A method and system for detecting abnormal behavior in social networks based on graph computing

Abstract

The present invention relates to the field of network security technology, and more specifically, to a method and system for detecting abnormal behavior in a social network based on graph computing, which obtains personal information data, network behavior data and corresponding context data of a user; constructs an edge weight graph G=(V, E, W) based on the network behavior data of the user, wherein V represents a user node set, E represents a user relationship set, and W represents the relationship strength; according to the edge weight graph G, performs information entropy-based clustering on user nodes to obtain K clustering results corresponding to abnormal behaviors; based on graph computing theory, performs abnormal subgraph detection on each clustering result, and marks the user corresponding to the detected abnormal subgraph as an abnormal user; performs support-based analysis and association on the abnormal users to generate a final abnormal behavior user list, which can effectively identify those behaviors that are normal at the individual user level but present abnormal behaviors in group interaction patterns.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically, to a method and system for detecting abnormal behavior in a social network based on graph computing. Background Art

[0002] With the rapid development of the Internet and social media, social networks have become an indispensable part of people's daily lives. However, with the popularity of social networks, various abnormal behaviors have also emerged, such as spam, fake account operations, malicious marketing, etc. These behaviors have seriously affected the healthy development of social networks and user experience. Therefore, how to effectively detect and prevent these abnormal behaviors has become an important topic in the field of social network management and security.

[0003] Existing methods for detecting abnormal behavior in social networks are mainly divided into rule-based methods, statistical methods, and machine learning methods. Although rule-based methods are simple and intuitive, they lack flexibility and are difficult to deal with complex and changeable abnormal behavior patterns. Statistical methods can process large-scale data, but they often ignore the relationship structure between users and cannot fully utilize the graph structure characteristics of social networks. Although machine learning methods have certain adaptive capabilities, they are often unsatisfactory when processing high-dimensional and sparse social network data, and require a large amount of labeled data for training.

[0004] In addition, most existing methods only focus on the behavioral characteristics of individual users and ignore the interaction patterns between user groups, which makes it difficult to effectively identify some complex abnormal behavior patterns. For example, some carefully designed fake influence marketing behaviors may appear normal at the level of individual users, but show obvious abnormal characteristics in the group interaction pattern.

[0005] Another common problem is that existing methods often use static detection models, which are difficult to adapt to the dynamic changes of user behavior in social networks. This leads to instability in detection results, especially when facing new types of abnormal behavior, the detection accuracy will drop significantly.

[0006] Finally, existing abnormal behavior detection methods can usually only give simple "normal" or "abnormal" judgment results, lacking in-depth analysis and explanation of abnormal behavior, which is not conducive to subsequent abnormal behavior processing and prevention work. Summary of the invention

[0007] In view of the above problems, the present invention proposes a method and system for detecting abnormal behavior in social networks based on graph computing. The method aims to achieve efficient and accurate detection of abnormal behavior in social networks by comprehensively utilizing multidimensional data, graph computing technology and machine learning algorithms.

[0008] The present invention provides a method for detecting abnormal behavior in a social network based on graph computing, comprising:

[0009] The acquisition steps include:

[0010] Obtaining the user's personal information data, network behavior data and corresponding context data;

[0011] The processing steps include:

[0012] Based on the network behavior data of the user, construct an edge weight graph G=(V, E, W), where V represents a user node set, E represents a user relationship set, and W represents a relationship strength;

[0013] According to the edge weight graph G, user nodes are clustered based on information entropy to obtain clustering results corresponding to K abnormal behaviors;

[0014] Based on graph computing theory, abnormal subgraph detection is performed on each clustering result, and users corresponding to the detected abnormal subgraphs are marked as abnormal users;

[0015] The output steps include:

[0016] The abnormal users are analyzed and associated based on support to generate a final list of users with abnormal behavior.

[0017] Preferably, the clustering based on information entropy specifically includes:

[0018] Calculate the degree information entropy of each user node;

[0019] Sort the user nodes in descending order according to the degree information entropy;

[0020] Set a threshold t, set the node set greater than the threshold t as U1, and set the node set less than the threshold t as U2;

[0021] Divide the U1 nodes into K classes evenly;

[0022] Calculate the information entropy of each node set;

[0023] sorting each set in ascending order according to the information entropy;

[0024] The first t sets with high information entropy are selected as abnormal user sets.

