Scheme for identifying counterfeit Twitter user based on large language model

Abstract

The invention relates to the technical field of counterfeit user identification, in particular to a scheme for identifying a counterfeit Twitter user based on a large language model. According to the technical scheme, the scheme for identifying the counterfeit Twitter user based on the large language model comprises a famous entity correlation degree analysis method based on the large model; compared with a traditional scheme for recognizing a counterfeit Twitter user based on a large language model, the method has the advantages that the counterfeit Twitter user is generally detected through a detection method based on rules or simple matching, the recognition accuracy is low, the model updating speed of a traditional method is low, the method is single, and development of a novel counterfeit means is difficult to achieve; according to the scheme for recognizing the counterfeit Twitter user based on the large language model, the grammar and semantic understanding ability of the language model can be utilized, the counterfeit user name can be recognized more accurately, the scheme can adapt to continuously changing counterfeit strategies through continuous learning and updating of the model, the model judgment ability can be continuously optimized and improved, and the counterfeit Twitter user can be recognized more accurately. And the processing judgment efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of counterfeit user identification, and in particular to a solution for identifying counterfeit Twitter users based on a large language model. Background Art

[0002] On social media platforms, especially large-scale user platforms like Twitter, phishing often occurs. Phishing users can mislead users, damage brand reputation, or even conduct fraudulent activities. Phishing users often imitate the usernames of legitimate users through variations or spelling errors to evade traditional rule-based or simple matching detection methods.

[0003] Existing solutions for identifying counterfeit Twitter users based on large language models generally detect counterfeit Twitter users through rule-based or simple matching detection methods. The recognition accuracy is low, and the traditional method has a low model update speed and a relatively simple method, which makes it difficult to keep up with the development of new counterfeiting methods.

[0004] Aiming at the problem that the existing scheme for identifying counterfeit Twitter users based on large language models has low recognition accuracy and the traditional method has a low model update speed and a relatively single method, which is difficult to keep up with the development of new counterfeiting methods, this scheme for identifying counterfeit Twitter users based on large language models can utilize the grammatical and semantic understanding capabilities of the language model, can more accurately identify counterfeit usernames, and can adapt to the ever-changing counterfeiting strategies by continuously learning and updating the model, and can continuously optimize and improve the model's judgment ability, thereby improving the processing and judgment efficiency. Summary of the invention

[0005] In order to overcome the existing solution of identifying counterfeit Twitter users based on large language models, counterfeit Twitter users are generally detected through rule-based or simple matching detection methods. The recognition accuracy is low, the model update speed of traditional methods is low, the method is relatively simple, and it is difficult to keep up with the development of new counterfeiting methods.

[0006] The technical solution of the present invention is: a solution for identifying counterfeit Twitter users based on a large language model, including the following methods:

[0007] S11: Collect real Twitter user text data for training models to identify the characteristics of normal users, and collect relevant data of suspected counterfeit users;

[0008] S12: extracting grammar and spelling related features from the collected text data, and extracting other features that may be helpful in distinguishing real users from fake users;

[0009] S13: Using a machine learning algorithm, training with feature data of real users and counterfeit users, establishing a detection model, and training the model to learn how to distinguish real users from counterfeit users based on the extracted features;

[0010] S14: Use a portion of data that has not participated in training to evaluate the model, check the accuracy and recall indicators, and adjust and optimize the model according to the evaluation results to improve its ability to identify counterfeit users;

[0011] S15: Input the Twitter user data to be detected into the model for detection, determine whether the user is a counterfeit user based on the result output by the model, and take corresponding measures;

[0012] S16: Continuously monitor the model to respond to new counterfeiting methods and technical developments, continuously collect new data and retrain the model to maintain its ability to identify counterfeit users;

[0013] S17: Use the big model to analyze the association between Twitter usernames and well-known entities to determine the intersection between usernames and well-known entities to identify possible counterfeiting behaviors. At the same time, use the big model to detect whether there are deliberate character replacements in the usernames.

