Social network abnormal user detection method and system based on external graph data

Abstract

The invention discloses a social network abnormal user detection method and system based on external graph data, and belongs to the technical field of graph structure data anomaly detection. Obtaining an external graph data set and at least one piece of target social network graph data; after data enhancement operation, taking the data as a candidate graph, and aligning node features; defining a spherical space, pre-training a graph model by using at least one piece of original target social network graph data, and generating target graph node representation and position coordinates thereof in the spherical space; inputting the candidate graph into a pre-trained graph model, and generating each candidate graph node representation and a position coordinate of the candidate graph node representation in a spherical space; screening candidate graphs according to the node characterization and the position coordinates of the node characterization in the spherical space; and secondarily training a graph model by utilizing the screened candidate graphs, and detecting abnormal users in the target social network to be detected by adopting the secondarily trained graph model. According to the method, the generalization ability of the model is enhanced through diversified external graph data, and the social network abnormal user detection precision is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of graph structure data anomaly detection, and in particular to a method and system for detecting abnormal users of a social network based on external graph data. Background Art

[0002] Graph Anomaly Detection (GAD) aims to identify abnormal instances or outliers in a graph that deviate from the main pattern of normal nodes. In social networks, abnormal users (such as fake accounts, spam, malicious advertisements, etc.) often present interaction patterns that are different from normal users. Graph anomaly detection can help identify these abnormal accounts, for example, by analyzing the interactive relationships between users, comments or post propagation paths, and timely discovering and preventing potential malicious behaviors. For example, a social platform often uses graph anomaly detection technology to identify robot accounts and malicious groups that manipulate information flows. The present invention focuses on the detection of abnormal user behavior in social networks.

[0003] With the widespread application of Graph Neural Networks (GNNs) in various fields, graph anomaly detection (GAD) has also made significant progress. Supervised and semi-supervised GAD methods use annotated anomaly data as supervision signals, so that the model can learn the distribution of normal and abnormal nodes, and then effectively distinguish abnormal nodes from normal nodes. However, anomalies in graph-structured data have some unique characteristics, which make supervised and semi-supervised graph anomaly detection methods based on limited labels often constrained by these challenges, and may face overfitting problems or fail to effectively generalize to unseen abnormal behaviors. To overcome these limitations, many studies have proposed unsupervised strategies that focus on learning a comprehensive and robust distribution of normal behaviors rather than the distribution of abnormal behaviors. By effectively learning normal behavior patterns, the model can naturally distinguish abnormal instances that deviate significantly from these patterns. However, these methods rely heavily on sufficient and representative normal patterns in the target data, but in practical applications, this condition may not always be met. When normal data is insufficient, the learned normal distribution may be biased, thereby weakening the effect of anomaly detection.

[0004] Take abnormal user detection in social networks as an example: In social graph analysis, 90% of normal users show stable social patterns: the number of friends gradually increases, the interaction time conforms to the circadian rhythm, and the content dissemination shows community aggregation. However, scholars in certain professional fields (users with low activity frequency but legitimate behavior) may show different patterns, such as frequent interactions during sudden academic conferences (usually 2 to 3 times a year), a high proportion of professional terminology dissemination, and cross-time zone collaboration characteristics. Traditional graph anomaly models usually focus on identifying high-frequency behavior patterns, which can easily lead to misjudgment of these legitimate low-frequency users and mistakenly regard them as abnormal users. However, real anomalies are not simply characterized by low-frequency behavior, but are reflected in obvious irregular behavior. For example, abnormal users with fake accounts often form social relationships with obvious star topology structures, which are rare among real users. Therefore, providing a more comprehensive and accurate perspective on normal behavior is helpful to help the model better identify abnormal users in social networks. Summary of the invention

[0005] In order to solve the above problems, the present invention proposes a method and system for detecting abnormal users in social networks based on external graph data, introduces external graph data sets with domain diversity and scale diversity, and generates candidate graphs through data enhancement. An external graph data selection mechanism based on representative indicators and diversity indicators is adopted to screen out candidate graphs that have sufficient similarity with the target graph data and can comprehensively cover various normal modes. The generalization ability of the model is enhanced through diversified external graph data, and the accuracy of abnormal user detection in social networks is improved.

[0006] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0007] In a first aspect, the present invention proposes a method for detecting abnormal users in a social network based on external graph data, comprising the following steps:

[0008] (1) Obtaining an external graph dataset based on domain diversity and scale diversity, and obtaining at least one target social network graph data; each graph data consists of a node feature matrix and an adjacency matrix;

[0009] (2) After data augmentation, the original graph data is used as a candidate graph. The node feature matrix and adjacency matrix of the original graph data are used to generate the node feature matrix and adjacency matrix of the candidate graph, and the node feature matrix of the candidate graph is aligned in feature space.

