A social robot detection method, device, medium and product

Abstract

The application discloses a social robot detection method and device, medium and product, and relates to the field of network security. The method comprises the following steps: taking all users in a current social network as nodes and taking the interaction between the users as edges to construct a social graph comprising a center node and a peripheral node; adopting a peripheral enhanced graph neural network to perform center node detection according to the social graph to obtain a detection result; determining a first classification loss according to the detection result of the center node and a corresponding label; determining a second classification loss according to the detection result of the peripheral node and a corresponding label; determining a cross-network domain adaptive loss based on an MK-MMD loss by using the features of the center node and the features of the peripheral node; and determining a total loss according to the first classification loss, the second classification loss and the cross-network domain adaptive loss. The application can improve the accuracy and robustness of social robot detection, thereby guaranteeing the security of the social network.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and particularly relates to a social bot detection method, device, medium and product. BACKGROUND

[0002] With the rapid development of social networks, social media platforms have become the main channel for obtaining news, interaction and expressing opinions. However, these platforms not only gather real users, but also are full of social bots controlled by automated programs or APIs. Many bots are used to maliciously spread false information, disrupt the platform ecosystem, and pose a threat to social stability and public safety. Therefore, social bot detection has become an important research direction of artificial intelligence and network security, and global platforms urgently need efficient detection methods.

[0003] Traditional social bot detection methods mainly rely on feature engineering, extracting user metadata and tweet content for classification. However, with the development of social bot technology, traditional detection methods gradually fail, because bots can disguise themselves by stealing real user content or mixing malicious and neutral information.

[0004] To address this challenge, researchers introduced graph neural networks (GNNs) to detect social bots by exploiting the differences between bots and real users in social network structures. Social bots usually have sparse connections and random interactions, while human users tend to establish close connections with people of similar interests or characteristics. Graph neural networks have shown significant advantages in identifying highly disguised social bots. Researchers have optimized complex social networks using graph neural network technology, significantly improving the accuracy and robustness of detection. Recently, various novel graph neural network architectures have emerged, further exploiting social graph information and becoming a key technology for social bot identification.

[0005] However, current graph structure-based social bot detection frameworks focus on improving GNN architectures, ignoring the analysis of social network structures, i.e., ignoring information in peripheral networks, affecting the overall performance of classification.

[0006] Based on the above problems, there is an urgent need to provide a new graph neural network framework for social bot detection to improve the accuracy and robustness of social bot detection, and thus ensure the security of social networks. SUMMARY

[0007] The purpose of the present application is to provide a social bot detection method, device, medium and product that can improve the accuracy and robustness of social bot detection, and thus ensure the security of social networks.

[0008] To achieve the above purpose, the present application provides the following solutions:

[0009] In a first aspect, the present application provides a social robot detection method, comprising:

[0010] A social graph is constructed, taking all users in a current social network as nodes and interactions between users as edges, the social graph including a center node and a peripheral node; the center node is a node that spreads a neighborhood as a source node; the peripheral node is a node that does not spread a neighborhood as a source node; the social graph includes a center network connected by the center node and a peripheral network connected by the peripheral node and the center node;

[0011] According to the social graph, a peripheral enhanced graph neural network is used to detect the center node to obtain a detection result; the detection result includes a social robot or a real user; the training process of the peripheral enhanced graph neural network is as follows:

[0012] A training set is obtained; the training set is a social graph formed by user interactions; the social graph includes a center node, a label corresponding to the center node, a peripheral node, and a label corresponding to the peripheral node;

[0013] The center node and the peripheral node are aggregated respectively to obtain a center node feature and a peripheral node feature; the center node feature includes structural information of the center network; the peripheral node feature includes structural information of the center network and structural information of the peripheral network;

[0014] A first classification loss is determined according to the detection result of the center node and the corresponding label; a second classification loss is determined according to the detection result of the peripheral node and the corresponding label; and a cross-network domain adaptive loss is determined based on an MK-MMD loss using the center node feature and the peripheral node feature;

[0015] A total loss is determined according to the first classification loss, the second classification loss, and the cross-network domain adaptive loss, and the peripheral enhanced graph neural network is optimized through back propagation to complete the training of the peripheral enhanced graph neural network.

