graph, and train with graph decoupling loss to make the corresponding target comment graph user node-specific features As much as possible, only domain-specific abnormal user knowledge of the target review graph is included.

[0057] The diagram couple ensures that the common features of user nodes and the unique features of user nodes further deviate from each other semantically by magnifying the structural differences between the adjacency matrix reconstructed by common features and the adjacency matrix reconstructed by unique features, thereby ensuring Specifically, this application first uses a common feature decoder Common features of user nodes in the target comment graph Decode and obtain the common features to reconstruct the adjacency matrix Specifically, the present application is implemented using vector inner product.

[0058] (8)

[0059] in, It is represented by the Sigmoid function, which is mainly used to normalize the inner product, and T represents transposition. Similarly, this application sets a corresponding unique feature decoder for the unique features of the user node , using the unique feature decoder to decode the unique features of the initial user node (Using target image-specific feature encoder (Untrained) Encode the node attributes of the user node in the target comment graph) and decode it to obtain the initial unique feature reconstruction adjacency matrix .

[0060] (9)

[0061] Then, this application maximizes and The Euclidean distance between them is used to ensure the decoupling of cross-domain graph structures.

[0062] (10)

[0063] Specifically, when and When the distance between is less than the set margin value d, minimize Will continue to expand and The gap between and When the distance between them is greater than or equal to d, The value of is zero. Train to convergence, unique feature encoder The deeper domain-specific knowledge in the target comment graph will be learned, and the user node-specific features will be obtained .

[0064] However, using the above methods alone may result in user node-specific features Too much deviation from the common characteristics of user nodes , which leads to the unique characteristics of user nodes The original semantics of the target comment graph is lost. Therefore, this application introduces graph contrast learning to ensure that the unique feature encoder does not lose the semantics of the target comment graph during the training process. Graph contrast learning obtains more effective node representation by shortening the distance between the target node features and the positive sample node features and extending the distance between the target node features and the negative sample node features. The graph contrast learning in this application can be described as follows.

[0065] (11)

[0066] in, represents the graph contrastive learning loss function, S represents the number of target user nodes sampled each time in the target comment graph by graph contrastive learning, Indicates the sampled e-th target user node The transposed vector of the unique features of , T represents the transposed, Indicates the sampled e-th target user node The first-order neighbor set of The first-order neighbor user nodes of the sampled target user node are regarded as positive samples; The non-neighbor user nodes of the sampled target user node are regarded as negative samples; The plot shows the learned temperature coefficients. By minimizing In the process of decoupling the unique features of the target user node from the common features, attention is paid to the relationship between the neighboring user nodes and non-neighboring user nodes, thereby preventing the semantic information contained in the unique features of the user node from deviating significantly.

[0067] Then, the present application completes the detection of users with unique abnormal comments in the target comment graph through reconstruction loss. Reconstruction loss is common in unsupervised graph anomaly detection methods. The principle is that individual cases that are significantly different from most of the data cannot be well reconstructed, so nodes with large reconstruction errors are more likely to be considered abnormal nodes. The present application uses structural reconstruction loss to detect users with unique abnormal comments in the target comment graph. Specifically, the structural reconstruction loss can be described as follows.

[0068] (12)

[0069] in, represents the structure reconstruction loss function, Represents the original adjacency matrix of the target review graph; Represents the unique features to reconstruct the adjacency matrix. By minimizing , the target review graph will be restored as much as possible in structure.

[0070] By integrating the loss functions of each part, the final loss function of that part can be obtained.

[0071] (13)

[0072] in, represents the final loss function, , , are all hyperparameters used to control the impact of each loss. Once converged, the reconstruction error can be used to detect unique abnormal comment users on the target comment graph.

[0073] S5: Specific features of the user node Decode and obtain the unique feature to reconstruct the neighboring matrix .

[0074] S6: Based on the common features of the user nodes, the unique feature reconstructed adjacency matrix and the common abnormality scoring model, the abnormal user nodes of the target comment graph are determined to complete the detection of abnormal comment users. Specifically, the process includes steps S61 to S64.

[0075] S61: Inputting the user node common features into the common anomaly scoring model to obtain a common anomaly score.

[0076] In order to obtain the common features of user nodes in the stable target comment graph and user node-specific features of the target comment graph After that, this application will perform anomaly scoring for these two features respectively. First, this application uses the public anomaly scoring model to score the public features of user nodes. Specifically, for the user node in the target comment graph, its public anomaly score is calculated by the following formula.

[0077] (14)

[0078] in, Represents the i-th user node in the target comment graph The public anomaly score of Represents the i-th user node in the target comment graph common features.

[0079] S62: Calculate a unique anomaly score based on the unique feature reconstructed adjacency matrix and the original adjacency matrix of the target review graph.

