Social network-oriented user behavior analysis system and method

Abstract

The invention discloses a social network-oriented user behavior analysis system and method, and the method comprises the steps: carrying out the judgment of a possible user interaction behavior violation access website, obtaining an accurate user interaction behavior violation access website, and outputting an Internet browsing track Trojan virus invasion early warning prompt box according to the accurate user interaction behavior violation access website; when the signal is the social connection user interaction behavior violation signal, calling the user interaction behavior violation geographical location in the social connection user interaction behavior violation signal; transmitting the user interaction behavior violation geographical location to an edge calculation gateway graph neural network analysis model in different parameter user interaction behavior violation time periods to obtain a social connection Trojan virus intrusion early warning prompt box; the internet browsing track Trojan virus invasion early warning prompt box gives specific reasons for user interaction behavior violation in the dangerous social connection, and behavior analysis is carried out; according to the invention, the recognition capability and response speed of the social network platform to illegal behaviors are improved, and the user experience is improved.

Description

Technical Field

[0001] The present invention relates to the field of KID analysis, and in particular to a user behavior analysis system and method for social networks. Background Art

[0002] With the popularity of social networking platforms, user behavior analysis has become an important part of social network management and operation. Traditional user behavior analysis methods mainly rely on rule engines, statistical models and traditional machine learning algorithms (such as decision trees, support vector machines, etc.). These methods rely on manual feature extraction and cannot fully explore the deep patterns and associations in user behavior data. For example, rule-based systems can only process predefined rules and thresholds, and are often difficult to deal with complex and changeable user interaction behaviors. Especially when faced with massive amounts of user data, the design, maintenance and update of rules and models require a lot of manual intervention. These methods are usually unable to accurately capture the dynamic changes in user behavior. Therefore, it is difficult to identify potential violations or abnormal behaviors in a timely manner, and it is impossible to conduct in-depth analysis based on the details of user behavior.

[0003] The disadvantage of the existing technology is the lack of in-depth analysis and rapid response capabilities for user interactive behaviors. Traditional analysis methods mostly rely on static features and patterns, lack the ability to process user interactive behaviors in real time, and cannot cope with real-time and dynamic social network environments. Especially in terms of user behavior violation detection, traditional methods often fail to capture potential violation risks in user behaviors in a timely manner through simple rules or label-based data classification. For example, for user interactive behaviors across platforms and time periods, traditional methods are difficult to fully detect, resulting in some violations not being discovered and handled in a timely manner. This slow response problem not only affects the compliance and security of the platform, but also reduces the efficiency and accuracy of the system in processing user behaviors; therefore, it is necessary to provide a user behavior analysis system and method for social networks to solve the above problems. Summary of the invention

[0004] In view of the deficiencies in the prior art, the purpose of the present invention is to provide a user behavior analysis system and method for social networks to solve the problems existing in the above-mentioned background technology.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] A user behavior analysis system for social networks, the system comprising:

[0007] A user interaction behavior violation signal module is used to perform dynamic feature analysis on the social network screening process of different groups, and when a user interaction behavior violation occurs, a user interaction behavior violation signal for screening of different groups of social networks is generated, wherein the user interaction behavior violation signal for screening of different groups of social networks is a user interaction behavior violation signal of an online browsing trajectory or a user interaction behavior violation signal of a social connection;

[0008] The user interaction behavior violation evaluation module for different time periods, when it is a user interaction behavior violation signal of the online browsing trajectory, retrieves the user interaction behavior violation statistics table in the user interaction behavior violation signal of the online browsing trajectory, transmits the user interaction behavior violation statistics table to the project user interaction behavior violation different time period edge computing gateway graph neural network analysis model, and obtains the possible user interaction behavior violation access URL;

[0009] The Internet browsing track Trojan virus intrusion warning prompt box module is used to judge the possible user interaction behavior illegal access URLs, obtain the accurate user interaction behavior illegal access URLs, and output the Internet browsing track Trojan virus intrusion warning prompt box according to the accurate user interaction behavior illegal access URLs;

[0010] The social connection Trojan virus intrusion warning prompt box module, when it is a social connection user interaction behavior violation signal, retrieves the user interaction behavior violation geographic location in the social connection user interaction behavior violation signal, transmits the user interaction behavior violation geographic location to the parameter user interaction behavior violation edge computing gateway graph neural network analysis model in different time periods, and obtains the social connection Trojan virus intrusion warning prompt box. The social connection Trojan virus intrusion warning prompt box contains the network background disconnection signal.

[0011] The following is a further improvement of the above technical solution of the present invention:

[0012] The user interaction behavior violation assessment modules for different time periods include:

[0013] The interface of possible user interaction behavior violation access website is used to sequentially transmit all user interaction behavior violation statistics tables in the user interaction behavior violation signal of the Internet browsing trajectory to the edge computing gateway graph neural network analysis model of the project user interaction behavior violation at different time periods, each user interaction behavior violation statistics table corresponds to the user interaction behavior violation feature, and the project user interaction behavior violation at different time periods edge computing gateway graph neural network analysis model includes a number of user interaction behavior violation statistics tables and corresponding possible user interaction behavior violation access website;

[0014] The interface for checking user interaction behavior violations at different time periods is used to output URLs that may be visited in violation of user interaction behavior, and to check URLs that may be visited in violation of user interaction behavior based on the characteristics of user interaction behavior violations.

[0015] Furthermore, the user interaction behavior violation checking interface for different time periods includes:

[0016] The user interaction behavior violation frequency determination sub-interface is used to retrieve the search behavior characteristics according to the user interaction behavior violation statistics table, and determine the user interaction behavior violation frequency according to the search behavior characteristics and the user interaction behavior violation characteristics;

[0017] The sub-interface for checking user interaction behavior violations at different time periods is used to check possible user interaction behavior violation access URLs based on the user interaction behavior violation frequency. Each possible user interaction behavior violation access URL in the edge computing gateway graph neural network analysis model of the project user interaction behavior violations at different time periods corresponds to the resulting user interaction behavior violation frequency.

