Internet information intelligent early warning system based on big data

Abstract

The present invention provides an Internet information intelligent early warning system based on big data, which belongs to the field of information processing and solves the problem of low efficiency of information early warning. Specifically, the information acquisition module acquires information to be analyzed; the information analysis module processes the information to be analyzed to obtain a text vector; a probability distribution model is constructed, and false information in the information to be analyzed is marked in combination with the text vector; the flow of each information to be analyzed is acquired, and dangerous information is marked through a flow-time variation equation; a bad information identification model is constructed, and bad information is marked; a continuous monitoring module is used to update the information to be analyzed and identify it; the present invention acquires, processes and analyzes information on the Internet, accurately identifies false information, dangerous information and bad information in the information, and ensures information security.

Description

Technical Field

[0001] The present invention discloses an Internet information intelligent early warning system based on big data and relates to the field of information processing. Background Art

[0002] The existing information early warning system has the following deficiencies:

[0003] Single analysis method: Existing systems mostly rely on deep learning models in the process of information security analysis. However, the existing data models used for information identification and early warning have obvious deficiencies in algorithm adaptability, such as over-reliance on training data, weak model interpretability, and poor dynamic adjustment capabilities. In the current rapidly changing Internet information environment, existing data models are difficult to quickly adapt to new data distributions or content forms, resulting in a decrease in prediction accuracy.

[0004] Insufficient data mining and feature extraction capabilities: The existing system has difficulty in integrating cross-domain information; the information structure, terminology, and rules in different fields vary greatly, and it is difficult for the existing system to unify standards for effective integration; the existing system also has the defect of insufficient association analysis: the existing system has limited ability to handle the association, progression, time series and other relationships of complex information, which affects the accuracy and credibility of the warning results.

[0005] Risk of false positives and false negatives: Most of the data processed by existing systems are automatically collected and manually labeled. This method of data acquisition not only increases labor costs, but also leads to the risk of false positives and false negatives in the system. Summary of the invention

[0006] In view of the shortcomings of the prior art, the purpose of the present invention is to provide an Internet information intelligent early warning system based on big data, aiming to solve the problem of low efficiency of information early warning.

[0007] In order to achieve the above object, the present invention is implemented through the following technical solutions: The Internet information intelligent early warning system based on big data includes:

[0008] Information acquisition module: used to count the number of accounts on the social platform, obtain the information published by each account, and obtain the information to be analyzed;

[0009] The information analysis module includes: a false information analysis submodule, a bad information identification submodule, and an information security monitoring submodule;

[0010] False information analysis submodule: used to vectorize the information to be analyzed to obtain text vectors; cluster the text vectors using a clustering algorithm to obtain stable vector clusters; then construct a probability distribution model corresponding to each stable vector cluster based on a Gaussian mixture model, and mark the false information in the information to be analyzed based on the probability distribution model;

[0011] Information security monitoring submodule: used to obtain the information with the largest single-day traffic on the social platform as Class I information; obtain the hourly traffic of each Class I information on the corresponding base day, calculate the autoregressive coefficient and error offset coefficient, and construct the traffic-time variation equation; obtain the traffic of each information to be analyzed at different times, and combine the traffic-time variation equation to mark the dangerous information in the information to be analyzed;

[0012] Bad information identification submodule: used to build a bad information identification model using the HMM model as the basic model; use the bad information identification model to analyze the information to be analyzed and mark the bad information;

[0013] Continuous monitoring module: used to update the information to be analyzed and identify it.

[0014] Furthermore, the workflow of the false information analysis submodule is as follows:

[0015] Process A1: Count the number of accounts on the social platform and record it as pn;

[0016] Get the number of messages posted by the first account, recorded as in(1); and so on, the number of messages posted by the pnth account, recorded as in(pn);

[0017] Calculate the sum of in(1) to in(pn), denoted as ain;

[0018] Process A2: Record the information published by accounts 1 to pn as te （1，1） ~te （pn，in（pn）） ;

[0019] Among them, （1，1） Indicates the first message posted by the first account; and so on. （pn，in（pn）） Indicates the in(pn)th message published by the pnth account;

[0020] Process A3: Summarize all the information published by the first account to obtain the set T （1） ; And so on, all the information released by the pnth account is summarized to obtain the set T （pn） ;

[0021] For the set T （1） ~ Collection T （pn） Perform Chinese word segmentation and get a word list to （1） ~to （pn） ;

[0022] Process A4: Convert all the information published by the first account into text vectors to obtain ve （1,1） ~ve （1，in（1）） ;

[0023] Among them, ve （1,1） Display information （1，1） The text vector of ; and so on, ve （1，in（1）） Display information （1，in（1）） The text vector of

[0024] Process A5: Repeat the same process of converting the information posted by the first account into a text vector, and convert the information posted by the second to pn accounts into text vectors to obtain the text vector ve （2，1） ~ve （pn，in（pn）） ;

[0025] Among them, ve （2，1） The text vector representing the first message published by the second account; and so on, ve （pn，in（pn）） A text vector representing the in(pn)th message published by the pnth account.

[0026] Furthermore, the subsequent process of process A5 is as follows:

[0027] Process A6: Using clustering algorithm, vector ve （1,1） ~ve （pn，in（pn）） Perform clustering processing to obtain stable vector clusters;

[0028] Process A7: Count the number of stable vector clusters, denoted as cu;

[0029] Count the number of vectors in the first stable vector cluster, denoted as an(1), an(2) to an(cu);

[0030] Where an(1) represents the number of vectors in the first stable vector cluster; an(2) represents the number of vectors in the second stable vector cluster; and so on, an(cu) represents the number of vectors in the cuth stable vector cluster;

[0031] The vectors in the 1st to cnth stable vector clusters are denoted as vector ct （1，1） ~ct （cu，an（cu）） ;

[0032] Among them, ct （1，1） represents the first vector in the first stable vector cluster; and so on, ct （cu，an（cu）） the an(cu)th vector in the cuth stable vector cluster;

[0033] Process A8: According to ct （1，1） ~ct （1，an（1）） , analyze the false information in the first stable vector cluster;

[0034] Process A9: Repeat the same process of analyzing the false information in the first stable vector cluster to analyze the false information in the second to cnth stable vector clusters.

[0035] Furthermore, the specific process of process A4 is as follows:

[0036] Process A41: Transmit information （1，1） As the target information, the target information is transformed into text vectorization to obtain ve （1,1） ;

[0037] Perform word segmentation on the target information to obtain a word list tot （1） ; Statistical list tot （1） The number of words in the sentence is denoted as vc;

[0038] Process A42: List tot （1） For the standard text, calculate the word frequency of the first to the vcth words in the target information and get TF （1,1,1） ~TF （1,1,vc） ;

[0039] To list of words （1） For the standard text, calculate the words from 1 to vc in the list to （1） Inverse document frequency in, get IDF （1,1,1） ~IDF （1,1,vc） ;

[0040] Process A43: Calculate the first word in the target information in the list to （1） ~to （pn） The weighted frequencies in get Q （1,1,1） ;

[0041] Process A44: Repeated calculation of Q （1,1,1） The same process is used to calculate the number of words from the 2nd to the vcth in the target information in the list to （1） ~to （pn） The weighted frequencies in get Q （1,1,2） ~Q （1,1,vc） ;

[0042] Summarize the list to （1） ~to （pn） All the words in the word list zt are obtained; the number of words in the list zt is counted and recorded as azt; where azt≤acy;

[0043] Get the Unicode code of the first to the aztth word in the list zt, and get Unz （1） ~Unz （azt） ;

[0044] Process A45: Unz the words in the list zt （1） ~Unz （azt） Arrange in ascending order to obtain a list xt; record the Unicode codes of the 1st to the aztth words in the list xt as Unt （1） ~Unt （azt） ; Among them, {Unt （1） ~Unt （azt） Unz （1） ~Unz （azt）};

[0045] Process A46: Create a 0 vector of length azt as the initial vector;

[0046] Get the Unicode code of the first to the vcth words, recorded as Unv （1） ~Unv （vc） ;

[0047] The first (Unv on the initial vector （1） -Unt （1） +1) position, fill in Q （1,1,1） ;

[0048] Similarly, the first (Unv （vc） -Unt （1） +1) position, fill in Q （1,1,vc） ; Get the text vector ve of the target information （1,1） ;

[0049] Process A47: Repeat the information （1，1） Convert to vector ve （1,1） The same process as above, the information （1，2） ~Information （1，in（1）） Convert to text vector and get vector ve （1，2） ~ve （1，in（1）） .