[0080] This application uses reconstruction loss to calculate the i-th user node in the target comment graph The corresponding unique anomaly scores are as follows.

[0081] (15)

[0082] in, Represents the i-th user node in the target comment graph The unique anomaly score of Represents the i-th user node in the reconstructed adjacency matrix Adjacency relationships with other user nodes, Represents the i-th user node in the target comment graph Adjacency relationship with other user nodes.

[0083] In and Afterwards, this application combines the two. A simple scoring fusion method is and The direct weighted sum of .

[0084] However, since these two anomaly scores come from different distributions, directly weighting and summing them may lead to a pre-optimized result. In order to fairly reflect the characteristics of common anomalies and unique anomalies, this application performs Z-score normalization on the common anomaly scores and unique anomaly scores before weighted fusion. The normalization of the common anomaly scores can be expressed by formula (16).

[0085] (16)

[0086] in, Represents the i-th user node in the target comment graph The normalized common anomaly score, and They represent the mean and standard deviation of the common anomaly scores respectively. Similarly, the normalization of the unique anomaly scores can be expressed by formula (17).

[0087] (17)

[0088] in, Represents the i-th user node in the target comment graph Normalized unique anomaly score, denote the mean and standard deviation of the unique anomaly scores, respectively.

[0089] S63: Determine a final anomaly score based on the common anomaly score and the unique anomaly score.

[0090] Finally, this application uses weighted sum to calculate the i-th user node in the target comment graph The final anomaly score .

[0091] (18)

[0092] in, It is a hyperparameter that controls the proportion of common anomaly scores and unique anomaly scores.

[0093] S64: Determine an abnormal user node of the target review graph based on the abnormal score.

[0094] The feasibility of the abnormal comment user detection method based on cross-domain graph provided in this application is verified through a specific data set.

[0095] This embodiment involves a total of three public graph anomaly detection datasets from different domains, namely YelpHotel (HTL), YelpRes (RES), and YelpNYC (NYC). Among them, HTL is a dataset about Yelp accommodation industry reviews in the Chicago area, and RES and NYC are datasets of Yelp catering enterprise reviews in the Chicago and New York areas, respectively. In the above datasets, each user node represents a reviewer, and each edge means that two reviewers have commented on the same target. If a reviewer posts a fraudulent review, it is considered an abnormal user node. The specific information of the dataset is shown in Table 1. This embodiment uses the above three datasets to conduct a total of 6 cross-domain graph anomaly detection experiments, namely NYC→HTL, RES→HTL, HTL→RES, NYC→RES, RES→NYC, and HTL→NYC (A→B, A is the source review graph, B is the target review graph, with the help of the known labels of the source review graph A, the model is guided to perform anomaly detection on the target review graph B with unknown labels).

[0096] In order to objectively evaluate the performance of the method of this embodiment, in the above 6 experiments, the ratio of the training set and the test set is 8:2, and the test results of the 5 epoch model are selected. The performance indicators are AUC-ROC and AUC-PR. The larger the value of the two, the better the performance of the model. Among them, AUC-ROC is used to evaluate the classification performance of the model for positive and negative samples at different thresholds, while AUC-PR focuses on the classification of positive samples and is more suitable for unbalanced data sets.

[0097] Table 1

[0098]

[0099] The experimental results are shown in Table 2, where ACT is the best existing cross-domain graph anomaly detection model. The results show that the proposed method has improved both indicators compared with the best existing model ACT.

[0100] Table 2

[0101]

[0102] In summary, the abnormal comment user detection method based on cross-domain graph proposed in this application performs abnormal scoring on user nodes in the target comment graph by simultaneously utilizing common features and unique features, and finally detects abnormal user nodes in the target comment graph.

[0103] Based on the same inventive concept, the embodiment of the present application also provides a system for implementing the above-mentioned abnormal comment user detection method based on a cross-domain graph. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in one or more embodiments of the abnormal comment user detection system based on a cross-domain graph provided below can refer to the limitations of the abnormal comment user detection method based on a cross-domain graph above, and will not be repeated here.

[0104] In an exemplary embodiment, a cross-domain graph-based abnormal comment user detection system is provided, including the following modules.

[0105] The encoding module is used to encode the node attributes of the user nodes in the source comment graph using the source graph feature encoder to obtain the user node features of the source comment graph.

[0106] The model training module is used to train a multi-layer neural network based on the user node features of the source comment graph and the labels of the user nodes in the source comment graph to obtain a public anomaly scoring model.

[0107] A user node common feature determination module is used to determine the user node common features of a target comment graph based on graph migration.

[0108] The user node-specific feature determination module is used to determine the user node-specific features of the target comment graph based on graph decoupling.