[0014] Preferably, when analyzing the association degree of well-known entities based on a large model, the following steps are included:

[0015] S21: Collect and organize a list of honest and reliable entities;

[0016] S22: Input the Twitter user name to be detected into the large language model;

[0017] S23: using a large language model to analyze the association between the user name and entities in the well-known entity list, and calculating the size of the intersection;

[0018] S24: When the correlation is too low, that is, the smaller the intersection is, the user is recorded as a counterfeit user.

[0019] Preferably, when performing character replacement detection based on a large model, the following steps are included:

[0020] S31: Formulate detection rules based on common character replacement patterns;

[0021] S32: Inputting the Twitter user name to be detected into the large language model;

[0022] S33: Use LLM to perform character replacement detection on the user name to identify whether there is character replacement in the preset rules;

[0023] S34: When there is a significant character replacement phenomenon, it is determined to be a counterfeit user name.

[0024] Preferably, when performing semantic association analysis based on a large model, the following steps are included:

[0025] S41: Obtain the tweet content and personal profile of the user to be detected through the Twitter API;

[0026] S42: using a large language model to perform semantic analysis on the acquired text to identify the subject and key information of the text;

[0027] S43: comparing the analysis results with the semantic features of well-known or similar entities to determine the semantic association and topic consistency between the two;

[0028] S44: When the semantic association or subject is inconsistent, it is recorded as a similar counterfeit user.

[0029] Preferably, when performing analysis based on account creation time, the following steps are included:

[0030] S51: Obtain the creation time of the account to be detected through Twitter API;

[0031] S52: Setting a reasonable account existence time threshold based on experience or data analysis;

[0032] S53: Compare the account creation time with the threshold;

[0033] S54: When the account was created very recently but has a high level of attention or activity, it is recorded as a likely fake user.

[0034] Preferably, when analyzing based on posting rate, the following steps are included:

[0035] S61: Obtain the posting frequency of the account to be detected through Twitter API;

[0036] S62: Setting a reasonable posting frequency threshold according to normal user posting habits;

[0037] S63: Compare the actual posting frequency with the threshold value. When an abnormally high posting frequency appears, it is determined that the account is counterfeited and used for batch posting.

[0038] Preferably, when performing security analysis based on the post content, the following steps are included:

[0039] S71: Obtain the latest post content of the account to be detected through Twitter API;

[0040] S72: Use security services and tools to conduct security assessment on the posted content;

[0041] S73: When malicious links, fraudulent content, or content that violates Twitter regulations is found, the account is judged to be a counterfeit account.

[0042] Preferably, when analyzing based on followers or attention ratio, the following steps are included:

[0043] S81: Obtain the number of followers and the number of followed objects of the account to be detected through the Twitter API, and calculate the ratio;

[0044] S82: Set a reasonable follower or following ratio threshold based on the common behavior patterns of Twitter users;

[0045] S83: Compare the actual ratio with the threshold. When there are followers or following ratios with abnormally high values, the recorded account is suspected to be used to maliciously increase followers.

[0046] Preferably, when continuous learning is performed based on manual feedback, the following steps are included:

[0047] S91: For user names with controversial or uncertain LLM recognition results, collect manual feedback results;

[0048] S92: updating the training data set of the large language model according to the manual feedback result, and retraining the model to improve the recognition accuracy;

[0049] S93: Regularly evaluate the recognition effect of the model and further optimize the model based on the evaluation results.

[0050] Preferably, when updating based on new technologies and counterfeiting techniques, the following steps are included:

[0051] S1001: Regularly collect and analyze new counterfeiting techniques and technology trends;

[0052] S1002: Update the knowledge base of the large language model based on new technologies and counterfeiting techniques to ensure that the model can identify and respond to new threats;

[0053] S1003: Continue testing the updated model.

[0054] Preferably, counterfeit Twitter users are screened through multiple dimensions, not only the grammar and spelling check of the username can be used, but also a large language model can be used to perform a deeper feature analysis of the username, which helps to more comprehensively identify counterfeit users. At the same time, a machine learning algorithm is used to train a large amount of feature data of real users and counterfeit users, and the model parameters are continuously optimized to make the model more accurate in identifying counterfeit users. Through model evaluation and adjustment, the recognition accuracy can be continuously improved.

