Public opinion management and control method for hijacking type malicious aggressive attack

Abstract

The invention relates to a public opinion management and control method for hijacking malicious aggressive attacks. The method comprises the following steps: step 1, constructing a social network evolution diagram; 2, monitoring the public opinion state of the social network; 3, carrying out attack risk early warning; step 4, recovering the abnormal account number; and step 5, providing predictive protection. Through a dynamic interval execution mechanism, the execution frequency of the defense strategy can be automatically adjusted according to the real-time change of the network state. The dynamic adjustment not only effectively reduces the computing overhead of the system, but also ensures the high efficiency and flexibility of defensive measures in response to attacks, thereby better coping with complex and changeable attack environments, providing predictive security measures by identifying and protecting key accounts and schemes with important influence in the network, and improving the security and reliability of the system. The network risk after successful attack is obviously reduced, and the stability of the whole social network is protected.

Description

Technical Field

[0001] The present invention designs a public opinion control method for hijacking-type malicious provocation attacks, belonging to the field of public opinion control in social networks. Background Art

[0002] In modern society, online discussions on social networks have become an integral part of our daily interactions. However, as social networks expand, growing conflicts, hatred and polarization are causing serious global challenges. What is even more worrying is that these problems are not limited to the Internet. Extreme and conflicting speech on the Internet are inextricably linked to conflicts in the real world.

[0003] In recent years, many studies have tried various methods to minimize public opinion conflicts in social networks. These methods can be roughly divided into three categories: 1) By limiting the scope of discussion: This type of method assumes that the incidence of conflict will decrease when people only interact with people with similar views. 2) By modifying the network topology: These methods try to reduce the chance of users being exposed to conflicting content by changing the way social networks are connected. 3) By blocking keywords: This method relies on identifying and blocking specific keywords or phrases to prevent the spread of content that may cause conflict on the network.

[0004] Although these methods have achieved certain results in the early stage, with the advancement of network attack technology, especially the rise of hijacking malicious provocation attacks, the effectiveness of existing methods in helping social media platforms control large-scale online conflict events has gradually weakened. Hijacking-based malicious provocation attacks are defined as posting provocative content by hijacking target online accounts to cause disharmony and conflict. This form of attack can undermine the effectiveness of the three existing conflict mitigation strategies because it can disrupt the basic logic of these strategies and weaken their effectiveness by invading various accounts to post extreme remarks. However, existing research does not have a platform defense response plan for hijacking malicious provocation attacks.

[0005] To this end, a public opinion control method targeting hijacking-style malicious provocation attacks is designed to overcome the above problems. Summary of the invention

[0006] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a public opinion control method for hijacking-type malicious provocation attacks, which can promptly identify early warning signals and make defensive responses after a social network hijacking-type malicious provocation attack occurs.

[0007] The present invention is implemented through the following technical solution: a method for public opinion control against hijacking-style malicious provocation attacks, comprising the following steps:

[0008] Step 1: Construct a social network evolution graph: For a social network facing an attack, model it as a weighted graph, in which indicators of the social network conflict level and the evolution of user opinions are defined;

[0009] Step 2: Monitor the public opinion status of social networks: Calculate the dynamic execution interval, which is dynamically determined by the indicators of the current network status to balance the computing overhead and defense effect. According to the interval, monitor and analyze the collection indicators of the public opinion data in the social network for the next period, track the dynamics of the network, and regularly update the conflict level indicator.

[0010] Step 3, attack risk warning: set the time threshold of the conflict state that requires intervention, calculate the difference between the current network state and the initial state, use the near-linear estimation method to predict the time when the conflict level approaches the predefined state, and trigger the warning mechanism when the predicted network state develops to a time less than the predefined time threshold away from the predefined conflict state;

[0011] Step 4, abnormal account recovery: Use behavioral analysis and pattern recognition technology to detect and mark abnormal activity accounts in the network, and use mechanisms such as account recovery, account retrieval and temporary freezing to recover abnormal accounts in the network to prevent further malicious behavior from spreading;

[0012] Step 5, provide predictive protection: infer the attacker's attack preferences based on the information of the identified abnormal accounts, calculate the probability of the account being attacked, analyze the influence and importance of each account in the network, determine which accounts may cause major conflicts after being attacked, and provide additional security measures for the identified key risk accounts, such as enhanced password policies, multi-factor authentication and regular security reviews.

