Social network abnormal event detection method based on event attention

Abstract

The invention discloses a social network abnormal event detection method based on event attention, and the method comprises the steps: determining a time period for abnormal event detection according to actual needs, dividing the time period into a plurality of time windows, collecting a text message set of a social network in each time window, constructing a social graph for each time window, and carrying out the detection of abnormal events in the social network. And according to the tense graph sequence, extracting to obtain an event and an event attention sequence, and analyzing the event attention sequence to judge whether the corresponding event is an abnormal event or not. According to the method, the tense graph sequence is generated by integrating the semantic information, the attention information and the time information of the text message, the event attention is extracted according to the tense graph sequence, the abnormal event is detected through the increase of the event attention, and the abnormal event detection accuracy is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of abnormal event detection in social networks, and more specifically, relates to a method for detecting abnormal events in social networks based on event attention. Background Art

[0002] The rise of Weibo, WeChat, QQ and other social networks has provided people with a more convenient way to receive and spread information. This means that in social networks, users' behaviors generate a large number of messages. When one or some similar messages cause a large number of users to interact, it is likely to evolve into a specific event. In the complex ecology of social networks, events that suddenly break out and have the characteristics of continuous dissemination, such events that attract widespread attention and cause negative impacts and damage are abnormal events in social networks. Therefore, timely detection and discovery of abnormal events in social networks is crucial to maintaining the healthy development of social networks.

[0003] In online social networks, abnormal events are sudden and can attract the attention of a large number of users in a short period of time. The sudden appearance of sudden events is accompanied by a sharp increase in attention and is quickly spread widely in social networks. This suddenness causes the influence of the event to expand rapidly in a very short period of time, forming an obvious abnormal phenomenon. This sudden change in attention in a short period of time shows the sudden characteristics of abnormal events in social networks. At the same time, abnormal events in online social networks are continuous. When an abnormal event occurs, community users post posts, messages, and comments about the user continuously. These interactive contents lead to a continuous increase in discussions related to the abnormal event. This continuous interaction may last for several days or even weeks, indicating that the attraction of abnormal events to users remains relatively continuous over time.

[0004] In recent years, the advancement of network technology has made it possible to analyze the rich information flow on social networks to detect abnormal events. To detect sudden abnormal events, the existing mainstream method is to represent events in the text stream as keywords, pre-label abnormal keywords by experts, and detect the sharp increase in the frequency (burst) of these abnormal keywords when the event occurs. This method is based on the basic assumption that when an event occurs, the usage of some related words will suddenly increase. Therefore, the event is represented by multiple abnormal keywords that show a surge in the number of occurrences. Although these event detection methods have been successful, two challenges still exist. First, selecting the right set of predefined abnormal keywords to track is a difficult task, which usually requires the knowledge of domain experts; second, once the right abnormal keywords are selected, the contextual semantics of these abnormal keywords must be correctly understood to better detect abnormal events. Therefore, using abnormal keywords alone (from the text of the message) is not always reliable.

[0005] Another approach to solving the task of abnormal event detection is to use the relationships in the social network structure. In view of the continuity of abnormal events, the propagation tree depicts the continuous evolution of topics in online user communities through the information propagation of social links (follower relationships). Abnormal events are accompanied by an increase in the rate of information propagation and a rapid expansion of the propagation range. The propagation tree continuously analyzes the propagation rate and range in the propagation path to identify abnormal propagation behaviors and thus detect abnormal events. Although the use of propagation trees is very useful in capturing the occurrence of abnormal events in online communities, the propagation tree structure is simple, and each node (user) only receives information through one path. In actual social networks, information is often transmitted through multiple paths and multiple channels, which results in the inability of propagation trees to receive information comprehensively, affecting the comprehensiveness of abnormal event detection. Other methods that use network structure relationships are to detect social events by analyzing the structure of abnormally connected subgraphs. This method indicates important features of event occurrence in social networks by detecting a sharp increase in the appearance of keywords within a specified time window. Subgraph analysis can also potentially help better divide graphs in document representations constructed from graphs. However, the subgraph structure method is a complex computational task, especially when the data scale is large, which will lead to a significant increase in computational overhead. At the same time, this method focuses on the frequency growth of a single word or phrase, ignoring the context and meaning of the event.

[0006] In summary, existing abnormal event detection methods face certain limitations in terms of relying on keyword burst detection and network structure analysis. Although the keyword method can capture the changes in word frequency when abnormal events occur, there are challenges in abnormal keyword selection and semantic understanding, making it difficult to fully and accurately detect abnormal events. On the other hand, although the propagation tree and community detection using social network structure provide a way to identify events from network relationships, the propagation tree method has a simple structure and lacks comprehensive capture of abnormal event detection. The method of analyzing abnormal connected subgraph structure has a large computational overhead and focuses on the growth of word frequency, ignoring the context and meaning of the event. Summary of the invention

[0007] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a method for detecting abnormal events in social networks based on event attention. A temporal graph sequence is generated by integrating the semantic information, attention information and time information of text messages, and the event attention is extracted according to the temporal graph sequence. Abnormal events are then detected through the growth of event attention, thereby improving the accuracy of abnormal event detection.