[0025] Preferably, the abnormal subgraph detection specifically includes:

[0026] Calculate the importance of each user node based on the Katz centrality index;

[0027] Construct an adjacency matrix;

[0028] Calculate the in-and-out degree of each subgraph node;

[0029] Traverse each subgraph and analyze the differences in the in-and-out degrees of the nodes;

[0030] Based on the preset threshold, mark the suspected abnormal subgraphs;

[0031] Further anomaly detection is performed from the two aspects of node out-degree and in-degree.

[0032] Preferably, the abnormality detection from the node out-degree aspect includes:

[0033] Determine whether the subgraph has only i nodes out-degree;

[0034] Determine whether the in-degree of the i subgraph nodes is greater than a specified threshold;

[0035] If the above two conditions are met at the same time, the subgraph is marked as an abnormal subgraph.

[0036] Preferably, the anomaly detection from the node in-degree aspect includes:

[0037] Determine whether node k exists in the subgraph;

[0038] Determine whether there is a node among the neighbor nodes of the node k whose in-degree is greater than the in-degree of the node k;

[0039] If the above two conditions are met at the same time, the subgraph is marked as an abnormal subgraph.

[0040] Preferably, the support-based analysis and association specifically include:

[0041] Create an abnormal user table, including id, user name, abnormal number and abnormal weight fields;

[0042] When a new user is marked as an abnormal user, the abnormal user table is updated;

[0043] If the abnormal user does not exist in the abnormal user table, a new record is added, the number of initial abnormalities is 1, and the abnormal weight is the difference between the first abnormal time and the system time;

[0044] If the abnormal user already exists in the abnormal user table, the abnormal number is increased by 1 and the abnormal weight is updated;

[0045] The user names are sorted according to the IDs in the abnormal user table to generate a final list of users with abnormal behavior.

[0046] Preferably, the abnormal weight is updated as follows:

[0047] Calculate the difference between the current abnormal time and the last abnormal time;

[0048] Multiply the difference by the number of anomalies to obtain a new anomaly weight.

[0049] Preferably, the pre-treatment step is also included:

[0050] Clean and standardize the acquired user personal information data, network behavior data and context data;

[0051] Extract key features and generate feature vectors for subsequent analysis.

[0052] Preferably, the post-processing step is also included:

[0053] Categorize and rate detected anomalous behaviors;

[0054] Generates abnormal behavior reports, including anomaly type, severity, and recommended actions.

[0055] A social network abnormal behavior detection system based on graph computing, comprising:

[0056] Data collection module, used to obtain users' personal information data, network behavior data and corresponding context data;

[0057] A data processing module, used for constructing an edge weight graph G=(V, E, W) based on the network behavior data of the user;

[0058] An abnormal user clustering module is used to cluster user nodes based on information entropy according to the edge weight graph G to obtain clustering results corresponding to K abnormal behaviors;

[0059] An abnormal subgraph detection module, used to perform abnormal subgraph detection on each clustering result based on graph computing theory, and mark the user corresponding to the detected abnormal subgraph as an abnormal user;

[0060] An association analysis module is used to analyze and associate the abnormal users based on support and generate a final list of users with abnormal behavior;

[0061] Among them, the specific implementation methods of the abnormal user clustering module, abnormal subgraph detection module and association analysis module are the same as the corresponding steps described.

[0062] Specifically, the present invention has the following significant beneficial effects:

[0063] The method of the present invention has the following significant beneficial effects:

[0064] First, by constructing an edge weight graph model, this method fully utilizes the structural characteristics of social networks, not only considering the behavioral characteristics of individual users, but also capturing the interaction patterns between user groups. This enables this method to effectively identify behaviors that are normal at the individual user level but abnormal in group interaction patterns.

[0065] Secondly, this method uses a clustering algorithm based on information entropy, which has good adaptive ability and can automatically adjust the clustering results according to the distribution characteristics of the data. This enables this method to adapt to the dynamic changes of user behavior in social networks and maintain a stable detection effect.

[0066] Thirdly, this method introduces abnormal subgraph detection technology, which can more comprehensively and accurately identify various types of abnormal behavior patterns by analyzing the in-degree characteristics of nodes. This method is particularly suitable for detecting those well-designed and hidden abnormal behaviors.

[0067] In addition, the method also includes support-based analysis and association steps, which enables the system to evaluate the persistence and severity of abnormal behavior. This dynamic evaluation mechanism not only improves the accuracy of detection, but also provides an important basis for subsequent user management and risk control.

