Social network abnormal behavior detection method based on user behavior knowledge graph

Abstract

The invention discloses a social network abnormal behavior detection method based on a user behavior knowledge graph, and the method comprises the steps: integrating the user behavior data in a social network to form the user behavior knowledge graph, constructing a fourth-order tensor according to the user behavior knowledge graph, carrying out the tensor decomposition of the tensor of the user behavior knowledge graph, and obtaining the abnormal behavior of the social network. The method comprises the following steps of: constructing a behavior reconstruction model, calculating to obtain each behavior embedding vector, forming a training sample set by the behavior embedding vectors corresponding to normal user behaviors, training the constructed behavior reconstruction model, finally inputting the behavior embedding vector to be detected into the trained behavior reconstruction model, and comparing a reconstruction error with a threshold value to obtain an abnormal behavior detection result. According to the invention, the accuracy of abnormal behavior detection can be effectively improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of social network security, and more specifically, relates to a method for detecting abnormal behavior in a social network based on a user behavior knowledge graph. Background Art

[0002] Social networks provide services to users based on the Internet and have become an important part of people's daily lives. They provide an important platform for people to share, obtain and disseminate information. In recent years, with the rapid development of emerging technologies such as artificial intelligence and big data, network security risks have continued to generalize. Network behaviors such as theft of user privacy and property, and the spread of false information pose a threat to the personal safety of users, social harmony and stability, and may even threaten national or regional security. On the one hand, the timeliness and speed of social network services lead to the fact that the information disseminated in social networks can attract the attention of a large number of network users in a very short period of time. Under the catalysis of these characteristics, network hot events and public opinion events may occur, causing network security threats; on the other hand, abnormal users post spam and fraudulent information on social platforms, which infringes on citizens' network rights and has a serious impact on social network security. Therefore, how to accurately discover these multiple abnormal behaviors generated by users from massive online social information and how to perceive the hidden security threats are cyberspace security issues that need to be solved urgently.

[0003] In the past few years, researchers have proposed many methods for identifying abnormal behaviors in social networks, including rule-based matching algorithms, statistics-based algorithms, and machine learning-based algorithms. The rule-based method mainly analyzes the user's behavior patterns, activity content, social relationships and other information, and matches and compares them with pre-defined rules or behavior patterns to identify possible abnormal behaviors. For example, if a user makes an abnormal number of login attempts in a short period of time, it may involve account theft; or if a user posts too much similar content in a short period of time, it may be spam or abuse. However, this method is limited by the experience and knowledge of domain experts. For complex or new abnormal behavior patterns, the rules may not be flexible enough to capture unknown anomalies. The statistical-based method uses statistical methods to analyze data and detect anomalies by identifying patterns that are inconsistent with normal behavior. Common methods include 3σ criteria, box plots, and time series modeling. For example, the change of users' online activity over time can be analyzed. Abnormal behavior may be manifested as posting a large amount of content in a very short period of time or being abnormally active in a normally inactive event segment. This method is suitable for processing low-dimensional data, but in the face of complex abnormal behavior patterns, statistical methods are not flexible enough to capture the nonlinear relationship of user behavior, and the computational cost of statistical methods is high. The machine learning-based method automatically learns normal behavior patterns from a large amount of historical data through training models, and then identifies abnormal behaviors by comparing new data with the learned patterns. Compared with the first two detection methods, the machine learning-based detection algorithm can handle complex nonlinear relationships and is applicable to various types of abnormal patterns; at the same time, this method can adapt to new data and new abnormal patterns through training, and has a certain generalization ability for unknown anomalies. Therefore, the machine learning-based detection algorithm has become the mainstream direction in the field of anomaly detection research.

[0004] For the detection of abnormal behavior in social networks, the above three methods all face the challenges of information explosion and lack of available knowledge in social networks. At present, the complex and diverse data types and structures of network behaviors such as likes, comments, forwarding and following generated by a large number of social network users on social platforms make it difficult to obtain available user behavior knowledge; and the scale of user behavior data in social networks is huge, making it difficult to discover complex, diverse and highly hidden abnormal behaviors. In short, the key to abnormal behavior detection in social networks is to build an efficient user behavior knowledge system based on the large amount of unstructured data on the network, so as to accurately detect abnormal user behavior from massive social network information. Summary of the invention

[0005] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a social network abnormal behavior detection method based on user behavior knowledge graph, which constructs a user behavior knowledge graph based on social network user behavior data, extracts user behavior embedding vectors from the knowledge graph after tensoring it for abnormal behavior detection, thereby improving the accuracy of abnormal behavior detection.

[0006] In order to achieve the above-mentioned object of the invention, the method for detecting abnormal behavior in a social network based on a user behavior knowledge graph of the present invention comprises the following steps:

[0007] S1: Integrate user behavior data in social networks to form a user behavior knowledge graph. The specific method is:

[0008] S1.1: Collect user behavior data from social networks, including user-posted content, interaction records, social relationships, and profile information, and filter and annotate normal user behavior from user behavior data;

[0009] S1.2: Extract user behavior knowledge. The specific method is as follows:

[0010] Identify entities from the user behavior data obtained in step S1.1, including users, places, and events; extract social relationships between any two user entities; extract events from the user behavior data to obtain structured information of the events, including user entities, event entities, place entities, and behavior relationships involved in the events;