[0008] To achieve the above-mentioned purpose, the method for detecting abnormal events in social networks based on event attention of the present invention comprises the following steps:

[0009] S1: Determine the time period for abnormal event detection according to actual needs, and divide the predetermined time period into K time windows Tk ∈(t k,start ,t k,end ],k=1,2,…,K,t k,start ,t k,end Represent the start time and end time of the kth time window respectively; obtain the text messages posted by all users in the social network within the predetermined time period, and then divide the text messages into corresponding time windows T according to the timestamps. k , get each time window T k Text message collection TXT k ;

[0010] S2: According to each time window T k Text message collection TXT k Generate the social graph G corresponding to the time window k , thus obtaining K social graphs G k The specific method of generating a social graph is as follows:

[0011] S2.1: Using the word vector representation method of the BERT model to represent the text message set TXT k Each text message in txt k,i Extract the text representation vector as its semantic information d k,i ,i=1,2,…,N k , N k Represents a text message collection TXT k The number of text messages contained in;

[0012] S2.2: For each text message txt k,i Extract attention information w k,i ;

[0013] S2.3: According to the text message txt k,i Extract time information from the specific timestamp t k,i ;

[0014] S2.4: Text message txt k,i As nodes, they constitute the social graph G k =(V k ,E k ),in N k A collection of message nodes, message node v k,i Represents text messages in social networks txt k,i Corresponding nodes, record each message node v k,i The attribute information is a triple {d k,i ,w k,i ,t k,i}; E k ={eij} represents the undirected edge set of the social graph, i,j=1,2,…,N k , e ij Represents the message node v k,i and message node v k,j The edges between are determined as follows:

[0015] Calculate the message node v k,i The semantic information of k,i and message node v k,j The semantic information of k,j The cosine similarity sim ij , when sim ij is greater than the preset threshold, then the message node v k,i and message node v k,j There is an edge e between ij , otherwise it does not exist;

[0016] The adjacency matrix of the social graph G is A = [a ij ] N×N , a ij =1 indicates message node v k,i and message node v k,j Connectivity, a ij =0 indicates message node v k,i and message node v k,j of disconnection;

[0017] S3: Extract the event and event attention sequence based on the temporal graph sequence. The specific method is as follows:

[0018] S3.1: Input the temporal graph sequence into the pre-trained graph attention neural network, and use the attention mechanism to analyze each social subgraph G in the temporal graph sequence. k Aggregate the semantic information of the message nodes in to get the message node v k,i The global semantic information D k,i ;

[0019] S3.2: For each time window T k The global semantic information of the message node in D k,i Clustering is performed to obtain M k node clusters, thus obtaining the time window T k M k Event Cluster m=1,2,…,M k ;

[0020] S3.3: K time windows T k The event cluster obtained in the above is matched to obtain the event. The specific method is as follows:

[0021] For two adjacent time windows T k-1 , T k Event cluster m′=1,2,…,M k-1 ,m=1,2,…,M k The cluster overlap is calculated using the following formula:

[0022]

[0023] Among them, || means to find the number of message nodes in the set;

[0024] If the cluster overlap Greater than the preset threshold θ overlap , then determine the event cluster and They belong to the same event, otherwise they do not belong to the same event;

[0025] The K time windows T k The event clusters belonging to the same event in the above example constitute an event cluster sequence, thus obtaining an event. The number of events obtained is Q. Then the qth event where q=1,2,…,Q,k q Indicates the starting time window number of the qth event, Z q represents the number of time windows covered by the qth event, Indicates that in the time window The event cluster number, z = 0, 1, ..., Z q -1, Represents the time window in the qth event Event clusters within

[0026] S3.4: For each event C q , calculate each event cluster Event attention Thus we get event C q Event attention sequence The event attention The calculation formula is as follows:

[0027]

[0028] Among them, α and β are weight parameters, Represents event clusters The number of message nodes in Represents event clusters Attention information of message nodes The average value of

[0029] S4: For each event C qEvent attention sequence Calculate the growth rate of event attention in two adjacent time windows z′=0,1,…,Z q -2, select the event cluster with the largest growth rate and take it as event C q Representative event clusters in Represents event clusters The corresponding time window number and event cluster number; then the following method is used to identify the representative event cluster Representative keywords:

[0030] Event cluster Each message node in the message node is Represents event clusters The number of message nodes in the message node is The corresponding global semantic information is recorded as Then the average semantic information is calculated using the following formula

[0031]

[0032] Searching for word vectors and averaging semantic information in the vocabulary of the BERT model The G word vectors with the highest similarity are used as candidate abnormal events C. q The theme word vector group W q ={w q,1 ,w q,2 ,…,w q,G}, where w q,g Represents the candidate abnormal event C q The word vector corresponding to the g-th topic word, g = 1, 2, ..., G;

[0033] Preset several abnormal event keywords, use the BERT model to determine their word vectors, and then obtain abnormal keyword phrases Represents the word vector corresponding to the h-th abnormal event topic word, h = 1, 2, ..., H; calculate each candidate abnormal event word vector w q,g Abnormal topic word vector The similarity between them is the same, and the maximum value is selected from the G×H similarity and recorded as sim_max q , if sim_max q If it is greater than the preset threshold, then event C q It is an abnormal event, otherwise it is not an abnormal event.