[0018] Furthermore, the Internet browsing track Trojan virus intrusion warning prompt box module includes:

[0019] The user interaction behavior violation transmission interface for different time periods is used to sequentially transmit the URLs visited for possible user interaction behavior violation to the user interaction behavior violation cloud for different time periods, and output the statistical table of related user interaction behavior violation. The user interaction behavior violation cloud for different time periods includes all the different time periods for user interaction behavior violation, and the statistical table of related user interaction behavior violation caused by each different time period for user interaction behavior violation;

[0020] The user interaction behavior violation judgment interface for different time periods is used to judge whether the associated user interaction behavior violation statistics table exists in the online browsing track user interaction behavior violation signal. When it appears in the online browsing track user interaction behavior violation signal, it is judged that the possible user interaction behavior violation visit URL is the accurate user interaction behavior violation visit URL;

[0021] The Internet browsing track Trojan virus intrusion warning prompt box generation interface is used to integrate all accurate user interaction behavior illegal access URLs and then output the Internet browsing track Trojan virus intrusion warning prompt box.

[0022] Furthermore, the social connection Trojan virus intrusion warning prompt box module includes:

[0023] A user interaction behavior violation geolocation transmission interface, used to transmit the user interaction behavior violation geolocation to a parameter user interaction behavior violation different time period edge computing gateway graph neural network analysis model, wherein the parameter user interaction behavior violation different time period edge computing gateway graph neural network analysis model includes all user interaction behavior violation geolocations, corresponding user interaction behavior violation results and network background disconnection signals;

[0024] The social connection Trojan virus intrusion warning prompt box generation interface is used to output the user interaction behavior violation results and the network background disconnection signal, and integrate the user interaction behavior violation results and the network background disconnection signal to obtain the social connection Trojan virus intrusion warning prompt box.

[0025] The present invention also provides a user behavior analysis method for social networks, the method comprising the following steps:

[0026] Perform dynamic feature analysis on the social network screening process for different groups, and when user interaction behavior violates the rules, generate a signal for violating the user interaction behavior of different groups of social networks, wherein the signal for violating the user interaction behavior of different groups of social networks is a signal for violating the user interaction behavior of online browsing track or a signal for violating the user interaction behavior of social connection;

[0027] When it is a user interaction behavior violation signal of the online browsing trajectory, the user interaction behavior violation statistics table in the user interaction behavior violation signal of the online browsing trajectory is retrieved, and the user interaction behavior violation statistics table is transmitted to the edge computing gateway graph neural network analysis model of the project user interaction behavior violation at different time periods to obtain the possible user interaction behavior violation access URL;

[0028] Determine the URLs that may be visited in violation of user interaction behaviors, obtain the accurate URLs that are visited in violation of user interaction behaviors, and output the Internet browsing track Trojan virus intrusion warning prompt box based on the accurate URLs that are visited in violation of user interaction behaviors;

[0029] When it is a social connection user interaction behavior violation signal, the user interaction behavior violation geographic location in the social connection user interaction behavior violation signal is retrieved, and the user interaction behavior violation geographic location is transmitted to the parameter user interaction behavior violation edge computing gateway graph neural network analysis model in different time periods to obtain a social connection Trojan virus intrusion warning prompt box, which contains a network background disconnection signal.

[0030] The following is a further improvement of the above technical solution of the present invention:

[0031] The step of transmitting the user interaction behavior violation statistics table to the edge computing gateway graph neural network analysis model of the project user interaction behavior violation at different time periods to obtain the URLs visited by possible user interaction behavior violations specifically includes:

[0032] Transmitting all user interaction behavior violation statistics tables in the online browsing trajectory user interaction behavior violation signals to the project user interaction behavior violation different time periods edge computing gateway graph neural network analysis model in sequence, each user interaction behavior violation statistics table corresponds to a user interaction behavior violation feature, and the project user interaction behavior violation different time periods edge computing gateway graph neural network analysis model includes a number of user interaction behavior violation statistics tables and corresponding possible user interaction behavior violation access URLs;

[0033] Output the URLs that may be visited by users in violation of user interaction behaviors, and check the URLs that may be visited by users in violation of user interaction behaviors according to the characteristics of user interaction behaviors in violation of regulations.

[0034] Furthermore, the step of screening the URLs accessed by possible user interaction behaviors in violation of regulations according to the user interaction behaviors in violation of regulations specifically includes:

[0035] Retrieve search behavior characteristics based on the user interaction behavior violation statistics table, and determine the user interaction behavior violation frequency based on the search behavior characteristics and the user interaction behavior violation characteristics;

[0036] According to the frequency of user interaction behavior violations, the possible user interaction behavior violation access URLs are checked, and each possible user interaction behavior violation access URL in the edge computing gateway graph neural network analysis model of the project user interaction behavior violations in different time periods corresponds to the resulting user interaction behavior violation frequency.

[0037] Furthermore, the step of judging the possible illegal access URLs of user interactive behaviors, obtaining accurate illegal access URLs of user interactive behaviors, and outputting a Trojan virus intrusion warning prompt box of Internet browsing track according to the accurate illegal access URLs of user interactive behaviors specifically includes:

[0038] Transmitting the possible user interaction behavior violation access URLs to the user interaction behavior violation cloud in different time periods in sequence, and outputting the associated user interaction behavior violation statistics table, wherein the user interaction behavior violation cloud in different time periods includes all user interaction behavior violation different time periods, and the interrelated user interaction behavior violation statistics table caused by each user interaction behavior violation different time periods;

[0039] Determine whether the associated user interaction behavior violation statistics table exists in the online browsing track user interaction behavior violation signal. If it appears in the online browsing track user interaction behavior violation signal, determine that the possible user interaction behavior violation access URL is the accurate user interaction behavior violation access URL;

[0040] After integrating all accurate user interaction behaviors and illegal access URLs, an Internet browsing track and Trojan virus intrusion warning prompt box are output.