[0011] S1.3: Construct a user behavior knowledge graph. The specific method is as follows: Based on the entity objects identified in step S1.2 and the relationships between entity objects, each piece of user behavior knowledge is represented as a four-tuple {h, r, t, d}, where h and t represent the head entity and the tail entity respectively, r represents the relationship between two entities, and d represents time; the entities are used as nodes, the edges between user entities are generated based on the social relationship between the two user entities, and the edges between user entities and event entities or place entities are generated based on the behavior of the user entities, and the attribute of each edge is the time when the relationship is formed or the behavior is performed;

[0012] S2: The user behavior knowledge graph contains N entities, M relationships, and D time periods. A fourth-order tensor χ with dimensions of N×N×M×D is constructed to store user behavior knowledge, where the first dimension represents the head entity, the second dimension represents the tail entity, the third dimension represents the type of relationship between entities, and the fourth dimension represents the time when the relationship occurs; each quadruple in the user behavior knowledge graph is converted into an element in the tensor, and each element χ i×j×m×d Indicates whether there is a relationship type m between the head entity i and the tail entity j in the time period d. If the relationship exists, then the i×j×m×d =1, if it does not exist, then χ i×j×m×d=0, where i, j = 1, 2, ..., N, m = 1, 2, ..., M, d = 1, 2, ..., D;

[0013] S3: Perform tensor decomposition on the user behavior knowledge graph tensor χ to obtain the head entity matrix Tail Entity Matrix Relationship Matrix in represents the embedding vector of entity i in the head entity factor, represents the embedding vector of entity j in the tail entity factor, represents the embedding vector of relation m in the relation factor, represents the embedding vector of time d in the time factor, and K represents the rank of decomposition;

[0014] The behavior embedding vector x is calculated based on the tensor decomposition result using the following formula: i,j,m,d :

[0015]

[0016] in, Represents the concatenation operation of vectors;

[0017] S4: According to the normal user behaviors marked in step S1.1, the behavior embedding vectors corresponding to the normal user behaviors are selected from all the behavior embedding vectors to form a normal behavior training sample set;

[0018] S5: construct a behavior reconstruction model according to actual needs, whose input is the behavior embedding vector and output is the reconstructed behavior embedding vector, and then use the normal behavior training sample set obtained in step S4 to train the behavior reconstruction model;

[0019] S6: Input the embedding vector of the behavior to be detected in the social network into the behavior reconstruction model trained in step S5, calculate the reconstruction error between the reconstructed behavior embedding vector and the embedding vector of the behavior to be detected, and determine whether it is greater than a preset threshold α. If it is greater, the behavior corresponding to the embedding vector of the behavior to be detected is abnormal behavior, otherwise the behavior corresponding to the embedding vector of the behavior to be detected is normal behavior.

[0020] The present invention is a method for detecting abnormal behavior in a social network based on a user behavior knowledge graph. The user behavior data in the social network is integrated to form a user behavior knowledge graph. Then, a fourth-order tensor is constructed according to the user behavior knowledge graph. The user behavior knowledge graph tensor is tensor-decomposed and each behavior embedding vector is calculated. The behavior embedding vectors corresponding to normal user behaviors constitute a training sample set and the constructed behavior reconstruction model is trained. Finally, the behavior embedding vector to be detected is input into the trained behavior reconstruction model, and the abnormal behavior detection result is obtained by comparing the reconstruction error with the threshold.

[0021] The present invention has the following beneficial effects:

[0022] 1) The present invention integrates multiple information such as users, events, places, time, and relationships in social networks by constructing a user behavior knowledge graph to form a multi-level, dynamic knowledge structure. By identifying different entities and their relationships in social networks in a graph structure, complex user behaviors and social interaction patterns can be captured;

[0023] 2) Based on the knowledge system construction, the present invention further optimizes the processing and analysis of large-scale social network data by using tensor decomposition; by representing user behavior data as tensors for storage, the correlation between different dimensions is effectively captured, and the characteristic information of user behavior is retained;

[0024] 3) The present invention extracts core behavioral features through tensor decomposition, and the behavior reconstruction model can more accurately identify abnormal behaviors that are significantly different from the normal mode, which helps to timely discover possible abnormal behaviors and improve the security and credibility of the social network platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a flowchart of a specific implementation method of a method for detecting abnormal behavior in a social network based on a user behavior knowledge graph of the present invention;

[0026] Figure 2 It is a flow chart of constructing a user behavior knowledge graph in the present invention;

[0027] Figure 3 This is a schematic diagram of the BERT model architecture;

[0028] Figure 4 is a schematic diagram of the user behavior knowledge graph tensor in this embodiment;

[0029] Figure 5 This is an example diagram of the user behavior knowledge graph in this embodiment.

[0030] Figure 6 This is an example diagram of the user behavior knowledge graph tensor in this embodiment. DETAILED DESCRIPTION

[0031] The specific implementation of the present invention is described below in conjunction with the accompanying drawings so that those skilled in the art can better understand the present invention. It should be noted that in the following description, when the detailed description of known functions and designs may dilute the main content of the present invention, these descriptions will be omitted here.

[0032] Example

[0033] Figure 1This is a flowchart of a specific implementation of the method for detecting abnormal behavior in a social network based on a user behavior knowledge graph of the present invention. Figure 1 As shown, the specific steps of the social network abnormal behavior detection method based on the user behavior knowledge graph of the present invention include:

[0034] S101: Build a user behavior knowledge graph:

[0035] In order to better extract the characteristics of user behavior in social networks, the present invention first integrates the user behavior data in social networks, including behavior subjects, behavior types, behavior relationships and behavior time, to form a user behavior knowledge graph. In other words, the user behavior knowledge graph takes the registered users in the social network as the behavior subjects, and the behavior types of registered users mainly include content generation, interaction, social interaction and information consumption. The content generation refers to users posting posts, commenting on texts, pictures, etc.; interactive behavior refers to users liking, commenting on and sharing content generated by social networks; social behavior refers to users following other users, establishing friendships with them or communicating with other users through private messages; information consumption refers to users browsing information, watching or clicking on links.