[0013] Preferably, in step 1, the status and association of users in the social network are represented by a graph, each user or entity is represented as a node in the graph, the edge between nodes represents the interactive relationship, the weight of the edge reflects the frequency or influence of the interaction, the attribute value of the node represents the user's opinion and position, and the network divergence value and polarization value are used to quantify the network conflict state. In the absence of an attacker, the change of each node's opinion in the network conforms to the opinion dynamics, such as the repeated average model. In the presence of an attacker, the opinion and position of the attacked node will be extreme values.

[0014] Preferably, in step 2, the current state of the network is characterized by using its divergence value and polarization value, and the changes of these two values ​​are approximately described by differential equations, and the monitoring time interval is dynamically adjusted. If the divergence value and polarization value increase significantly, the monitoring time of the network state is shortened.

[0015] Preferably, in step 3, a forward-looking early warning trigger mechanism is implemented by setting a time threshold of the conflict state, combining a quantitative analysis of the difference between the current and initial network states, and using a near-linear estimation method to predict future conflict levels.

[0016] Preferably, in step 4, advanced behavioral analysis and pattern recognition technologies are used to quickly and accurately identify and respond to abnormally active accounts in the network, and comprehensive recovery measures are used to quickly restore account status or isolate risks, effectively preventing the further spread of malicious behavior and ensuring network security.

[0017] Preferably, in step 5, the pre-attack behavior and network structure characteristics of the detected abnormal accounts are deeply analyzed, and statistical methods such as kernel density function are used to predict the risk of other nodes in the network being subjected to similar attacks. At the same time, algorithms such as PageRank are combined to evaluate the importance of each node in the network, and the two are combined to identify key nodes that may cause major conflicts once attacked. Subsequently, enhanced security measures are provided for these key risk accounts, such as strong password policies, multi-factor authentication, and regular security reviews, so as to proactively protect the network from potential attacks.

[0018] The beneficial effects of the present invention are as follows:

[0019] The present invention can automatically adjust the execution frequency of the defense strategy according to the real-time changes in the network status through a dynamic interval execution mechanism. This dynamic adjustment not only effectively reduces the system's computing overhead, but also ensures the efficiency and flexibility of the defense measures in responding to attacks, so as to better cope with complex and changing attack environments. The present invention identifies and protects key accounts with important influence in the network. The solution provides predictive security measures, significantly reduces the network risks after they are successfully attacked, and protects the stability of the entire social network. The present invention monitors the dynamic changes in the social network in real time and the early warning mechanism. The solution can take protective measures in time when the conflict level rises rapidly, maximizing the function and user experience of the social network. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a schematic diagram of the overall process of the present invention.

[0021] Figure 2 The figure is an application flow chart of the present invention. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to more clearly understand the objectives, technical solutions and advantages of the present invention, the present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0023] In the description of the present invention, it is necessary to understand that the orientation or position relationship indicated by the terms such as "up", "down", "left", "right", "inside", "outside", "horizontal" and "vertical" is based on the orientation or position relationship shown in the accompanying drawings, and is only for the convenience of describing the present invention, rather than indicating or implying that the device or original referred to must have a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0024] The present invention will be described in detail below with reference to the accompanying drawings: Figure 1-2 As shown, a method for public opinion control against hijacking-style malicious provocation attacks includes the following steps:

[0025] Step 1: Construct a social network evolution graph: For a social network facing an attack, model it as a weighted graph, in which indicators of the social network conflict level and the evolution of user opinions are defined;

[0026] Step 2: Monitor the public opinion status of social networks: Calculate the dynamic execution interval, which is dynamically determined by the indicators of the current network status to balance the computing overhead and defense effect. According to the interval, monitor and analyze the collection indicators of the public opinion data in the social network for the next period, track the dynamics of the network, and regularly update the conflict level indicator.