[0041] Furthermore, the step of transmitting the user interaction behavior violation geolocation to the parameter user interaction behavior violation different time period edge computing gateway graph neural network analysis model to obtain the social connection Trojan virus invasion warning prompt box specifically includes:

[0042] Transmitting the geographic location of user interaction behavior violations to a parameter user interaction behavior violation different time period edge computing gateway graph neural network analysis model, wherein the parameter user interaction behavior violation different time period edge computing gateway graph neural network analysis model includes all user interaction behavior violation geographic locations, corresponding user interaction behavior violation results and network background disconnection signals;

[0043] Output the violation results of user interaction behavior and the network background disconnection signal, and integrate the violation results of user interaction behavior and the network background disconnection signal to obtain a social connection Trojan virus intrusion warning prompt box.

[0044] Beneficial effects:

[0045] The present invention adopts the above technical scheme, which is ingenious in conception and can perform dynamic feature analysis on the social network screening links of different groups. When user interaction behavior violates the rules, a signal for screening user interaction behavior violation of different groups of social networks is generated. The signal for screening user interaction behavior violation of different groups of social networks is a user interaction behavior violation signal of an online browsing trajectory or a user interaction behavior violation signal of a social connection. When it is a user interaction behavior violation signal of an online browsing trajectory, a user interaction behavior violation statistics table in the user interaction behavior violation signal of an online browsing trajectory is retrieved, and the user interaction behavior violation statistics table is transmitted to the edge computing gateway graph neural network analysis model of the project user interaction behavior violation at different time periods to obtain a possible user interaction behavior violation access URL, and the possible user interaction behavior violation access URL is judged to obtain accurate user interaction behavior. For illegal access to the website, the Internet browsing trajectory Trojan virus invasion warning prompt box is output according to the accurate user interaction behavior illegal access website; when it is a social connection user interaction behavior violation signal, the user interaction behavior violation geographic location in the social connection user interaction behavior violation signal is retrieved, and the user interaction behavior violation geographic location is transmitted to the parameter user interaction behavior violation different time period edge computing gateway graph neural network analysis model, and the social connection Trojan virus invasion warning prompt box is obtained; the Internet browsing trajectory Trojan virus invasion warning prompt box can give the specific reason for the user interaction behavior violation of the dangerous object, so as to analyze the actual behavior; the social connection Trojan virus invasion warning prompt box contains the network background disconnection signal, and then can quickly respond to the user interaction behavior violation problem, improve work efficiency, and effectively prevent the user from illegally surfing the Internet. The present invention uses the graph neural network structured data processing technology, which can automatically extract efficient feature representation from the data through adaptive learning and multi-level information transmission, so as to analyze the user behavior more comprehensively and accurately. Compared with traditional methods, the graph neural network model can not only find potential complex patterns in massive data, but also realize real-time feedback when facing dynamically changing user behavior. Through graph neural network technology, the social networking platform's ability to identify and respond to violations can be significantly improved, thereby improving overall operational efficiency and user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a system structure diagram of the present invention.

[0047] Figure 2 It is a flow chart of the system operation of the present invention; DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0049] The specific implementation of the present invention is described in detail below in conjunction with specific embodiments.

[0050] like Figure 1 As shown, an embodiment of the present invention further provides a user behavior analysis system for social networks, the system comprising:

[0051] The user interaction behavior violation signal module 101 is used to perform dynamic feature analysis on the social network screening process of different groups, and generate a user interaction behavior violation signal for screening of different groups of social networks when a user interaction behavior violation occurs. The user interaction behavior violation signal for screening of different groups of social networks is a user interaction behavior violation signal of an online browsing trajectory or a user interaction behavior violation signal of a social connection;

[0052] The user interaction behavior violation different time period evaluation module 102, when it is an online browsing trajectory user interaction behavior violation signal, retrieves the user interaction behavior violation statistics table in the online browsing trajectory user interaction behavior violation signal, transmits the user interaction behavior violation statistics table to the project user interaction behavior violation different time period edge computing gateway graph neural network analysis model, and obtains the possible user interaction behavior violation access URL;

[0053] The Internet browsing track Trojan virus intrusion warning prompt box module 103 is used to judge the possible user interaction behavior illegal access website, obtain the accurate user interaction behavior illegal access website, and output the Internet browsing track Trojan virus intrusion warning prompt box according to the accurate user interaction behavior illegal access website;

[0054] The social connection Trojan virus intrusion warning prompt box module 104, when it is a social connection user interaction behavior violation signal, retrieves the user interaction behavior violation geographic location in the social connection user interaction behavior violation signal, transmits the user interaction behavior violation geographic location to the parameter user interaction behavior violation edge computing gateway graph neural network analysis model in different time periods, and obtains the social connection Trojan virus intrusion warning prompt box, which contains the network background disconnection signal.

[0055] In the embodiment of the present invention, dynamic feature analysis is performed on each link of social network screening for different groups. When user interaction behavior violates the rules, a signal of violation of user interaction behavior screening for different groups of social networks is generated. The signal of violation of user interaction behavior screening for different groups of social networks is generated in two situations. One is that when dangerous social connections are detected, some unqualified items appear, and a signal of violation of user interaction behavior in online browsing trajectory is generated.

[0056] The other is that during the analysis of dangerous goods, if the analysis parameters of prohibited social connections show user interaction behavior violations, a social connection user interaction behavior violation signal will be generated.

[0057] When a user interaction behavior violation signal of an online browsing trajectory is generated, a user interaction behavior violation statistics table in the user interaction behavior violation signal of the online browsing trajectory is retrieved, and the user interaction behavior violation statistics table is transmitted to the edge computing gateway graph neural network analysis model of the project user interaction behavior violation in different time periods to obtain possible user interaction behavior violation access URLs. In order to further narrow the scope of different time periods of user interaction behavior violations and determine the specific reasons, the embodiment of the present invention will automatically judge possible user interaction behavior violation access URLs to obtain accurate user interaction behavior violation access URLs, and output an online browsing trajectory Trojan virus intrusion warning prompt box based on the accurate user interaction behavior violation access URLs. In this way, the online browsing trajectory Trojan virus intrusion warning prompt box can give the specific reasons for the user interaction behavior violations in dangerous social connections, thereby realizing behavior analysis.