[0034] The present invention discloses a method for detecting abnormal events in social networks based on event attention. The method determines the time period for abnormal event detection according to actual needs and divides it into several time windows. The text message set of the social network in each time window is collected. Then, a social graph is constructed for each time window to obtain a temporal graph sequence. Events and event attention sequences are extracted according to the temporal graph sequence. The event attention sequence is analyzed to determine whether the corresponding event is an abnormal event.

[0035] The present invention has the following beneficial effects:

[0036] 1) The present invention integrates the semantic information, attention information and time information of text messages posted by users in social networks by constructing a temporal graph, thereby forming a message cluster that represents network events. This method aggregates the message semantics in the temporal graph and uses the attention of event clusters to perceive emergencies and perform anomaly identification.

[0037] 2) The present invention can also track the fermentation changes of abnormal events based on the rate of change of attention, and provide accurate analysis of the growth, climax and decline stages of events. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a structural diagram of a specific implementation method of a method for detecting abnormal events in a social network based on event attention of the present invention;

[0039] Figure 2 is a flow chart of generating a social graph in the present invention;

[0040] Figure 3 is a flow chart of a method for calculating attention information in this embodiment;

[0041] Figure 4 It is a flow chart of extracting event and event attention sequence in the present invention. DETAILED DESCRIPTION

[0042] The specific implementation of the present invention is described below in conjunction with the accompanying drawings so that those skilled in the art can better understand the present invention. It should be noted that in the following description, when the detailed description of known functions and designs may dilute the main content of the present invention, these descriptions will be omitted here.

[0043] Example

[0044] Figure 1 1 is a structural diagram of a specific implementation of the method for detecting abnormal events in social networks based on event attention in the present invention. Figure 1 As shown, the method for detecting abnormal events in social networks based on event attention of the present invention comprises the following steps:

[0045] S101: Obtaining social network text messages:

[0046] Determine the time period for abnormal event detection according to actual needs, and divide the predetermined time period into K time windows T k ∈(t k,start ,t k,end ],k=1,2,…,K,t k,start ,t k,end Represent the start time and end time of the kth time window respectively. Get all the text messages posted by users in the social network within the predetermined time period, and then divide the text messages into corresponding time windows T according to the timestamps k , get each time window T k Text message collection TXT k .

[0047] S102: Constructing a social network temporal graph sequence:

[0048] In order to better extract event features in social networks, we first construct a temporal graph sequence for each user in the social network, that is, according to each time window T k Text message collection TXT k Generate the social graph G corresponding to the time window k , thus obtaining K social graphs G k The sequence of temporal graphs.

[0049] Figure 2 is a flowchart of generating a social graph in the present invention. Figure 2 As shown, generating a social graph in the present invention includes the following steps:

[0050] S201: Obtaining semantic information of text message:

[0051] The word vector representation method of the BERT (Bidirectional Encoder Representation from Transformers) model is used to represent the text message set TXT. k Each text message in txt k,i Extract the text representation vector as its semantic information d k,i ,i=1,2,…,N k , N k Represents a text message collection TXT k The number of text messages contained in .

[0052] The specific method of extracting text representation from the word vector representation method of the BERT (Bidirectional Encoder Representation from Transformers) model is:

[0053] First, the text messages are cleaned to remove irrelevant characters (punctuation marks, URLs, HTML tags, etc.) in the text, unify the format and remove extra spaces.

[0054] Use BERT's word segmenter to segment the text message after data cleaning, convert the text message into subword units, map each subword to a word ID, and obtain a word ID sequence.

[0055] To ensure that the model can correctly process the sentence structure in the message, a [CLS] tag is added at the beginning of each sentence in the word ID sequence to indicate the beginning of the sentence, and a [SEP] tag is added between sentences or at the end of a sentence to separate sentences or mark the end of a sentence. An attention mask is generated to indicate actual words and filler words. A value of 1 in the mask indicates an actual word, and a value of 0 indicates a filler word.

[0056] The length of all padded word ID sequences in the text message is unified, that is, shorter sequences are padded (to a fixed length) and overlong sequences are truncated. Padding usually uses a special marker [PAD], and the corresponding word ID is 0.

[0057] If the text message contains multiple sentences, segment IDs need to be generated to indicate which sentence each subword belongs to (usually 0 or 1).

[0058] The word ID, attention mask, and segment ID are input into the BERT preprocessing model. The [CLS] tag vector output by the model is a vector representation of a sentence that encodes the information learned when encoding all the input words.

[0059] Finally, the average pooling method is used to average the vector representations of all sentences to generate the text representation vector of the entire text message as semantic information.