[0068] Finally, this method can not only detect abnormal behaviors, but also generate detailed abnormal behavior reports, including information such as abnormality type, severity, and recommended treatment measures. This in-depth analysis result provides strong support for the management and governance of social networks.

[0069] In general, the method proposed in the present invention realizes comprehensive, accurate and dynamic detection of abnormal behavior in social networks through the organic combination of multiple steps. There are obvious complementary and synergistic effects between the various steps. For example, the construction of the edge weight graph provides a basis for subsequent clustering and abnormal subgraph detection, and the support-based analysis further verifies and evaluates the results of the previous steps. This multi-level and multi-angle detection method greatly improves the accuracy and reliability of abnormal behavior detection and provides a strong technical guarantee for the healthy development of social networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 The present invention is a flow chart of the method.

[0071] Figure 2 This is a clustering logic block diagram based on information entropy of the present invention.

[0072] Figure 3 This is a logic block diagram of abnormal subgraph detection of the present invention.

[0073] Figure 4This is a logic block diagram of node out-degree anomaly detection of the present invention.

[0074] Figure 5 This is a logic block diagram of node in-degree anomaly detection of the present invention.

[0075] Figure 6 This is the support analysis and association logic block diagram of the present invention.

[0076] Figure 7 It is a logic block diagram of the system of the present invention. DETAILED DESCRIPTION

[0077] Please refer to Figure 1-7 The present invention provides a method and system for detecting abnormal behavior in social networks based on graph computing. The method achieves efficient and accurate detection of abnormal behavior in social networks by comprehensively utilizing multidimensional data, graph computing technology and machine learning algorithms.

[0078] First, the method includes an acquisition step. In this step, the system acquires the user's personal information data, network behavior data and corresponding context data. These multi-dimensional data provide a rich information basis for subsequent abnormal behavior detection. Preferably, personal information data may include the user's basic information, interests and hobbies, etc.; network behavior data may include the user's posting, commenting, liking and other activities; context data may include information such as the time, place, and device of the user's behavior.

[0079] Next, the method enters the processing step. This step first constructs an edge weight graph G = (V, E, W) based on the user's network behavior data. In this graph, V represents the user node set, E represents the user relationship set, and W represents the relationship strength. This graph model can effectively express the complex relationships between users in a social network. For example, the relationship strength between two users can be calculated by factors such as the frequency of their interactions and the length of their messages.

[0080] After constructing the edge weight graph, this method uses a clustering algorithm based on information entropy to cluster user nodes and obtains K clustering results corresponding to abnormal behaviors. The K value here can be adjusted according to actual needs, and a value between 3 and 10 can usually be selected. The specific steps of information entropy clustering will be described in detail later.

[0081] Subsequently, based on graph computing theory, this method performs abnormal subgraph detection on each clustering result. This step marks the users corresponding to the detected abnormal subgraphs as abnormal users. The specific process of abnormal subgraph detection will also be described in detail later.

[0082] Finally, in the output step, the method performs support-based analysis and association on the marked abnormal users to generate a final list of users with abnormal behavior. This support-based analysis can help identify users who continuously behave abnormally and improve the accuracy of detection.

[0083] Next, we explain the clustering process based on information entropy in detail. The process includes the following specific steps:

[0084] First, calculate the degree information entropy of each user node. The calculation formula of degree information entropy is as follows:

[0085]

[0086] Among them, H(u i ) represents user u i The degree information entropy, p k represents the probability of degree k, and n represents the maximum degree. Then, the user nodes are sorted in descending order according to the calculated degree information entropy. This step helps to rank users with abnormal behavior patterns at the front.

[0087] Next, set a threshold t. The choice of this threshold is critical, as it directly affects the recognition effect of abnormal users. Based on experience, t can be set to the average value of the degree information entropy of all users plus one standard deviation. For example, if the average information entropy is 2.5 and the standard deviation is 0.5, then t can be set to 3. Based on this threshold t, we set the set of nodes greater than the threshold t as U1, and the set less than the threshold t as U2. In this way, users are preliminarily divided into two categories: potentially abnormal users and normal users.

[0088] For the U1 set, we divide it into K classes equally. The K value here also needs to be adjusted according to the actual situation, and usually a value between 3 and 7 can be selected.

[0089] Based on this threshold t, we set the set of nodes greater than the threshold t as U1, and the set less than the threshold t as U2. In this way, users are initially divided into two categories: potentially abnormal users and normal users.