[0027] Step 3, attack risk warning: set the time threshold of the conflict state that requires intervention, calculate the difference between the current network state and the initial state, use the near-linear estimation method to predict the time when the conflict level approaches the predefined state, and trigger the warning mechanism when the predicted network state develops to a time less than the predefined time threshold away from the predefined conflict state;

[0028] Step 4, abnormal account recovery: Use behavioral analysis and pattern recognition technology to detect and mark abnormal activity accounts in the network, and use mechanisms such as account recovery, account retrieval and temporary freezing to recover abnormal accounts in the network to prevent further malicious behavior from spreading;

[0029] Step 5, provide predictive protection: infer the attacker's attack preferences based on the information of the identified abnormal accounts, calculate the probability of the account being attacked, analyze the influence and importance of each account in the network, determine which accounts may cause major conflicts after being attacked, and provide additional security measures for the identified key risk accounts, such as enhanced password policies, multi-factor authentication and regular security reviews.

[0030] In step 1, the status and association of users in the social network are represented by a graph, each user or entity is represented as a node in the graph, the edge between nodes represents the interactive relationship, the weight of the edge reflects the frequency or influence of the interaction, the attribute value of the node represents the user's opinion and position, and the network divergence value and polarization value are used to quantify the network conflict state. In the absence of an attacker, the change of each node's opinion in the network conforms to the opinion dynamics, such as the repeated average model. In the presence of an attacker, the opinion and position of the attacked node will be extreme values.

[0031] In step 2, the current state of the network is characterized by using its divergence value and polarization value, and the changes of these two values ​​are approximately described by differential equations, and the monitoring time interval is dynamically adjusted. If the divergence value and polarization value increase significantly, the monitoring time of the network state is shortened.

[0032] In step 3, a forward-looking early warning trigger mechanism is implemented by setting a time threshold of the conflict state, combining a quantitative analysis of the difference between the current and initial network states, and using a near-linear estimation method to predict future conflict levels.

[0033] In step 4, advanced behavioral analysis and pattern recognition technologies are used to quickly and accurately identify and respond to abnormal activity accounts in the network, and comprehensive recovery measures are used to quickly restore account status or isolate risks, effectively preventing the further spread of malicious behavior and ensuring network security.

[0034] In step 5, the pre-attack behavior and network structure characteristics of the detected abnormal accounts are deeply analyzed, and statistical methods such as kernel density functions are used to predict the risk of other nodes in the network being subjected to similar attacks. At the same time, algorithms such as PageRank are combined to evaluate the importance of each node in the network. The two are combined to identify key nodes that may cause major conflicts once attacked. Subsequently, enhanced security measures such as strong password policies, multi-factor authentication, and regular security reviews are provided for these key risk accounts to proactively protect the network from potential attacks.

[0035] In step 1 of the above method, the status and association of users in the social network are represented by a graph, each user or entity is represented as a node in the graph, the edge between the nodes represents the interaction relationship, the weight of the edge reflects the frequency or influence of the interaction, the attribute value of the node represents the user's opinion and position, and the network disagreement value D is used. t (z t ) and polarization value P t (z t ) to quantify the network conflict status.

[0036] In step 2 of the above method, public opinion data in social networks is collected regularly, the dynamics of the network are tracked, indicators are monitored, and conflict level indicators are regularly updated. and polarization value According to the current conflict level indicator and polarization value Determine the next time to monitor the network for conflict indicators.

[0037] In step 3 of the above method, we use the divergence value of the network and polarization value To characterize its current state, and approximate the changes of these two values ​​through differential equations. In order to determine the time when the attacker approaches the predetermined conflict state, the system dynamics are integrated over a time window T. It is worth noting that T increases with the increase of the upper limit of the attack disturbance. When the predicted network state develops to a time less than the predefined time threshold away from the predefined conflict state, the early warning mechanism is triggered.

[0038] In step 4 of the above method, technologies such as account recovery, community reporting mechanism, manual review, and keyword filtering are relied upon to detect and mark abnormal activity accounts in the network, and mechanisms such as account recovery, account recovery, and temporary freezing are used to recover abnormal accounts in the network to prevent further spread of malicious behavior.

[0039] In step 5 of the above method, the pre-attack state of the detected abnormal node is used as the node feature, the kernel density function is used to fit the feature distribution of the abnormal node, the abnormal probability of other nodes is estimated, the PageRank value is used as a quantitative measure of the importance of the node, and the nodes within the budget are selected for predictive protection in combination with the probability of mutation and importance.

[0040] Repeat steps 2-4 until the network status returns to normal.

[0041] The method of the present invention is used for the defense against hijacking malicious provocation attacks on social networks, allowing the platform to define conflict states as needed and defend against attacks in a near real-time environment based on a limited budget.