[0050] Furthermore, the specific process of the process A43 is as follows:

[0051] Process A431: Count the first word in the list to （1） The number of occurrences in is denoted by cc （1,1） ; The first word in the list to （2） The number of occurrences in is denoted by cc （1,2） ; and so on, the first word in the list to （pn） The number of occurrences in is denoted by cc （1,pn） ;

[0052] Calculate cc （1,1） ~cc （1,pn）The sum of is recorded as acc;

[0053] Process A432: Calculate the first-level weight of the first word in the target information as qa （1,1,1） ;qa （1,1,1） The calculation formula is: qa （1,1,1） =TF （1,1,1） ×IDF （1,1,1） ;

[0054] Process A433: Statistics list to （1） The number of all words in the （1） ; And so on, the statistical list to （pn） The number of all words in the （pn） ;

[0055] Calculate cy （1） ~cy （pn） The sum of is written as acy;

[0056] Process A434: Calculate the first word in the list to （1） ~to （pn） The inverse document frequency in is denoted as qb （1,1,1） ;qb （1,1,1） The calculation formula is:

[0057] ;

[0058] According to qa （1,1,1） and qb （1,1,1） Calculate Q （1,1,1） , Q （1,1,1） The calculation formula is:

[0059] .

[0060] Furthermore, the specific process of process A6 is as follows:

[0061] Process A61: for vector ve （1,1） ~ve （pn，in（pn）） Perform a clustering operation;

[0062] In the vector ve （1,1） ~ve （pn，in（pn）） Randomly select kn vectors as the center vectors; where kn represents the number of center vectors, and the calculation formula of kn is: kn = (acy) 1 / 4 , kn is rounded up;

[0063] The 1st to knth center vectors are denoted as ce （1,1） ,ce （2,2） ~ce （kn,kn） ;

[0064] Among them, ce （1,1） Indicates the first center vector; ce （2,2） represents the second center vector; and so on, ce （kn,kn） represents the knth center vector;

[0065] Process A62: Define calculation formula A1: ; Among them, ve （i，j） Indicates （i，j） Text vector, te （i，j） Indicates the jth information released by the i-th account; the value range of i is: 1~pn; the value range of j changes with i; represents the magnitude of a vector;

[0066] ce （k,k） represents the kth center vector, and the value range of k is: 1~kn;

[0067] Process A63: vector ve （1,1） Perform clustering;

[0068] Process A631: Use formula A1 to calculate the vector ve （1,1） The Euclidean distance to the 1st to knth center vectors is d （（1,1）-1） ~d （（1,1）-kn） ;

[0069] Among them, d （（1,1）-1） Represents the vector ve （1,1） The Euclidean distance to the first center vector; and so on, d （（1,1）-kn） Represents the vector ve （1,1） Euclidean distance to the knth center vector;

[0070] Process A632: If d （（1,1）-1） ~d （（1,1）-kn） The minimum value in is unique;

[0071] Extract （（1,1）-1） ~d （（1,1）-kn） The minimum value in is denoted as dl; the vector ve （1,1） Divide the center vector corresponding to dl;

[0072] Process A633: If d （（1,1）-1） ~d （（1,1）-kn） The minimum value in is not unique;

[0073] Process A6331: d （（1,1）-1） ~d （（1,1）-kn） The minimum value of the tie is denoted as dll （1） ~dll （s） ; where s represents d （（1,1）-1） ~d （（1,1）-kn）The number of parallel minimum values ​​in , the value range of s is: 2~kn;

[0074] Process A6332: Extraction of （（1,1）-1） ~d （（1,1）-kn） The corresponding center vector is taken as the undetermined vector; the undetermined vector is denoted as cel （1,1） ~cel （s,s） ; Among them, cel （1,1） Indicates the first undetermined vector, cel （s,s） represents the sth undetermined vector; （1,1） ~cel （s,s）}∈{ce （1,1） ~ce （kn,kn）};

[0075] Process A6333: Define relation A2:

[0076] ;

[0077] Among them, cel （i,i） represents the i-th undetermined vector, and the value range of i is: 1~s;

[0078] Will cel （1,1） ~cel （s,s） Substitute into the relation A2, find the undetermined vector that satisfies the relation A2, denoted as cey; replace the vector ve （1,1） Divide the center vector corresponding to cey.

[0079] Furthermore, the subsequent process of the process A63 is as follows:

[0080] Process A64: Repeat for vector ve （1,1） The same process of clustering is carried out for the vector ve （1，2） ~ve （pn，in（pn）） Perform clustering to obtain the 1st to knth clusters, recorded as cluster c （1） ~Cluster c （kn） ;

[0081] Among them, ve （2，1） The text vector representing the first message published by the second account;

[0082] Cluster c （1） Indicates division into the center vector ce （1,1） The vector set in cluster c （kn） Indicates division into the center vector ce （kn,kn） The vector set in ;

[0083] Process A65: Calculate the average vector of the first cluster, denoted as ac （1）; Similarly, calculate the average vector of the knth cluster, denoted as ac （kn） ;

[0084] Define relation A3:

[0085] ;

[0086] Among them, ce （1,1） represents the i-th center vector, ac （i） Represents the average vector of the i-th cluster, and the value range of i is: 1~kn;

[0087] Process A66: ce （1,1） ~ce （kn,kn） and ac （1） ~ac （kn） Substitute into relation A3 to determine the new center vector of the secondary clustering;

[0088] If （1,1） and ac （1） If the relationship A3 is satisfied, the new center vector is ac （1） ; If ce （1,1） and ac （1） If the relationship A3 is not satisfied, the new center vector is ce （1,1） and ac （1） ;

[0089] If （2,2） and ac （2） If the relationship A3 is satisfied, the new center vector is ac （2） ; If ce （2,2） and ac （2） If the relationship A3 is not satisfied, the new center vector is ce （2,2） and ac （2） ;

[0090] By analogy, if ce （kn,kn） and ac （kn） If the relationship A3 is satisfied, the new center vector is ac （kn） ; If ce （kn,kn） and ac （kn） If the relationship A3 is not satisfied, the new center vector is ce （kn,kn） and ac （kn） ;

[0091] Process A67: Using the new center vector as the clustering basis, repeat the vector ve （1,1） ~ve （pn，in（pn）） Perform the same clustering process once, for ve （1,1） ~ve （pn，in（pn）） Perform secondary clustering until the center vector of each cluster no longer changes, and obtain a stable vector cluster.

[0092] Furthermore, the specific process of the process A8 is as follows:

[0093] Process A81: Create a zero matrix of (an(1)×azt), denoted as matrix ZO; where azt represents the number of words in list zt;

[0094] The vector ct （1，1） , fill in the first row of the matrix ZO;

[0095] The vector ct （1，2） , fill in the second row in the matrix ZO;

[0096] Similarly, the vector ct （1，an（1）） , fill in the first row of matrix an (1) to obtain matrix ZE;

[0097] Process A82: Define calculation formula A3: ;

[0098] Among them, lx （j） represents the average value of the parameters in the jth column of the matrix ZE, x （i,j） Represents the parameter of the i-th row and j-th column in the matrix ZE. The value range of i is: 1 to an (1), and the value range of j is: 1 to azt;

[0099] According to formula A3, the average values ​​of the parameters in the first to act columns of the matrix ZE are calculated to obtain lx （1） ~lx （azt） ;

[0100] Define the calculation formula A4: Y （i,j） =x （i,j） -lx （j） ; Among them, Y （i,j） Represents x （i,j） The centralization value of

[0101] Will lx （1） ~lx （azt） Substitute into the calculation formula A4, calculate the centralization value corresponding to each parameter in the matrix ZE, and obtain the centralization matrix, which is recorded as matrix Y;

[0102] Process A83: The covariance matrix of the matrix ZE is denoted as E; the calculation formula is: E = [(Y) T ×Y] / (j-1); where T represents the transpose of the matrix, and the minimum value of (j-1) is 1;

[0103] Based on the data in process A81 to process A83, the ct constructed （1,j） The probability density function is denoted by ; The mathematical expression is:

[0104] ; Among them, ct （1,j） represents the jth vector in the first stable vector cluster, and the value range of j is: 1~an(1); represents the square root of the matrix E;

[0105] e represents a natural constant; (j / 2) is a positive integer, rounded up;

[0106] f(ct （1,j） ) exponentially, f(ct （1,j） ) is expressed as:

[0107] ;

[0108] Among them, I represents a matrix, T represents the transpose of the matrix, and -1 represents the inverse of the matrix;

[0109] Process A84: vector ct （1，1） ~ct （1，an（1）） Substitution In the vector ct （1，1） ~ct （1，an（1）） The probability density of （1，1） )~pp(ct （1，an（1）） );

[0110] Define the relationship A5: pp (ct （1，j） )∈(0,lx （j） ];

[0111] pp (ct （1，1） )~pp(ct （1，an（1）） ) is substituted into relational expression A5, and the vector satisfying relational expression A5 is extracted as the abnormal vector;

[0112] The information corresponding to the abnormal vector is marked as false information.