[0090] For the U1 set, we divide it into K classes equally. The K value here also needs to be adjusted according to the actual situation, and usually a value between 3 and 7 can be selected.

[0091] Then, the information entropy of each node set is calculated. The information entropy calculation formula of the set is as follows:

[0092]

[0093] Among them, H(S) represents the information entropy of set S, |S i | represents a subset Si The size of , |S| represents the total size of set S, and m represents the number of subsets.

[0094] Finally, each set is sorted in ascending order according to the calculated information entropy, and the first t sets with high information entropy are selected as abnormal user sets. The t value here can be adjusted according to actual needs, and a value between 1 and 3 can usually be selected.

[0095] Through the above steps, we have completed the user clustering based on information entropy and obtained the set of users who may have abnormal behavior. The advantage of this method is that it can effectively identify the user group whose behavior pattern is different from that of most users, providing a good foundation for subsequent abnormal behavior detection.

[0096] Next, we explain the process of abnormal subgraph detection in detail. The process includes the following specific steps: First, the importance of each user node is calculated based on the Katz centrality index. The calculation formula of Katz centrality is as follows:

[0097]

[0098] Among them, C Katz (i) represents the Katz centrality of node i, A ij is an element of the adjacency matrix, α is the attenuation factor (usually less than the inverse of the largest eigenvalue of the adjacency matrix), and β is the basic centrality score (usually 1).

[0099] Then, the adjacency matrix is ​​constructed based on the calculated Katz centrality values. The construction formula of the adjacency matrix is ​​as follows:

[0100]

[0101] Among them, A ij Represents the elements of the adjacency matrix, C Katz (i) and C Katz (j) represents the Katz centrality value of nodes i and j respectively, and E represents the edge set.

[0102] Next, calculate the in-degree and out-degree of each subgraph node. The calculation formulas for the out-degree and in-degree of a node are as follows:

[0103]

[0104]

[0105] Among them, d out (i) and d in (i) represents the out-degree and in-degree of node i respectively.

[0106] Then, we traverse each subgraph and analyze the in-degree difference of the nodes. We can calculate the in-degree difference value:

[0107] Δd(i)=|d out (i)-d in (i)|,

[0108] If Δd(i) is greater than a preset threshold (for example, the threshold may be set to the average value of Δd values ​​of all nodes plus two standard deviations), the corresponding subgraph is marked as a suspected abnormal subgraph.

[0109] Finally, further anomaly detection is performed from the two aspects of node out-degree and in-degree. This process will be described in detail in the subsequent claims.

[0110] Through the above steps, we have completed the detection of abnormal subgraphs and effectively identified user groups that may have abnormal behaviors in social networks. The advantage of this method is that it not only considers the behavioral characteristics of individual users, but also considers the interaction patterns between user groups, so that complex abnormal behavior patterns can be identified more accurately.

[0111] The method of the present invention proposes a novel, effective and practical solution for detecting abnormal behavior in social networks by comprehensively using technologies from multiple fields such as graph computing, information theory and machine learning. It can not only effectively detect abnormal behavior in social networks, but also has good interpretability, scalability and adaptability, which is of great significance for improving the security and reliability of social networks. The method of the present invention further refines the detection of abnormal subgraphs and conducts in-depth analysis from the two aspects of node out-degree and in-degree.

[0112] First, anomaly detection is performed from the node out-degree aspect. In one embodiment of the present invention, this process includes the following steps:

[0113] Determine whether the subgraph has only i nodes with out-degree. The value of i here is usually small, for example, it can be set to 2 or 3. This is because abnormal behavior is usually manifested as a small number of nodes sending a large amount of information outward.

[0114] Next, it is determined whether the in-degree of the i subgraph nodes is greater than a specified threshold. This threshold can be adjusted according to the actual situation, for example, it can be set to the average value of the in-degree of all nodes plus two standard deviations.

[0115] Preferably, the threshold can be calculated using the following formula:

[0116] threshold=μ in +2σ in ,

[0117] Among them, μ inrepresents the average value of all node in-degrees, σ in Represents the standard deviation of the in-degree of all nodes.

[0118] If both of the above conditions are met, the subgraph is marked as an abnormal subgraph. This method can effectively identify abnormal patterns where a small number of nodes send a large amount of information to the outside but receive less information. In practice, this pattern may correspond to abnormal behaviors such as spam or malicious marketing.