[0016] Optionally, the training set is obtained, specifically including:

[0017] Machine learning is performed based on a feature-based weak supervision source according to the center node and the peripheral node to obtain a label corresponding to the center node and a label corresponding to the peripheral node; the feature-based weak supervision source includes an adaptive enhancement algorithm, a random forest algorithm, and a multilayer perceptron.

[0018] Optionally, the center node feature and the peripheral node feature are obtained by aggregating the center node and the peripheral node respectively, specifically including:

[0019] A two-layer graph aggregation layer is used as an encoder;

[0020] The neighbor information of the center node and the peripheral node is aggregated by using an encoder.

[0021] Optionally, the center node and the peripheral node are aggregated respectively to obtain a center node feature and a peripheral node feature, and then the method further comprises:

[0022] The aggregated node features are converted by using a linear layer and a softmax layer.

[0023] Optionally, the first classification loss is determined according to the detection result of the center node and the corresponding label; the second classification loss is determined according to the detection result of the peripheral node and the corresponding label; and the cross-network domain adaptive loss is determined based on the MK-MMD loss by using the center node feature and the peripheral node feature, and the cross-network domain adaptive loss specifically comprises:

[0024] The first classification loss L C is determined by using the formula .

[0025] The second classification loss L P is determined by using the formula .

[0026] The cross-network domain adaptive loss L DA is determined by using the formula .

[0027] Wherein, N C is the number of center nodes, N is the number of peripheral nodes, C is the center node set, P is the peripheral node set, is the detection result of user i in the center network, y i is the label of user i in the center network, is the detection result of user j in the peripheral network, y j is the label of user j in the peripheral network, is the expectation, L is the number of kernel functions used, k l (·) is the mapping by using the lth kernel function, represents the feature of the center node x after passing through the two-layer graph aggregation layer, c is the cross-domain center node set, which is extracted from the center node set C, n is the cross-domain peripheral node set, which is extracted from the peripheral node set P, is the feature of the peripheral node y after passing through the two-layer graph aggregation layer, is the feature of the center node x' after passing through the two-layer graph aggregation layer, is the feature of the peripheral node y' after passing through the two-layer graph aggregation layer.

[0028] Optionally, a total loss is determined according to the first classification loss, the second classification loss and the cross-network domain adaptation loss, and the peripheral enhanced graph neural network is optimized through back propagation to complete training of the peripheral enhanced graph neural network, specifically including:

[0029] The total loss L is determined according to the formula L T = aL C + (1-a)L P + bL DA T ;

[0030] Wherein, a and b are weight coefficients.

[0031] In a second aspect, the present application provides a social robot detection device, the social robot detection device comprising:

[0032] A social graph construction module is configured to construct a social graph comprising a center node and a peripheral node, with all users in a current social network as nodes and interactions between users as edges; the center node is a node that diffuses a neighborhood as a source node; the peripheral node is a node that does not diffuse a neighborhood as a source node; the social graph comprises a center network connected by the center node and a peripheral network connected by the peripheral node and the center node;

[0033] A detection module is configured to use a peripheral enhanced graph neural network to detect the center node according to the social graph to obtain a detection result; the detection result comprises a social robot or a real user; the training process of the peripheral enhanced graph neural network is as follows:

[0034] A training set is obtained; the training set is a social graph formed by user interactions; the social graph comprises a center node, a label corresponding to the center node, a peripheral node and a label corresponding to the peripheral node;

[0035] The center node and the peripheral node are aggregated respectively to obtain a center node feature and a peripheral node feature; the center node feature comprises structural information of the center network; the peripheral node feature comprises structural information of the center network and structural information of the peripheral network;

[0036] A first classification loss is determined according to the detection result of the center node and the corresponding label; a second classification loss is determined according to the detection result of the peripheral node and the corresponding label; and a cross-network domain adaptation loss is determined based on an MK-MMD loss using the center node feature and the peripheral node feature;

[0037] A total loss is determined according to the first classification loss, the second classification loss and the cross-network domain adaptation loss, and the peripheral enhanced graph neural network is optimized through back propagation to complete training of the peripheral enhanced graph neural network.

[0038] ​In a third aspect, the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the social bot detection method.

[0039] In a fourth aspect, the present application provides a computer readable storage medium, having a computer program stored thereon, wherein the computer program is executed by a processor to implement the social bot detection method.

[0040] In a fifth aspect, the present application provides a computer program product, comprising a computer program, wherein the computer program is executed by a processor to implement the social bot detection method.