[0058] When it is a social connection user interaction behavior violation signal, the user interaction behavior violation geolocation in the social connection user interaction behavior violation signal is retrieved, and the user interaction behavior violation geolocation is transmitted to the parameter user interaction behavior violation edge computing gateway graph neural network analysis model in different time periods to obtain a social connection Trojan virus intrusion warning prompt box. The social connection Trojan virus intrusion warning prompt box contains a network background disconnection signal, which can quickly respond to user interaction behavior violation issues, improve work efficiency, and effectively prevent users from illegally accessing the Internet.

[0059] In a preferred embodiment of the present invention, the user interaction behavior violation different time period evaluation module 102 includes:

[0060] Possible user interaction behavior violation access website interface 1021, used to sequentially transmit all user interaction behavior violation statistics tables in the Internet browsing trajectory user interaction behavior violation signal to the project user interaction behavior violation different time period edge computing gateway graph neural network analysis model, each user interaction behavior violation statistics table corresponds to the user interaction behavior violation feature, and the project user interaction behavior violation different time period edge computing gateway graph neural network analysis model includes a plurality of user interaction behavior violation statistics tables and corresponding possible user interaction behavior violation access website;

[0061] The user interaction behavior violation checking interface 1022 for different time periods is used to output possible user interaction behavior violation access URLs and check possible user interaction behavior violation access URLs according to user interaction behavior violation characteristics.

[0062] In a preferred embodiment of the present invention, the user interaction behavior violation different time period troubleshooting interface 1022 includes:

[0063] The user interaction behavior violation frequency determination sub-interface 10221 is used to retrieve the search behavior characteristics according to the user interaction behavior violation statistics table, and determine the user interaction behavior violation frequency according to the search behavior characteristics and the user interaction behavior violation characteristics;

[0064] The sub-interface 10222 for checking user interaction behavior violations at different time periods is used to check possible user interaction behavior violation access URLs according to the user interaction behavior violation frequency. Each possible user interaction behavior violation access URL in the edge computing gateway graph neural network analysis model of the project user interaction behavior violations at different time periods corresponds to the resulting user interaction behavior violation frequency.

[0065] In a preferred embodiment of the present invention, the Internet browsing track Trojan virus invasion warning prompt box module 103 includes:

[0066] The user interaction behavior violation transmission interface 1031 is used to sequentially transmit the possible user interaction behavior violation access URLs to the user interaction behavior violation cloud at different time periods, and output the associated user interaction behavior violation statistics table, wherein the user interaction behavior violation cloud at different time periods includes all user interaction behavior violation at different time periods, and the associated user interaction behavior violation statistics table caused by each user interaction behavior violation at different time periods;

[0067] The user interaction behavior violation different time period judgment interface 1032 is used to judge whether the associated user interaction behavior violation statistics table exists in the online browsing track user interaction behavior violation signal. When it appears in the online browsing track user interaction behavior violation signal, it is judged that the possible user interaction behavior violation access URL is the accurate user interaction behavior violation access URL;

[0068] The Internet browsing track Trojan virus intrusion warning prompt box generation interface 1033 is used to integrate all accurate user interaction behavior illegal access URLs and then output the Internet browsing track Trojan virus intrusion warning prompt box.

[0069] In a preferred embodiment of the present invention, the social connection Trojan virus invasion warning prompt box module 104 includes:

[0070] The user interaction behavior violation geolocation transmission interface 1041 is used to transmit the user interaction behavior violation geolocation to the parameter user interaction behavior violation different time period edge computing gateway graph neural network analysis model, wherein the parameter user interaction behavior violation different time period edge computing gateway graph neural network analysis model includes all user interaction behavior violation geolocation, corresponding user interaction behavior violation results and network background disconnection signal;

[0071] The social connection Trojan virus invasion warning prompt box generation interface 1042 is used to output the user interaction behavior violation results and the network background disconnection signal, and integrate the user interaction behavior violation results and the network background disconnection signal to obtain the social connection Trojan virus invasion warning prompt box.

[0072] like Figure 2 As shown, a user behavior analysis method for social networks includes the following steps:

[0073] Step S1, performing dynamic feature analysis on the social network screening process for different groups, and generating a signal for the user interaction behavior violation of the social network screening for different groups when a user interaction behavior violation occurs, wherein the signal for the user interaction behavior violation of the social network screening for different groups is a user interaction behavior violation signal of an online browsing trajectory or a user interaction behavior violation signal of a social connection;

[0074] Step S2: when it is a user interaction behavior violation signal of the online browsing trajectory, retrieve the user interaction behavior violation statistics table in the user interaction behavior violation signal of the online browsing trajectory, transmit the user interaction behavior violation statistics table to the edge computing gateway graph neural network analysis model of the project user interaction behavior violation at different time periods, and obtain the possible user interaction behavior violation access URL;

[0075] Step S3, judging the possible illegal access URLs of user interactive behaviors, obtaining accurate illegal access URLs of user interactive behaviors, and outputting a Trojan virus intrusion warning prompt box of Internet browsing track according to the accurate illegal access URLs of user interactive behaviors;

[0076] Step S4: When it is a social connection user interaction behavior violation signal, retrieve the user interaction behavior violation geolocation in the social connection user interaction behavior violation signal, transmit the user interaction behavior violation geolocation to the parameter user interaction behavior violation in different time periods edge computing gateway graph neural network analysis model, and obtain the social connection Trojan virus intrusion warning prompt box.

[0077] It should be noted that with the deepening and popularization of intelligent analysis, it has also been applied to the screening of social networks of different groups. Various parameters in user behavior can be uploaded to the server in real time to facilitate remote dynamic feature analysis to ensure the convenience of dangerous goods analysis. Although remote dynamic feature analysis can timely know that there are user interaction behavior violations, it is often unable to give the specific cause and solution of the problem, and cannot quickly respond to user interaction behavior violations, thereby improving work efficiency and effectively preventing users from illegally surfing the Internet. The embodiments of the present invention aim to solve the above problems.

[0078] In the embodiment of the present invention, the graph neural network analysis model, the analysis process includes:

[0079] S101. Model input and graph structure. First, define the graph structure and input, nodes (users and URLs):

[0080] Each node represents a user or a URL;

[0081] The characteristics of user nodes include interactive behavior violation characteristics (such as frequent access, time, violation type, etc.);

[0082] The characteristics of the URL node include the website's violation history, whether it is a known violation URL, etc.