[0010] (3) defining a spherical space, using at least one original target social network graph data to pre-train a graph model, generating a target graph node representation and determining the position coordinates of each node representation in the spherical space; and inputting the candidate graph into the pre-trained graph model to generate each candidate graph node representation and its position coordinates in the spherical space;

[0011] (4) Adopting an external graph data selection mechanism based on representativeness and diversity indicators to screen candidate graphs according to node representations and their position coordinates in spherical space;

[0012] (5) Using the candidates obtained through screening Figure 2 The second training graph model is used to detect abnormal users in the target social network to be detected.

[0013] As a preferred embodiment of the present invention, the external graph data set includes two or more of e-commerce network graph data, social network graph data, academic citation network graph data, and hyperlink network graph data.

[0014] As a preferred embodiment of the present invention, the data enhancement operations include feature masking, node deletion, edge perturbation and subgraph extraction. Each data enhancement operation sets multiple strength parameters, and each data enhancement operation under different strength parameters is traversed to generate a candidate graph.

[0015] As a preferred embodiment of the present invention, the method for aligning the feature space of the node feature matrix of the candidate graph is:

[0016] Determine the type of node features of the candidate graph, where the type is one of a text form feature and a table form feature;

[0017] If it is a tabular feature, the rule-based conversion method converts it into a text feature; otherwise, no processing is required;

[0018] The text form features are input into the multi-language pre-trained language model, and the text embedding generated by the language model after encoding the text is used as the node feature after feature space alignment.

[0019] As a preferred embodiment of the present invention, the method of pre-training a graph model using at least one original target social network graph data comprises:

[0020] Input the node feature matrix and adjacency matrix corresponding to the original target social network graph into the graph model to generate the node representation of the target graph;

[0021] The training goal is to distribute as many target graph node representations output by the graph model as possible in the spherical space.

[0022] As a preferred embodiment of the present invention, the representative indicators in the external graph data selection mechanism include the sphere center similarity deviation based on the sphere center stability constraint and the distribution similarity deviation based on the distribution similarity constraint;

[0023] The sphere center similarity deviation is the L2 norm between the mean of the target graph node representation and the candidate graph node representation and the mean of the target graph node representation;

[0024] The distribution similarity deviation is the distance between the probability distribution of the spherical coordinate sets of the target graph node representation and the candidate graph node representation and the probability distribution of the spherical coordinate set of the target graph node representation.

[0025] As a preferred embodiment of the present invention, the diversity index in the external graph data selection mechanism adopts the integral value of the minimum hypersphere energy of different scale radii.

[0026] As a preferred embodiment of the present invention, the final score of each candidate graph is calculated by integrating the representative index and the diversity index, and a preset number of candidate graphs are screened in order of scores from low to high.

[0027] As a preferred embodiment of the present invention, the method of using a secondary trained graph model to detect abnormal users in a target social network to be detected includes:

[0028] Input the node feature matrix and adjacency matrix of the target social network to be detected into the secondary trained graph model, generate node representations and determine the position coordinates of each node representation in the spherical space;

[0029] If the node representations are distributed in the spherical space, the node corresponding to the node representation is judged to be a normal user, otherwise the node corresponding to the node representation is judged to be an abnormal user.

[0030] In a second aspect, the present invention proposes a social network abnormal user detection system based on external graph data, which is used to implement the above-mentioned social network abnormal user detection method based on external graph data.

[0031] The beneficial effects of the present invention are:

[0032] By introducing external graph data and precise data selection strategies, the present invention significantly improves the accuracy and robustness of abnormal user detection tasks in social networks. This method can effectively avoid the overfitting problem in traditional graph anomaly detection models and enhance the generalization ability of the model through diversified external graph data. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is an overall block diagram of a method for detecting abnormal users in a social network based on external graph data shown in an embodiment of the present invention.

[0034] Figure 2 Schematic diagram of a feature mask shown in an embodiment of the present invention.

[0035] Figure 3 It is a schematic diagram of node deletion shown in an embodiment of the present invention.

[0036] Figure 4 Schematic diagram of edge disturbance shown in an embodiment of the present invention.

[0037] Figure 5 It is a schematic diagram of sub-graph extraction shown in an embodiment of the present invention. DETAILED DESCRIPTION

[0038] The present invention is further described and illustrated below in conjunction with specific embodiments. The embodiments are merely exemplary of the present disclosure and do not define the scope of limitation. The technical features of each embodiment of the present invention may be combined accordingly without conflicting with each other.

[0039] The accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. Some of the block diagrams shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0040] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the steps. For example, some steps may be decomposed, while some steps may be combined or partially combined, so the actual execution order may change according to the actual situation.

[0041] Figure 1 The figure shows the overall framework of the graph anomaly detection method based on external graph data of the present invention, which mainly includes the construction of an external graph database and the screening of external graph data, and the training of the screened external graph to obtain a graph anomaly detection model. The functions of each part and their implementation details are introduced below.