[0109] The decoding module is used to decode the unique features of the user node to obtain a unique feature reconstructed adjacency matrix.

[0110] The abnormal user detection module is used to determine the abnormal user nodes of the target comment graph based on the common features of the user nodes, the unique feature reconstructed adjacency matrix and the common abnormal scoring model, and complete the detection of abnormal comment users.

[0111] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0112] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0113] The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0114] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0115] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A method for detecting abnormal comment users based on a cross-domain graph, characterized in that: include: The source graph feature encoder is used to encode the node attributes of the user nodes in the source comment graph to obtain the user node features of the source comment graph; Training a multi-layer neural network based on user node features of the source comment graph and labels of user nodes in the source comment graph to obtain a public anomaly scoring model; Determine the common features of user nodes in the target review graph based on graph migration; Specifically, it includes: using a target graph public feature encoder to encode the node attributes of the user nodes in the target comment graph to obtain the initial user node public features of the target comment graph; calculating the graph migration loss function based on the user node features and the initial user node public features; training the target graph public feature encoder based on the graph migration loss function; using the trained target graph public feature encoder to encode the node attributes of the user nodes in the target comment graph to obtain the user node public features of the target comment graph; Determine the user node-specific features of the target comment graph based on graph decoupling; specifically include: using a common feature decoder to decode the common features of the user nodes of the target comment graph to obtain a common feature reconstruction adjacency matrix; using a target graph-specific feature encoder to encode the node attributes of the user nodes in the target comment graph to obtain the initial user node-specific features of the target comment graph; using a specific feature decoder to decode the initial user node-specific features to obtain the initial specific feature reconstruction adjacency matrix; calculating the decoupling loss function based on the common feature reconstruction adjacency matrix and the initial specific feature reconstruction adjacency matrix; calculating the graph contrast learning loss function based on the initial user node-specific features; calculating the structure reconstruction loss function based on the original adjacency matrix of the target comment graph and the initial specific feature reconstruction adjacency matrix; determining the final loss function based on the decoupling loss function, the graph contrast learning loss function and the structure reconstruction loss function; training the target graph-specific feature encoder based on the final loss function; using the trained target graph-specific feature encoder to encode the node attributes of the user nodes in the target comment graph to obtain the user node-specific features of the target comment graph; Decoding the user node-specific features to obtain a unique feature-reconstructed adjacency matrix; Based on the common features of the user nodes, the adjacency matrix reconstructed by the unique features and the common anomaly scoring model, the abnormal user nodes of the target comment graph are determined to complete the detection of abnormal comment users; specifically comprising: inputting the common features of the user nodes into the common anomaly scoring model to obtain a common anomaly score; calculating a unique anomaly score based on the adjacency matrix reconstructed by the unique features and the original adjacency matrix of the target comment graph; determining a final anomaly score based on the common anomaly score and the unique anomaly score; and determining the abnormal user nodes of the target comment graph based on the anomaly score.

2. The abnormal comment user detection method based on cross-domain graph according to claim 1 is characterized in that: Calculating a graph migration loss function based on the user node features and the initial user node common features specifically includes: Calculate a point migration loss function based on an optimal transmission distance between the user node feature and the initial user node common feature; Determining edge similarity between the source comment graph and the target comment graph based on the user node feature and the initial user node common feature; Calculating an edge migration loss function based on the edge similarity; A graph migration loss function is determined based on the point migration loss function and the edge migration loss function.

3. The abnormal comment user detection method based on cross-domain graph according to claim 2 is characterized in that: The expression of the point migration loss function is: ； in, represents the point migration loss function, Indicates that Migrate to All feasible spaces in Representing the common features of user nodes in the target comment graph The probability measure vector of User node features representing the source comment graph The probability measure vector of represents the migration matrix, Represents the i-th user node in the target comment graph Migrate to the jth user node in the source comment graph The migration weight of and Respectively represent the i-th user node in the target comment graph The common features of the j-th user node in the source comment graph , N represents the number of user nodes in the target comment graph, M represents the number of user nodes in the source comment graph, Indicates that the i-th user node in the target comment graph Migrate to the jth user node in the source comment graph The cost required; The expression of the edge migration loss function is: ； in, represents the edge migration loss function, Represents the kth user node in the target comment graph Migrate to the lth user node in the source comment graph The migration weight of represents the edge e in the target review graph ik To the edge e in the source comment graph jl The migration weight of and They represent the edge e in the target comment graph respectively. ik and edge e in the source comment graph jl , and Respectively represent the kth user node in the target comment graph The common features of the l-th user node in the source comment graph The node characteristics of represents the migration cost between edges; The expression of the graph migration loss function is: ； in, represents the graph transfer loss function, D node represents the point migration loss, D edge represents the edge migration loss, and λ represents the balance factor between point migration loss and edge migration loss.