[0036] Figure 2 This is a flow chart of constructing a user behavior knowledge graph in the present invention. Figure 2 As shown, the specific steps of constructing the user behavior knowledge graph in the present invention include:

[0037] S201: Acquire and pre-process user behavior data:

[0038] Collect user behavior data from social networks, including content posted by users, interaction records, social relationships, and profile information, and filter and annotate normal user behavior from the user behavior data.

[0039] In order to facilitate subsequent processing, it is usually necessary to pre-process the collected user behavior data. Since user behavior data involves multiple types of user behavior interactions and content, including text data such as posts and comments, interactive behaviors such as likes, shares, and follows, friend relationships in social networks, time and geographic information bound to user behavior data, and text information extracted from pictures and videos. In view of the characteristics of these data, the pre-processing method used in this embodiment includes deduplication, word segmentation, stop word removal, and data cleaning to improve the accuracy and efficiency of subsequent knowledge extraction. The specific steps include:

[0040] 1) Perform deduplication operations on crawled user behavior data. This operation is to remove duplicate messages, comments, and forwarded content generated during user interactions, thereby reducing redundant data and improving computing efficiency.

[0041] 2) Perform word segmentation on the deduplicated user behavior data. When analyzing user-generated content, since Chinese does not have spaces to separate words, word segmentation is needed to separate continuous characters into independent words. In particular, subsequent entity extraction and relationship extraction rely on correct word boundaries.

[0042] 3) Next, we remove stop words from the user behavior data after word segmentation. This operation can further improve the effectiveness of the text by removing words that frequently appear in user-generated content but contribute little to semantic analysis, and retaining words that are useful for knowledge extraction.

[0043] 4) Finally, social network user data may have missing values, invalid characters, and inconsistent formats. Therefore, data cleaning operations are performed on the data after removing stop words to fix coding errors, unify time formats, and complete or remove missing values ​​to ensure that the data can be correctly input into the subsequent analysis process and reduce noise and errors. By performing these preprocessing steps, user behavior data is converted into clean and structured information to ensure the effectiveness of subsequent knowledge extraction and analysis.

[0044] S202: User behavior knowledge extraction:

[0045] Next, we extract user behavior knowledge, that is, deduce and identify information related to user behavior from user behavior data, including entity recognition, relationship extraction, and event extraction. The specific method is as follows:

[0046] Entity objects are identified from the user behavior data obtained in step S201, including users, places and events. Relationships between any two user entities are extracted. Events are then extracted from the user behavior data to obtain structured information of the events, including user entities, event entities, place entities and behaviors involved in the events.

[0047] In this embodiment, the BERT (Bidirectional Encoder Representation from Transformers) model is used to extract knowledge of user behavior. BERT is a bidirectional pre-trained model based on Transformer, which captures contextual information in the input text through a multi-layer self-attention mechanism. Figure 3 This is a schematic diagram of the BERT model architecture. Figure 3 As shown, the BERT model includes an input layer, a Transformer encoder layer, and an output layer. Next, the BERT model will illustrate the implementation process of the tasks in the present invention.

[0048] 1) Entity extraction

[0049] In the present invention, the entity extraction task is to extract three types of entities, namely users, places and events in social networks from user behavior data.

[0050] The input of BERT is preprocessed text data, usually with a single Chinese character or word fragment (token) as the basic unit. The input of each sentence consists of three parts: word embedding (Token Embedding), segment embedding (Segment Embedding), and position embedding (Position Embedding). Token Embedding maps each token in a social network to a vector representation of a fixed dimension. For Chinese social network data, each Chinese character is treated as an independent token. Although social network texts are mostly short sentences, it is necessary to process multiple paragraphs of content in user conversations or posts. In this case, Segment Embedding helps the model distinguish different paragraphs or sentences, ensuring that the model can capture the contextual relationship of each sentence when two sentences are input. Since BERT is an unordered model, Position Embedding introduces the position information of each token in the sentence to capture the order of words in the sentence. In the specific input processing, the short text "I went to Beijing and visited the museum" is segmented into a token sequence <[CLS]`I``went``to``Beijing``[SEP]`visited``the``museum``[SEP]>, and the start and end positions of the sentence are marked by adding special tokens [CLS] and [SEP].

[0051] The core of BERT is a multi-layer stacked Transformer encoder, which encodes the semantic representation of each token through the interaction of multi-head self-attention mechanism and context information. In social network texts, entities may exist in the form of phrases, nicknames or abbreviations, and it is difficult to directly determine their categories with a single word fragment. BERT uses a multi-head self-attention mechanism to enable each word fragment to focus on multiple positions in the context at the same time, thereby accurately identifying entities. Through multi-layer stacked encoders, the representation of each word fragment is continuously updated in the short text to generate a high-dimensional vector representation that combines context information.

[0052] After being processed by multiple layers of encoders, the output layer generates a context-dependent representation for each word fragment. The entity recognition task in social networks uses the BIO annotation format (B-entity start, I-entity inside, O-non-entity), and the final output layer generates a probability distribution of entity labels for each token through a softmax function. For each input text sentence, BERT predicts a label for each word fragment, such as B-PRE (beginning of a person's name), I-LOC (inside a place name), or O (non-entity). In this way, BERT can accurately annotate entities in short texts on social networks.