[0113] Furthermore, the workflow of the information security monitoring submodule is as follows:

[0114] Process B1: Obtain the information with the largest daily traffic on social platforms in the past three years as Category I information;

[0115] The third year's Category I information is recorded as information aⅠ;

[0116] The second year's Category I information is recorded as information bⅠ;

[0117] Category I information in the first year is recorded as information cⅠ;

[0118] Process B2: The day with the largest daily traffic of Class I information is used as the base day;

[0119] Get the hourly flow of information aⅠ on the base day and get aj （1） ~aj （24） ;

[0120] Get the hourly flow of information bⅠ on the base day and get bj （1） ~bj （24） ;

[0121] Get the hourly flow of information cⅠ on the base day and get cj （1） ~cj （24） ;

[0122] Among them, aj （1） 、bj （1） and cj （1） , respectively represent the traffic of information aⅠ, information bⅠ and information cⅠ in the first hour of the corresponding reference day; and so on, aj （24） 、bj （24） and cj （24） , respectively represent the flow of information aⅠ, information bⅠ and information cⅠ in the 24th hour of the corresponding reference day;

[0123] Process B3: Define calculation formula B1: ; Among them, aj （h） 、bj （h） and cj （h） , respectively represent the flow of information aⅠ, information bⅠ and information cⅠ in the hth hour of the corresponding reference day; aaj （h） Indicates the maximum average flow of information aⅠ, information bⅠ and information cⅠ in the hth hour; the value range of h is: 1~24;

[0124] will aj （1） ~aj （24） 、bj （1） ~bj （24） and cj （1） ~cj （24） Substituting into the calculation formula B1, we get the maximum average flow of information aⅠ, information bⅠ and information cⅠ from the 1st to the 24th hour: aaj （1） ~aaj （24） ;

[0125] Among them, aaj （1） It represents the maximum average flow of information aⅠ, information bⅠ and information cⅠ in the first hour;

[0126] And so on, aaj （24） It represents the maximum average flow of information aⅠ, information bⅠ and information cⅠ in the 24th hour;

[0127] Process B4: Calculate the autoregressive coefficient and error offset coefficient corresponding to information aⅠ based on the data in processes B1 to B3;

[0128] Process B41: aj （1） The autoregressive coefficient is considered as 1, and the calculation formula B2 is defined as: （p-q） =aj （p） / aj （q） ; where aj represents the correlation coefficient of information aⅠ from the qth to the pth hour; （p） and aj （q） , respectively represent the flow of information aⅠ in the pth and qth hours, the relationship between p and q satisfies: p+1=q, the value range of p is: 1~23, the value range of q is: 2~24;

[0129] will aj （1） ~aj （24） Substituting into formula B2, we can obtain the correlation coefficients of information aⅠ from the 1st to the 2nd hour, from the 2nd to the 3rd hour, and from the 23rd to the 24th hour: I （1-2） ,I （2-3） ~I （23-24） ;

[0130] Process B42: Calculation I （1-2） ~I （23-24） The average value of is denoted as aI;

[0131] Calculate the value of [(aI+1) / 2] as the autoregressive coefficient of information aⅠ, denoted as zg(1);

[0132] Process B43: Define calculation formula B3: w （h） =(aj （h） -aaj （h） ) / aj （h） ; Among them, aj （h） represents the flow of information aⅠ at the hth hour (in the reference day);

[0133] w （h） represents the flow deviation coefficient of information aⅠ at the hth hour;

[0134] aaj （h） It shows the maximum average flow of information aⅠ, information bⅠ and information cⅠ in the h hour;

[0135] will aj （1） ~aj （24） and aaj （1） ~aaj （24） Substituting into the calculation formula B3, we get the flow deviation coefficient of information aⅠ in the 1st, 2nd, and 24th hours: a （1） 、a （2）~a （24） ;

[0136] Calculate a （1） ~a （24） The average value of is taken as the error offset coefficient of information aⅠ, denoted as wo(1).

[0137] Furthermore, the subsequent process of process B4 is as follows:

[0138] Process B5: Repeat the same process of calculating the autoregressive coefficient and error offset coefficient corresponding to information aⅠ, calculate the regression coefficients corresponding to information bⅠ and information cⅠ, denoted as zg(2) and zg(3); calculate the error offset coefficients corresponding to information bⅠ and information cⅠ, denoted as wo(2) and wo(3);

[0139] Calculate the average value of zg(1), zg(2) and zg(3), denoted as azg;

[0140] Calculate the average of wo(1), wo(2) and wo(3), denoted as awo;

[0141] Define the information flow - time change equation, recorded as equation Imh (t); where t represents time;

[0142] The mathematical expression of the equation Imh(t) is:

[0143] ;

[0144] Among them, Y （t-2） represents the information flow at the (t-2)th hour, Y （t-1） represents the information flow at the (t-1)th hour, Y （t） represents the information flow at the tth hour; cw represents the error, and the initial value of cw is 0;

[0145] Process B6: aj （1） 、bj （1） and cj （1） As the initial value α, aj （2） 、bj （2） and cj （2） As the initial value β, aj （1） ~aj （24） 、bj （1） ~bj （24） and cj （1） ~cj （24） Substituting into the equation Imh(t), calculate the value of cw and record it as acw;

[0146] Substituting acw into the equation Imh(t), we get the definite flow-time variation equation, recorded as equation Amh(t);

[0147] Process B7: Analyze information （1，1） Is it safe?

[0148] Get the current time as dt; get the information te （1，1） The flow rate at the (dt-2)th hour is recorded as ya, and the flow rate at the (dt-1)th hour is recorded as yb;

[0149] Substituting ya as the initial value α and yb as the initial value β into the equation Amh(t), we can obtain （1，1） The maximum flow rate at hour dt is denoted as yy;

[0150] Get information （1，1） The actual flow at hour dt is denoted as yc;

[0151] Judgement log （yy） （yc） <Whether γ holds true; where γ represents the judgment coefficient;

[0152] If true, it means that the information （1，1） Safety;

[0153] If not, the information te （1，1） Unsafe and marked as dangerous information;

[0154] Process B8: Repeat analysis information （1，1） Is it safe to use the same process to analyze information? （1，2） ~te （pn，in（pn）） Is it safe and mark the danger information.

[0155] Compared with the prior art, the present invention has the following beneficial effects:

[0156] Large-scale data processing capabilities: The present invention is capable of processing and analyzing massive amounts of Internet data, and monitoring Internet data in real time, discovering anomalies and potential security threats in the information in advance; enabling the system to comprehensively monitor various events and behaviors in the Internet environment and discover potential security threats.

[0157] Intelligent decision-making: The present invention utilizes technologies such as data mining, machine learning, and artificial intelligence. The system can conduct in-depth analysis and mining of Internet information, and extract the implicit characteristics and patterns of false information, dangerous information, and bad information; these characteristics and patterns can provide intelligent decision-making support for relevant departments, help them optimize security strategies and decisions, and improve the effectiveness and efficiency of network security.