[0119] The method of the present invention also performs anomaly detection from the node in-degree. In a preferred embodiment, this process includes the following steps:

[0120] First, determine whether there is a node k in the subgraph. This node k should have special properties, for example, it may be the node with the largest in-degree in the subgraph.

[0121] Then, determine whether there is a node with an in-degree greater than that of node k among the neighbor nodes of node k. A proportional coefficient α can be introduced here to make the judgment condition more flexible. For example, the following condition can be used:

[0122]

[0123] Among them, N(k) represents the set of neighbor nodes of node k, d in (j) and d in (k) represents the in-degree of nodes j and k respectively, and α is a positive number less than 1, for example, it can be 0.8 or 0.9.

[0124] If both of the above conditions are met, the subgraph is marked as an abnormal subgraph. This method can identify abnormal patterns where there is a "central" node, but the node is not a real information aggregation center. In practical applications, this pattern may correspond to abnormal behaviors such as fake influence marketing or deliberately constructed fake social networks.

[0125] By combining the analysis of node out-degree and in-degree, the method of the present invention can more comprehensively and accurately identify abnormal behavior patterns in social networks.

[0126] After completing the detection of abnormal subgraphs, the method of the present invention further includes analyzing and associating abnormal users based on support. In one embodiment of the present invention, this process specifically includes the following steps:

[0127] First, create an abnormal user table. This table contains fields such as id, user name, abnormal number and abnormal weight. This structural design enables us to comprehensively record and analyze users' abnormal behaviors.

[0128] When a new user is marked as an abnormal user, the system will update the abnormal user table. The update process is as follows:

[0129] If the abnormal user does not exist in the abnormal user table, a new record is added. In this new record, the number of initial abnormalities is 1, and the abnormal weight is set to the difference between the first abnormal time and the current system time. This setting method takes the time factor into account and can distinguish newly discovered abnormal behaviors from long-standing abnormal behaviors.

[0130] If the abnormal user already exists in the abnormal user table, the abnormal number is increased by 1 and the abnormal weight is updated. The update of abnormal weight is a key innovation of this method. It adopts a dynamic calculation method to better reflect the persistence and severity of the user's abnormal behavior.

[0131] In a preferred embodiment of the present invention, the abnormal weight is updated as follows:

[0132] First, calculate the difference between the current abnormal time and the last abnormal time. This difference reflects the frequency of abnormal behavior of the user.

[0133] Then, this difference is multiplied by the number of anomalies to obtain a new anomaly weight. This calculation method takes into account the frequency and cumulative effect of abnormal behavior and can more accurately assess the severity of user abnormal behavior.

[0134] Specifically, the new anomaly weight can be calculated using the following formula:

[0135] w new =(t current -t last )×n,

[0136] Among them, w new represents the new anomaly weight, t current Indicates the current abnormal time, t last Indicates the last abnormal time, and n indicates the cumulative number of abnormal times.

[0137] Finally, we sort the user names according to the IDs in the abnormal user table to generate the final list of users with abnormal behavior. This sorting process can help us quickly identify the abnormal users that need the most attention.

[0138] Through this support-based analysis and association method, the present invention can effectively identify users who continuously behave abnormally, improving the accuracy and reliability of abnormal behavior detection. At the same time, this method also provides strong support for subsequent user management and risk control.

[0139] In general, the method for detecting abnormal behavior in social networks based on graph computing proposed in the present invention realizes efficient and accurate detection of abnormal behavior in social networks by comprehensively using multiple advanced technologies such as multidimensional data analysis, graph computing technology, information entropy clustering, abnormal subgraph detection, and support-based analysis. This method can not only effectively identify various types of abnormal behaviors, but also evaluate the severity and persistence of abnormal behaviors, providing strong technical support for the security management of social networks. The method of the present invention also includes an important preprocessing step, which is performed before abnormal behavior detection to provide a high-quality data basis for subsequent analysis. In a preferred embodiment of the present invention, the preprocessing step specifically includes the following contents:

[0140] First, the acquired user personal information data, network behavior data, and contextual data are cleaned and standardized. During the data cleaning process, the system will remove duplicate data, correct erroneous data, fill in missing values, etc. For example, for user age data, obviously unreasonable values ​​may appear, such as negative numbers or values ​​exceeding 150, which need to be corrected or deleted. Standardization is to convert data of different scales to the same scale to facilitate subsequent analysis and comparison. Commonly used standardization methods include minimum-maximum scaling and Z-score standardization.