[0053] 2) Relationship Extraction

[0054] BERT’s architecture in relation extraction tasks is similar to that of entity extraction, but it needs to combine multiple entities and their contexts to predict the relationship between them. This includes special tagging design at the input layer, context information aggregation of multi-layer Transformer encoders, and relation classification tasks at the output layer.

[0055] In relation extraction, the input text contains two or more entities. In order to clarify these entities, special tags are added at both ends of the entities to distinguish them. Through these tags, BERT can clearly distinguish the entities to be extracted and their context.

[0056] The encoding layer encodes two entities and their contexts through the self-attention mechanism. Due to the bidirectional encoding characteristics of BERT, each entity can not only pay attention to its own semantic information, but also to the other entity and the contextual information between the two. Each token generates three different vectors through the self-attention mechanism: query vector, key vector and value vector. These vectors are used to measure the relationship between the token and other tokens. The query vector represents the information that the token needs to pay attention to, the key vector represents the information contained in other tokens, and the key vector indicates how to use this information to update the representation of the token. For the sentence "Zhang San is on a business trip in Beijing", the self-attention mechanism will match the query vector of "Zhang San" with the key vector of "Beijing" to generate a weight value, which reflects the attention of "Zhang San" to "Beijing". The self-attention mechanism calculates the similarity between each word in the sentence and other words, thereby generating a context-related representation of each word, capturing the contextual information between them, and repeatedly updating the entity representation through multi-layer encoders to clarify the relationship between the two entities.

[0057] In the output layer, the BERT model uses a specific classification head to predict relationships. In this paper, the main types of relationships are belonging relationships, location relationships, and social relationships. The output layer generates probability distributions of different relationship categories for tokens through a softmax function, and the category with the highest probability is the predicted entity relationship.

[0058] 3) Event extraction

[0059] Event extraction identifies words that trigger specific events from text and extracts the participants, time, and place related to the event. Different from entity extraction, event extraction not only identifies entities, but also needs to infer the dynamic occurrence process of events from semantic and temporal relationships.

[0060] The first step of event extraction is to convert the event description sentence into an input form that BERT can process. As with entity extraction, the input is tokenized into subwords and wrapped with special tokens [CLS][SEP]. [CLS] in event extraction represents the global semantics of the entire event, and subsequent tokens are processed into the time, action, and participants of the sentence.

[0061] BERT's multi-layer Transformer structure can capture the complex dynamic relationship between event trigger words and their arguments (such as time, place, and participants) through the self-attention mechanism. The words that trigger events are usually verbs or words with action meanings. In the sentence "Zhang San posted a post in Beijing", the self-attention mechanism allows the model to recognize that "post" is an event trigger word, and at the same time, combined with contextual information, to determine the relevant information of the event. Then, through argument extraction, the entity or object related to the trigger word is found. In the same sentence, "Zhang San" can be identified as the initiator (participant) of the event, "Beijing" as the place where the event occurred, and "post" as the event object. This context understanding ability that relies on the self-attention mechanism enables BERT to accurately extract events and their arguments from social network texts, especially to deal with implicit information in short texts.

[0062] In the output layer, the BERT-encoded output is classified, the trigger words in the sentence are identified, and the event type of the entire sentence is classified. After identifying the event trigger words, the sequence labeling method is used to assign role labels to the event arguments—participants, time, and place. The representation of each word is further sent to the sequence labeling layer, and the boundaries of the arguments are identified through the BIO labeling method, and specific roles are assigned to them. Through the context modeling capabilities and multi-head self-attention mechanism of the BERT model, the event extraction task in social networks can accurately identify the event trigger words and their related participants, time, and location information from short texts.

[0063] S203: Build a user behavior knowledge graph:

[0064] The present invention constructs a user behavior knowledge graph based on user behavior data. By combining time and semantic relationships, the social network user behavior knowledge system can more comprehensively reflect the complex social behavior information in the social network. In the social user behavior knowledge graph, the head and tail entities represent users, places, events, etc., and the relationship is the association between two entities. Therefore, the specific method of generating the user behavior knowledge graph of the present invention is:

[0065] According to the entity objects identified in step S202 and the relationship between entity objects, each piece of user behavior knowledge is represented as a four-tuple form {h, r, t, d}, where h and t represent the head entity and the tail entity respectively, r represents the relationship between two entities, and d represents time. The entities are taken as nodes, the edges between user entities are generated according to the relationship between two user entities, the edges between user entities and event entities or place entities are generated according to the behavior of the user entities, and the attribute of each edge is the time when the relationship is formed or the behavior is performed.

[0066] The specific method for constructing the user behavior knowledge graph in this embodiment is as follows: first, define the types of nodes and edges in the graph, where nodes represent entities, edges represent the association relationship between entities, and each edge is accompanied by a time attribute to record the time when the relationship occurs. In practical applications, attributes can also be added to nodes, such as personal basic information of user entities, basic information of place entities, and basic information of event entities. Then, corresponding data structures are created in the import script to store user nodes and relationships. Each entity is stored using a dictionary object, and the dictionary stores the specific information of the entity in the form of key-value. The key is the index ID of each entity, which uniquely identifies the user through the index ID; the value is the specific attribute information of the entity object, which is also stored in the form of a dictionary to store the user's attributes and attribute values. After the node dictionary is established, an edge relationship is established for each user. If there is a relationship between nodes, the relationship is created in the edge relationship dictionary, and finally the time information is added to the edge. Next, the user data is parsed, and the parsed data is stored in each node dictionary and edge relationship dictionary in a standard format, and finally it is stored in batches in the graph database to visualize the social user behavior relationship.