[0158] Simple and fast: The present invention improves the response speed of the present invention to information security incidents through a variety of intelligent information processing and information analysis mechanisms such as clustering, Gaussian mixture model, time series analysis, etc.; and the present invention uses the information published on the Internet as the analysis object, which is convenient for data collection. BRIEF DESCRIPTION OF THE DRAWINGS

[0159] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0160] Figure 1 It is a schematic diagram of the system of the present invention;

[0161] Figure 2 This is a schematic diagram of data processing of the present invention;

[0162] Figure 3 This is a functional schematic diagram of the false information analysis submodule of the present invention. DETAILED DESCRIPTION

[0163] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0164] See also Figure 1 and Figure 2 ,The Internet information intelligent early warning system based on big data includes: information acquisition module, information analysis module and continuous monitoring module;

[0165] Information acquisition module: used to count the number of accounts on the social platform, obtain the information published by each account, and obtain the information to be analyzed;

[0166] It should be noted that the “social platform” in the present invention means: a platform where information is open and everyone can access it freely;

[0167] The information analysis module includes: a false information analysis submodule, a bad information identification submodule, and an information security monitoring submodule;

[0168] False information analysis submodule: used to vectorize the information to be analyzed to obtain text vectors; cluster the text vectors using a clustering algorithm to obtain stable vector clusters; then construct a probability distribution model corresponding to each stable vector cluster based on a Gaussian mixture model, and mark the false information in the information to be analyzed based on the probability distribution model;

[0169] Process A: Please refer to Figure 3 ,The workflow of the false information analysis sub-module is as follows:

[0170] Process A1: Count the number of accounts on the social platform and record it as pn;

[0171] Get the number of messages posted by the first account, recorded as in(1); the number of messages posted by the second account, recorded as in(2); and so on, the number of messages posted by the pnth account, recorded as in(pn);

[0172] Calculate the sum of in(1) to in(pn), denoted as ain;

[0173] Process A2: Record the information published by accounts 1 to pn as te （1，1） 、te （1，2） ~te （1，in（1）） ~te （pn，in（pn）） ;

[0174] Among them, （1，1） Indicates the first information published by the first account; （1，2） Indicates the second message posted by the first account; and so on. （1，in（1）） Indicates the in(1)th message published by the first account; （pn，in（pn）） Indicates the in(pn)th message published by the pnth account;

[0175] Process A3: Summarize all the information published by the first account to obtain the set T （1） ; Summarize all the information published by the second account to get the set T （2） ; And so on, all the information released by the pnth account is summarized to obtain the set T （pn） ;

[0176] Use jieba.lcut() function to cut the set T one by one （1） ~ Collection T （pn） Perform Chinese word segmentation and get a word list to （1） ~to （pn） ;

[0177] Process A4: Convert all the information published by the first account into text vectors to obtain ve （1,1） ,ve （1，2） ~ve （1，in（1）） ;

[0178] Among them, ve （1,1） Display information （1，1） The text vector of ve （1，2） Display information （1，2） The text vector of ; and so on, ve （1，in（1）） Display information （1，in（1）） The text vector of

[0179] Process A41: Transmit information （1，1）As the target information, the target information is transformed into text vectorization to obtain ve （1,1） ;

[0180] Perform word segmentation on the target information to obtain a word list tot （1） ; Statistical list tot （1） The number of words in the sentence is denoted as vc;

[0181] Process A42: List tot （1） For the standard text, calculate the word frequency of the 1st to vcth words in the target information and get TF （1,1,1） ~TF （1,1,vc） ;

[0182] To list of words （1） For the standard text, calculate the words from 1 to vc in the list to （1） Inverse document frequency in, get IDF （1,1,1） ~IDF （1,1,vc） ;

[0183] Process A43: Calculate the first word in the target information in the list to （1） ~to （pn） The weighted frequencies in get Q （1,1,1） ;

[0184] Process A431: Count the first word (in the target information) in the list to （1） The number of occurrences in is denoted by cc （1,1） ; The first word in the list to （2） The number of occurrences in is denoted by cc （1,2） ; and so on, the first word in the list to （pn） The number of occurrences in is denoted by cc （1,pn） ;

[0185] Calculate cc （1,1） ~cc （1,pn） The sum of is recorded as acc;

[0186] Process A432: Calculate the first-level weight of the first word (in the target information) in the target information as qa （1,1,1） ;qa （1,1,1） The calculation formula is: qa （1,1,1） =TF （1,1,1） ×IDF （1,1,1） ;

[0187] Process A433: Statistics list to （1） The number of all words in the （1） ; Statistics list to （2）The number of all words in the （2） ; And so on, the statistical list to （pn） The number of all words in the （pn） ;

[0188] Calculate cy （1） ~cy （pn） The sum of is written as acy;

[0189] Process A434: Calculate the first word (in the target information) in the list to （1） ~to （pn） The inverse document frequency in is denoted as qb （1,1,1） ;qb （1,1,1） The calculation formula is:

[0190] ;

[0191] According to qa （1,1,1） and qb （1,1,1） Calculate Q （1,1,1） , Q （1,1,1） The calculation formula is:

[0192] ;

[0193] Process A44: Repeated calculation of Q （1,1,1） The same process is used to calculate the number of words from the 2nd to the vcth in the target information in the list to （1） ~to （pn） The weighted frequencies in get Q （1,1,2） ~Q （1,1,vc） ;

[0194] Summarize the list to （1） ~to （pn） All the words in the word list zt are obtained; the number of words in the list zt is counted and recorded as azt; where azt≤acy;

[0195] Get the Unicode code of the first to the aztth word in the list zt, and get Unz （1） ~Unz （azt） ;

[0196] Process A45: Unz the words in the list zt （1） ~Unz （azt） Arrange in ascending order to obtain a list xt; record the Unicode codes of the 1st to the aztth words in the list xt as Unt （1） ~Unt （azt） ; Among them, {Unt （1） ~Unt （azt） Unz （1）~Unz （azt）}; (i.e. “Unt （1） ~Unt （azt） ” and “Unz （1） ~Unz （azt） " has the same value, but not necessarily the same position)

[0197] Process A46: Create a 0 vector of length azt as the initial vector;

[0198] Get the Unicode code of the first to the vcth words (in the target information), recorded as Unv （1） ~Unv （vc） ;

[0199] The first (Unv on the initial vector （1） -Unt （1） +1) position, fill in Q （1,1,1） ;

[0200] The first (Unv on the initial vector （2） -Unt （1） +1) position, fill in Q （1,1,2） ;

[0201] Similarly, the first (Unv （vc） -Unt （1） +1) position, fill in Q （1,1,vc） ; Get the text vector ve of the target information （1，1） ;

[0202] Process A47: Repeat the information （1，1） Convert to vector ve （1,1） The same process (i.e., process A41 to process A46) is used to convert the information te （1，2） ~ Information （1，in（1）） Convert to text vector and get vector ve （1，2） ~ve （1，in（1）） ;

[0203] Process A5: Repeat the same process of converting the information posted by the first account into a text vector (i.e., process A4), and convert the information posted by the second to pnth accounts into text vectors to obtain the text vector ve （2，1） ,ve （2，2） ~ve （2，in（2）） ~ve （pn，in（pn）） ; Among them, ve （2，1） The text vector representing the first message published by the second account; ve （2，2） The text vector representing the second message published by the second account; and so on. （2，in（2））The text vector representing the in(2)th message published by the second account; ve （pn，in（pn）） The text vector representing the in(pn)th message published by the pnth account;

[0204] Process A6: Using clustering algorithm, vector ve （1,1） ~ve （pn，in（pn）） Perform clustering processing to obtain stable vector clusters;

[0205] Process A61: for vector ve （1,1） ~ve （pn，in（pn）） Perform a clustering operation;

[0206] In the vector ve （1,1） ~ve （pn，in（pn）） Randomly select kn vectors as the center vectors; where kn represents the number of center vectors, and the calculation formula of kn is: kn = (acy) 1 / 4 , kn is rounded up;

[0207] The 1st to knth center vectors are denoted as ce （1,1） ,ce （2,2） ~ce （kn,kn） ;

[0208] Among them, ce （1,1） Indicates the first center vector; ce （2,2） represents the second center vector; and so on, ce （kn,kn） represents the knth center vector;