[0042] Example 1

[0043] The embodiment of the present invention introduces a defense response strategy for hijacking malicious provocation attacks in social networks. The method aims to give social platforms the ability to flexibly define conflict states, ensuring that such attacks can be effectively and efficiently resisted in near real-time situations based on established resource budget constraints. By dynamically adjusting defense measures and resource allocation, the method can maximize the protection of social networks from malicious provocations when resources are limited.

[0044] As shown in the figure, the defense implementation scheme of the present invention allows the platform to predefine the network conflict state and prevent attacks from causing the network to fall into a conflict state. The method of the present invention includes the following steps:

[0045] (1) In step 1 of the above method, the intrinsic opinion s of each account i in the social network is obtained during modeling. i and expression value z i , where s i ,z i ∈[0,1]. In the absence of an attacker, the change of each node's opinion in the network conforms to opinion dynamics, such as the repeated average model. The opinion of a user in the network at a given time t z t ∈[0,1] n , we use the network divergence value D t (z t ) and polarization value P t (z t ) to quantify the network conflict status. The calculation methods of these two indicators are

[0046]

[0047] In the formula, z t represents the average variable eigenvalue at time t, and its calculation formula is

[0048] (2) We use the network's divergence value and polarization value to characterize its current state, and the changes of these two values ​​are approximately described by the following differential equations. Considering the attacker's behavior, the dynamics of the network can be expressed as:

[0049]

[0050] These two ordinary differential equations describe the evolution of bifurcation values ​​and polarization values ​​over time. Taking the first equation as an example, Differentiation with respect to t The change rate includes the change of th The nodes affected by the round of attacks have a change of and the part recovered by the defender α represents the success rate of the attack, and ε is the proportion of suspected conflict nodes that are successfully recovered at time t. The other equation follows a similar rule.

[0051] When a node is successfully controlled with probability α, it can increase divergence and polarization by Θ(t), where Θ(t) represents:

[0052]

[0053] Among them, Pr(k i ) is a node with degree k i The probability of <k>is the average node degree of the network. c(k i ) represents the degree of conflict that a node can cause, Indicates the number of nodes that can be reached in one round of attack.

[0054] (3) The attack disturbance can be approximated as

[0055]

[0056] Among them, δ * In order to determine the time t when the attacker approaches the predetermined conflict state a ≡argmin|x * -x t |, we first integrate the system dynamics over a time window T. It is worth noting that T increases with the increase of the upper limit of the attack disturbance. Then, the variational equation is integrated to obtain the corresponding variational matrix M(t a ) The matrix is ​​based on Map small changes in the network's initial state to changes in the attack perturbation trajectory δx(t a ). This mapping is used to select the risk increment perturbation δx to the current initial state. t , so that the perturbation trajectory and the target at time t are within the error interval τ a The distance between them is the smallest, and Additional constraints are imposed to ensure the validity of the variational approximation. When the predicted network state evolves to a time less than a predefined time threshold away from a predefined conflict state, the early warning and defense response mechanisms are triggered.

[0057] (4) When the defense response mechanism is triggered, abnormal accounts in the network are detected. For hijacked accounts, account recovery is attempted first to help the original owner retrieve the account. If recovery is not possible, a warning message is sent to the account’s friends to restrict the account from making extreme remarks and control the spread of malicious remarks.

[0058] (5) Note r i represents the probability of a node being attacked, v i The defender selects the most critical n nodes to protect. i , using the pre-attack views and network structure characteristics of the detected abnormal nodes as node features, and using the kernel density function to fit the characteristic distribution of abnormal nodes to estimate the probability of mutations in other nodes. Calculate the PageRank value of each node as its v i , select r i *v i The first n nodes with the largest values ​​provide foresight protection.

[0059] The advantages of the defense method of the present invention are as follows: 1) The defense is effective and can effectively deal with provocative attacks such as account hijacking, and limit the upper limit of the attack effect before the network falls into a conflict state; 2) Good real-time performance, and can predict and warn the conflict level in near real time, so that defense measures can be deployed quickly; 3) Flexible use: This method allows platform administrators to flexibly define parameters such as the time threshold and trigger conditions of the conflict state according to actual needs. This high degree of customizability allows defense strategies to better meet the security needs of specific scenarios; 4) Fast calculation: The PageRank value of the network node can be pre-calculated, and the network node risk uses fewer characteristic parameters, which can be quickly calculated according to the kernel density algorithm, effectively shortening the time difference from threat discovery to response, and improving the timeliness of the overall defense.