[0042] 1. External graph database construction:

[0043] It mainly includes three parts: original external graph data collection, graph data enhancement and feature space alignment, as follows:

[0044] S11, considers the diversity of raw external graph data collection from two dimensions: domain diversity and scale diversity.

[0045] (1) Aiming at domain diversity, in order to ensure the comprehensive representation of normal patterns of cross-domain graph data, this paper collects external graph data from four different fields: e-commerce network, social network, academic citation network and hyperlink network. Among them:

[0046] In e-commerce networks, nodes represent users or products; features of user nodes may include age, gender, geographic location, historical purchase records, and user activity (such as the number of comments or purchases); features of product nodes may include price, category, brand, mean or variance of user ratings, text embedding of product descriptions, etc.; edges are used to represent associations between users (such as comments on the same product) or between products (such as being purchased by the same user or being recommended to be purchased together).

[0047] In social networks, nodes represent individual users or organizations; node features can include basic attributes of users (such as age, gender, interest tags), embeddings of user-generated content (such as text features of profiles or posts); edges are used to represent social relationships between users, such as friend / follow relationships.

[0048] In the academic citation network, nodes represent academic papers, node features are usually the text embeddings of the papers (such as title, abstract, keywords), and edges represent the citation relationships between papers.

[0049] In a hyperlink network, nodes represent web pages, node features are embedded web page content (such as keywords, topic model representations), and edges represent hyperlink relationships between web pages.

[0050] In a specific implementation of the present invention, a total of twelve graph data sets are compiled for the above fields, including P-Learning, P-Electronic, P-Entertainment, P-Household, P-Fashion, P-YelpRes, YelpNYC, Instagram, Reddit, Cora, PubMed, arXiv and WikiCS. The graph data in the above graph data sets only contain normal nodes, without abnormal nodes.

[0051] In addition to the above external graph data, the graph database must also include target social network graph data containing a small number of abnormal nodes. The abnormal nodes refer to abnormal users, and the remaining nodes are normal users. The node features are the basic attributes of the user (such as age, gender, interest tags) and / or the embedding of user-generated content (such as text features of the introduction or post content), which are used to provide a more accurate and realistic reference for the model.

[0052] (2) Regarding scale diversity, the graph data collected by the present invention also covers a wide range in graph scale to capture diverse graph structures. For example, the smallest graph dataset Cora contains 2,708 nodes and 10,858 edges, while the largest graph dataset P-Learning contains 651,762 nodes and 24,599,888 edges. This diversity in scale enhances the model's ability to identify and characterize normal samples of graphs of different scales, thereby more effectively capturing normal patterns.

[0053] S12, performing data enhancement on the original external graph data and the original target graph data.

[0054] The present invention introduces graph data enhancement technology to diversify candidate data sets, thereby achieving wider coverage of normal patterns in graph data. Data enhancement technology helps the model better adapt to variable data distribution, thereby enhancing the generalization ability and robustness of the model. This technology is particularly beneficial in cross-dataset application scenarios. Therefore, the present invention applies graph data enhancement technology to expand the original graph data to obtain effective new samples.

[0055] In a specific implementation of the present invention, a set of data enhancement operations are designed to improve the diversity and expressiveness of each graph data. The data enhancement operations include:

[0056] Feature mask: Set the feature values ​​of some nodes to 0 or the average of their neighbors’ feature values; e.g. Figure 2 As shown, the eigenvalue of node 1 is set to the average of the eigenvalues ​​of nodes 2, 3, and 5.

[0057] Node deletion: Randomly remove a certain proportion of nodes from the original graph data; e.g. Figure 3 As shown, node 1 and its related edges are removed.

[0058] Edge perturbation: Modify the structure of the original graph by adding or removing edges to generate a graph with different connectivity relationships; e.g. Figure 4 As shown, the edge between node 1 and node 2, and the edge between node 1 and node 5 are deleted, and the edge between node 2 and node 5 is added.

[0059] Subgraph extraction: extract some nodes and some of their related edges and features from the original graph to obtain a new subgraph; Figure 5 As shown, node 1, node 3, node 4, node 5, and the edges between node 1 and node 3, the edges between node 3 and node 4, the edges between node 4 and node 5, and the edges between node 5 and node 1 are extracted from the original graph.

[0060] In order to control the degree of change of the original graph by the data enhancement method, the present invention presets an intensity parameter for each enhancement method, and its value is selected from {0.2, 0.4, 0.6, 0.8}. Specifically, for feature masking, the intensity is defined as the proportion of nodes that mask the features; for node deletion, the intensity is defined as the proportion of nodes randomly removed from the graph; for edge perturbation, the intensity is defined as the proportion of edges added or deleted in the original graph; for subgraph extraction, the intensity is defined as the difference between the proportion of subgraph nodes extracted from the original graph and 1. The data enhancement operations at different intensities determine the degree of change of the original graph by the data enhancement method, thereby affecting the structure and feature information of the graph data, and the original graph data is expanded by traversing all data enhancement operations at different intensities. Here, subgraph extraction can be achieved by a conventional random walk algorithm, which will not be repeated here.