[0209] Process A62: Define calculation formula A1: ; Among them, ve （i，j） Indicates （i，j） Text vector, te （i，j） Indicates the jth information published by the i-th account; the value range of i is: 1~pn; the value range of j changes with i; if i is 1, the value range of j is: 1~in(1); if i is 2, the value range of j is: 1~in(2); and so on, if i is pn, the value range of j is: 1~in(pn); Represents the magnitude of a vector (i.e., the Euclidean distance between two vectors);

[0210] ce （k,k） represents the kth center vector, and the value range of k is: 1~kn;

[0211] Process A63: vector ve （1,1） Perform clustering;

[0212] Process A631: Use formula A1 to calculate the vector ve （1,1）The Euclidean distance (i.e., Euclidean distance) to the 1st to knth center vectors is obtained as d （（1,1）-1） ,d （（1,1）-2） ~d （（1,1）-kn） ;

[0213] Among them, d （（1,1）-1） Represents the vector ve （1,1） Euclidean distance to the first center vector; d （（1,1）-2） Represents the vector ve （1,1） The Euclidean distance to the second center vector; and so on, d （（1,1）-kn） Represents the vector ve （1,1） Euclidean distance to the knth center vector;

[0214] Process A632: If d （（1,1）-1） ~d （（1,1）-kn） The minimum value in is unique;

[0215] Extract （（1,1）-1） ~d （（1,1）-kn） The minimum value in is denoted as dl; the vector ve （1,1） Divide the center vector corresponding to dl;

[0216] Process A633: If d （（1,1）-1） ~d （（1,1）-kn） The minimum value in is not unique;

[0217] Process A6331: d （（1,1）-1） ~d （（1,1）-kn） The minimum value of the tie is denoted as dll （1） ~dll （s） ; where s represents d （（1,1）-1） ~d （（1,1）-kn） The number of parallel minimum values ​​in , the value range of s is: 2~kn;

[0218] Process A6332: Extraction of （（1,1）-1） ~d （（1,1）-kn） The corresponding center vector is taken as the undetermined vector; the undetermined vector is denoted as cel （1,1） ~cel （s,s） ; Among them, cel （1,1） Indicates the first undetermined vector, cel （s,s） represents the sth undetermined vector; （1,1） ~cel （s,s）}∈{ce （1,1） ~ce （kn,kn）};

[0219] Process A6333: Define relation A2:

[0220] ;

[0221] Among them, cel （i,i） represents the i-th undetermined vector, and the value range of i is: 1~s;

[0222] Will cel （1,1） ~cel （s,s） Substitute into the relation A2, find the undetermined vector that satisfies the relation A2, denoted as cey; replace the vector ve （1,1） Divide the center vector corresponding to cey;

[0223] Process A64: Repeat for vector ve （1,1） The same process of clustering is carried out for the vector ve （1，2） ~ve （pn，in（pn）） Perform clustering to obtain the 1st to knth clusters, recorded as cluster c （1） , cluster c （2） ~Cluster c （kn） (Complete a clustering);

[0224] Among them, cluster c （1） Indicates division into the center vector ce （1,1） The set of vectors in; cluster c （2） Indicates division into the center vector ce （2,2） The vector set in cluster c （kn） Indicates division into the center vector ce （kn,kn） The vector set in ;

[0225] Process A65: Calculate the first cluster (i.e. cluster c （1） ), denoted as ac （1） ; Calculate the second cluster (i.e. cluster c （2） ), denoted as ac （2） ; And so on, calculate the knth cluster (i.e. cluster c （kn） ), denoted as ac （kn） ;

[0226] Define relation A3:

[0227] ;

[0228] Among them, ce （1,1） represents the i-th center vector, ac （i） Represents the average vector of the i-th cluster, and the value range of i is: 1~kn;

[0229] Process A66: ce （1,1） ~ce （kn,kn） and ac （1） ~ac （kn） Substitute into relation A3 to determine the new center vector of the secondary clustering;

[0230] If （1,1） and ac （1） If the relationship A3 is satisfied, the new center vector is ac （1） ; If ce （1,1） and ac （1） If the relationship A3 is not satisfied, the new center vector is ce （1,1） and ac （1） ;

[0231] If （2,2） and ac （2） If the relationship A3 is satisfied, the new center vector is ac （2） ; If ce （2,2） and ac （2） If the relationship A3 is not satisfied, the new center vector is ce （2,2） and ac （2） ;

[0232] By analogy, if ce （kn,kn） and ac （kn） If the relationship A3 is satisfied, the new center vector is ac （kn） ; If ce （kn,kn） and ac （kn） If the relationship A3 is not satisfied, the new center vector is ce （kn,kn） and ac （kn） ;

[0233] Process A67: Using the new center vector as the clustering basis, repeat the vector ve （1,1） ~ve （pn，in（pn）） Perform the same clustering process once, for ve （1,1） ~ve （pn，in（pn）） Perform secondary clustering until the center vector of each cluster no longer changes, and obtain a stable vector cluster;

[0234] Process A7: Count the number of stable vector clusters, denoted as cu;

[0235] Count the number of vectors in the first stable vector cluster, denoted as an(1), an(2) to an(cu);

[0236] Where an(1) represents the number of vectors in the first stable vector cluster; an(2) represents the number of vectors in the second stable vector cluster; and so on, an(cu) represents the number of vectors in the cuth stable vector cluster;

[0237] The vectors in the 1st to cnth stable vector clusters are denoted as vector ct （1，1） ,ct （1，2） ~ct （1，an（1）） ~ct （cu，an（cu）） ;

[0238] Among them, ct （1，1） Indicates the first vector in the first stable vector cluster; ct （1，2） represents the second vector in the first stable vector cluster; and so on, ct （1，an（1）） represents the an(1)th vector in the first stable vector cluster; ct （cu，an（cu）） the an(cu)th vector in the cuth stable vector cluster;

[0239] Process A8: According to ct （1，1） ~ct （1，an（1）） , analyze the false information in the first stable vector cluster;

[0240] Process A81: Create a zero matrix of (an(1)×azt), denoted as matrix ZO; where azt represents the number of words in list zt;

[0241] The vector ct （1，1） , fill in the first row of the matrix ZO;

[0242] The vector ct （1，2） , fill in the second row in the matrix ZO;

[0243] Similarly, the vector ct （1，an（1）） , fill in the first row of matrix an (1) to obtain matrix ZE;

[0244] Process A82: Define calculation formula A3: ;

[0245] Among them, lx （j） represents the average value of the parameters in the jth column of the matrix ZE, x （i,j） Represents the parameter of the i-th row and j-th column in the matrix ZE. The value range of i is: 1 to an (1), and the value range of j is: 1 to azt;

[0246] According to formula A3, the average values ​​of the parameters in the first to act columns of the matrix ZE are calculated to obtain lx （1） ~lx （azt） ;

[0247] Define the calculation formula A4: Y （i,j） =x （i,j） -lx （j） ; Among them, Y （i,j） Represents x （i,j） The centralization value of

[0248] Will lx （1） ~lx （azt） Substitute into the calculation formula A4, calculate the centralization value corresponding to each parameter in the matrix ZE, and obtain the centralization matrix, which is recorded as matrix Y;

[0249] Process A83: The covariance matrix of the matrix ZE is denoted as E; the calculation formula is: E = [(Y) T ×Y] / (j-1); where T represents the transpose of the matrix, and the minimum value of (j-1) is 1;

[0250] Based on the data in process A81 to process A83, the ct constructed （1,j） The probability density function is denoted by ; The mathematical expression is:

[0251] ; Among them, ct （1,j） represents the jth vector in the first stable vector cluster, and the value range of j is: 1~an(1); represents the square root of the matrix E (considering the matrix E as the determinant and using a recursive algorithm such as Laplace expansion to calculate it);

[0252] e represents a natural constant (valued at 2.7); (j / 2) is a positive integer, rounded up;

[0253] f(ct （1,j） ) exponentially, f(ct （1,j） ) is expressed as:

[0254] ;

[0255] Among them, I represents a matrix, T represents the transpose of the matrix, and -1 represents the inverse of the matrix;

[0256] Process A84: vector ct （1，1） ~ct （1，an（1）） Substitution In the vector ct （1，1） ~ct （1，an（1）） The probability density of （1，1） )~pp(ct （1，an（1）） );