[0041] According to the specific embodiments provided by the present application, the present application has the following technical effects:

[0042] The present application provides a social bot detection method, device, medium and product, constructs a social graph comprising a center node and a peripheral node, and then divides the social graph into a center layer and a peripheral layer according to the topological structure of the nodes; and uses a peripheral enhanced graph neural network (PEGNN) to fully consider the information in the peripheral network, and adjusts the existing detection task to a center node classification task; and uses three losses to extract and fuse the information in the center network and the peripheral network to enhance the center node classification effect. Finally, the user social is divided into a robot and a real user; the analysis of the social network structure of the present application can improve the accuracy and robustness of the social bot detection, and thus ensure the security of the social network. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0044] Figure 1 FIG. 1 is a flowchart of a social bot detection method according to an embodiment of the present application;

[0045] Figure 2 FIG. 2 is a schematic diagram of a peripheral enhanced graph neural network architecture according to an embodiment of the present application. DETAILED DESCRIPTION

[0046] With reference to the drawings of the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments of the present application, all the other embodiments obtained by those skilled in the art without creative work fall within the scope of the present application.

[0047] The above purposes, features and advantages of the present application will be more apparent and understandable. The present application will be further described in detail below with reference to the drawings and specific embodiments.

[0048] In an exemplary embodiment, as shown in Figure 1 A social robot detection method is provided, which comprises the following steps S101 to S102. Wherein:

[0049] S101, constructing a social graph comprising a center node and a peripheral node, taking all users in a current social network as nodes and taking interactions between users as edges; the center node is a node that diffuses a neighborhood as a source node; the peripheral node is a node that does not diffuse a neighborhood as a source node; the social graph comprises a center network connected by the center node and a peripheral network connected by the peripheral node and the center node;

[0050] The specific process of constructing the social graph is as follows:

[0051] S1, selecting a plurality of seed user nodes as an initial node set;

[0052] S2, selecting a plurality of nodes as source nodes, expanding their neighbor nodes to the node set using breadth-first search (BFS), random walk or other search algorithms, and establishing directed edges from the source nodes to the neighbor nodes;

[0053] S3, selecting a plurality of nodes in the expanded node set as source nodes to expand adjacent nodes, and establishing directed edges from the source nodes to the adjacent nodes;

[0054] S4, repeating S3.

[0055] The nodes that have been used as source nodes and expanded and merged adjacent nodes by search methods are taken as crawled nodes; the nodes that have not been expanded as source nodes are taken as observation nodes; the crawled nodes can actively connect to other nodes and establish edges pointing to other nodes. The observation nodes cannot actively connect to other nodes. This results in mutual connection between the crawled nodes, connection from the crawled nodes to the observation nodes, and no connection between the observation nodes. This further results in a radial shape of the entire network, in which the crawled nodes are located at the center and the observation nodes are located at the periphery;

[0056] According to the difference of nodes in the network structure, the crawled nodes are defined as center nodes, and the observed nodes are defined as peripheral nodes. In addition, the network formed by the center nodes connected with each other is called a center network, and the network formed by the center nodes connected with the peripheral nodes is defined as a peripheral network.

[0057] In S102, according to the social graph, a peripheral enhanced graph neural network is used for center node detection to obtain a detection result; the detection result includes a social robot or a real user.

[0058] As shown in Figure 2 The peripheral enhanced graph neural network extracts and fuses the information of the center network and the peripheral network, and enhances the classification effect of the center nodes.

[0059] The training process of the peripheral enhanced graph neural network is as follows:

[0060] In S21, a training set is obtained; the training set is a social graph formed by user interaction; the social graph includes center nodes, labels corresponding to the center nodes, peripheral nodes, and labels corresponding to the peripheral nodes.

[0061] According to the center nodes and the peripheral nodes, machine learning is performed based on a feature-based weak supervision source to obtain labels corresponding to the center nodes and labels corresponding to the peripheral nodes; the feature-based weak supervision source includes an adaptive enhancement algorithm, a random forest algorithm, and a multi-layer perceptron. A weak supervision method is used to label the peripheral nodes to solve the problem of missing peripheral node labels.

[0062] Since the data set used for the center node classification task usually lacks labels of the peripheral nodes, it is difficult to directly calculate the classification loss of the peripheral nodes. In order to solve this problem, the label generation method in Twibot-22 is borrowed, and the weak supervision learning framework Snorkel is used to label the peripheral nodes, and the labels of the center nodes are combined.