[0061] In this embodiment, by integrating all the original graph data and their enhanced samples, a dataset of 221 candidate graphs is finally constructed, which provides rich samples and diverse feature distribution for model training. Here, the candidate graphs include the original external graph data and its enhanced samples, the original target graph data and its enhanced samples.

[0062] S13, aligning the feature space of the graph data after data enhancement.

[0063] Since the collected external graph data comes from different fields and channels, its node features are often distributed in different feature spaces, with different dimensions and complex properties. The present invention converts the node features of these heterogeneous attributes into text form, and uses a language model to understand and process them in a unified semantic space. The node features of graph data can be divided into two categories: text features and table features. Text features are directly expressed as text information. For example, the node features in the academic citation network are usually text embedded descriptions of papers, and these features can be directly used as inputs of language models. Tabular features usually exist in the form of classification or numerical vectors. For example, in social networks, node features include basic attributes of users (such as age, gender, and interest tags), which are generally recorded in the form of tables. For such tabular features, they must first be converted into text descriptions. In this embodiment, a rule-based conversion method is used to textualize tabular features. For example, a node feature in the Tolokers data set represents a worker, and its tabular features are approved_rate: 0.8, skipped_rate:0.2, expired_rate: 0.2, rejected_rate:0.1. Through the rule-based conversion method, these table features are converted into the following text format: "The probability of this worker being supported is 0.8, the probability of being ignored is 0.2, the probability of being expired is 0.2, and the probability of being rejected is 0.1". After completing the text conversion of the table features, the present invention uses the powerful language understanding ability of the language model to input the node features in the text format of each graph data into the language model, and the text embedding generated by the language model after encoding the text is used as the aligned node feature, thereby realizing the alignment of the heterogeneous feature semantic space. In addition, in response to the multilingual problem existing in the collected extensive candidate graph dataset (for example, the dataset contains English and Chinese), the present invention adopts a multilingual pre-trained language model, such as mBERT, to ensure effective processing and semantic understanding between different languages. By aligning the feature space of the graph data after data enhancement, a candidate graph dataset containing rich and diverse graph data is obtained, and the node features of each candidate graph in the dataset are the node features after spatial alignment using the above method.

[0064] 2. External graph data screening:

[0065] The lack of normal patterns and poor quality in the external graph data may cause the representation space generated by the model to be irregular and deviate from the standard hypersphere, which may cause errors in the stage of using the hypersphere to evaluate normal and abnormal samples. To overcome this problem, the present invention specifically integrates external graph data that can assist model training and help optimize the representation space, in order to provide a more comprehensive depiction of normal patterns. Specifically, by defining a spherical space, suitable external graph data is screened out to enhance the performance of anomaly detection tasks.

[0066] It mainly includes four parts: defining the spherical space, training the GNN model, calculating the node representation of the candidate graph and determining the position coordinates of each node representation in the spherical space, and designing the external graph data selection mechanism. The details are as follows:

[0067] S21, defines spherical space based on the following three core elements:

[0068] (1) Sphere center (referred to as sphere center): The sphere center is defined as the mean of all node representations, and the calculation formula is: ,in, Indicates the center of the ball, Represents the number of nodes in the graph data, Represents the i-th node representation in the graph data.

[0069] (2) Radial distance: The Euclidean distance between each node and the center of the sphere, calculated as: ,in, represents the radial distance represented by the i-th node in the graph data, It means to find the Euclidean distance.

[0070] (3) Relative direction: The unit vector from each node to the center of the sphere, calculated as ,in, Represents the relative direction of the i-th node representation in the graph data.

[0071] In order to characterize normal graph data samples more comprehensively and discriminatively, the present invention proposes the above-mentioned spherical space for characterizing and representing analysis nodes.

[0072] S22, using any original target graph (containing a small number of abnormal nodes) to pre-train the GNN model, so that most of the node representations of the original target graph output by the GNN model are distributed in the above-mentioned spherical space.

[0073] In this embodiment, by combining radial and angular information, each multidimensional node on the hypersphere can be represented by spherical coordinates. To express,

[0074] By training a base model using any original target graph , to learn its corresponding spherical space and obtain each node in the target graph Characterization and its spherical coordinates , the training target is the basic model Output node representation of the original target graph Most of them are distributed in the above spherical space, and the basic model obtained by training It reflects the current model's understanding of normal patterns within the target graph.