[0060] S202: Obtaining attention information of the text message:

[0061] For each text message txt k,i Extract attention information w k,i .

[0062] The attention representation information is used to characterize the user's influence. In this embodiment, the generation and diffusion process of user influence in the three sub-networks of attention, forwarding, and commenting are analyzed, and then the user influence representation vector is aggregated and measured. The influence is: if a user is followed, forwarded, and commented by many users at the same time, then the user is considered to have influence. Figure 3 4 is a flow chart of the method for calculating the attention information in this embodiment.

[0063] like Figure 3As shown, the calculation method of the attention information in this embodiment is as follows:

[0064] S301: Calculate the forwarding influence between users:

[0065] In this embodiment, the user forwarding influence is measured based on the propagation probability between the publishing user and the forwarding user. First, the text message set TXT is obtained. k The publishers and forwarders of all text messages in the network are then used as nodes to build a user forwarding network V r , and then use the following formula to calculate the time window T of a publishing user δ and a forwarding user γ k The forwarding interaction intensity influence index Inf k r (δ,γ):

[0066]

[0067] in, Indicates that in the time window T k The number of times the text message of the posting user δ is forwarded by the forwarding user γ, Indicates that in the time window T k The number of times all text messages of the forwarding user γ are forwarded, Indicates that in the time window T k The number of times all text messages posted by user δ have been forwarded.

[0068] This interaction intensity influence index calculation method takes into account the frequency of interaction between users, that is, the extent to which user γ interacts with user δ. The more frequent the interaction, the greater the influence of user δ on user γ. It also takes into account the frequency of user δ being interacted with by other users. These two types of interaction intensity are equally important in the calculation of influence index, so the arithmetic mean of the two indicators is calculated as the influence index of user δ and user γ.

[0069] The following formula is used to calculate the probability of forwarding influence propagation from the publishing user δ to the forwarding user γ:

[0070]

[0071] in, Represents the forwarding user γ in time window T k The set of users who posted the forwarded text messages. Indicates that in the time window T k The forwarding interaction intensity influence index of the internal posting user α and the forwarding user γ,

[0072] It can be seen that this embodiment uses the forwarding influence propagation probability It is understood as the influence index of the publishing user δ on the forwarding user γ among all the forwarded users The relative weight of the influence index on user γ (user γ forwarding the message of user δ is understood as the influence of δ on γ). Therefore, the forwarding influence propagation probability can be used To calculate the forwarding influence, the specific method is:

[0073] Randomly set forwarding network V r The initial value of the forwarding influence of each user in is then calculated by a predetermined number of iterations to obtain the forwarding influence of each user. In each iteration, the following formula is used to calculate the forwarding influence of the publishing user δ

[0074]

[0075] in, Indicates that in the time window T k The set of forwarding users who have forwarded the text message published by the publishing user δ.

[0076] S302: Calculate the influence of comments between users:

[0077] Similar to the forwarding influence, in this embodiment, the influence of user comments is measured based on the propagation probability between the posting user and the commenting user. First, obtain the text message set TXT k The users who posted and commented on all the text messages in the network are then used as nodes to build the comment network V c , and then use the following formula to calculate the time window T of a publishing user δ and a commenting user γ k Influence index of the comment interaction intensity within

[0078]

[0079] in, Indicates that in the time window T k The number of comments made by the internal commenting user γ on the text message of the posting user δ, Indicates that in the time window T k The number of all text message comments by commenting user γ, Indicates that in the time window T k The number of times all text messages posted by user δ have been commented on.

[0080] The following formula is used to calculate the probability of spreading the influence of comments from the publishing user δ to the commenting user γ:

[0081]

[0082] in, Denotes the comment user γ in the time window T k The user set corresponding to the comment text message, represents the comment interaction strength influence index between the posting user α and the commenting user γ,

[0083] Similarly, the probability of spreading the influence of comments It is understood as the influence index of the publishing user δ on the commenting user γ among all the commented users The relative weight of the influence index of the comment user γ (the message of user γ commenting on user δ is understood as the influence of δ on γ). Therefore, the probability of propagation of comment influence can be used To calculate the influence of comments, the specific method is:

[0084] Randomly set the comment network V c The initial value of the comment influence of each user in is then iterated for a predetermined number of times to obtain the forwarding influence of each user. In each iteration, the following formula is used to calculate the comment influence of the posting user δ

[0085]

[0086] in, Indicates that in the time window T k The set of users who have commented on the text message posted by the posting user δ.

[0087] S303: Calculate the attention influence between users:

[0088] In this embodiment, the influence of user comments is measured based on the propagation probability between the posting user and the following user. Since the following relationship between users is an unweighted edge, the influence of user on user cannot be quantified by the interaction intensity. In this case, the propagation probability of the following influence is defined by analyzing the messages posted by the user. First, obtain the text message set TXT k The publishers and followers of all text messages in the network are then used as nodes to build a follow network V f Then, the following formula is used to calculate the time window T between a publishing user δ and a following user γ k Probability of spreading influence within

[0089]

[0090] Among them, P k (δ), P k (α) represents the posting user δ and user α in time window Tk The number of published messages in Represents user γ in time window T k The collection of followed users within.