[0055] Beneficial effects of the present invention:

[0056] 1. Compared with the traditional solution of identifying counterfeit Twitter users based on large language models, counterfeit Twitter users are generally detected through detection methods based on rules or simple matching, with low recognition accuracy and low model update speed and single method, which makes it difficult to keep up with the development of new counterfeiting methods. The solution of identifying counterfeit Twitter users based on large language models can utilize the grammatical and semantic understanding ability of language models, can more accurately identify counterfeit user names, and can adapt to changing counterfeiting strategies by continuously learning and updating models, can continuously optimize and improve the model judgment ability, and improve the processing and judgment efficiency;

[0057] 2. Screening of counterfeit Twitter users through multiple dimensions can not only use grammar and spelling checks on usernames, but also use large language models to conduct more in-depth feature analysis of usernames, which helps to more comprehensively identify counterfeit users. At the same time, machine learning algorithms are used to train feature data of a large number of real users and counterfeit users, and model parameters are continuously optimized to make the model more accurate in identifying counterfeit users. Through model evaluation and adjustment, the recognition accuracy can be continuously improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 What is shown is a schematic diagram of the workflow of the solution for identifying counterfeit Twitter users based on a large language model of the present invention;

[0059] Figure 2 Shown is a schematic diagram of the well-known entity association analysis process based on a large model for the solution of identifying counterfeit Twitter users based on a large language model of the present invention;

[0060] Figure 3 What is shown is a schematic diagram of a character replacement detection process based on a large model for the solution of the present invention for identifying counterfeit Twitter users based on a large language model. DETAILED DESCRIPTION

[0061] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0062] See also Figure 1-3 The present invention provides an embodiment: a solution for identifying counterfeit Twitter users based on a large language model, including the following methods:

[0063] S11: Collect real Twitter user text data for training models to identify the characteristics of normal users, and collect relevant data of suspected counterfeit users;

[0064] S12: extracting grammar and spelling related features from the collected text data, and extracting other features that may be helpful in distinguishing real users from fake users;

[0065] S13: Using a machine learning algorithm, training with feature data of real users and counterfeit users, establishing a detection model, and training the model to learn how to distinguish real users from counterfeit users based on the extracted features;

[0066] S14: Use a portion of data that has not participated in training to evaluate the model, check the accuracy and recall indicators, and adjust and optimize the model according to the evaluation results to improve its ability to identify counterfeit users;

[0067] S15: Input the Twitter user data to be detected into the model for detection, determine whether the user is a counterfeit user based on the result output by the model, and take corresponding measures;

[0068] S16: Continuously monitor the model to respond to new counterfeiting methods and technical developments, continuously collect new data and retrain the model to maintain its ability to identify counterfeit users;

[0069] S17: Use the big model to analyze the association between Twitter usernames and well-known entities to determine the intersection between usernames and well-known entities to identify possible counterfeiting behaviors. At the same time, use the big model to detect whether there are deliberate character replacements in the usernames.

[0070] Preferably, when analyzing the association degree of well-known entities based on a large model, the following steps are included:

[0071] S21: Collect and organize a list of honest and reliable entities;

[0072] S22: Input the Twitter user name to be detected into the large language model;

[0073] S23: using a large language model to analyze the association between the user name and entities in the well-known entity list, and calculating the size of the intersection;

[0074] S24: When the correlation is too low, that is, the smaller the intersection is, the user is recorded as a counterfeit user.

[0075] Preferably, when performing character replacement detection based on a large model, the following steps are included:

[0076] S31: Formulate detection rules based on common character replacement patterns;

[0077] S32: Inputting the Twitter user name to be detected into the large language model;

[0078] S33: Use LLM to perform character replacement detection on the user name to identify whether there is character replacement in the preset rules;

[0079] S34: When there is a significant character replacement phenomenon, it is determined to be a counterfeit user name.