[0063] First, 1000 nodes are randomly selected from the center nodes with existing labels, and are divided into a training set and a test set in a ratio of 8:2. On the training set, multiple weak supervision sources are used for training, and evaluation is performed on the test set. In order to avoid inaccurate label generation due to the difference in graph structure between the center nodes and the peripheral nodes, no graph neural network-based weak supervision source is selected, but three commonly used feature-based weak supervision sources are used for machine learning.

[0064] After generating initial labels from the three weak supervision sources, the outputs are combined and corrected through a label network. The label network is used to evaluate the accuracy of each weak supervision source and its mutual dependence, and finally more reliable training labels can be generated to provide high-quality labeled data for the peripheral nodes.

[0065] S22, respectively, the center node and the peripheral node are aggregated to obtain the center node feature and the peripheral node feature; the center node feature includes: the structural information of the center network; the peripheral node feature includes: the structural information of the center network and the structural information of the peripheral network;

[0066] A two-layer graph aggregation layer is used as an encoder; the neighbor information of the center node and the peripheral node is aggregated by using the encoder; the specific encoding process is as follows:

[0067] The feature vector of the node i is represented as x i , and is transformed by a full connection layer as the initial feature in the GNN, that is:

[0068]

[0069] Wherein, W I and b I are learnable parameters, and sigma is a leaky-relu activation function;

[0070] After the preliminary encoding of the node is completed, the structural information of the graph is integrated into the node feature, and a two-layer graph aggregation layer is used as an encoder to aggregate the neighbor information of each node. The graph aggregation layer used here is not limited, for example, a GCN layer (formula (2)) or a RGCN layer (formula (3)) can be used:

[0071]

[0072] Wherein, in formula (2), x is the feature of the node i in the lth layer, is a learnable parameter of the aggregated neighbor node in the lth layer, denotes the neighbor set of the node i, denotes the number of neighbors of the node i, is a learnable parameter of the self-loop in the lth layer. In formula (3), R denotes a set of edge types, denotes the neighbor set of the node i under the r relationship, denotes the number of neighbors of the node i under the r relationship, is a learnable parameter of the r relationship in the lth layer, is a learnable parameter of the self-loop in the lth layer.

[0073] After aggregation, the center node feature only contains the structural information of the center network, and the peripheral node feature contains the structural information of the center network and the structural information of the peripheral network;

[0074] A linear layer and a softmax layer are used to convert the aggregated node feature.

[0075]

[0076] where W and b are learnable parameters, is the feature vector of user i after two-layer graph aggregation, is the predicted value (detection result) of user i, i∈C∪P.

[0077] S23, determine the first classification loss according to the detection result and the corresponding label of the center node; determine the second classification loss according to the detection result and the corresponding label of the peripheral node; and determine the cross-network domain adaptive loss based on the MK-MMD loss by using the center node feature and the peripheral node feature;

[0078] The first classification loss L C is determined by using the formula

[0079] The second classification loss L P is determined by using the formula

[0080] The cross-network domain adaptive loss L DA is determined by using the formula

[0081] where N C is the number of center nodes, N is the number of peripheral nodes, in order to improve the running efficiency of the network, N nodes are randomly selected from the peripheral nodes for processing, C is the center node set, P is the peripheral node set, is the detection result of user i in the center network, y i is the label of user i in the center network, is the detection result of user j in the peripheral network, y j is the label of user j in the peripheral network, is the expectation, L is the number of kernel functions used, k l (·) is mapped by using the lth kernel function, represents the feature of the center node x after passing through the two-layer graph aggregation layer, c is the cross-domain center node set, which is extracted from the center node set C, n is the number of nodes, p is the cross-domain peripheral node set, which is extracted from the peripheral node set P, is the feature of the peripheral node y after passing through the two-layer graph aggregation layer, is the feature of the center node x' after passing through the two-layer graph aggregation layer, is the feature of the peripheral node y' after passing through the two-layer graph aggregation layer.

[0082] where the cross-network domain adaptive loss L DA ​​​The field adaptation is realized by introducing the MK-MMD loss to optimize the fusion of information of the two networks. MMD measures the similarity by projecting the samples of the two domains into the Reproducing Kernel Hilbert Space (RKHS) and calculating the distribution difference using the kernel function. MK-MMD combines multiple kernel functions, respectively calculates the distribution difference in multiple RKHS, and sums the results to more accurately measure the similarity of the two domains.