[0091] Similarly, we will focus on the probability of influence spread It is understood as the influence index of the publishing user δ on the following user γ among all the followed users The relative weight of the influence index on user γ (user γ's attention to user δ is understood as the influence of δ on γ). Therefore, the probability of attention influence propagation can be used To calculate the forwarding influence, the specific method is:

[0092] Randomly set attention network V f The initial value of the attention influence of each user in is then calculated by a predetermined number of iterations to obtain the forwarding influence of each user. In each iteration, the following formula is used to calculate the attention influence of the posting user δ

[0093]

[0094] in, Indicates that in the time window T k The set of users who follow the posting user δ.

[0095] S304: Obtaining a set of users related to the text message:

[0096] For text messages txt k,i , get the k The collection of users who forwarded the text message The collection of users who commented on the text message

[0097] S305: Calculate the attention information of the text message:

[0098] Use the following formula to calculate the text message txt k,i The attention information k,i :

[0099]

[0100] Among them, x1 represents the forwarding user set The forwarding users in x2 represent the set of commenting users. Comment user in, x k,i Indicates text message txt k,i The publishing user.

[0101] It can be seen that in this embodiment, the text message txt k,iInformation about the degree of attention k,i The influence is represented by the following three aspects: Indicates that the text message txt is forwarded i The sum of all users’ forwarding influence; Indicates that a text message txt has been commented on i The sum of the influence of all users’ comments; Indicates publishing a text message txt i User x k,i Attention influence, attention influence is only related to the user himself.

[0102] S203: Obtaining time information:

[0103] According to the text message txt k,i Extract time information from the specific timestamp t k,i . In this embodiment, in order to ensure the consistency and standardization of all time information, the present invention uniformly converts all timestamps into the ISO8601 standard time format specified by the International Organization for Standardization. The ISO 8601 format usually adopts the form of YYYY-MM-DDTHH:MM:SSZ, which is expressed as "year-month-day T hour: minute: second Z" (where "Z" represents coordinated universal time, UTC). For example, if the timestamp is 15:30:45 (UTC) on September 13, 2024, then according to the ISO 8601 format, the timestamp should be converted to "2024-09-13T15:30:45Z". Through this standardized processing, all time information will be stored and compared in a unified format, which is convenient for subsequent downstream task analysis.

[0104] S204: Building a social graph:

[0105] txt k,i As nodes, they constitute the social graph G k =(V k ,E k ),in N k A collection of message nodes, message node v k,i Represents text messages in social networks txt k,i Corresponding nodes, record each message node v i The attribute information is a triple {d k,i ,w k,i ,t k,i}. E k ={e ij} represents the undirected edge set of the social graph, i,j=1,2,…,N k , e ij Represents the message node v k,i and message node vk,j The edges between are determined as follows:

[0106] The message node v is calculated using the following formula: i The semantic information of i and message node v j The semantic information of j The cosine similarity sim ij :

[0107]

[0108] Among them, |||| represents the modulus of the vector.

[0109] When sim ij is greater than the preset threshold, then the message node v k,i and message node v k,j There is an edge e between ij , otherwise it does not exist.

[0110] The adjacency matrix of the social graph G is A = [a ij ] N×N , a ij =1 indicates message node v k,i and message node v k,j Connected, that is, the text content is semantically similar, a ij =0 indicates message node v k,i and message node v k,j Disconnected, that is, the two message nodes are not semantically similar.

[0111] S103: Extracting events and event attention sequences:

[0112] Extracting event attention in the temporal graph is a prerequisite for detecting abnormal events in social networks. Therefore, it is necessary to extract the event and event attention sequence based on the temporal graph sequence. Figure 4 is a flowchart of extracting event and event attention sequence in the present invention. Figure 4 As shown, the specific steps of extracting events and event attention sequences in the present invention include:

[0113] S401: Aggregating social graph semantic information:

[0114] The temporal graph sequence is input into the pre-trained graph attention neural network, and the attention mechanism is used to analyze each social subgraph G in the temporal graph sequence. k Aggregate the semantic information of the message nodes in to get the message node v k,i The global semantic information D k,i Graph attention neural network is a commonly used graph neural network, and its specific process will not be described here.

[0115] S402: Clustering to obtain event clusters:

[0116] For each time window T k The global semantic information of the message node in D k,i Clustering is performed to obtain M k node clusters, thus obtaining the time window T k M k Event Cluster m=1,2,…,M k .

[0117] The specific clustering algorithm can be set according to actual needs. In this embodiment, the DBSCAN (Density-Based Spatial Clustering of Applications with Noise) algorithm is used for clustering. The DBSCAN algorithm is a density-based clustering algorithm with two main parameters: the domain radius ∈ and the minimum number of points MinPts within the domain radius to become a core object. In this embodiment, the feature vector dimension is 50, the domain radius ∈=1.5, and the minimum number of points MinPts=100.