[0083] Edge (interaction between users and users, users and URLs):

[0084] The edges between users can represent social relationships (such as following, interaction, etc.);

[0085] S102, node feature initialization, initial features of each node v It is initialized according to the behavior or attributes of the node. For user node u:

[0086]

[0087] For URL node w:

[0088]

[0089] Where f(·) represents the feature extraction function, which can be a simple linear transformation or a feature vector obtained by other methods;

[0090] S103, Graph Convolution Layer. The core of graph neural network is the information transmission and aggregation process. In each round of graph convolution, a node updates its own state by aggregating the information of its neighboring nodes.

[0091] Assume that the nodes in the tth layer are represented as Its update formula is:

[0092]

[0093] in, is the feature representation of node v in round t, W (t) is the weight matrix of the tth layer, N(v) represents the set of neighbor nodes of node v, and σ is the activation function (such as ReLU);

[0094] In this formula, the information of each node is not only related to its own characteristics, but also affected by the information of its neighboring nodes. After the information of the neighboring nodes is aggregated, it is combined with the characteristics of the node itself and a new representation is obtained through the activation function.

[0095] S104, the final feature representation of the node. After multiple rounds of graph convolution, the final representation of the node It will contain the interaction information between itself and its neighbors, which can be used for subsequent prediction tasks;

[0096] S105, violation prediction, for each user node u, the final representation obtained by the present invention through the graph convolution layer Can be used to predict violations and output a probability value To indicate whether the user may violate the rules:

[0097]

[0098] Among them, W out is the weight matrix of the output layer; σ is the activation function (usually the sigmoid function is used for binary classification);

[0099] S106, website violation prediction. Similarly, for a website node w, the present invention can predict whether the website will be visited and whether it is a violation website. The prediction formula is similar to the prediction of the user node:

[0100]

[0101] S107, loss function, assuming that the present invention has label data, the violation label of the user behavior is y u , the URL's violation label is y w , the loss function can use binary cross entropy loss:

[0102]

[0103] Among them, V is the set of all nodes (including user and website nodes), is the probability predicted by the model, y v is the true label;

[0104] S108, the training process of the model, by minimizing the loss function L, the present invention can train the graph neural network model and optimize the weight matrix W (t) and W out , so that the model can more accurately predict users' illegal behaviors and possible illegal URLs;

[0105] S109, model output, finally, the model outputs the possible illegal access URL w pred :

[0106]

[0107] This means that for each user node u, the model outputs the possible illegal URL w associated with it based on its behavior characteristics. pred , and check these URLs based on the violation prediction results.

[0108] In the embodiment of the present invention, dynamic feature analysis is performed on each link of social network screening for different groups. When user interaction behavior violates the rules, a signal of violation of user interaction behavior screening for different groups of social networks is generated. The signal of violation of user interaction behavior screening for different groups of social networks is generated in two situations. One is that when dangerous social connections are detected, some unqualified items appear, and a signal of violation of user interaction behavior in online browsing trajectory is generated.

[0109] The other is that during the analysis of dangerous goods, if the analysis parameters of prohibited social connections show user interaction behavior violations, a social connection user interaction behavior violation signal will be generated.

[0110] When a user interaction behavior violation signal of an online browsing trajectory is generated, a user interaction behavior violation statistics table in the user interaction behavior violation signal of the online browsing trajectory is retrieved, and the user interaction behavior violation statistics table is transmitted to the edge computing gateway graph neural network analysis model of the project user interaction behavior violation in different time periods to obtain possible user interaction behavior violation access URLs. In order to further narrow the scope of different time periods of user interaction behavior violations and determine the specific reasons, the embodiment of the present invention will automatically judge possible user interaction behavior violation access URLs to obtain accurate user interaction behavior violation access URLs, and output an online browsing trajectory Trojan virus intrusion warning prompt box based on the accurate user interaction behavior violation access URLs. In this way, the online browsing trajectory Trojan virus intrusion warning prompt box can give the specific reasons for the user interaction behavior violations in dangerous social connections, thereby realizing behavior analysis.

[0111] When it is a social connection user interaction behavior violation signal, the user interaction behavior violation geolocation in the social connection user interaction behavior violation signal is retrieved, and the user interaction behavior violation geolocation is transmitted to the parameter user interaction behavior violation edge computing gateway graph neural network analysis model in different time periods to obtain a social connection Trojan virus intrusion warning prompt box. The social connection Trojan virus intrusion warning prompt box contains a network background disconnection signal, which can quickly respond to user interaction behavior violation issues, improve work efficiency, and effectively prevent users from illegally accessing the Internet.

[0112] In a preferred embodiment of the present invention, the step of transmitting the user interaction behavior violation statistics table to the edge computing gateway graph neural network analysis model of the project user interaction behavior violation at different time periods to obtain the URLs visited by possible user interaction behavior violations specifically includes:

[0113] Transmitting all user interaction behavior violation statistics tables in the online browsing trajectory user interaction behavior violation signals to the project user interaction behavior violation different time periods edge computing gateway graph neural network analysis model in sequence, each user interaction behavior violation statistics table corresponds to a user interaction behavior violation feature, and the project user interaction behavior violation different time periods edge computing gateway graph neural network analysis model includes a number of user interaction behavior violation statistics tables and corresponding possible user interaction behavior violation access URLs;

[0114] Output the URLs that may be visited by users in violation of user interaction behaviors, and check the URLs that may be visited by users in violation of user interaction behaviors according to the characteristics of user interaction behaviors in violation of regulations.

[0115] In an embodiment of the present invention, an edge computing gateway graph neural network analysis model for project user interaction behavior violations at different time periods is established in advance, and the edge computing gateway graph neural network analysis model for project user interaction behavior violations at different time periods includes several user interaction behavior violation statistics tables and corresponding possible user interaction behavior violation access URLs. In this way, the possible user interaction behavior violation access URLs can be determined based on the user interaction behavior violation statistics table. It is easy to understand that these possible user interaction behavior violation access URLs will lead to the generation of the user interaction behavior violation statistics table.