[0257] Define the relationship A5: pp (ct （1，j） )∈(0,lx （j） ];

[0258] pp (ct （1，1） )~pp(ct （1，an（1）） ) is substituted into relational expression A5, and the vector satisfying relational expression A5 is extracted as the abnormal vector;

[0259] Mark the information corresponding to the abnormal vector as false information;

[0260] Process A9: Repeat the same process of analyzing the false information in the first stable vector cluster to analyze the false information in the second to cnth stable vector clusters;

[0261] Information security monitoring submodule: used to obtain the information with the largest single-day traffic on the social platform as Class I information; obtain the hourly traffic of each Class I information on the corresponding base day, calculate the autoregressive coefficient and error offset coefficient, and construct the traffic-time variation equation; obtain the traffic of each information to be analyzed at different times, and combine the traffic-time variation equation to mark the dangerous information in the information to be analyzed;

[0262] Process B: The workflow of the information security monitoring submodule is as follows:

[0263] Process B1: Obtain the information with the largest daily traffic on social platforms in the past three years as Category I information;

[0264] The third year's Category I information is recorded as information aⅠ;

[0265] The second year's Category I information is recorded as information bⅠ;

[0266] Category I information in the first year is recorded as information cⅠ;

[0267] Process B2: The day with the largest daily traffic of Class I information is used as the base day;

[0268] Get the hourly flow rate of information aⅠ on the reference day (i.e., the flow rate within 24 hours), and get aj （1） , ~aj （24） ;

[0269] Get the hourly flow of information bⅠ on the reference day (i.e., the flow within 24 hours), and get bj （1） 、bj （2） ~bj （24） ;

[0270] Get the hourly flow of information cⅠ on the base day (i.e., the flow within 24 hours) and get cj （1） 、cj （2） ~cj （24） ;

[0271] Among them, aj （1） 、bj （1） and cj （1） , respectively represent the traffic of information aⅠ, information bⅠ and information cⅠ in the first hour of the corresponding reference day; aj （2） 、bj （2） and cj （2）, respectively represent the traffic of information aⅠ, information bⅠ and information cⅠ in the second hour of the corresponding reference day; and so on, aj （24） 、bj （24） and cj （24） , respectively represent the flow of information aⅠ, information bⅠ and information cⅠ in the 24th hour of the corresponding reference day;

[0272] Process B3: Define calculation formula B1: ; Among them, aj （h） 、bj （h） and cj （h） , respectively represent the flow of information aⅠ, information bⅠ and information cⅠ in the hth hour of the corresponding reference day; aaj （h） Indicates the maximum average flow of information aⅠ, information bⅠ and information cⅠ in the hth hour; the value range of h is: 1~24;

[0273] will aj （1） ~aj （24） 、bj （1） ~bj （24） and cj （1） ~cj （24） Substituting into the calculation formula B1, we get the maximum average flow of information aⅠ, information bⅠ and information cⅠ from the 1st to the 24th hour: aaj （1） 、a~aaj （24） ;

[0274] Among them, aaj （1） It represents the maximum average flow of information aⅠ, information bⅠ and information cⅠ in the first hour;

[0275] a represents the maximum average flow of information aⅠ, information bⅠ and information cⅠ in the second hour;

[0276] And so on, aaj （24） It represents the maximum average flow of information aⅠ, information bⅠ and information cⅠ in the 24th hour;

[0277] Process B4: Calculate the autoregressive coefficient and error offset coefficient corresponding to information aⅠ based on the data in processes B1 to B3;

[0278] Process B41: aj （1） The autoregressive coefficient is considered as 1, and the calculation formula B2 is defined as: （p-q） =aj （p） / aj （q） ; where aj represents the correlation coefficient of information aⅠ from the qth to the pth hour; （p） and aj （q）, respectively represent the flow of information aⅠ in the pth and qth hours (within the reference day), the relationship between p and q satisfies: p+1=q, the value range of p is: 1~23, the value range of q is: 2~24;

[0279] will aj （1） ~aj （24） Substituting into formula B2, we can obtain the correlation coefficients of information aⅠ from the 1st to the 2nd hour, from the 2nd to the 3rd hour, and from the 23rd to the 24th hour: I （1-2） ,I （2-3） ~I （23-24） ;

[0280] Process B42: Calculation I （1-2） ~I （23-24） The average value of is denoted as aI;

[0281] Calculate the value of [(aI+1) / 2] as the autoregressive coefficient of information aⅠ, denoted as zg(1);

[0282] Process B43: Define calculation formula B3: w （h） =(aj （h） -aaj （h） ) / aj （h） ; Among them, aj （h） represents the flow of information aⅠ at the hth hour (in the reference day);

[0283] w （h） represents the flow deviation coefficient of information aⅠ at the hth hour;

[0284] aaj （h） It shows the maximum average flow of information aⅠ, information bⅠ and information cⅠ in the h hour;

[0285] will aj （1） ~aj （24） and aaj （1） ~aaj （24） Substituting into the calculation formula B3, we get the flow deviation coefficient of information aⅠ in the 1st, 2nd, and 24th hours: a （1） 、a （2） ~a （24） ;

[0286] Calculate a （1） ~a （24） The average value of is taken as the error offset coefficient of information aⅠ, denoted as wo(1);

[0287] Process B5: Repeat the same process of calculating the autoregressive coefficient and error offset coefficient corresponding to information aⅠ, calculate the regression coefficients corresponding to information bⅠ and information cⅠ, denoted as zg(2) and zg(3); calculate the error offset coefficients corresponding to information bⅠ and information cⅠ, denoted as wo(2) and wo(3);

[0288] Calculate the average value of zg(1), zg(2) and zg(3), denoted as azg;

[0289] Calculate the average of wo(1), wo(2) and wo(3), denoted as awo;

[0290] Define the information flow - time change equation, recorded as equation Imh (t); where t represents time;

[0291] The mathematical expression of the equation Imh(t) is:

[0292] ;

[0293] Among them, Y （t-2） represents the information flow at the (t-2)th hour, Y （t-1） represents the information flow at the (t-1)th hour, Y （t） represents the information flow at the tth hour; cw represents the error, and the initial value of cw is 0;

[0294] It should be noted that if t is the first hour of a day, then (t-2) means the 23rd hour of yesterday, and (t-1) means the 24th hour of yesterday (i.e., zero o'clock on the day); the "dt" in process B7 is the same as the "t" in process B5;

[0295] For example, if t is: October 2, 1:00, then (t-2) is: October 1, 23:00, and (t-1) is: October 1, 24:00 (or: October 2, 0:00);

[0296] Process B6: aj （1） 、bj （1） and cj （1） As the initial value α, aj （2） 、bj （2） and cj （2） As the initial value β, aj （1） ~aj （24） 、bj （1） ~bj （24） and cj （1） ~cj （24） Substituting into the equation Imh(t), calculate the value of cw and record it as acw;

[0297] Substituting acw into the equation Imh(t), we get the definite flow-time variation equation, recorded as equation Amh(t);

[0298] Process B7: Analyze information （1，1） Is it safe?

[0299] Get the current time as dt; get the information te （1，1） The flow rate at the (dt-2)th hour is recorded as ya, and the flow rate at the (dt-1)th hour is recorded as yb;

[0300] Substituting ya as the initial value α and yb as the initial value β into the equation Amh(t), we can obtain （1，1） The maximum flow rate at hour dt is denoted as yy;

[0301] Get information （1，1） The actual flow at hour dt is denoted as yc;

[0302] Judgement log （yy） （yc） <Whether γ holds true; where γ represents the judgment coefficient;

[0303] If true, it means that the information （1，1） Safety;

[0304] If not, the information te （1，1） Unsafe and marked as dangerous information;

[0305] It should be noted that the value range of "γ" in the present invention is [1,2], and the user or relevant technical personnel can adjust the value range γ according to actual needs;

[0306] Process B8: Repeat analysis information （1，1） Is it safe to use the same process to analyze information? （1，2） ~te （pn，in（pn）） Is it safe and mark the danger information.

[0307] Bad information identification submodule: used to build a bad information identification model using the HMM model as the basic model; use the bad information identification model to analyze the information to be analyzed and mark the bad information;

[0308] It should be noted that the "bad information" in the present invention refers to information containing bad fields such as violence, insults, and slander.