[0118] S403: Event cluster matching to obtain events:

[0119] The K time windows T k The event clusters obtained in the social subgraphs are matched to obtain events. Event cluster matching can ensure that event clusters in social subgraphs in different time windows correspond to the same event. The present invention adopts an event cluster matching method based on cluster overlap, and the specific method is as follows:

[0120] For two adjacent time windows T k-1 、T k Event cluster m′=1,2,…,M k-1 ,m=1,2,…,M k The cluster overlap is calculated using the following formula:

[0121]

[0122] Among them, || means to find the number of message nodes in the set. Represents event clusters and The number of common message nodes in (the intersection of message nodes in two event clusters), Represents event clusters and The number of all nodes in (the union of message nodes in the two event clusters).

[0123] If the cluster overlap Greater than the preset threshold θ overlap , then determine the event cluster and is the adjacent time window T k-1 , T k The continuation of the same event cluster in belongs to the same event, otherwise it does not belong to the same event. In this embodiment, the threshold θ is set overlap =0.7.

[0124] By continuously calculating the overlap of event clusters in adjacent time windows, we can form a set of event clusters across multiple time windows, that is, k The event clusters belonging to the same event in the event cluster sequence constitute an event cluster sequence, then an event is obtained, and the number of events obtained is recorded as Q. Then the qth event where q=1,2,…,Q,k q Indicates the starting time window number of the qth event, Z q represents the number of time windows covered by the qth event, Indicates that in the time window The event cluster number, z = 0, 1, ..., Z q -1, Represents the time window in the qth event Event clusters within.

[0125] S404: Calculate event attention sequence:

[0126] For each event C q , calculate each event cluster Event attention Thus we get event C q Event attention sequence The event attention The calculation formula is as follows:

[0127]

[0128] Among them, α and β are weight parameters, Represents event clusters The number of message nodes in Represents event clusters Attention information of message nodes The average value of . Represents event clusters The sum of the attention information of all message nodes in Represents event clusters The variance of the attention information of all message nodes in . The variance reflects the degree of dispersion. Here, the variance of message attention information can represent the node attention information The larger variance means that there are abnormal events in the cluster. Therefore, the present invention uses the sum of message attention and the message attention variance to calculate the event attention of the event cluster.

[0129] Assume that an event contains three event clusters, of which the first event cluster contains five message nodes, and their attention information is 0.6, 0.8, 0.7, 0.9, and 0.5 respectively. Set α = 0.7 and β = 0.3, so the sum of attention information is 3.5, the mean of attention is 0.7, and the variance is 0.02, so the event attention = 0.7 × 3.5 + 0.3 × 0.02 = 2.45 + 0.006 = 2.456. Assume that the event attention of the second and third event clusters is 3.124 and 2.789 respectively, then the event attention sequence of the event is {2.456, 3.124, 2.789}.

[0130] S104: Abnormal event detection:

[0131] Event attention can measure the interest of social network users in an event. However, abnormal events in social networks are sudden and continuous. Only observing event attention cannot measure these two characteristics of abnormal events. Therefore, the present invention proposes a method of detecting abnormal events by analyzing the change of event attention and matching keywords. The specific method is as follows:

[0132] For each event C q Event attention sequence Calculate the growth rate of event attention in two adjacent time windows The maximum growth rate is selected and its corresponding event cluster is taken as event C q Representative event clusters in Represents event clusters The corresponding time window number and event cluster number. For example, if the event attention sequence of an event is {2.1, 4.5, 6.3}, and the event attention growth rates of adjacent time windows are 2.4 and 1.8 respectively, and the maximum growth rate is 2.4, then the second event cluster is taken as the representative event cluster of the event.

[0133] In order to confirm whether the candidate event is a real abnormal event, the present invention extracts the representative subject word group of the event according to the representative event cluster and compares its similarity with the preset abnormal event subject words to finally determine the abnormal event. Therefore, the following method is used to identify the representative event cluster Representative keywords:

[0134] Event cluster Each message node in the message node is Represents event clusters The number of message nodes in the message node is The corresponding global semantic information is recorded as Then the average semantic information is calculated using the following formula

[0135]

[0136] Searching for word vectors and averaging semantic information in the vocabulary of the BERT model The G word vectors with the highest similarity are used as candidate abnormal events C. q The theme word vector group W q ={w q,1 ,w q,2 ,…,w q,G}, where w q,g Represents the candidate abnormal event C q The word vector corresponding to the g-th topic word, g = 1, 2, ..., G. In this embodiment, G = 10.

[0137] Preset several abnormal event keywords, use the BERT model to determine their word vectors, and then obtain abnormal keyword phrases Represents the word vector corresponding to the hth abnormal event topic word, h = 1, 2, ..., H. Calculate each candidate abnormal event word vector w q,g Abnormal topic word vector The similarity between them is the same, and the maximum value is selected from the G×H similarity and recorded as sim_max q If sim_max q If it is greater than the preset threshold, then event C q It is an abnormal event, otherwise it is not an abnormal event.