[0080] Preferably, when performing semantic association analysis based on a large model, the following steps are included:

[0081] S41: Obtain the tweet content and personal profile of the user to be detected through the Twitter API;

[0082] S42: using a large language model to perform semantic analysis on the acquired text to identify the subject and key information of the text;

[0083] S43: comparing the analysis results with the semantic features of well-known or similar entities to determine the semantic association and topic consistency between the two;

[0084] S44: When the semantic association or subject is inconsistent, it is recorded as a similar counterfeit user.

[0085] Preferably, when performing analysis based on account creation time, the following steps are included:

[0086] S51: Obtain the creation time of the account to be detected through Twitter API;

[0087] S52: Setting a reasonable account existence time threshold based on experience or data analysis;

[0088] S53: Compare the account creation time with the threshold;

[0089] S54: When the account was created very recently but has a high level of attention or activity, it is recorded as a likely fake user.

[0090] Preferably, when analyzing based on posting rate, the following steps are included:

[0091] S61: Obtain the posting frequency of the account to be detected through Twitter API;

[0092] S62: Setting a reasonable posting frequency threshold according to normal user posting habits;

[0093] S63: Compare the actual posting frequency with the threshold value. When an abnormally high posting frequency appears, it is determined that the account is counterfeited and used for batch posting.

[0094] Preferably, when performing security analysis based on the post content, the following steps are included:

[0095] S71: Obtain the latest post content of the account to be detected through Twitter API;

[0096] S72: Use security services and tools to conduct security assessment on the posted content;

[0097] S73: When malicious links, fraudulent content, or content that violates Twitter regulations is found, the account is judged to be a counterfeit account.

[0098] Preferably, when analyzing based on followers or attention ratio, the following steps are included:

[0099] S81: Obtain the number of followers and the number of followed objects of the account to be detected through the Twitter API, and calculate the ratio;

[0100] S82: Set a reasonable follower or following ratio threshold based on the common behavior patterns of Twitter users;

[0101] S83: Compare the actual ratio with the threshold. When there are followers or following ratios with abnormally high values, the recorded account is suspected to be used to maliciously increase followers.

[0102] Preferably, when continuous learning is performed based on manual feedback, the following steps are included:

[0103] S91: For user names with controversial or uncertain LLM recognition results, collect manual feedback results;

[0104] S92: updating the training data set of the large language model according to the manual feedback result, and retraining the model to improve the recognition accuracy;

[0105] S93: Regularly evaluate the recognition effect of the model and further optimize the model based on the evaluation results.

[0106] Preferably, when updating based on new technologies and counterfeiting techniques, the following steps are included:

[0107] S1001: Regularly collect and analyze new counterfeiting techniques and technology trends;

[0108] S1002: Update the knowledge base of the large language model based on new technologies and counterfeiting techniques to ensure that the model can identify and respond to new threats;

[0109] S1003: Continue testing the updated model.

[0110] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited to the above embodiments, and various changes can be made within the knowledge scope of those skilled in the art without departing from the spirit of the present invention.

Claims

1. A solution for identifying fake Twitter users based on a large language model; the characteristics are: The following methods are included: S11: Collect real Twitter user text data for training models to identify the characteristics of normal users, and collect relevant data of suspected counterfeit users; S12: extracting grammar and spelling related features from the collected text data, and extracting other features that may be helpful in distinguishing real users from fake users; S13: Using a machine learning algorithm, training with feature data of real users and counterfeit users, establishing a detection model, and training the model to learn how to distinguish real users from counterfeit users based on the extracted features; S14: Use a portion of data that has not participated in training to evaluate the model, check the accuracy and recall indicators, and adjust and optimize the model according to the evaluation results to improve its ability to identify counterfeit users; S15: Input the Twitter user data to be detected into the model for detection, determine whether the user is a counterfeit user based on the result output by the model, and take corresponding measures; S16: Continuously monitor the model to respond to new counterfeiting methods and technical developments, continuously collect new data and retrain the model to maintain its ability to identify counterfeit users; S17: Use the big model to analyze the association between Twitter usernames and well-known entities to determine the intersection between usernames and well-known entities to identify possible counterfeiting behaviors. At the same time, use the big model to detect whether there are deliberate character replacements in the usernames.