[0067] In practical applications, social networks contain a huge amount of user information, which results in a large scale of the obtained time series knowledge graph, increasing the complexity of subsequent calculations. In this case, the user behavior knowledge graph can be divided into multiple sub-graphs according to time periods, and each sub-graph only contains entities and relationships within a specific time period. In this way, the amount of data for a single calculation can be greatly reduced. In addition, the optimal time period length can be selected according to the characteristics of the data. For data that changes frequently, a shorter time period can be selected; for data that changes slowly, the time period can be appropriately extended to analyze the changes in interactions between users in different time periods.

[0068] S102: User behavior knowledge graph tensorization:

[0069] As an extension of one-dimensional vectors and two-dimensional matrices in high-dimensional space, tensors can well represent high-dimensional data of user behavior information while retaining the structural characteristics of high-dimensional information. Due to the multi-dimensional characteristics of knowledge graphs, the present invention combines the high-dimensional characteristics of tensors to convert the four-tuple knowledge in the knowledge graph into tensors for representation and storage. In order to convert the time series knowledge graph into a tensor, it is also necessary to encode entities, relationships, and time, and map each entity, relationship type, and time information to a unique ID. Based on the above analysis, the specific method of tensorization of the user behavior knowledge graph of the present invention is as follows:

[0070] Note that the user behavior knowledge graph contains N entities, M relationships, and D time periods. A fourth-order tensor χ with dimensions of N×N×M×D is constructed to store massive amounts of user behavior knowledge, where the first dimension represents the head entity, the second dimension represents the tail entity, the third dimension represents the type of relationship between entities, and the fourth dimension represents the time when the relationship occurs. Each quadruple in the user behavior knowledge graph is converted into an element in the tensor. Each element χ i×j×m×d Indicates whether there is a relationship type m between the head entity i and the tail entity j in the time period d. If the relationship exists, then the i×j×m×d =1, if it does not exist, then χ i×j×m×d =0, where i, j = 1, 2,…, N, m = 1, 2,…, M, d = 1, 2,…, D.

[0071] For example, if user A follows user B on 2024-08, the quaternion is (A, follow, B, 2024-08). Assume that the index ID of user A is '2', the index ID of user B is '5', the index ID of the relation "follow" is '3', and the index ID of the time 2024-08 is '8', the corresponding tensor element χ 2×5×3×8 Then it is 1, indicating that such a relationship exists, and the rest of the positions are set to 0. Repeat the operation and fill each quadruple into the tensor to obtain the fourth-order tensor corresponding to the user behavior knowledge graph and store. Figure 4It is a schematic diagram of the user behavior knowledge graph tensor in this embodiment.

[0072] S103: Obtaining behavior embedding vector based on tensor decomposition:

[0073] Since high-order tensors contain a large amount of data, directly storing and processing this data will take up a lot of storage space and computing resources. The high-order original tensor can be represented as the sum of multiple low-rank tensors, which significantly reduces the amount of stored data, and the reduced-dimensional representation makes subsequent anomaly detection more efficient. In addition, the original data contains a lot of noise, and the main information components can be extracted through tensor decomposition. The low-rank components after decomposition are also easier to identify and analyze the user's abnormal behavior. Therefore, after obtaining the user behavior knowledge graph tensor χ, the present invention performs tensor decomposition on it to obtain the head entity matrix Tail Entity Matrix Relationship Matrix in represents the embedding vector of entity i in the head entity factor, represents the embedding vector of entity j in the tail entity factor, represents the embedding vector of relation m in the relation factor, represents the embedding vector of time d in the time factor, and K represents the rank of decomposition.

[0074] In this embodiment, the tensor decomposition adopts CP decomposition. Respectively represent the column vectors of the corresponding factor matrix, and the CP decomposition can be expressed as follows:

[0075]

[0076] in, Represents the outer product.

[0077] The factor matrix A after decomposition h and A t It can identify potential relationship patterns between users, such as a h,k and a t,k The values ​​of a latent factor are both high, indicating that the two users have a strong connection in this relationship mode. The factor matrix C can reveal which relationship types play a dominant role in a specific latent factor. k The values ​​of some relationship types in are very high, indicating that such relationships are very important under this latent factor. For example, a latent factor may correspond to the "follow" relationship between users, while another latent factor may correspond to the "like" relationship of users to certain topics. Each row of the four matrices represents the vector representation of the head and tail entities, the association relationship between the head and tail entities, and time.

[0078] The elements of user behavior include multiple key factors, such as the subject of the behavior, the content of the behavior, the time and place of the behavior, etc. These elements are equivalent to the head and tail entities, relationships and time information in the knowledge system. Therefore, the present invention represents user behavior by combining two entities, relationships and time embedding vectors. For a specific user A h [i], executes the behavior of relation B[m] within time C[d], and its object is A t [j], then the behavior embedding vector x can be obtained by the following formula i,j,m,d :

[0079]

[0080] in, Represents a vector concatenation operation.

[0081] The above-mentioned behavior embedding vector can intuitively represent the user's behavior operation information within a certain period of time. Taking it as the input of the anomaly detection model can better capture the characteristics of the user performing specific behaviors at a specific time point and identify the abnormal behaviors therein.

[0082] S104: Obtaining a normal behavior training sample set:

[0083] According to the normal user behavior marked in step S201, the behavior embedding vector corresponding to the normal user behavior is screened out from all behavior embedding vectors to form a normal behavior training sample set.