[0116] In a preferred embodiment of the present invention, the step of screening the URLs accessed by possible user interaction behaviors in violation of regulations according to the user interaction behaviors in violation of regulations specifically includes:

[0117] Retrieve search behavior characteristics based on the user interaction behavior violation statistics table, and determine the user interaction behavior violation frequency based on the search behavior characteristics and the user interaction behavior violation characteristics;

[0118] According to the frequency of user interaction behavior violations, the possible user interaction behavior violation access URLs are checked, and each possible user interaction behavior violation access URL in the edge computing gateway graph neural network analysis model of the project user interaction behavior violations in different time periods corresponds to the resulting user interaction behavior violation frequency.

[0119] In an embodiment of the present invention, there may be many websites that may be visited in violation of user interaction behavior regulations. In order to further narrow the scope, the search behavior characteristics are retrieved according to the project name of the user interaction behavior violation statistics table, and the user interaction behavior violation frequency is determined according to the frequency of the user interaction behavior violation characteristics deviating from the search behavior characteristics. Finally, the possible user interaction behavior violation website addresses are checked according to the user interaction behavior violation frequency. Each possible user interaction behavior violation website address in the edge computing gateway graph neural network analysis model of the project user interaction behavior violation in different time periods corresponds to the resulting user interaction behavior violation frequency. It is easy to understand that although many different time periods will lead to the generation of the same user interaction behavior violation statistics table, the user interaction behavior violation frequencies generated for the same project in different time periods are different. The embodiment of the present invention checks the possible user interaction behavior violation website addresses based on this principle.

[0120] In a preferred embodiment of the present invention, the steps of judging the possible illegal access URLs of user interactive behaviors, obtaining accurate illegal access URLs of user interactive behaviors, and outputting a Trojan virus intrusion warning prompt box of Internet browsing track according to the accurate illegal access URLs of user interactive behaviors specifically include:

[0121] Transmitting the possible user interaction behavior violation access URLs to the user interaction behavior violation cloud in different time periods in sequence, and outputting the associated user interaction behavior violation statistics table, wherein the user interaction behavior violation cloud in different time periods includes all user interaction behavior violation different time periods, and the interrelated user interaction behavior violation statistics table caused by each user interaction behavior violation different time periods;

[0122] Determine whether the associated user interaction behavior violation statistics table exists in the online browsing track user interaction behavior violation signal. If it appears in the online browsing track user interaction behavior violation signal, determine that the possible user interaction behavior violation access URL is the accurate user interaction behavior violation access URL;

[0123] After integrating all accurate user interaction behaviors and illegal access URLs, an Internet browsing track and Trojan virus intrusion warning prompt box are output.

[0124] In the embodiment of the present invention, the possible user interaction behavior violation access website after screening still has the problem of not being specific and accurate enough. Furthermore, it is necessary to transmit the possible user interaction behavior violation access website to the user interaction behavior violation cloud of different time periods. The user interaction behavior violation cloud of different time periods is established in advance. The user interaction behavior violation cloud of different time periods includes all different time periods of user interaction behavior violations, and the interrelated user interaction behavior violation statistics tables caused by each user interaction behavior violation different time periods. It is easy to understand that a user interaction behavior violation different time period often leads to the simultaneous generation of multiple user interaction behavior violation statistics tables, and these user interaction behavior violation statistics tables are interrelated. Therefore, each time a possible user interaction behavior violation access website is transmitted, an associated user interaction behavior violation statistics table will be obtained, and then it is determined whether the associated user interaction behavior violation statistics table exists in the user interaction behavior violation signal of the online browsing trajectory. Only when it appears in the user interaction behavior violation signal of the online browsing trajectory, the possible user interaction behavior violation access website is determined to be an accurate user interaction behavior violation access website; otherwise, the possible user interaction behavior violation access website is determined to be a non-user interaction behavior violation different time period and deleted.

[0125] Finally, after integrating all accurate user interaction behavior violation URLs, an Internet browsing track Trojan virus intrusion warning prompt box is output. In this way, the Internet browsing track Trojan virus intrusion warning prompt box can give the precise and specific reasons for the user interaction behavior violations in dangerous social connections.

[0126] In a preferred embodiment of the present invention, the step of transmitting the user interaction behavior violation geographic location to the parameter user interaction behavior violation different time period edge computing gateway graph neural network analysis model to obtain the social connection Trojan virus invasion warning prompt box specifically includes:

[0127] Transmitting the geographic location of user interaction behavior violations to a parameter user interaction behavior violation different time period edge computing gateway graph neural network analysis model, wherein the parameter user interaction behavior violation different time period edge computing gateway graph neural network analysis model includes all user interaction behavior violation geographic locations, corresponding user interaction behavior violation results and network background disconnection signals;

[0128] Output the violation results of user interaction behavior and the network background disconnection signal, and integrate the violation results of user interaction behavior and the network background disconnection signal to obtain a social connection Trojan virus intrusion warning prompt box.

[0129] In an embodiment of the present invention, a parameterized user interaction behavior violation at different time periods edge computing gateway graph neural network analysis model is established in advance, and the parameterized user interaction behavior violation at different time periods edge computing gateway graph neural network analysis model includes all user interaction behavior violation geolocations, corresponding user interaction behavior violation results and network background disconnection signals, and the parameterized user interaction behavior violation at different time periods edge computing gateway graph neural network analysis model needs to be continuously updated and improved by relevant staff, and the user interaction behavior violation geolocation is transmitted to the parameterized user interaction behavior violation at different time periods edge computing gateway graph neural network analysis model, and the user interaction behavior violation results and network background disconnection signals are automatically output, and the user interaction behavior violation results and the network background disconnection signals are integrated to obtain a social connection Trojan virus intrusion warning prompt box, through which the staff can clearly know the results and remedial measures caused by the parameterized user interaction behavior violation, and can then quickly respond to user interaction behavior violation problems in the user behavior analysis process, thereby improving work efficiency and effectively preventing users from accessing the Internet in violation of regulations.

[0130] The above only describes in detail the preferred embodiments of the present invention, which is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0131] It should be understood that, although the steps in the flowcharts of the embodiments of the present invention are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows; unless otherwise clearly stated in this document, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders; moreover, at least a part of the steps in each embodiment may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternation with other steps or at least a part of the sub-steps or stages of other steps.