2. The solution for identifying counterfeit Twitter users based on a large language model according to claim 1, characterized in that: When analyzing the association of well-known entities based on a large model, the following steps are included: S21: Collect and organize a list of honest and reliable entities; S22: Input the Twitter user name to be detected into the large language model; S23: using a large language model to analyze the association between the user name and entities in the well-known entity list, and calculating the size of the intersection; S24: When the correlation is too low, that is, the smaller the intersection is, the user is recorded as a counterfeit user.

3. The solution for identifying counterfeit Twitter users based on a large language model according to claim 1, characterized in that: When performing character replacement detection based on a large model, the following steps are included: S31: Formulate detection rules based on common character replacement patterns; S32: Inputting the Twitter user name to be detected into the large language model; S33: Use LLM to perform character replacement detection on the user name to identify whether there is character replacement in the preset rules; S34: When there is a significant character replacement phenomenon, it is determined to be a counterfeit user name.

4. The method for identifying counterfeit Twitter users based on a large language model according to claim 1, characterized in that: When performing semantic association analysis based on a large model, the following steps are included: S41: Obtain the tweet content and personal profile of the user to be detected through the Twitter API; S42: using a large language model to perform semantic analysis on the acquired text to identify the subject and key information of the text; S43: comparing the analysis results with the semantic features of well-known or similar entities to determine the semantic association and topic consistency between the two; S44: When the semantic association or subject is inconsistent, it is recorded as a similar counterfeit user.

5. The solution for identifying counterfeit Twitter users based on a large language model according to claim 1, characterized in that: When performing analysis based on account creation time, the following steps are included: S51: Obtain the creation time of the account to be detected through Twitter API; S52: Setting a reasonable account existence time threshold based on experience or data analysis; S53: Compare the account creation time with the threshold; S54: When the account was created very recently but has a high level of attention or activity, it is recorded as a likely fake user.

6. The solution for identifying counterfeit Twitter users based on a large language model according to claim 1, characterized in that: When analyzing based on posting rate, the following steps are included: S61: Obtain the posting frequency of the account to be detected through Twitter API; S62: Setting a reasonable posting frequency threshold according to normal user posting habits; S63: Compare the actual posting frequency with the threshold value. When an abnormally high posting frequency appears, it is determined that the account is counterfeited and used for batch posting.

7. The solution for identifying counterfeit Twitter users based on a large language model according to claim 1, characterized in that: When conducting security analysis based on the content of a post, the following steps are included: S71: Obtain the latest post content of the account to be detected through Twitter API; S72: Use security services and tools to conduct security assessment on the posted content; S73: When malicious links, fraudulent content, or content that violates Twitter regulations is found, the account is judged to be a counterfeit account.

8. The method for identifying counterfeit Twitter users based on a large language model according to claim 1, characterized in that: When analyzing based on followers or follower ratio, the following steps are included: S81: Obtain the number of followers and the number of followed objects of the account to be detected through the Twitter API, and calculate the ratio; S82: Set a reasonable follower or following ratio threshold based on the common behavior patterns of Twitter users; S83: Compare the actual ratio with the threshold. When there are followers or following ratios with abnormally high values, the recorded account is suspected to be used to maliciously increase followers.

9. The solution for identifying counterfeit Twitter users based on a large language model according to claim 1, characterized in that: When continuous learning is based on human feedback, the following steps are involved: S91: For user names with controversial or uncertain LLM recognition results, collect manual feedback results; S92: updating the training data set of the large language model according to the manual feedback result, and retraining the model to improve the recognition accuracy; S93: Regularly evaluate the recognition effect of the model and further optimize the model based on the evaluation results.

10. The solution for identifying counterfeit Twitter users based on a large language model according to claim 1, characterized in that: When updating based on new technologies and counterfeiting methods, the following steps are included: S1001: Regularly collect and analyze new counterfeiting techniques and technology trends; S1002: Update the knowledge base of the large language model based on new technologies and counterfeiting techniques to ensure that the model can identify and respond to new threats; S1003: Continue testing the updated model.

Images