[0084] S105: Build and train a behavior reconstruction model:

[0085] A behavior reconstruction model is constructed according to actual needs, whose input is the behavior embedding vector and output is the reconstructed behavior embedding vector, and then the behavior reconstruction model is trained using the normal behavior training sample set obtained in step S105.

[0086] In this embodiment, the social network abnormal behavior detection model uses a variational auto-encoder (VAE). The VAE model generates and reconstructs data by learning the latent variable distribution of user data. Abnormal behavior detection includes constructing the VAE encoder p θ (z|x) and decoder where θ and are the model parameters of the encoder and decoder respectively. The input layer of the encoder is used to receive the behavior embedding vector, and then the vector dimension is gradually reduced through the fully connected layer of the hidden layer, the low-dimensional representation of the embedding is extracted, and finally the output of the hidden layer is mapped to the mean and variance of the latent space through the mean and variance layer to generate the latent variable. The input layer of the decoder receives the variables sampled from the latent space, and the dimension is gradually increased through the fully connected layer. Finally, the input layer outputs a vector of the same dimension as the original behavior embedding to reconstruct the input data.

[0087] In the present invention, the obtained behavior is embedded into the vector As the input data of the variational autoencoder, these vectors represent the characteristics of user behavior in different dimensions. The decoder parameters are responsible for mapping the input user behavior characteristics to the distribution of latent variables, capturing the high-dimensional features of user behavior patterns. By learning the model parameters, the encoder can compress the user's behavior information and extract low-dimensional latent representations. The mean and variance in the latent variables represent the core characteristics and uncertainty of user behavior, respectively. These variables capture the latent factors of user behavior, especially the common characteristics in regular behavior. For abnormal behavior, the distribution of latent variables may deviate from the normal pattern, resulting in the model being unable to successfully reconstruct the input through the decoder, thereby identifying the anomaly.

[0088] Specifically, the input user behavior vector passes through the fully connected layer and the activation function σ(x) to reduce the data dimension, and the mean μ and variance log(σ 2 ), the relevant formula is as follows:

[0089]

[0090] μ=W μ h+b μ

[0091] log(σ 2 )=W σ h+b σ

[0092] Where x is the input behavior embedding vector, h is the intermediate representation of the encoder output, and W μ and W σ are weight matrices, b μ and b σ is the bias vector. To generate the latent variable z, we use the reparameterization technique from a standard normal distribution. A random variable ε is sampled from , and is calculated as follows:

[0093] z=μ+σε

[0094]

[0095] Among them, ⊙ represents the element-by-element multiplication operation. In this way, the model can perform end-to-end back-propagation training.

[0096] The decoder has a similar structure to the encoder. The decoder accepts the latent variable z as input, and after passing through the fully connected layer and activation function, it restores the data dimension layer by layer, and finally outputs the reconstructed data with the same dimension as the input data. The weights and biases of the decoder determine whether the model can accurately reconstruct the input data from the latent variables, which reflects the reconstruction ability of the model. The input of normal behavior can be accurately reconstructed, while abnormal behavior will cause the reconstruction error to increase significantly due to the difference in the latent space.

[0097] The ultimate goal of variational autoencoder training is to minimize the total loss function, which consists of two parts: reconstruction loss and KL divergence loss. The reconstruction loss uses the mean square error (MSE) to measure the gap between the original data and the reconstructed data:

[0098]

[0099] Among them, Q represents the number of samples in the training sample set, x q , They represent the input user behavior vector and the reconstructed user behavior vector respectively, q=1,2,…,Q.

[0100] KL divergence measures the difference between the latent variable distribution q(z|x) and the standard normal distribution The difference between them is calculated as:

[0101]

[0102] Among them, G is the dimension of the latent variable, μ g and σ g are the mean and standard deviation of the g-th latent variable, g = 1, 2, ..., G. The total loss function L VAE is the weighted sum of reconstruction error and KL divergence loss:

[0103] L VAE =L MSE +βL KL

[0104] Among them, β is a weight parameter used to adjust the balance between the two parts of the loss. By minimizing the total loss function, the VAE model can be trained to effectively capture the potential distribution characteristics of the input data. During the training process, stochastic gradient descent is used to update the model parameters.

[0105] S106: Abnormal behavior detection:

[0106] When the embedding vector of the behavior to be detected is input into the behavior reconstruction model, the normal behavior embedding vector can be represented by the latent vector in the latent space and reconstructed with minimal loss, while the abnormal behavior embedding vector is difficult to be represented by the latent space, resulting in a large error between the reconstructed data and the original input data. Therefore, the present invention uses the reconstruction error of the model as an important indicator for detecting abnormal behavior. A large reconstruction error means that the behavior is significantly different from the normal mode and may be an abnormal behavior. Therefore, the behavior can be judged whether it is abnormal by calculating the reconstruction error, that is, the data point with a large error is regarded as abnormal behavior. The specific method of abnormal behavior detection in the present invention is:

[0107] The embedding vector of the behavior to be detected in the social network is input into the behavior reconstruction model trained in step S106, and the reconstruction error between the reconstructed behavior embedding vector and the behavior to be detected is calculated to determine whether it is greater than a preset threshold α. If it is greater, the behavior corresponding to the embedding vector of the behavior to be detected is an abnormal behavior, otherwise the behavior corresponding to the embedding vector of the behavior to be detected is a normal behavior.