[0083] The kernel function is set as a Gaussian kernel function with different bandwidths:

[0084]

[0085] where σ l is the bandwidth of the Gaussian kernel function.

[0086] S24, determine the total loss according to the first classification loss, the second classification loss and the cross-network domain adaptation loss, and optimize the peripheral enhanced graph neural network through back propagation to complete the training of the peripheral enhanced graph neural network.

[0087] The total loss L T is determined by the formula L C = αL P +(1-α)L DA +βL T ; the total loss L T Through effective combination of information from the center and peripheral networks, the performance of the network in the center node classification task is significantly improved.

[0088] where α and β are weight coefficients.

[0089] The goal of PEGNN is to effectively extract and fuse information in the center and peripheral networks to improve the detection of social robots by the center nodes. The social graph formed based on user interaction is input into the PEGNN framework, and three losses are calculated to train the network.

[0090] During network training, the classification loss L C is calculated by the classification results of the center nodes and their corresponding labels, and the classification loss L P is calculated by the classification results of the peripheral nodes and their labels. In addition, the cross-network domain adaptation loss L DA is calculated using the features of the center nodes and the peripheral nodes after two-layer graph aggregation.

[0091] Finally, the center node classification loss, the peripheral node classification loss and the cross-network domain adaptation loss are weighted and summed to form the total loss L DA , and the network parameters are optimized through back propagation to improve the overall performance.

[0092] In one specific embodiment, social bot detection experiments are performed on the graph-based benchmark datasets used, Twibot20 and Twibot22. Both datasets construct a directed and heterogeneous social graph with users as nodes and social relationships between users as edges, with two types of edges: follow and followed. Detailed information of the two datasets is as follows:

[0093] Table 1: Twibot-20 and Twibot-22 dataset statistics

[0094] Dataset Number of nodes Number of edges Labeled nodes Number of robots Number of humans Twibot-20 26,292 431,267 11,826 6,589 5,237 Twibot-22 1,000,000 4,513,155 1,000,000 139,643 860,357

[0095] The original task of both datasets in Table 1 is to classify the labeled nodes. Based on the graph hierarchy theory, we analyze and adjust the original task on the dataset to perform the center node classification task to test the performance of PEGNN.

[0096] The graph hierarchy phenomenon on the two datasets is analyzed. Since it is not directly known which nodes in each dataset are the source nodes that crawl their adjacent nodes, a simpler strategy is used to find the center nodes - the set of all edge starting nodes in the network is the center node. The rest are peripheral nodes. Specifically, given a graph G = (V, E), the set of center nodes is defined as:

[0097]

[0098] The remaining nodes V P = V \ V C are peripheral nodes;

[0099] Table 2 counts the number of edges in the center nodes, peripheral nodes, and center and peripheral networks in the Twibot-20 and Twibot-22 datasets;

[0100] Table 2 wiibot-20 and Twibot-22 dataset structure

[0101] Dataset Hub nodes Hub edges Peripheral nodes Peripheral edges Twibot-20 11,924 14,368 217,656 213,611 Twibot-22 10,009 220,470 989,991 3,523,164

[0102] As shown in Table 2, the number of peripheral nodes is much larger than that of the center nodes, and the number of edges in the peripheral network is much larger than that in the center network. This indicates that the size of the peripheral network is much larger than that of the center network, which can contain rich information that can be used to improve the effectiveness of the center node classification task. The average degree of the center nodes in Twibot-20 is 20.32, and the average degree of the peripheral nodes is 0.98. The average degree of the center nodes in Twibot-22 is 396.05, and the average degree of the peripheral nodes is 3.56. As can be seen, the degree of the peripheral nodes is much smaller than that of the center nodes. That is, the first-order neighborhood integrity of the peripheral nodes is much smaller than that of the center nodes. Therefore, the peripheral nodes are not suitable as detection objects.

[0103] As shown in Table 3, the Twibot-20 dataset is analyzed. The distribution of 11,826 labeled nodes on the center nodes and the peripheral nodes is counted.

[0104] Table 3 Distribution of labeled nodes in Twibot-20

[0105] Distribution type Node count Hub nodes and labeled nodes 10,739 Hub nodes, but not labeled nodes 1,185 Labeled nodes, but not hub nodes 1,087

[0106] As shown in Table 3, the center nodes are highly overlapped with the labeled nodes, so the original task of Twibot-20 can be regarded as a center node classification task. The experiment is directly performed using the original training set, validation set and test set, and the remaining nodes are used for enhancement.