[0132] A person skilled in the art will easily conceive of other embodiments of the present disclosure after considering the disclosure in the specification and examples; the present application is intended to cover any modification, use or adaptive change of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the technical field not disclosed in the present disclosure; the specification and examples are to be regarded as exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

Claims

1. A user behavior analysis system for social networks, characterized in that: The system includes: A user interaction behavior violation signal module is used to perform dynamic feature analysis on the social network screening process of different groups, and when a user interaction behavior violation occurs, a user interaction behavior violation signal for screening of different groups of social networks is generated, wherein the user interaction behavior violation signal for screening of different groups of social networks is a user interaction behavior violation signal of an online browsing trajectory or a user interaction behavior violation signal of a social connection; The user interaction behavior violation evaluation module for different time periods, when it is a user interaction behavior violation signal of the online browsing trajectory, retrieves the user interaction behavior violation statistics table in the user interaction behavior violation signal of the online browsing trajectory, transmits the user interaction behavior violation statistics table to the project user interaction behavior violation different time period edge computing gateway graph neural network analysis model, and obtains the possible user interaction behavior violation access URL; The Internet browsing track Trojan virus intrusion warning prompt box module is used to judge the possible user interaction behavior illegal access URLs, obtain the accurate user interaction behavior illegal access URLs, and output the Internet browsing track Trojan virus intrusion warning prompt box according to the accurate user interaction behavior illegal access URLs; The social connection Trojan virus intrusion warning prompt box module, when it is a social connection user interaction behavior violation signal, retrieves the user interaction behavior violation geographic location in the social connection user interaction behavior violation signal, transmits the user interaction behavior violation geographic location to the parameter user interaction behavior violation different time period edge computing gateway graph neural network analysis model, and obtains the social connection Trojan virus intrusion warning prompt box, and the social connection Trojan virus intrusion warning prompt box contains the network background disconnection signal; The graph neural network analysis model, the analysis process includes: S101, model input and graph structure, define the structure and input of the graph, each node represents a user or a URL; the characteristics of the user node include the violation characteristics of the interactive behavior; the characteristics of the URL node include the violation history of the website and whether it is a known violation URL; the edge represents the interaction between users and users, and between users and URLs; S102, node feature initialization, initial features of each node v It is initialized according to the behavior or attributes of the node. For user node u: For URL node w: Where f(·) represents the feature extraction function; S103, graph convolution layer. In each round of graph convolution, a node updates its own state by aggregating information from its neighboring nodes. Assume that the nodes in the tth layer are represented as Its update formula is: in, is the feature representation of node v in round t, W (t) is the weight matrix of the tth layer, represents the set of neighbor nodes of node v, and σ is the activation function. The information of each node is not only related to its own characteristics, but also affected by the information of its neighbor nodes. After the information of the neighbor nodes is aggregated, it is combined with the characteristics of the node itself and a new representation is obtained through the activation function. S104, the final feature representation of the node. After multiple rounds of graph convolution, the final representation of the node It will contain the interaction information between itself and its neighbors, which is used for subsequent prediction tasks; S105, violation prediction, for each user node u, the final representation obtained by the graph convolution layer, Used to predict violations and output a probability value To indicate whether the user may violate the rules: Among them, W out is the weight matrix of the output layer; σ is the activation function; S106, website violation prediction: for website node w, predict whether the website will be visited and whether it is a violation website. The prediction formula is similar to the prediction of user nodes: S107, loss function, assuming there is labeled data, the violation label of user behavior is y u , the URL's violation label is y w , the loss function uses binary cross entropy loss: Among them, V is the set of all nodes (including user and website nodes), is the probability predicted by the model, y v is the true label; S108, the model training process, by minimizing the loss function L, training the graph neural network model, and optimizing the weight matrix W (t) and W out , so that the model can predict users’ illegal behaviors and possible illegal URLs; S109, model output, finally, the model outputs the possible illegal access URL w pred : It means that for each user node u, the model outputs the possible illegal URL w associated with it according to its behavior characteristics. pred , and check these URLs based on the violation prediction results.

2. A user behavior analysis system for social networks according to claim 1, characterized in that: The user interaction behavior violation assessment modules for different time periods include: The interface of possible user interaction behavior violation access website is used to sequentially transmit all user interaction behavior violation statistics tables in the user interaction behavior violation signal of the Internet browsing trajectory to the edge computing gateway graph neural network analysis model of the project user interaction behavior violation at different time periods, each user interaction behavior violation statistics table corresponds to the user interaction behavior violation feature, and the project user interaction behavior violation at different time periods edge computing gateway graph neural network analysis model includes a number of user interaction behavior violation statistics tables and corresponding possible user interaction behavior violation access website; The interface for checking user interaction behavior violations at different time periods is used to output URLs that may be visited in violation of user interaction behavior, and to check URLs that may be visited in violation of user interaction behavior based on the characteristics of user interaction behavior violations.

3. A user behavior analysis system for social networks according to claim 2, characterized in that: The user interaction behavior violation investigation interface at different time periods includes: The user interaction behavior violation frequency determination sub-interface is used to retrieve the search behavior characteristics according to the user interaction behavior violation statistics table, and determine the user interaction behavior violation frequency according to the search behavior characteristics and the user interaction behavior violation characteristics; The sub-interface for checking user interaction behavior violations at different time periods is used to check possible user interaction behavior violation access URLs based on the user interaction behavior violation frequency. Each possible user interaction behavior violation access URL in the edge computing gateway graph neural network analysis model of the project user interaction behavior violations at different time periods corresponds to the resulting user interaction behavior violation frequency.