[0060] The specific embodiments described herein are merely illustrative of the principles and effects of the present invention and are not intended to limit the present invention. Anyone familiar with the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by a person of ordinary skill in the art without departing from the spirit and technical ideas disclosed by the present invention shall still be covered by the claims of the present invention.< / k>

Claims

1. A method for public opinion control against hijacking-style malicious provocation attacks, characterized in that: The steps include: Step 1: Construct a social network evolution graph: For a social network facing an attack, model it as a weighted graph, in which indicators of the social network conflict level and the evolution of user opinions are defined; Step 2: Monitor the public opinion status of social networks: Calculate the dynamic execution interval, which is dynamically determined by the indicators of the current network status to balance the computing overhead and defense effect. According to the interval, monitor and analyze the collection indicators of the public opinion data in the social network for the next period, track the dynamics of the network, and regularly update the conflict level indicator. Step 3, attack risk warning: set the time threshold of the conflict state that requires intervention, calculate the difference between the current network state and the initial state, use the near-linear estimation method to predict the time when the conflict level approaches the predefined state, and trigger the warning mechanism when the predicted network state develops to a time less than the predefined time threshold away from the predefined conflict state; Step 4, abnormal account recovery: Use behavioral analysis and pattern recognition technology to detect and mark abnormal activity accounts in the network, and use mechanisms such as account recovery, account retrieval and temporary freezing to recover abnormal accounts in the network to prevent further malicious behavior from spreading; Step 5, provide predictive protection: infer the attacker's attack preferences based on the information of the identified abnormal accounts, calculate the probability of the account being attacked, analyze the influence and importance of each account in the network, determine which accounts may cause major conflicts after being attacked, and provide additional security measures for the identified key risk accounts, such as enhanced password policies, multi-factor authentication and regular security reviews.

2. The method for public opinion control against hijacking-style malicious provocation attacks according to claim 1 is characterized in that: In step 1, the status and association of users in the social network are represented by a graph, each user or entity is represented as a node in the graph, the edge between nodes represents the interactive relationship, the weight of the edge reflects the frequency or influence of the interaction, the attribute value of the node represents the user's opinion and position, and the network divergence value and polarization value are used to quantify the network conflict state. In the absence of an attacker, the change of each node's opinion in the network conforms to the opinion dynamics, such as the repeated average model. In the presence of an attacker, the opinion and position of the attacked node will be extreme values.

3. The method for public opinion control against hijacking-style malicious provocation attacks according to claim 1 is characterized in that: In step 2, the current state of the network is characterized by using its divergence value and polarization value, and the changes of these two values ​​are approximately described by differential equations, and the monitoring time interval is dynamically adjusted. If the divergence value and polarization value increase significantly, the monitoring time of the network state is shortened.

4. The method for public opinion control against hijacking-style malicious provocation attacks according to claim 1 is characterized in that: In step 3, a forward-looking early warning trigger mechanism is implemented by setting a time threshold of the conflict state, combining a quantitative analysis of the difference between the current and initial network states, and using a near-linear estimation method to predict future conflict levels.

5. The method for public opinion control against hijacking-style malicious provocation attacks according to claim 1 is characterized in that: In step 4, advanced behavioral analysis and pattern recognition technologies are used to quickly and accurately identify and respond to abnormal activity accounts in the network, and comprehensive recovery measures are used to quickly restore account status or isolate risks, effectively preventing the further spread of malicious behavior and ensuring network security.

6. The method for public opinion control against hijacking malicious provocation attacks according to claim 1 is characterized in that: In step 5, the pre-attack behavior and network structure characteristics of the detected abnormal accounts are deeply analyzed, and statistical methods such as kernel density functions are used to predict the risk of other nodes in the network being subjected to similar attacks. At the same time, algorithms such as PageRank are combined to evaluate the importance of each node in the network. The two are combined to identify key nodes that may cause major conflicts once attacked. Subsequently, enhanced security measures such as strong password policies, multi-factor authentication, and regular security reviews are provided for these key risk accounts to proactively protect the network from potential attacks.

Images