[0138] Assume that the preset abnormal event keywords include "cyber attack, network destruction, hacker destruction, web surfing, and The Matrix", and a keyword vector of a candidate abnormal event is "hacker intrusion", and its similarities with the word vectors of these five abnormal event keywords are 0.85, 0.80, 0.81, 0.50, and 0.20, respectively. The maximum value is 0.85, which is greater than the preset threshold of 0.7. Therefore, the candidate abnormal event is determined to be an abnormal event.

[0139] In practical applications, the fermentation tracking of abnormal events can also be performed according to the event attention sequence. The fermentation tracking of abnormal events refers to identifying the growth, climax and decline stages of events. The specific method of abnormal event fermentation tracking in this embodiment is:

[0140] For the event attention sequence of abnormal events, the time window corresponding to the event attention peak is determined by taking the second-order derivative. This time window is the climax stage, the time before this time window is the growth stage, and the time after this time window is the decline stage.

[0141] It can be seen that this mathematical analysis method can more accurately understand the continuous changes of abnormal events.

[0142] Although the above describes the illustrative specific embodiments of the present invention to facilitate those skilled in the art to understand the present invention, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations using the concept of the present invention are protected.

Claims

1. A method for detecting abnormal events in social networks based on event attention, characterized in that: The following steps are involved: S1: Determine the time period for abnormal event detection according to actual needs, and divide the predetermined time period into K time windows T k ∈(t k,start ,t k,end ],k=1,2,…,K,t k,start ,t k,end Represent the start time and end time of the kth time window respectively; obtain the text messages posted by all users in the social network within the predetermined time period, and then divide the text messages into corresponding time windows T according to the timestamps. k , get each time window T k Text message collection TXT k ; S2: According to each time window T k Text message collection TXT k Generate the social graph G corresponding to the time window k , thus obtaining K social graphs G k The specific method of generating a social graph is as follows: S2.1: Using the word vector representation method of the BERT model to represent the text message set TXT k Each text message in txt k,i Extract the text representation vector as its semantic information d k,i ,i=1,2,…,N k , N k Represents a text message collection TXT k The number of text messages contained in; S2.2: For each text message txt k,i Extract attention information w k,i ; S2.3: According to the text message txt k,i Extract time information from the specific timestamp t k,i ; S2.4: Text message txt k,i As nodes, they constitute the social graph G k =(V k ,E k ),in N k A collection of message nodes, message node v k,i Represents text messages in social networks txt k,i Corresponding nodes, record each message node v k,i The attribute information is a triple {d k,i ,w k,i ,t k,i }; E k ={e ij } represents the undirected edge set of the social graph, i,j=1,2,…,N k , e ij Represents the message node v k,i and message node v k,j The edges between are determined as follows: Calculate the message node v k,i The semantic information of k,i and message node v k,j The semantic information of k,j The cosine similarity sim ij , when sim ij is greater than the preset threshold, then the message node v k,i and message node v k,j There is an edge e between ij , otherwise it does not exist; The adjacency matrix of the social graph G is A = [a ij ] N×N , a ij =1 indicates message node v k,i and message node v k,j Connectivity, a ij =0 indicates message node v k,i and message node v k,j of disconnection; S3: Extract the event and event attention sequence based on the temporal graph sequence. The specific method is as follows: S3.1: Input the temporal graph sequence into the pre-trained graph attention neural network, and use the attention mechanism to analyze each social subgraph G in the temporal graph sequence. k Aggregate the semantic information of the message nodes in to get the message node v k,i The global semantic information D k,i ; S3.2: For each time window T k The global semantic information of the message node in D k,i Clustering is performed to obtain M k node clusters, thus obtaining the time window T k M k Event Cluster S3.3: K time windows T k The event cluster obtained in the above is matched to obtain the event. The specific method is as follows: For two adjacent time windows T k-1 、T k Event cluster m=1,2,…,M k The cluster overlap is calculated using the following formula: Among them, | | indicates the number of message nodes in the set; If the cluster overlap Greater than the preset threshold θ overlap , then the event cluster is determined and They belong to the same event, otherwise they do not belong to the same event; The K time windows T k The event clusters belonging to the same event in the above example constitute an event cluster sequence, thus obtaining an event. The number of events obtained is Q. Then the qth event where q=1,2,…,Q,k q Indicates the starting time window number of the qth event, Z q represents the number of time windows covered by the qth event, Indicates that in the time window The event cluster number, z = 0, 1, ..., Z q -1, Represents the time window in the qth event Event clusters within S3.4: For each event C q , calculate each event cluster Event attention Thus we get event C q Event attention sequence The event attention The calculation formula is as follows: Among them, α and β are weight parameters, Represents event clusters The number of message nodes in Represents event clusters Attention information of message nodes The average value of S4: For each event C q Event attention sequence Calculate the growth rate of event attention in two adjacent time windows z′=0,1,…,Z q -2, select the event cluster with the largest growth rate and take it as event C q Representative event clusters in Represents event clusters The corresponding time window number and event cluster number; then the following method is used to identify the representative event cluster Representative keywords: Event cluster Each message node in the message node is Represents event clusters The number of message nodes in the message node is The corresponding global semantic information is recorded as Then the average semantic information is calculated using the following formula Searching for word vectors and averaging semantic information in the vocabulary of the BERT model The G word vectors with the highest similarity are used as candidate abnormal events C. q The theme word vector group W q ={w q,1 ,w q,2 ,…,w q,G }, where w q,g Represents the candidate abnormal event C q The word vector corresponding to the g-th topic word, g = 1, 2, ..., G; Preset several abnormal event keywords, use the BERT model to determine their word vectors, and then obtain abnormal keyword phrases Represents the word vector corresponding to the h-th abnormal event topic word, h = 1, 2, ..., H; calculate each candidate abnormal event word vector w q,g Abnormal topic word vector The similarity between them is the same, and the maximum value is selected from the G×H similarity and recorded as sim_max q , if sim_max q If it is greater than the preset threshold, then event C q It is an abnormal event, otherwise it is not an abnormal event.