[0309] Continuous monitoring module: used to update the information to be analyzed and identify it.

[0310] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technical personnel in this field according to actual conditions. For example, if there are weight coefficients and proportional coefficients, their set sizes are to quantify each parameter to obtain a specific value, which is convenient for subsequent comparison. Regarding the size of the weight coefficient and the proportional coefficient, it is sufficient as long as it does not affect the proportional relationship between the parameter and the quantized value.

[0311] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. The Internet information intelligent early warning system based on big data is characterized by: include: Information acquisition module: used to obtain the number of accounts on the social platform, obtain the information published by each account, and obtain the information to be analyzed; The information analysis module includes: a false information analysis submodule, a bad information identification submodule, and an information security monitoring submodule; Information security monitoring submodule: used to obtain the flow of each information to be analyzed at different times, and combine the flow-time variation equation to mark the dangerous information in the information to be analyzed. The workflow is as follows: Get the information of the largest daily traffic on the social platform in the past three years, denoted as aⅠ, bⅠ, cⅠ, Define the maximum average flow calculation formula for the hth hour: ; Among them, aj （h） 、bj （h） and cj （h） They represent the flow rates of aⅠ, bⅠ, and cⅠ in the hth hour of the corresponding day respectively; Calculate the autoregressive coefficient and error offset coefficient corresponding to the information aⅠ: Define the correlation coefficient calculation formula: I （p-q） =aj （p） / aj （q） ;aj （p） and aj （q） represents the flow rate of aⅠ at the pth and qth hour respectively, p+1=q; calculate I （1-2） ~I （23-24） The average value aI; calculate the autoregressive coefficient zg(1)=[(aI+1) / 2] of aⅠ; Definition information aⅠ Calculation formula of flow deviation coefficient at the hth hour: w （h） =(aj （h） -aaj （h） ) / aj （h） ; The error offset coefficient wo(1) of information aⅠ is w （1） ~w （24） The average value of Repeat the same process to calculate the autoregressive coefficients and error offset coefficients corresponding to information bⅠ and information cⅠ, and calculate the average value azg of the three autoregressive coefficients and the average value awo of the three error offset coefficients; Define the information flow - time change equation, recorded as equation Imh (t): ； Y （t-2） , Y （t-1） , Y （t） They represent the flow of information at t-2, t-1, and t hours respectively; cw represents the error; Aj （1） ~aj （24） 、bj （1） ~bj （24） and cj （1） ~cj （24） Substitute the value of cw into the equation Imh (t) and substitute it into the equation Imh (t) to obtain the determined flow-time variation equation Amh (t); Get the current time as dt; get the flow rate ya of information te at the (dt-2)th hour as the initial value α, and the flow rate yb of the (dt-1)th hour as the initial value β, substitute them into the equation Amh(t), and get the maximum flow rate yy at the dtth hour of information te; get the actual flow rate yc of information te at the dtth hour; Judgement log （yy） （yc） <Whether γ holds true; where γ represents the judgment coefficient; If true, the information is safe; if not true, it is unsafe and marked as dangerous information; Continuous monitoring module: used to update the information to be analyzed and identify it.

2. The Internet information intelligent early warning system based on big data according to claim 1 is characterized in that: The false information analysis submodule is used to vectorize the information to be analyzed to obtain text vectors; cluster the text vectors using a clustering algorithm to obtain stable vector clusters; then construct a probability distribution model corresponding to each stable vector cluster based on a Gaussian mixture model, and mark the false information in the information to be analyzed based on the probability distribution model; The workflow of the false information analysis submodule is as follows: Process A1: Count the number of accounts on the social platform and record it as pn; Get the number of messages posted by the first account, recorded as in(1); and so on, the number of messages posted by the pnth account, recorded as in(pn); Calculate the sum of in(1) to in(pn), denoted as ain; Process A2: Record the information published by accounts 1 to pn as te （1，1） ~te （pn，in（pn）） ; Process A3: Summarize all the information published by the first account to obtain the set T （1） ; And so on, all the information released by the pnth account is summarized to obtain the set T （pn） ; For the set T （1） ~ Collection T （pn） Perform Chinese word segmentation and get a word list to （1） ~to （pn） ; Process A4: Convert all the information published by the first account into text vectors to obtain ve （1,1） ~ve （1，in（1）） ; Process A5: Repeat the same process of converting the information posted by the first account into a text vector, and convert the information posted by the second to pn accounts into text vectors to obtain the text vector ve （2，1） ~ve （pn，in（pn）） .

3. The Internet information intelligent early warning system based on big data according to claim 2 is characterized in that: The subsequent process of process A5 is as follows: Process A6: Using clustering algorithm, vector ve （1,1） ~ve （pn，in（pn）） Perform clustering processing to obtain stable vector clusters; Process A7: Count the number of stable vector clusters, denoted as cu; Count the number of vectors in the first, second, up to the cuth stable vector clusters, denoted as an(1), an(2)~an(cu); Where an(1) represents the number of vectors in the first stable vector cluster; an(2) represents the number of vectors in the second stable vector cluster; and so on, an(cu) represents the number of vectors in the cuth stable vector cluster; The vectors in the 1st to cnth stable vector clusters are denoted as vector ct （1，1） ~ct （cu，an（cu）） ; Among them, ct （1，1） represents the first vector in the first stable vector cluster; and so on, ct （cu，an（cu）） the an(cu)th vector in the cuth stable vector cluster; Process A8: According to ct （1，1） ~ct （1，an（1）） , analyze the false information in the first stable vector cluster; Process A9: Repeat the same process of analyzing the false information in the first stable vector cluster to analyze the false information in the second to cnth stable vector clusters.

4. The Internet information intelligent early warning system based on big data according to claim 3 is characterized in that: The specific process of process A4 is as follows: Process A41: Transmit information （1，1） As the target information, the target information is transformed into text vectorization to obtain ve （1,1） ; Perform word segmentation on the target information to obtain a word list tot （1） ; Statistical list tot （1） The number of words in the sentence is denoted as vc; Process A42: List tot （1） For the standard text, calculate the word frequency of the first to the vcth words in the target information and get TF （1,1,1） ~TF （1,1,vc） ; To list of words （1） For the standard text, calculate the words from 1 to vc in the list to （1） Inverse document frequency in, get IDF （1,1,1） ~IDF （1,1,vc） ; Process A43: Calculate the first word in the target information in the list to （1） ~to （pn） The weighted frequencies in get Q （1,1,1） ; Process A44: Repeated calculation of Q （1,1,1） The same process is used to calculate the number of words from the 2nd to the vcth in the target information in the list to （1） ~to （pn） The weighted frequencies in get Q （1,1,2） ~Q （1,1,vc） ; Summarize the list to （1） ~to （pn） All the words in the word list zt are obtained; the number of words in the list zt is counted and recorded as azt; Get the Unicode code of the first to the aztth word in the list zt, and get Unz （1） ~Unz （azt） ; Process A45: Unz the words in the list zt （1） ~Unz （azt） Arrange in ascending order to obtain a list xt; record the Unicode codes of the 1st to the aztth words in the list xt as Unt （1） ~Unt （azt） ; Among them, {Unt （1） ~Unt （azt） Unz （1） ~Unz （azt） }; Process A46: Create a 0 vector of length azt as the initial vector; Get the Unicode code of the first to the vcth words, recorded as Unv （1） ~Unv （vc） ; The first (Unv on the initial vector （1） -Unt （1） +1) position, fill in Q （1,1,1） ; Similarly, the first (Unv （vc） -Unt （1） +1) position, fill in Q （1,1,vc） ; Get the text vector ve of the target information （1,1） ; Process A47: Repeat the information （1，1） Convert to vector ve （1,1） The same process as above, the information （1，2） ~Information （1，in（1）） Convert to text vector and get vector ve （1，2） ~ve （1，in（1）） .