[0107] However, the remaining nodes in Twibot-20 are not labeled. In order to make the experiment proceed smoothly, the above-mentioned weakly supervised network is used to train and test on the labeled nodes, and the network is used to label the remaining nodes. The network achieves an accuracy of 93.0% on the test set.

[0108] The Twibot-22 dataset is analyzed, and all nodes in Twibot-22 have labels, so the original task of Twibot-22 is to classify all nodes, and the training set, validation set and test set are divided on all nodes, and in order to match the present application, the training set, validation set and test set are randomly re-divided on the center nodes in the ratio of 7:2:1, and the peripheral nodes are used for enhancement.

[0109] A graph-based social bot detection method is used as a baseline model. The following baseline models are widely used in the latest social bot detection research.

[0110] GCN is a classic graph neural network model that learns node representations by aggregating features from neighboring nodes. Specifically, GCN weights and sums the features from neighboring nodes, then processes them through a nonlinear activation function and passes them to a linear layer for classification or regression tasks. It is simple and efficient in design.

[0111] GAT introduces an attention mechanism that computes attention coefficients to aggregate node features, assigning different weights to different neighboring nodes. This attention mechanism can more flexibly capture important information in the graph structure and enable the model to better handle complex relationships in the graph. Compared with traditional GCN, GAT has significantly improved performance.

[0112] HGT aims to handle heterogeneous graphs and can be used to handle different types of nodes and edges in the graph. HGT computes attention coefficients for different types of nodes and edges through a type-aware multi-head attention mechanism, capturing complex relationships in the graph. HGT also introduces meta-path encoding, further improving the model's performance on heterogeneous graphs.

[0113] Simple-HGN is a simple but powerful heterogeneous graph neural network model. Through a simplified neighbor aggregation method, Simple-HGN effectively combines features from different types of neighbors while sharing partial weights of different types of edges to reduce the number of parameters. The model uses a multi-layer perceptron (MLP) to further process the aggregated features, maintaining low computational complexity and good performance.

[0114] BotRGCN aims to detect Twitter bots by constructing a heterogeneous social network graph and using RGCN. Specifically, BotRGCN constructs an attention relationship to construct a heterogeneous graph and uses RGCN to capture complex relationships between users.

[0115] RGT performs Twitter bot detection by using a graph transformer and semantic attention mechanism, effectively simulating the heterogeneity of social networks. Specifically, RGT constructs a heterogeneous information network that treats various relationships between users as nodes and multiple relationships as edges. Then, through a relationship graph transformer and semantic attention network, information is aggregated across users and relationships for heterogeneous-aware Twitter bot detection.

[0116] The performance of different social bot detection methods on TwiBot-20 and TwiBot-22 is shown in Table 4:

[0117] Table 4

[0118]

[0119]

[0120] Several representative graph-based social bot detection frameworks on Twibot-20 and Twibot-22 were evaluated, and the results are shown in Table 4, including four indicators: accuracy, F1 score, precision, and recall. The study shows that the social bot detection framework based on heterogeneous graph is generally superior to the method based on homogeneous graph. The framework based on heterogeneous graph captures more information in the social network.

[0121] Subsequently, several heterogeneous graph frameworks were enhanced with the PEGNN framework to evaluate the enhancement effect of the framework. Compared with the previous framework that only uses the central network information for central node classification, PEGNN also extracts information from the peripheral network and integrates it with the information from the central network to enhance the classification of the central node. On the Twibot-20 dataset, the model enhanced with PEGNN improved the accuracy and F1 score by an average of 1.35% and 1.41%, and on the Twibot-22 dataset, it improved by an average of 2.52% and 8.24%. In addition, PEGNN significantly improved the precision and recall of the model. These enhancements show that PEGNN, which introduces and integrates peripheral network information, can effectively enhance the classification performance of the model, especially in complex social networks, can better extract and utilize node information, and improve the accuracy and comprehensiveness of detection.

[0122] Based on the same inventive concept, the embodiments of the present application also provide a social bot detection device for implementing the social bot detection method described above. The implementation scheme of the device for solving the problem is similar to the implementation scheme described in the above method, so the specific limitations in one or more social bot detection device embodiments provided below can refer to the limitations of the social bot detection method described above, which will not be repeated here.