[0141] Secondly, this method will extract key features and generate feature vectors for subsequent analysis. Feature extraction is a crucial step that directly affects the effect of anomaly detection. In one embodiment of the present invention, the features that can be extracted include but are not limited to:

[0142] 1. User activity characteristics: such as the average number of posts, comments, and likes per day.

[0143] 2. Social network structural characteristics: such as user degree centrality, betweenness centrality, eigenvector centrality, etc.

[0144] 3. Content characteristics: such as the sentiment tendency and topic distribution of the post text.

[0145] 4. Time series characteristics: such as the periodicity and burstiness of user behavior.

[0146] These features can be calculated by the following formula to obtain the feature vector:

[0147] f=[f1,f2,...,f n ] T ,

[0148] Among them, f i represents the i-th feature, and n is the total number of features.

[0149] Through this preprocessing step, the method of the present invention can effectively improve data quality and enhance the accuracy and reliability of subsequent anomaly detection.

[0150] In addition to the aforementioned abnormality detection step, the method of the present invention also includes an important post-processing step. This step is intended to further analyze and process the detected abnormal behavior to provide more valuable information for practical applications. In a preferred embodiment of the present invention, the post-processing step specifically includes the following:

[0151] First, the detected abnormal behaviors are classified and rated. Classification can help us better understand the nature of abnormal behaviors. For example, abnormal behaviors can be classified into categories such as spam dissemination, fake account operation, and malicious marketing. Rating quantifies the severity of abnormal behaviors. The following rating formula can usually be used:

[0152] S=w1·f1+w2·f2+...+w n ·f n ,

[0153] Among them, S represents the severity score of abnormal behavior, f i represents the i-th evaluation factor (such as abnormal duration, impact range, etc.), w i Indicates the corresponding weight.

[0154] Secondly, this method will generate an abnormal behavior report. This report includes information such as the abnormality type, severity, and recommended treatment measures. The report can be generated in a templated manner, filling in the corresponding content according to different abnormality types and severities. For example, for a high-severity abnormal behavior detected as spam, the report may contain the following content:

[0155] "Abnormal behavior of user ID: xxx was detected;

[0156] Abnormal type: spam spreading;

[0157] Severity: High (score: 8.7 / 10);

[0158] Recommended measures: 1. Immediately freeze the user's account; 2. Delete all content recently posted by the user; 3. Conduct further investigation on the user's associated accounts.

[0159] Through this post-processing step, the method of the present invention can not only detect abnormal behavior, but also provide more detailed and targeted analysis results, providing strong support for the management and governance of social networks.

[0160] Finally, the present invention also provides a social network abnormal behavior detection system based on graph computing, which includes multiple functional modules, each module is responsible for a specific task, and together achieves efficient and accurate abnormal behavior detection.

[0161] The data collection module 1 is responsible for obtaining the user's personal information data, network behavior data and corresponding context data.

[0162] The data processing module 2 is used to construct an edge weight graph G = (V, E, W) based on the user's network behavior data, completing the conversion process from raw data to edge weight graph.

[0163] The abnormal user clustering module 3 is responsible for clustering user nodes based on information entropy according to the edge weight graph G, and obtaining clustering results corresponding to K abnormal behaviors. This module may include an information entropy calculation submodule, a node sorting submodule, and a clustering execution submodule.

[0164] The abnormal subgraph detection module 4 is used to perform abnormal subgraph detection on each clustering result based on graph computing theory, and mark the users corresponding to the detected abnormal subgraphs as abnormal users.

[0165] The association analysis module 5 is used to analyze and associate abnormal users based on support, and generate a final list of users with abnormal behavior.

[0166] These modules are connected and interact with each other through data streams. For example, the output of data acquisition module 1 is used as the input of data processing module 2, and the output of data processing module 2 is used as the input of abnormal user clustering module 3, and so on. This modular design makes the system have good scalability and maintainability, and can flexibly adapt to different application requirements.

[0167] In general, the graph computing-based social network abnormal behavior detection method and system provided by the present invention realizes efficient and accurate detection of abnormal behavior in social networks by comprehensively applying multiple advanced technologies. The method not only considers the behavioral characteristics of individual users, but also considers the interaction patterns between user groups, and can effectively identify various types of abnormal behaviors. At the same time, the method also provides a detailed abnormal behavior analysis report, providing strong technical support for the security management of social networks. This method and system have important value in practical applications and can effectively improve the security and reliability of social networks.