5. The Internet information intelligent early warning system based on big data according to claim 4 is characterized in that: The specific process of process A43 is as follows: Process A431: Count the first word in the list to （1） The number of occurrences in is denoted as cc （1,1） ; The first word in the list to （2） The number of occurrences in is denoted by cc （1,2） ; and so on, the first word in the list to （pn） The number of occurrences in is denoted by cc （1,pn） ; Calculate cc （1,1） ~cc （1,pn） The sum of is recorded as acc; Process A432: Calculate the first-level weight of the first word in the target information as qa （1,1,1） ;qa （1,1,1） The calculation formula is: qa （1,1,1） =TF （1,1,1） ×IDF （1,1,1） ; Process A433: Statistics list to （1） The number of all words in the （1） ; And so on, the statistical list to （pn） The number of all words in the （pn） ; Calculate cy （1） ~cy （pn） The sum of is written as acy; Process A434: Calculate the first word in the list to （1） ~to （pn） The inverse document frequency in is denoted as qb （1,1,1） ;qb （1,1,1） The calculation formula is: ； According to qa （1,1,1） and qb （1,1,1） Calculate Q （1,1,1） , Q （1,1,1） The calculation formula is: 。 6. The Internet information intelligent early warning system based on big data according to claim 5 is characterized in that: The specific process of process A6 is as follows: Process A61: for vector ve （1,1） ~ve （pn，in（pn）） Perform a clustering operation; In the vector ve （1,1） ~ve （pn，in（pn）） Randomly select kn vectors as the center vectors; where kn represents the number of center vectors, and the calculation formula of kn is: kn = (acy) 1 / 4 , kn is rounded up; The 1st to knth center vectors are denoted as ce （1,1） ,ce （2,2） ~ce （kn,kn） ; Among them, ce （1,1） Indicates the first center vector; ce （2,2） represents the second center vector; and so on, ce （kn,kn） represents the knth center vector; Process A62: Define calculation formula A1: ; Among them, ve （i，j） Indicates （i，j） Text vector, te （i，j） Indicates the jth information published by the i-th account; the value range of i is: 1~pn; the value range of j changes with i; represents the magnitude of a vector; ce （k,k） represents the kth center vector, and the value range of k is: 1~kn; Process A63: vector ve （1,1） Perform clustering; Process A631: Use formula A1 to calculate the vector ve （1,1） The Euclidean distance to the 1st to knth center vectors is d （（1,1）-1） ~d （（1,1）-kn） ; Among them, d （（1,1）-1） Represents the vector ve （1,1） The Euclidean distance to the first center vector; and so on, d （（1,1）-kn） Represents the vector ve （1,1） Euclidean distance to the knth center vector; Process A632: If d （（1,1）-1） ~d （（1,1）-kn） The minimum value in is unique; Extract （（1,1）-1） ~d （（1,1）-kn） The minimum value in is denoted as dl; the vector ve （1,1） Divide the center vector corresponding to dl; Process A633: If d （（1,1）-1） ~d （（1,1）-kn） The minimum value in is not unique; Process A6331: d （（1,1）-1） ~d （（1,1）-kn） The minimum value of the tie is denoted as dll （1） ~dll （s） ; where s represents d （（1,1）-1） ~d （（1,1）-kn） The number of parallel minimum values ​​in , the value range of s is: 2~kn; Process A6332: Extraction of （（1,1）-1） ~d （（1,1）-kn） The corresponding center vector is taken as the undetermined vector; the undetermined vector is denoted as cel （1,1） ~cel （s,s） ; Among them, cel （1,1） Indicates the first undetermined vector, cel （s,s） represents the sth undetermined vector; （1,1） ~cel （s,s） }∈{ce （1,1） ~ce （kn,kn） }; Process A6333: Define relation A2: ； Among them, cel （i,i） represents the i-th undetermined vector, and the value range of i is: 1~s; Will cel （1,1） ~cel （s,s） Substitute into the relation A2, find the undetermined vector that satisfies the relation A2, denoted as cey; replace the vector ve （1,1） Divide the center vector corresponding to cey.

7. The Internet information intelligent early warning system based on big data according to claim 6 is characterized in that: The subsequent process of the process A63 is as follows: Process A64: Repeat for vector ve （1,1） The same process of clustering is carried out for the vector ve （1，2） ~ve （pn，in（pn）） Perform clustering to obtain the 1st to knth clusters, recorded as cluster c （1） ~Cluster c （kn） ; Among them, ve （2，1） The text vector representing the first message published by the second account; Cluster c （1） Indicates division into the center vector ce （1,1） The vector set in cluster c （kn） Indicates division into the center vector ce （kn,kn） The vector set in ; Process A65: Calculate the average vector of the first cluster, denoted as ac （1） ; Similarly, calculate the average vector of the knth cluster, denoted as ac （kn） ; Define relation A3: ； Among them, ce （i,i） represents the i-th center vector, ac （i） Represents the average vector of the i-th cluster, and the value range of i is: 1~kn; Process A66: ce （1,1） ~ce （kn,kn） and ac （1） ~ac （kn） Substitute into relation A3 to determine the new center vector of the secondary clustering; If （1,1） and ac （1） If the relationship A3 is satisfied, the new center vector is ac （1） ; If ce （1,1） and ac （1） If the relationship A3 is not satisfied, the new center vector is ce （1,1） and ac （1） ; By analogy, if ce （kn,kn） and ac （kn） If the relationship A3 is satisfied, the new center vector is ac （kn） ; If ce （kn,kn） and ac （kn） If the relationship A3 is not satisfied, the new center vector is ce （kn,kn） and ac （kn） ; Process A67: Using the new center vector as the clustering basis, repeat the vector ve （1,1） ~ve （pn，in（pn）） Perform the same clustering process once, for ve （1,1） ~ve （pn，in（pn）） Perform secondary clustering until the center vector of each cluster no longer changes, and obtain a stable vector cluster.

8. The Internet information intelligent early warning system based on big data according to claim 7 is characterized in that: The specific process of process A8 is as follows: Process A81: Create a zero matrix of (an(1)×azt), denoted as matrix ZO; where azt represents the number of words in list zt; The vector ct （1，1） , fill in the first row of the matrix ZO; The vector ct （1，2） , fill in the second row in the matrix ZO; Similarly, the vector ct （1，an（1）） , fill in the an(1)th row in the matrix ZO, and get the matrix ZE; Process A82: Define calculation formula A3: ; Among them, lx （j） represents the average value of the parameters in the jth column of the matrix ZE, x （i,j） Represents the parameter of the i-th row and j-th column in the matrix ZE. The value range of i is: 1 to an (1), and the value range of j is: 1 to azt; According to formula A3, the average values ​​of the parameters in the 1st to th columns of the matrix ZE are calculated to obtain lx （1） ~lx （azt） ; Define the calculation formula A4: Y （i,j） =x （i,j） -lx （j） ; Among them, Y （i,j） Represents x （i,j） The centralization value of Will lx （1） ~lx （azt） Substitute into formula A4, calculate the centralization value corresponding to each parameter in the matrix ZE, and obtain the centralization matrix, which is recorded as matrix Y; Process A83: Let the covariance matrix of the matrix ZE be E; the calculation formula of E is: E = [(Y) T ×Y] / (j-1); where T represents the transpose of the matrix, and the minimum value of (j-1) is 1; According to the data in process A81 to process A83, a probability density function is constructed and recorded as ; The mathematical expression is: ; Among them, ct （1,j） represents the jth vector in the first stable vector cluster, and the value range of j is: 1~an(1); represents the square root of the matrix E; e represents a natural constant; (j / 2) is a positive integer, rounded up; f(ct （1,j） ) represents the exponential term of e, f(ct （1,j） ) is expressed as: ； Among them, I represents a matrix, T represents the transpose of the matrix, and -1 represents the inverse of the matrix; Process A84: vector ct （1，1） ~ct （1，an（1）） Substitution In the vector ct （1，1） ~ct （1，an（1）） The probability density of （1，1） )~pp(ct （1，an（1）） ); Define the relationship A5: pp (ct （1，j） )∈(0,lx （j） ]; pp (ct （1，1） )~pp(ct （1，an（1）） ) is substituted into relational expression A5, and the vector satisfying relational expression A5 is extracted as the abnormal vector; The information corresponding to the abnormal vector is marked as false information.

9. The Internet information intelligent early warning system based on big data according to claim 1 is characterized in that: The bad information identification submodule is used to construct a bad information identification model using the HMM model as a basic model; analyze the information to be analyzed using the bad information identification model, and mark the bad information.

Images