2. The method for detecting abnormal events in social networks according to claim 1, characterized in that: The calculation method of the attention information in step S2.2 is as follows: S2.2.1: Get text message collection TXT k All the users who publish and forward text messages in the network are then used as nodes to build a forwarding network V r , and then use the following formula to calculate the time window T of a publishing user δ and a forwarding user γ k Influence index of the forwarding interaction intensity within in, Indicates that in the time window T k The number of times the text message of the posting user δ is forwarded by the forwarding user γ, Indicates that in the time window T k The number of times all text messages of the forwarding user γ are forwarded, Indicates that in the time window T k The number of times all text messages of user δ are forwarded; The following formula is used to calculate the probability of forwarding influence propagation from the publishing user δ to the forwarding user γ: in, Represents the forwarding user γ in time window T k The set of users who posted the forwarded text messages. Indicates that in the time window T k The forwarding interaction intensity influence index of the internal posting user α and the forwarding user γ, The initial value of the forwarding influence of each user is randomly set, and then a predetermined number of iterations are performed to obtain the forwarding influence of each user. In each iteration, the following formula is used to calculate the forwarding influence of the publishing user δ: in, Indicates that in the time window T k The set of forwarding users who have forwarded the text message posted by the posting user δ; S2.2.2: Get text message collection TXT k All the users who posted and commented on the text messages in the network are then used as nodes to build the comment network V c , and then use the following formula to calculate the time window T of a publishing user δ and a commenting user γ k Comment interaction intensity influence indicator in, Indicates that in the time window T k The number of comments made by the internal commenting user γ on the text message of the posting user δ, Indicates that in the time window T k The number of all text message comments by commenting user γ, Indicates that in the time window T k The number of comments on all text messages posted by user δ; The following formula is used to calculate the probability of spreading the influence of comments from the publishing user δ to the commenting user γ: in, Denotes the comment user γ in the time window T k The user set corresponding to the comment text message, represents the comment interaction strength influence index between the posting user α and the commenting user γ, Randomly set the comment network V c The initial value of the comment influence of each user in is then iterated for a predetermined number of times to obtain the forwarding influence of each user. In each iteration, the following formula is used to calculate the comment influence of the posting user δ in, Indicates that in the time window T k The set of users who have commented on the text message posted by the posting user δ; S2.2.3: Get text message collection TXT k The publishers and followers of all text messages in the network are then used as nodes to build a follow network V f , and then use the following formula to calculate the time window T of a publishing user δ and a following user γ k Probability of spreading influence within Among them, P k (δ), P k (α) represents the posting user δ and user α in time window T k The number of published messages in Represents user γ in time window T k The collection of followed users in the Randomly set attention network V f The initial value of the attention influence of each user in is then calculated by a predetermined number of iterations to obtain the forwarding influence of each user. In each iteration, the following formula is used to calculate the attention influence of the posting user δ in, Indicates that in the time window T k The set of users who follow the posting user δ; S2.2.4: For text messages txt k,i , get the k The collection of users who forwarded the text message The collection of users who commented on the text message S2.2.5: Use the following formula to calculate the text message txt k,i Information about the degree of attention k,i : Among them, x1 represents the forwarding user set The forwarding users in x2 represent the set of commenting users. Comments from users, x k,i Indicates text message txt k,i The publishing user.

3. The method for detecting abnormal events in social networks according to claim 1, characterized in that: In step S3.2, the message nodes are clustered using the DBSCAN algorithm.

4. The method for detecting abnormal events in social networks according to claim 1, characterized in that: The step S4 also includes fermentation tracking of abnormal events, and the specific method is as follows: For the event attention sequence of abnormal events, the time window corresponding to the event attention peak is determined by taking the second-order derivative. This time window is the climax stage, the time before this time window is the growth stage, and the time after this time window is the decline stage.

Images