[0168] It should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modification, replacement, and improvement made within the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting abnormal behavior in social networks based on graph computing, characterized in that ,include: The acquisition steps include: Obtaining the user's personal information data, network behavior data and corresponding context data; The processing steps include: Based on the network behavior data of the user, construct an edge weight graph G=(V, E, W), where V represents a user node set, E represents a user relationship set, and W represents a relationship strength; According to the edge weight graph G, user nodes are clustered based on information entropy to obtain clustering results corresponding to K abnormal behaviors; Based on graph computing theory, abnormal subgraph detection is performed on each clustering result, and users corresponding to the detected abnormal subgraphs are marked as abnormal users; The output steps include: The abnormal users are analyzed and associated based on support to generate a final list of users with abnormal behavior.

2. The method according to claim 1, characterized in that , the clustering based on information entropy specifically includes: Calculate the degree information entropy of each user node; Sort the user nodes in descending order according to the degree information entropy; Set a threshold t, set the node set greater than the threshold t as U1, and set the node set less than the threshold t as U2; Divide the U1 nodes into K classes evenly; Calculate the information entropy of each node set; sorting each set in ascending order according to the information entropy; The first t sets with high information entropy are selected as abnormal user sets.

3. The method according to claim 1, characterized in that , the abnormal subgraph detection specifically includes: Calculate the importance of each user node based on the Katz centrality index; Construct an adjacency matrix; Calculate the in-and-out degree of each subgraph node; Traverse each subgraph and analyze the differences in the in-and-out degrees of the nodes; Based on the preset threshold, mark the suspected abnormal subgraphs; Further anomaly detection is performed from the two aspects of node out-degree and in-degree.

4. The method according to claim 3, characterized in that ,The anomaly detection from the node out-degree aspect includes: Determine whether the subgraph has only i nodes out-degree; Determine whether the in-degree of the i subgraph nodes is greater than a specified threshold; If the above two conditions are met at the same time, the subgraph is marked as an abnormal subgraph.

5. The method according to claim 3, characterized in that ,The anomaly detection from the node in-degree aspect includes: Determine whether node k exists in the subgraph; Determine whether there is a node among the neighbor nodes of the node k whose in-degree is greater than the in-degree of the node k; If the above two conditions are met at the same time, the subgraph is marked as an abnormal subgraph.

6. The method according to claim 1, characterized in that , the support-based analysis and association specifically include: Create an abnormal user table, including id, user name, abnormal number and abnormal weight fields; When a new user is marked as an abnormal user, the abnormal user table is updated; If the abnormal user does not exist in the abnormal user table, a new record is added, the number of initial abnormalities is 1, and the abnormal weight is the difference between the first abnormal time and the system time; If the abnormal user already exists in the abnormal user table, the abnormal number is increased by 1 and the abnormal weight is updated; The user names are sorted according to the IDs in the abnormal user table to generate a final list of users with abnormal behavior.

7. The method according to claim 6, characterized in that ,The updating method of the abnormal weight is: Calculate the difference between the current abnormal time and the last abnormal time; Multiply the difference by the number of anomalies to obtain a new anomaly weight.

8. The method according to claim 1, characterized in that , also includes the preprocessing steps: Clean and standardize the acquired user personal information data, network behavior data and context data; Extract key features and generate feature vectors for subsequent analysis.

9. The method according to claim 1, characterized in that , also includes post-processing steps: Categorize and rate detected anomalous behaviors; Generates abnormal behavior reports, including anomaly type, severity, and recommended actions.

10. A social network abnormal behavior detection system based on graph computing, characterized by ,include: Data collection module, used to obtain users' personal information data, network behavior data and corresponding context data; A data processing module, used for constructing an edge weight graph G=(V, E, W) based on the network behavior data of the user; An abnormal user clustering module is used to cluster user nodes based on information entropy according to the edge weight graph G to obtain clustering results corresponding to K abnormal behaviors; An abnormal subgraph detection module, used to perform abnormal subgraph detection on each clustering result based on graph computing theory, and mark the user corresponding to the detected abnormal subgraph as an abnormal user; An association analysis module is used to analyze and associate the abnormal users based on support and generate a final list of users with abnormal behavior; Among them, the specific implementation methods of the abnormal user clustering module, the abnormal subgraph detection module and the association analysis module are the same as the corresponding steps described in claims 1-9.

Images