4. The abnormal comment user detection method based on cross-domain graph according to claim 1 is characterized in that: The expression of the decoupling loss function is: ； in, represents the decoupled loss function, represents the common feature reconstruction adjacency matrix, represents the initial unique feature reconstruction adjacency matrix, d represents the set margin value, Indicates the degree of difference between the common feature reconstruction matrix and the initial unique feature reconstruction matrix; The expression of the graph contrast learning loss function is: ； in, represents the graph contrastive learning loss function, S represents the number of target user nodes sampled each time in the target comment graph by graph contrastive learning, Indicates the sampled e-th target user node The transposed vector of the unique features of , T represents the transposed, Indicates the sampled e-th target user node The first-order neighbor set of The first-order neighbor user nodes of the sampled target user node are regarded as positive samples; The non-neighbor user nodes of the sampled target user node are regarded as negative samples; Representation graph comparison study temperature coefficient; The expression of the structure reconstruction loss function is: ； in, represents the structure reconstruction loss function, Represents the original adjacency matrix of the target review graph; Represents unique features to reconstruct the adjacency matrix; The expression of the final loss function is: ； in, represents the final loss function, , , are all hyperparameters.

5. The abnormal comment user detection method based on cross-domain graph according to claim 1 is characterized in that: Before determining a final anomaly score based on the common anomaly score and the specific anomaly score, the method further includes: The common anomaly score and the unique anomaly score are normalized.

6. The method for detecting abnormal comment users based on a cross-domain graph according to claim 5 is characterized in that: Using formula The common anomaly score is normalized; wherein, Represents the i-th user node in the target comment graph The normalized common anomaly score, Represents the i-th user node in the target comment graph The public anomaly score of and denote the mean and standard deviation of the common anomaly scores, respectively; Using formula The unique anomaly score is normalized; wherein, Represents the i-th user node in the target comment graph Normalized unique anomaly score, Represents the i-th user node in the target comment graph The unique anomaly score of denote the mean and standard deviation of the unique anomaly scores, respectively.

7. A cross-domain graph-based abnormal comment user detection system, characterized in that: include: An encoding module, used to encode the node attributes of the user nodes in the source comment graph using a source graph feature encoder to obtain the user node features of the source comment graph; A model training module, used for training a multi-layer neural network based on user node features of the source comment graph and labels of user nodes in the source comment graph to obtain a public anomaly scoring model; The user node common feature determination module is used to determine the user node common features of the target comment graph based on graph migration; specifically comprising: using a target graph common feature encoder to encode the node attributes of the user nodes in the target comment graph to obtain the initial user node common features of the target comment graph; calculating the graph migration loss function based on the user node features and the initial user node common features; training the target graph common feature encoder based on the graph migration loss function; using the trained target graph common feature encoder to encode the node attributes of the user nodes in the target comment graph to obtain the user node common features of the target comment graph; The user node-specific feature determination module is used to determine the user node-specific features of the target comment graph based on graph decoupling; specifically comprising: using a common feature decoder to decode the common features of the user nodes of the target comment graph to obtain a common feature reconstruction adjacency matrix; using a target graph-specific feature encoder to encode the node attributes of the user nodes in the target comment graph to obtain the initial user node-specific features of the target comment graph; using a specific feature decoder to decode the initial user node-specific features to obtain an initial specific feature reconstruction adjacency matrix; calculating a decoupling loss function based on the common feature reconstruction adjacency matrix and the initial specific feature reconstruction adjacency matrix; calculating a graph contrast learning loss function based on the initial user node-specific features; calculating a structure reconstruction loss function based on the original adjacency matrix of the target comment graph and the initial specific feature reconstruction adjacency matrix; determining a final loss function based on the decoupling loss function, the graph contrast learning loss function and the structure reconstruction loss function; training the target graph-specific feature encoder based on the final loss function; using the trained target graph-specific feature encoder to encode the node attributes of the user nodes in the target comment graph to obtain the user node-specific features of the target comment graph; A decoding module, used for decoding the unique features of the user node to obtain a unique feature reconstructed adjacency matrix; The abnormal user detection module is used to determine the abnormal user nodes of the target comment graph based on the common features of the user nodes, the adjacency matrix reconstructed by the unique features and the common anomaly scoring model, and complete the detection of abnormal comment users; specifically includes: inputting the common features of the user nodes into the common anomaly scoring model to obtain a common anomaly score; calculating the unique anomaly score based on the adjacency matrix reconstructed by the unique features and the original adjacency matrix of the target comment graph; determining the final anomaly score based on the common anomaly score and the unique anomaly score; and determining the abnormal user nodes of the target comment graph based on the anomaly score.

Images