[0123] In one exemplary embodiment, a social bot detection device is provided, comprising:

[0124] A social graph construction module is configured to construct a social graph comprising central nodes and peripheral nodes, with all users in the current social network as nodes and interactions between users as edges; the central nodes are nodes that spread the neighborhood as source nodes; the peripheral nodes are nodes that do not spread the neighborhood as source nodes; the social graph includes a central network connected by central nodes and a peripheral network connected by peripheral nodes and central nodes;

[0125] The detection module is configured to perform center node detection on the social graph by using a peripheral enhanced graph neural network to obtain a detection result, wherein the detection result includes a social robot or a real user, and the peripheral enhanced graph neural network is trained according to the following process:

[0126] obtain a training set, wherein the training set is a social graph formed by user interaction, and the social graph includes a center node, a label corresponding to the center node, a peripheral node, and a label corresponding to the peripheral node;

[0127] aggregate the center node and the peripheral node respectively to obtain a center node feature and a peripheral node feature, wherein the center node feature includes structural information of a center network, and the peripheral node feature includes structural information of the center network and structural information of a peripheral network;

[0128] determine a first classification loss according to the detection result of the center node and the corresponding label, determine a second classification loss according to the detection result of the peripheral node and the corresponding label, and determine a cross-network domain adaptive loss based on an MK-MMD loss by using the center node feature and the peripheral node feature;

[0129] determine a total loss according to the first classification loss, the second classification loss, and the cross-network domain adaptive loss, and optimize the peripheral enhanced graph neural network by back propagation to complete the training of the peripheral enhanced graph neural network.

[0130] In an exemplary embodiment, a computer device is provided, which can be a server or a terminal. The computer device includes a processor, a memory, an input / output interface (I / O), and a communication interface. The processor, the memory, and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to communicate with external terminals through a network connection. The computer program is executed by the processor to implement a social robot detection method.

[0131] In an exemplary embodiment, a computer-readable storage medium is provided, which stores a computer program. The computer program is executed by a processor to implement the steps in each of the method embodiments described above.

[0132] In an example embodiment, a computer program product is provided, including a computer program which, when executed by a processor, implements the steps of any of the above method embodiments.

[0133] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant regulations.

[0134] It can be understood by those skilled in the art that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. Any reference to memory, database or other medium used in the embodiments provided by the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0135] The database involved in the embodiments provided by the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided by the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0136] In the present application, all actions of obtaining signals, information or data are performed under the premise of complying with the corresponding data protection regulations and policies of the country where the device is located, and obtaining the authorization given by the owner of the corresponding device.

[0137] The technical features of the above embodiments can be combined in any manner. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described, however, as long as the combinations of the technical features do not exist contradictions, they should be considered as the scope of the present disclosure.

[0138] The principles and implementation manners of the present application are described by using specific examples herein, and the above embodiments are only used to help understand the method of the present application and its core idea; meanwhile, for those of ordinary skill in the art, the specific implementation manners and application ranges will be changed according to the idea of the present application. In conclusion, the content of the present description should not be understood as a limitation of the present application.

Claims

1. A social robot detection method, characterized by, The social robot detection method comprises: A social graph comprising a center node and a peripheral node is constructed by taking all users in a current social network as nodes and interactions between the users as edges; the center node is a node that diffuses a neighborhood as a source node; the peripheral node is a node that does not diffuse a neighborhood as a source node; the social graph comprises a center network connected by the center node and a peripheral network connected by the peripheral node and the center node; According to the social graph, a peripheral enhanced graph neural network is used to detect the center node to obtain a detection result; the detection result comprises a social robot or a real user; the training process of the peripheral enhanced graph neural network comprises: A training set is obtained; the training set is a social graph formed by user interactions; the social graph comprises a center node, a label corresponding to the center node, a peripheral node and a label corresponding to the peripheral node; The center node and the peripheral node are aggregated respectively to obtain a center node feature and a peripheral node feature; the center node feature comprises structural information of the center network; the peripheral node feature comprises structural information of the center network and structural information of the peripheral network; A first classification loss is determined according to the detection result of the center node and the corresponding label; a second classification loss is determined according to the detection result of the peripheral node and the corresponding label; and a cross-network domain adaptive loss is determined based on an MK-MMD loss by using the center node feature and the peripheral node feature. The total loss is determined according to the first classification loss, the second classification loss and the cross-network domain adaptive loss, and the peripheral enhanced graph neural network is optimized through back propagation to complete the training of the peripheral enhanced graph neural network.