[0075] S23, input the candidate graph into the above GNN model, generate node representations of each candidate graph and determine the position coordinates of each node representation in the spherical space , which provides a key basis for subsequent external graph data screening.

[0076] S24, using an external graph data selection mechanism to filter graph data according to the position coordinates of each node representation in the spherical space.

[0077] In order to select external graph data that can strengthen model training and enrich the representation space, the external graph data selection mechanism designed in the present invention follows two key criteria: representativeness index and diversity index. Among them, representativeness means that the selected graph data should be highly consistent with the potential pattern of the target graph, indicating that it has a high similarity with the target graph. Diversity means that the selected graph data should show sufficient diversity to cover more comprehensive coverage in the representation space. These two criteria complement each other. Representativeness ensures the relevance of external graph data, while diversity aims to maximize the coverage of normal pattern graph data. Ideal external graph data should meet both criteria at the same time. By comprehensively considering the above criteria, the present invention can calculate a final score for each candidate graph to evaluate its applicability and potential in improving the performance of anomaly detection tasks.

[0078] The quantitative evaluation of representative indicators and diversity indicators is introduced below:

[0079] (1) Representative indicators

[0080] The similarity between the selected external graph data and the target graph data is crucial for the effective fusion of graph data. If the similarity between the external graph data and the target graph data is insufficient, noise may be introduced, resulting in a shift in data distribution and a negative impact on model performance. The present invention quantitatively evaluates representative indicators from the following two key perspectives.

[0081] First, the sphere center stability constraint:

[0082] After integrating the external graph data with the target graph data, it is important to maintain the stability of the position of the center of the representation space. In other words, the center should not move significantly. To evaluate this stability, the Euclidean distance between the center of the original representation space and the center of the new representation space after combining the external graph data can be calculated.

[0083] According to the node representation of the candidate graph, calculate the sphere center similarity of each candidate graph :

[0084]

[0085]

[0086] in, The center of the sphere representing the original representation space of the target graph is calculated as the mean of the representations of the nodes in the target graph; It is the center of the sphere of the new representation space combining a candidate graph and the target graph, calculated as the mean of the target graph node representation and a candidate graph node representation; A set of node representations representing the target graph, A node representation set representing a candidate graph, Represents a node representation in the graph, Represent the number of nodes in the target graph and candidate graph respectively, represents the L2 norm.

[0087] Center similarity A smaller value of indicates a smaller displacement of the sphere center, which means that the external graph data can be effectively integrated without distorting the representation space. On the contrary, if the value is larger, it indicates that the sphere center has a larger displacement, which may have an adverse effect on the performance of the model in the anomaly detection task.

[0088] Second, distribution similarity constraints:

[0089] The similarity between the target graph node representation distribution and the representation distribution after integrating the external graph data is evaluated. This embodiment uses the Wasserstein distance as a metric. This distance measures the minimum cost required to transform one distribution into another, while taking into account the value and direction of the representation vector.

[0090] According to the position coordinates of the node representation of the candidate graph in the spherical space, calculate the distribution similarity of each candidate graph :

[0091]

[0092] in, represents the set of spherical coordinates representing the target graph nodes, Represents the set of spherical coordinates after combining a candidate image and a target image. Represents a computed probability distribution.

[0093] Distribution Similarity The smaller it is, the more similar the distribution of the mixed external graph data is to the distribution of the target graph, thus ensuring that the external graph data is well aligned with the original graph data.

[0094] (2) Diversity indicators

[0095] Although representative indicators play an important role in ensuring that the selected external graph data is highly consistent with the target dataset, their single application may not be sufficient to comprehensively improve the performance of the model. Relying solely on representativeness may cause the model to overfit specific patterns. In this case, the model may focus too much on these specific patterns and ignore other potential patterns in the graph data, thereby affecting the generalization ability of the model. Therefore, the present invention introduces diversity indicators to promote the uniform distribution of graph data samples in the representation space, so that the model can learn and recognize a wider range of normal sample features and patterns, thereby enhancing the generalization ability of the model.

[0096] Specifically, the realization of diversity in the spherical space depends on the uniform distribution of node representations in the entire spherical space, that is, they should not be overly concentrated in a specific area of ​​the hypersphere, but should be widely distributed throughout the hypersphere. The present invention uses the minimum hyperspherical energy (MHE) as an indicator to measure the uniformity of the node representation distribution.

[0097] In spherical space Hypersphere energy is defined in as follows:

[0098]

[0099] in, , Indicates the minimum and maximum radius of the target graph node representation and the candidate graph node representation after mixing in the spherical space. Indicates the radius The node representation set below, Indicated in The set of node pairs in , express A pair of node representations in ; Represents the energy of a pair of node representations, defined using a Gaussian potential kernel , the specific form is as follows:

[0100]

[0101] in, Represents the energy function of a pair of nodes in spherical space, is a hyperparameter of the Gaussian potential kernel. The function is designed as a decreasing real-valued function based on distance, that is, in the representation space, a pair of node representations with a closer distance is given a higher energy, while a pair of node representations with a farther distance is given a lower energy.