[0108] In order to improve the accuracy of abnormal behavior detection, this embodiment proposes a method for determining the threshold α:

[0109] Input each behavior embedding vector in the normal behavior training sample set into the behavior reconstruction model and calculate the reconstruction error MSE between each reconstructed behavior embedding vector and the behavior embedding vector to be detected q , calculate its mean μ and standard deviation σ respectively:

[0110]

[0111] Then the calculated threshold α=μ+Z 0.95 σ, Z 0.95 Indicates the Z score when the confidence interval is 95%. In order to better illustrate the technical effect of the present invention, a specific example is used to experimentally verify the present invention.

[0112] 1) Construction of knowledge graph of social network user behavior

[0113] First, collect user data information from social networks, including user ID, personal basic information, timestamp, tweet content, tweet ID, number of likes and number of reposts, etc. Then clean and organize the collected data, clean the tweet content, remove links, @username, #tags, etc., and retain the plain text content. In this embodiment, it is assumed that there are 5 pre-processed user behavior data. Table 1 is a list of data information in this embodiment.

[0114]

[0115] Table 1

[0116] After preprocessing, knowledge extraction technology is used to extract useful information from the above text data, including using BERT to identify entities in the text, marking names, places, events, etc.; identifying the relationship between entities, recording the relationship between user behavior and behavior objects; and identifying events described in the text and related entities, time, place, etc. For the above example, the results obtained after entity extraction, relationship extraction and event extraction. Table 2 is the user behavior knowledge extraction results in this embodiment.

[0117]

[0118]

[0119] Table 2

[0120] In order to facilitate subsequent imports, the extracted user knowledge is stored in the same table. The table contains multiple forms. The same type is stored in the same form. The first row stores the attribute name, and each row from the second row stores the information of a user. According to the 5 user information extracted above, the entity object, relationship type, and behavior type are identified with a unique ID, and added to different tables according to the category. Table 3 is the entity information table in this embodiment. Table 4 is the relationship information table in this embodiment. Table 5 is the behavior information table in this embodiment.

[0121]

[0122] Table 3

[0123]

[0124] Table 4

[0125]

[0126] Table 5

[0127] As shown in Table 3, Table 4, and Table 5, three types of forms are created in this embodiment, and data information of different categories of five users are stored respectively. Table 3 is used to store entity objects required for building knowledge graphs, such as users, posts, locations, etc.; Table 4 stores the association between two users, such as attention, friend relationship, etc.; Table 5 is used to store user operation information on the platform, including time and posting, forwarding, liking, commenting, etc. Through this method, the system collects and stores user behavior data in social networks, and structurally represents the interaction relationship between users.

[0128] Next, the user's node and attribute information is imported according to the format, and the parsed data is stored in each entity node dictionary and edge relationship dictionary according to the standard format. In this example, entity_node_dict, behavior_node_dict node dictionary and relationship_edge_dict edge relationship dictionary are created respectively, and the data in the form is stored in these three dictionaries respectively. Finally, the graph database is connected, and the nodes and relationships in the dictionary are stored in the graph database through the node construction function and the edge relationship creation function. When storing, there are two types of merge and create. If the node ID already exists in the database, the merge operation is executed to merge the new node with the original node, otherwise the create operation is executed to create a new node. Then the relationship creation function is used to create a relationship edge for the user node, and the corresponding user is matched according to the ID of the user node. The connection between the two entity nodes is established through the merge operation, and then the time period information is added to the edge and the attributes are added to the node. Through the above series of operations, a knowledge system of social network user behavior based on the knowledge graph is established. Figure 5 This is an example diagram of the user behavior knowledge graph in this embodiment.

[0129] (2) Tensor data storage structure of knowledge graph

[0130] Since the scale of the above example is very small, there is no need to perform time segmentation on the generated temporal knowledge graph, so the knowledge graph is directly tensorized. Figure 5 The user behavior knowledge graph shown in the figure generates 11 nodes (entities), 8 types of relationships (user relationships, behavior types) and 5 time periods, so a fourth-order tensor is used First, create a 4th-order tensor of size 11×11×8×5, initialize all elements to 0, and then traverse all quadruple, and set the corresponding value to 1 according to the position of the quadruple in the tensor. For example, a quadruple information (Zhang San, attend, artificial intelligence conference, 2024-06-20 14:30:00), where the entity ID corresponding to 'Zhang San' is '1', the entity ID of 'artificial intelligence conference' is '3', the relationship ID of 'attend' is '3', and the ID corresponding to the time '2024-06-20 14:30:00' is '1', then the tensor position χ corresponding to the quadruple is 1×3×3×1 The value of is 1. Through the above steps, the constructed fourth-order tensor can represent all entities in the knowledge graph and their relationships, and can effectively store the knowledge graph in a structured manner in the tensor. Figure 6 is an example diagram of the user behavior knowledge graph tensor in this embodiment. For the convenience of representation, Figure 6 In the figure, only the three-dimensional tensor structure is drawn. The blue element value is 1, and the rest of the value is 0.

[0131] After generating the tensor data structure, the CP decomposition technique is used to extract the low-dimensional information features of user behavior from the fourth-order tensor data, and decompose the inefficient tensor structure into four efficient information feature vectors.

[0132] (3) Detection mechanism of abnormal behavior in social networks

[0133] Construct a variational autoencoder as a behavior reconstruction model, including an input layer, several hidden layers and an output layer, a hidden layer encoder and a decoder part, and use the user behavior embedding vector x 11,11,8,5 The model is trained, and the training set only contains normal behavior data at this time, with the goal of minimizing the reconstruction error between input and output. In this process, the input layer is designed to receive the dimension K of the embedding vector x, and then a series of encoder layers are designed, each layer uses an activation function σ(x) to gradually reduce the data dimension to the latent layer; finally, a latent layer is set to gradually increase the data dimension, and finally restore it to the dimension of the input layer, using an activation function symmetric to the encoder.