4. A user behavior analysis system for social networks according to claim 1, characterized in that: The Internet browsing track Trojan virus intrusion warning prompt box module includes: The user interaction behavior violation transmission interface for different time periods is used to sequentially transmit the URLs visited for possible user interaction behavior violation to the user interaction behavior violation cloud for different time periods, and output the statistical table of related user interaction behavior violation. The user interaction behavior violation cloud for different time periods includes all the different time periods for user interaction behavior violation, and the statistical table of related user interaction behavior violation caused by each different time period for user interaction behavior violation; The user interaction behavior violation judgment interface for different time periods is used to judge whether the associated user interaction behavior violation statistics table exists in the online browsing track user interaction behavior violation signal. When it appears in the online browsing track user interaction behavior violation signal, it is judged that the possible user interaction behavior violation visit URL is the accurate user interaction behavior violation visit URL; The Internet browsing track Trojan virus intrusion warning prompt box generation interface is used to integrate all accurate user interaction behavior illegal access URLs and then output the Internet browsing track Trojan virus intrusion warning prompt box.

5. A user behavior analysis system for social networks according to claim 1, characterized in that: The social connection Trojan virus invasion warning prompt box module includes: A user interaction behavior violation geolocation transmission interface, used to transmit the user interaction behavior violation geolocation to a parameter user interaction behavior violation different time period edge computing gateway graph neural network analysis model, wherein the parameter user interaction behavior violation different time period edge computing gateway graph neural network analysis model includes all user interaction behavior violation geolocations, corresponding user interaction behavior violation results and network background disconnection signals; The social connection Trojan virus intrusion warning prompt box generation interface is used to output the user interaction behavior violation results and the network background disconnection signal, and integrate the user interaction behavior violation results and the network background disconnection signal to obtain the social connection Trojan virus intrusion warning prompt box.

6. A user behavior analysis method for social networks, characterized in that: The method includes: Perform dynamic feature analysis on the social network screening process for different groups, and when user interaction behavior violates the rules, generate a signal for violating the user interaction behavior of different groups of social networks, wherein the signal for violating the user interaction behavior of different groups of social networks is a signal for violating the user interaction behavior of online browsing track or a signal for violating the user interaction behavior of social connection; When it is a user interaction behavior violation signal of the online browsing trajectory, the user interaction behavior violation statistics table in the user interaction behavior violation signal of the online browsing trajectory is retrieved, and the user interaction behavior violation statistics table is transmitted to the edge computing gateway graph neural network analysis model of the project user interaction behavior violation at different time periods to obtain the possible user interaction behavior violation access URL; Determine the URLs that may be visited in violation of user interaction behaviors, obtain the accurate URLs that are visited in violation of user interaction behaviors, and output the Internet browsing track Trojan virus intrusion warning prompt box based on the accurate URLs that are visited in violation of user interaction behaviors; When it is a social connection user interaction behavior violation signal, the user interaction behavior violation geographic location in the social connection user interaction behavior violation signal is retrieved, and the user interaction behavior violation geographic location is transmitted to the parameter user interaction behavior violation edge computing gateway graph neural network analysis model in different time periods to obtain a social connection Trojan virus intrusion warning prompt box, which contains a network background disconnection signal.

7. A user behavior analysis method for social networks according to claim 6, characterized in that: The step of transmitting the user interaction behavior violation statistics table to the edge computing gateway graph neural network analysis model of the project user interaction behavior violation at different time periods to obtain the URLs visited by possible user interaction behavior violations specifically includes: Transmitting all user interaction behavior violation statistics tables in the online browsing trajectory user interaction behavior violation signals to the project user interaction behavior violation different time periods edge computing gateway graph neural network analysis model in sequence, each user interaction behavior violation statistics table corresponds to a user interaction behavior violation feature, and the project user interaction behavior violation different time periods edge computing gateway graph neural network analysis model includes a number of user interaction behavior violation statistics tables and corresponding possible user interaction behavior violation access URLs; Output the URLs that may be visited by users in violation of user interaction behaviors, and check the URLs that may be visited by users in violation of user interaction behaviors according to the characteristics of user interaction behaviors in violation of regulations.

8. A user behavior analysis method for social networks according to claim 7, characterized in that: The step of checking the URLs that may be visited by users in violation of user interaction behaviors according to the violation characteristics of user interaction behaviors specifically includes: Retrieve search behavior characteristics based on the user interaction behavior violation statistics table, and determine the user interaction behavior violation frequency based on the search behavior characteristics and the user interaction behavior violation characteristics; According to the frequency of user interaction behavior violations, the possible user interaction behavior violation access URLs are checked, and each possible user interaction behavior violation access URL in the edge computing gateway graph neural network analysis model of the project user interaction behavior violations in different time periods corresponds to the resulting user interaction behavior violation frequency.

9. A user behavior analysis method for social networks according to claim 6, characterized in that: The steps of judging the possible illegal access URLs of user interactive behaviors, obtaining accurate illegal access URLs of user interactive behaviors, and outputting a Trojan virus intrusion warning prompt box of Internet browsing track according to the accurate illegal access URLs of user interactive behaviors specifically include: Transmitting the possible user interaction behavior violation access URLs to the user interaction behavior violation cloud in different time periods in sequence, and outputting the associated user interaction behavior violation statistics table, wherein the user interaction behavior violation cloud in different time periods includes all user interaction behavior violation different time periods, and the interrelated user interaction behavior violation statistics table caused by each user interaction behavior violation different time periods; Determine whether the associated user interaction behavior violation statistics table exists in the online browsing track user interaction behavior violation signal. If it appears in the online browsing track user interaction behavior violation signal, determine that the possible user interaction behavior violation access URL is the accurate user interaction behavior violation access URL; Integrate all accurate user interaction behaviors and illegal access URLs to output the browsing track and Trojan virus intrusion warning prompt box; The step of transmitting the geographic location of the user interaction behavior violation to the edge computing gateway graph neural network analysis model of the parameter user interaction behavior violation at different time periods to obtain the social connection Trojan virus invasion warning prompt box specifically includes: Transmitting the geographic location of user interaction behavior violations to a parameter user interaction behavior violation different time period edge computing gateway graph neural network analysis model, wherein the parameter user interaction behavior violation different time period edge computing gateway graph neural network analysis model includes all user interaction behavior violation geographic locations, corresponding user interaction behavior violation results and network background disconnection signals; Output the violation results of user interaction behavior and the network background disconnection signal, and integrate the violation results of user interaction behavior and the network background disconnection signal to obtain a social connection Trojan virus intrusion warning prompt box.

Images