[0102] Minimum and maximum radius , The definition is as follows:

[0103]

[0104] The present invention introduces the integration of the energy of different scale radii, which ensures that diversity is considered at multiple scales of the hypersphere, rather than being limited to the case of a fixed radius (e.g., r=1). This multi-scale analysis method provides a more comprehensive metric for diversity assessment.

[0105] 3. Training graph anomaly detection model:

[0106] The representativeness and diversity indicators proposed in this paper together constitute effective indicators for evaluating the quality of external graph data. By calculating the final score of each candidate graph, the problem of selecting graph data can be transformed into the following optimization problem:

[0107]

[0108] in, ∈[0,1] is a trade-off coefficient used to balance the weight between representation and diversity. They represent the sphere center similarity, distribution similarity and hypersphere energy after z-score standardization.

[0109] Given a budget constraint of In the case of external graph data, the lowest score is determined by calculation. external graph data, and then use this The GNN model is trained twice with selected external graph data.

[0110] The GNN model obtained by the secondary training is used as a graph anomaly detection model to detect anomalies in the target graph data. The detection process is as follows:

[0111] The GNN model obtained by the secondary training generates the representation of each node of the target graph data;

[0112] If the node representation is distributed in the spherical space, the node represents a normal user, otherwise the node is an abnormal user.

[0113] The graph anomaly detection model of the present invention is first trained on the target graph data to initialize and establish the initial parameters of the model. On this basis, Applied to each candidate external graph, given a budget constraint of In the case of a graph, the lowest score is determined by calculation The model is trained twice with external graphs, which ensures that the model can obtain the most effective and diverse knowledge from these external graphs.

[0114] This embodiment verifies the implementation effect of the present invention through a specific experiment.

[0115] 1. Data Description

[0116] The present invention uses four social network target graph datasets with real anomalies from different fields, including YelpHotel, Amazon_cn, C15, and Twi20.

[0117] The details of these data sets are as follows:

[0118] The nodes of YelpHotel represent users of the Yelp website. The node features are all the review texts of hotels on Yelp.com. The edges between users represent that two users have reviewed the same hotel. Abnormal users are malicious reviewers, and abnormal labels are sorted and marked by Yelp's proprietary filtering mechanism.

[0119] Amazon is data collected from Amazon China. Its nodes represent users of the website, and the node features are users' Chinese comments on product information. Edges between users represent that two users have commented on the same product. Abnormal users are malicious commenters, and abnormal labels are sorted and marked by the website's proprietary filtering mechanism.

[0120] C15 is based on a dataset consisting of real and fake Twitter users. Nodes represent Twitter users, node features are basic attributes of users, and edges represent mutual attention relationships between users. Abnormal users are robot accounts maliciously placed on Twitter.

[0121] Twi20 is based on the Twitter platform. Nodes represent Twitter users, node features are basic attributes of users, and edges represent the mutual attention relationship between users. Abnormal users are robot accounts maliciously placed on Twitter.

[0122] 2. Baseline Model

[0123] In order to fully verify the effectiveness of the model of the present invention, this experiment compared it with several different types of baseline models. The baseline models compared with the model of the present invention include DOMINANT, AnomalyDAE, AdONE, GAAN, DONE, GAE, OCGNN, TAM and RAND.

[0124] The details of these benchmark methods are as follows:

[0125] DOMINANT is a deep learning-based graph anomaly detection framework that uses graph autoencoders to learn node representations, reconstructs the input graph, and then measures the reconstruction error (including topology reconstruction error and attribute reconstruction error) to detect abnormal nodes.

[0126] AnomalyDAE is an anomaly detection model designed based on the reconstruction error of graph autoencoders. The difference from DOMINANT is that it trains the structure and attribute autoencoders separately.

[0127] AdONE is an anomaly detection method based on one-class nearest neighbor. It determines whether a node is an abnormal node by calculating the distance between nodes.

[0128] GAAN is a graph anomaly detection method based on the attention mechanism. It uses the Graph Attention Network (GAT) to learn the local and global features of nodes and enhances the node representation ability by weighted aggregation of neighbor node information. GAAN can effectively capture hidden abnormal patterns in graph data and detect abnormal nodes by calculating anomaly scores.

[0129] GAE is a graph embedding method based on autoencoders, which can perform anomaly detection by learning low-dimensional representations of nodes and reconstructing the errors of node embeddings.

[0130] OCGN is a model that transforms anomaly detection into a single-class classification problem by learning the feature distribution of normal patterns. OCGNN pays special attention to the representation of normal nodes in the graph. By excluding the interference of abnormal nodes, it can more accurately capture the distribution range of normal patterns and detect abnormal nodes that deviate from these distributions.