[0134] After the model training is completed, the user behavior vector to be detected is input, and the reconstruction error between the input and output of each sample is calculated. By comparing it with the calculated threshold, the abnormal behavior detection of social network users is completed.

[0135] Although the above describes the illustrative specific embodiments of the present invention to facilitate those skilled in the art to understand the present invention, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations using the concept of the present invention are protected.

Claims

1. A method for detecting abnormal behavior in social networks based on user behavior knowledge graph, characterized in that: The following steps are involved: S1: Integrate user behavior data in social networks to form a user behavior knowledge graph. The specific method is: S1.1: Collect user behavior data from social networks, including user-posted content, interaction records, social relationships, and profile information, and filter and annotate normal user behavior from user behavior data; S1.2: Extract user behavior knowledge. The specific method is as follows: Identify entities from the user behavior data obtained in step S1.1, including users, places, and events; extract the social relationship between any two user entities; Extract events from user behavior data to obtain structured information of events, including user entities, event entities, location entities, and behavior relationships involved in the events; S1.3: Construct a user behavior knowledge graph. The specific method is as follows: Based on the entity objects identified in step S1.2 and the relationships between entity objects, each piece of user behavior knowledge is represented as a four-tuple {h, r, t, d}, where h and t represent the head entity and the tail entity respectively, r represents the relationship between two entities, and d represents time; the entities are used as nodes, the edges between user entities are generated based on the social relationship between the two user entities, and the edges between user entities and event entities or place entities are generated based on the behavior of the user entities, and the attribute of each edge is the time when the relationship is formed or the behavior is performed; S2: The user behavior knowledge graph contains N entities, M relationships and D time periods. A fourth-order tensor χ with dimensions of N×N×M×D is constructed to store user behavior knowledge, where the first dimension represents the head entity, the second dimension represents the tail entity, the third dimension represents the relationship type between entities, and the fourth dimension represents the time when the relationship occurs. Convert each quadruple in the user behavior knowledge graph into an element in the tensor, and each element χ i×j×m×d Indicates whether there is a relationship type m between the head entity i and the tail entity j in the time period d. If the relationship exists, then the i×j×m×d =1, if it does not exist, then χ i×j×m×d =0, where i, j = 1, 2, ..., N, m = 1, 2, ..., M, d = 1, 2, ..., D; S3: Perform tensor decomposition on the user behavior knowledge graph tensor χ to obtain the head entity matrix Tail Entity Matrix Relationship Matrix in represents the embedding vector of entity i in the head entity factor, represents the embedding vector of entity j in the tail entity factor, represents the embedding vector of relation m in the relation factor, represents the embedding vector of time d in the time factor, and K represents the rank of decomposition; The behavior embedding vector x is calculated based on the tensor decomposition result using the following formula: i,j,m,d : in, Represents the concatenation operation of vectors; S4: According to the normal user behaviors marked in step S1.1, the behavior embedding vectors corresponding to the normal user behaviors are selected from all the behavior embedding vectors to form a normal behavior training sample set; S5: construct a behavior reconstruction model according to actual needs, whose input is the behavior embedding vector and output is the reconstructed behavior embedding vector, and then use the normal behavior training sample set obtained in step S4 to train the behavior reconstruction model; S6: Input the embedding vector of the behavior to be detected in the social network into the behavior reconstruction model trained in step S5, calculate the reconstruction error between the reconstructed behavior embedding vector and the embedding vector of the behavior to be detected, and determine whether it is greater than a preset threshold α. If it is greater, the behavior corresponding to the embedding vector of the behavior to be detected is abnormal behavior, otherwise the behavior corresponding to the embedding vector of the behavior to be detected is normal behavior.

2. The method for detecting abnormal behavior in a social network according to claim 1, characterized in that: The step S1.1 also includes preprocessing the collected user behavior data, and the specific method is as follows: 1) De-duplicate the crawled user behavior data; 2) Perform word segmentation on the user behavior data after deduplication; 3) Remove stop words from the user behavior data after word segmentation; 4) Perform data cleaning operations on the data after removing stop words.

3. The method for detecting abnormal behavior in a social network according to claim 1, characterized in that: In step S1.2, the BERT model is used to extract user behavior knowledge.

4. The method for detecting abnormal behavior in a social network according to claim 1, characterized in that: In step S3, the tensor decomposition adopts CP decomposition.

5. The method for detecting abnormal behavior in a social network according to claim 1, characterized in that: The behavior reconstruction model adopts a variational autoencoder.

6. The method for detecting abnormal behavior in a social network according to claim 5, characterized in that: The loss function L during the training of the variational autoencoder VAE The calculation formula is as follows: L VAE =L MSE +βL KL Among them, L MSE represents the reconstruction error, L KL represents the KL divergence, and β represents the weight parameter.

7. The method for detecting abnormal behavior in a social network according to claim 1, characterized in that: The method for determining the threshold α in step S6 is: Input each behavior embedding vector in the normal behavior training sample set into the behavior reconstruction model and calculate the reconstruction error MSE between each reconstructed behavior embedding vector and the behavior embedding vector to be detected q , calculate its mean μ and standard deviation σ respectively: Then the calculated threshold α=μ+Z 0.95 σ, Z 0.95 Represents the Z score at a 95% confidence interval.

Images