2. The social robot detection method of claim 1, wherein, The training set is obtained in detail as follows: Machine learning is performed based on a feature-based weak supervision source according to the center node and the peripheral node to obtain the label corresponding to the center node and the label corresponding to the peripheral node; the feature-based weak supervision source comprises an adaptive enhancement algorithm, a random forest algorithm and a multilayer perceptron. 3.The social robot detection method of claim 1, wherein, The center node and the peripheral node are aggregated respectively to obtain the center node feature and the peripheral node feature in detail as follows: A two-layer graph aggregation layer is used as an encoder; The neighbor information of the center node and the peripheral node is aggregated by using the encoder.

4. The social robot detection method of claim 1, wherein, The center node and the peripheral node are aggregated respectively to obtain the center node feature and the peripheral node feature, and then the following steps are further included: The aggregated node features are converted by using a linear layer and a softmax layer.

5. The social robot detection method of claim 1, wherein, The first classification loss is determined according to the detection result of the center node and the corresponding label; the second classification loss is determined according to the detection result of the peripheral node and the corresponding label; The cross-network domain adaptive loss is determined based on the MK-MMD loss by using the center node feature and the peripheral node feature, and the training of the peripheral enhanced graph neural network is completed by optimizing the peripheral enhanced graph neural network through back propagation, and the training of the peripheral enhanced graph neural network is completed in detail as follows: Using the formula determining the first classification loss L C ; Using the formula determining a second classification loss L P ; Using the formula determining the cross-network domain adaptation loss L DA ; Where, N C Let N be the number of center nodes, C be the set of center nodes, and P be the set of outer nodes. For the detection result of user i in the central network, y i The label for user i in the central network. For the detection results of user j in the peripheral network, y j For the label of user j in the peripheral network, To calculate the expected value, let L be the number of kernel functions used, and k be the number of kernel functions used. l (·) indicates that the mapping is performed using the lth kernel function. Let represent the features of the central node x after passing through two graph aggregation layers, c be the cross-domain central node set (n nodes extracted from the central node set C), and p be the cross-domain peripheral node set (n nodes extracted from each of the peripheral node sets P). The features of the outer node y after passing through two graph aggregation layers. The features of the central node x′ after passing through two graph aggregation layers. The features of the outer node y′ after passing through two graph aggregation layers.

6. The social robot detection method of claim 5, wherein, Wherein, α and β are weight coefficients. Using the formula L T = aL C + (1 - a)L P + bL DA to determine the total loss L T ; The social robot detection device comprises:

7. A social robot detection device, characterized in that ​ The social graph construction module is configured to construct a social graph including a center node and a peripheral node, with all users in a current social network as nodes and interactions between the users as edges; the center node is a node that diffuses a neighborhood as a source node; the peripheral node is a node that does not diffuse a neighborhood as a source node; and the social graph includes a center network connected by the center node and a peripheral network connected by the peripheral node and the center node; The detection module is configured to detect the center node by using a peripheral enhanced graph neural network according to the social graph to obtain a detection result; the detection result includes a social robot or a real user; and the training process of the peripheral enhanced graph neural network is as follows: Obtaining a training set; the training set is a social graph formed by user interactions; the social graph includes a center node, a label corresponding to the center node, a peripheral node, and a label corresponding to the peripheral node; Aggregating the center node and the peripheral node respectively to obtain a center node feature and a peripheral node feature; the center node feature includes structural information of the center network; and the peripheral node feature includes structural information of the center network and structural information of the peripheral network; Determining a first classification loss according to the detection result of the center node and the corresponding label; determining a second classification loss according to the detection result of the peripheral node and the corresponding label; and determining a cross-network domain adaptive loss based on an MK-MMD loss by using the center node feature and the peripheral node feature; Determining a total loss according to the first classification loss, the second classification loss, and the cross-network domain adaptive loss, and optimizing the peripheral enhanced graph neural network by back propagation to complete the training of the peripheral enhanced graph neural network.

8. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the computer program to implement the social robot detection method of any one of claims 1-6.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the social robot detection method of any one of claims 1-6.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the social robot detection method of any one of claims 1-6.

Images