[0131] TAM is a method based on the fact that normal nodes in graph data usually have high similarity with neighboring nodes, but deviate from this pattern with abnormal nodes. The model accurately captures the relationship between normal nodes through truncated affinity optimization and reduces the interference of abnormal nodes on the overall modeling.

[0132] RAND is a graph anomaly detection method that dynamically selects the neighbors of each node through reinforcement learning, so that the neighborhood characteristics of the node more accurately reflect normal behavior while reducing the interference of abnormal nodes.

[0133] 3. Evaluation Metrics

[0134] This paper uses two evaluation indicators to evaluate the proposed method:

[0135] AUROC (area under the receiver operating characteristic curve) is a commonly used indicator for evaluating the performance of a binary classification model. It reflects the model's ability to distinguish between positive and negative samples at different thresholds by calculating the area under the ROC curve. The ROC curve uses the true positive rate (TPR) as the vertical axis and the false positive rate (FPR) as the horizontal axis. The AUROC value ranges from 0 to 100%. The larger the value, the better the model performance.

[0136] AUCPR (area under the precision-recall curve) is a commonly used evaluation indicator, especially suitable for class-imbalanced datasets. By calculating the area under the precision-recall curve (PR curve), AUCPR reflects the model's ability to detect positive samples. The PR curve has recall as the horizontal axis and precision as the vertical axis. The value range of AUCPR is 0 to 100%, and the larger the value, the better the model performance.

[0137] 4. Comparative Experiment

[0138] The experimental results are shown in Table 1 (AUCROC) and Table 2 (AUCPR), where the values ​​in brackets are indicator values, the values ​​outside brackets are indicator values, and the values ​​in brackets are standard deviations of multiple experiments.

[0139] Table 1

[0140]

[0141] Table 2

[0142]

[0143] It can be clearly observed from Tables 1 and 2 that the Wild-GAD framework proposed in this paper significantly outperforms the existing baseline methods in the field of abnormal user detection in social networks. In terms of AUCROC and AUCPR, two key indicators for measuring model performance, Wild-GAD achieved significant improvements of 18% and 32% respectively. This performance improvement is mainly due to the external graph data cleverly introduced into the framework. These data greatly enrich the information source of the model, enabling it to model normal patterns more comprehensively and deeply, thereby greatly improving the ability to identify and distinguish abnormal patterns.

[0144] In addition, it can be found that in most cases, adding more external graph data can bring more significant performance improvements to the model than adding only one type of external graph data. The logic behind this phenomenon is that as the amount of external graph data increases, the model is exposed to more diverse normal patterns during training. This rich diversity enables the model to learn and understand the distribution characteristics of the data more comprehensively, thereby achieving more accurate judgments in anomaly detection tasks.

[0145] Based on the same inventive concept, this embodiment also provides a social network abnormal user detection system based on external graph data, and the system includes:

[0146] An external graph database, which is used to obtain an external graph data set based on domain diversity and scale diversity, and to obtain at least one target social network graph data; each graph data is composed of a node feature matrix and an adjacency matrix;

[0147] A graph data node feature alignment module is used to perform data enhancement operations on the original graph data as a candidate graph, generate the node feature matrix and adjacency matrix of the candidate graph using the node feature matrix and adjacency matrix of the original graph data, and perform feature space alignment on the node feature matrix of the candidate graph;

[0148] A graph model pre-training module is used to define a spherical space, pre-train a graph model using at least one original target social network graph data, generate a target graph node representation and determine the position coordinates of each node representation in the spherical space; and input a candidate graph into the pre-trained graph model to generate each candidate graph node representation and its position coordinates in the spherical space;

[0149] A candidate graph screening module, which is used to select candidate graphs according to node representations and their position coordinates in spherical space by using an external graph data selection mechanism based on representative indicators and diversity indicators;

[0150] The graph model secondary training module is used to use the screened candidates Figure 2 Train the graph model again;

[0151] The abnormal user detection module is used to detect abnormal users in the target social network to be detected by using a secondary trained graph model.

[0152] For the system embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment, and the implementation methods of the remaining modules will not be repeated here. The system embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0153] The embodiments of the system of the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The system embodiments can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, the corresponding computer program instructions in the non-volatile memory are read into the memory by the processor of any device with data processing capabilities and run.

[0154] The above-mentioned embodiments only express several implementation modes of the present invention, and the description is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. For those of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A method for detecting abnormal users in social networks based on external graph data, characterized in that: The following steps are involved: (1) obtaining an external graph dataset based on domain diversity and scale diversity, and obtaining at least one target social network graph data; Each graph data consists of a node feature matrix and an adjacency matrix; (2) After data augmentation, the original graph data is used as a candidate graph. The node feature matrix and adjacency matrix of the original graph data are used to generate the node feature matrix and adjacency matrix of the candidate graph, and the node feature matrix of the candidate graph is aligned in feature space. (3) defining a spherical space, using at least one original target social network graph data to pre-train a graph model, generating a target graph node representation and determining the position coordinates of each node representation in the spherical space; And, inputting the candidate graph into the pre-trained graph model to generate the representation of each candidate graph node and its position coordinates in the spherical space; (4) Adopting an external graph data selection mechanism based on representativeness and diversity indicators to screen candidate graphs according to node representations and their position coordinates in spherical space; (5) The screened candidate graph is used to retrain the graph model, and the retrained graph model is used to detect abnormal users in the target social network to be detected.

2. The method for detecting abnormal users in social networks based on external graph data according to claim 1, characterized in that: The external graph data set includes two or more of e-commerce network graph data, social network graph data, academic citation network graph data, and hyperlink network graph data.

3. The method for detecting abnormal users in social networks based on external graph data according to claim 1, characterized in that: The data enhancement operations include feature masking, node deletion, edge perturbation and subgraph extraction. Each data enhancement operation sets multiple strength parameters, and each data enhancement operation under different strength parameters is traversed to generate a candidate graph.

4. The method for detecting abnormal users in social networks based on external graph data according to claim 1, characterized in that: The method for aligning the feature space of the node feature matrix of the candidate graph is: Determine the type of node features of the candidate graph, where the type is one of a text form feature and a table form feature; If it is a tabular feature, the rule-based conversion method converts it into a textual feature; Otherwise, no processing is required; The text form features are input into the multi-language pre-trained language model, and the text embedding generated by the language model after encoding the text is used as the node feature after feature space alignment.

5. The method for detecting abnormal users in social networks based on external graph data according to claim 1, characterized in that: The method of pre-training a graph model using at least one original target social network graph data includes: Input the node feature matrix and adjacency matrix corresponding to the original target social network graph into the graph model to generate the node representation of the target graph; The training goal is to distribute as many target graph node representations output by the graph model as possible in the spherical space.

6. The method for detecting abnormal users in social networks based on external graph data according to claim 1, characterized in that: Representative indicators in the external graph data selection mechanism include sphere center similarity deviation based on sphere center stability constraint and distribution similarity deviation based on distribution similarity constraint; The sphere center similarity deviation is the L2 norm between the mean of the target graph node representation and the candidate graph node representation and the mean of the target graph node representation; The distribution similarity deviation is the distance between the probability distribution of the spherical coordinate sets of the target graph node representation and the candidate graph node representation and the probability distribution of the spherical coordinate set of the target graph node representation.

7. The method for detecting abnormal users in social networks based on external graph data according to claim 1, characterized in that: The diversity index in the external graph data selection mechanism adopts the integral value of the minimum hypersphere energy of different scale radii.

8. The method for detecting abnormal users in social networks based on external graph data according to claim 1, characterized in that: The final score of each candidate graph is calculated by integrating representativeness index and diversity index, and a preset number of candidate graphs are screened in order of scores from low to high.

9. The method for detecting abnormal users in social networks based on external graph data according to claim 1, characterized in that: The method of using a secondary trained graph model to detect abnormal users in a target social network to be detected includes: Input the node feature matrix and adjacency matrix of the target social network to be detected into the secondary trained graph model, generate node representations and determine the position coordinates of each node representation in the spherical space; If the node representations are distributed in the spherical space, the node corresponding to the node representation is judged to be a normal user, otherwise the node corresponding to the node representation is judged to be an abnormal user.

10. A social network abnormal user detection system based on external graph data, used to implement the method of claim 1; characterized in that: The system comprises: An external graph database, which is used to obtain an external graph data set based on domain diversity and scale diversity, and to obtain at least one target social network graph data; each graph data is composed of a node feature matrix and an adjacency matrix; A graph data node feature alignment module is used to perform data enhancement operations on the original graph data as a candidate graph, generate the node feature matrix and adjacency matrix of the candidate graph using the node feature matrix and adjacency matrix of the original graph data, and perform feature space alignment on the node feature matrix of the candidate graph; A graph model pre-training module is used to define a spherical space, pre-train a graph model using at least one original target social network graph data, generate a target graph node representation and determine the position coordinates of each node representation in the spherical space; and input a candidate graph into the pre-trained graph model to generate each candidate graph node representation and its position coordinates in the spherical space; A candidate graph screening module, which is used to select candidate graphs according to node representations and their position coordinates in spherical space by using an external graph data selection mechanism based on representative indicators and diversity indicators; A graph model secondary training module, which is used to secondary train the graph model using the screened candidate graphs; The abnormal user detection module is used to detect abnormal users in the target social network to be detected by using a secondary trained graph model.

Images