Malicious user detection method and system for open source software collaboration platform

Abstract

The invention discloses a malicious user detection method and system oriented to an open source software collaboration platform, and the method comprises the following steps: obtaining user data, generating corresponding user event sequences according to the user data, and carrying out the preprocessing of the user event sequences, and obtaining the preprocessed user event sequences; performing Softmax operation on the comprehensive feature representation of the user event to obtain the probability of the user category to which each user belongs; constructing a user interaction heterogeneous graph based on the user data; performing Softmax operation on the feature representation of each node in the user interaction heterogeneous graph to obtain the probability of the user category to which each target user node belongs; training the comprehensive feature representation of each user based on an XGBOOST classifier to obtain a prediction result of a user category to which each user belongs; user events and interaction modes are deeply mined, the malicious user detection accuracy is improved, and the requirement for safety guarantee of an open source software cooperation platform is met.

Description

Technical Field

[0001] The present invention relates to the technical fields of open source software supply chain security and cyberspace security, and specifically to a malicious user detection method and system for an open source software collaboration platform. Background Art

[0002] In the field of open source software, the rapid spread of the internet has directly led to the flourishing of the open source ecosystem. Open source software has become an indispensable part of the modern information industry, bringing significant changes to the composition and development process of software. Collaborative software development has become a trend. Open source software collaboration platforms such as GitHub and Gitee provide a sharing and collaborative environment for developers around the world. However, a large number of malicious users exploit the openness of these platforms to conduct fraudulent promotions and inject malicious code. This not only disrupts the platform's order but also poses serious threats to software systems and user data. Therefore, effectively detecting malicious users on open source software collaboration platforms is crucial for ensuring the security and healthy development of open source software.

[0003] Open source software collaboration platforms not only provide Git-based version control but also integrate rich social coding capabilities, forming a unique class of online social networks (OSNs). Traditional methods for detecting malicious users in online social networks typically rely on analyzing users' social behavior patterns or posted text and multimedia content. However, user events on open source software collaboration platforms primarily revolve around code repositories, focusing on technical exchange and project collaboration. These platforms lack the rich text or multimedia content found in traditional online social networks, limiting the applicability of traditional methods in these platforms.

[0004] Currently, some research has focused on detecting malicious users on open source software collaboration platforms. Most of these methods rely solely on static attribute features for classification. However, malicious users continually optimize their camouflage strategies to evade detection, making static feature-based methods difficult to effectively identify. Furthermore, some studies have attempted to use deep learning to analyze historical user activity sequences. However, these methods have not fully exploited the rich user interaction graph features of the platform and have failed to effectively capture the complex and dynamic interaction patterns of users.

[0005] In order to avoid the limitations of existing detection methods that lead to high rates of missed reports and false positives, which bring platform security risks and deteriorate the open source ecosystem, technical personnel in this field have been seeking a malicious user detection method for open source software collaboration platforms, so as to be able to deeply mine user events and interaction patterns, improve the accuracy of malicious user detection, and meet the security protection needs of open source software collaboration platforms. Summary of the Invention

[0006] The purpose of the present invention is to provide a malicious user detection method and system for open source software collaboration platforms, which can integrate the user's static attributes, dynamic behavior sequences and interaction graph structure information, effectively capture the user's interaction pattern, thereby improving the accuracy of malicious user detection and reducing the missed alarm and false alarm rates.

[0007] The malicious user detection method for an open source software collaboration platform designed by the present invention to achieve one of the above-mentioned purposes is characterized in that it includes the following steps:

[0008] Acquire user data, generate corresponding user event sequences according to the user data, and preprocess the user event sequences to obtain preprocessed user event sequences;

[0009] Applying a temporal multi-head attention mechanism to each of the preprocessed user event sequences to obtain a temporal dependency within each of the user event sequences; applying an interactive multi-head attention mechanism to each of the preprocessed user event sequences to obtain an interactive relationship between each of the user event sequences; fusing the temporal dependency within each of the user event sequences with the interactive relationship between each of the user event sequences, and inputting the resultant information into a feedforward network to obtain a feature representation of the user event; and inputting the feature representation of the user event into a bidirectional long short-term memory network to extract a comprehensive feature representation of the user event.

[0010] Performing a Softmax operation on the comprehensive feature representation of the user event to obtain the probability of each user belonging to the user category;

[0011] Constructing a user interaction heterogeneous graph based on the user data, wherein the user interaction heterogeneous graph includes a target user node, an auxiliary user node, a repository node, and edges connecting the nodes;

[0012] Aggregating each node in the user interaction heterogeneous graph based on a repository window and a time window to obtain a feature representation of a target user node aggregated by the repository window and a feature representation of a target user node aggregated by the time window; fusing the feature representation of the target user node aggregated by the repository window and the feature representation of the target user node aggregated by the time window to obtain a feature representation of the target user node, and updating the user interaction heterogeneous graph using the feature representation of the target user node to obtain an updated user interaction heterogeneous graph;

[0013] Applying a time-aware attention mechanism to the updated user interaction heterogeneous graph to obtain a feature representation of each node in the user interaction heterogeneous graph;

[0014] Performing a Softmax operation on the feature representation of each node in the user interaction heterogeneous graph to obtain the probability of each target user node belonging to the user category;

[0015] Extracting descriptive features of each user from user data and extracting descriptive features of each user's interaction attributes from the user interaction heterogeneous graph; fusing the probability of each user belonging to a user category, the probability of each target user node belonging to a user category, the descriptive features of each user, and the descriptive features of each user's interaction attributes to obtain a comprehensive feature representation of each user;

[0016] The comprehensive feature representation of each user is trained based on the XGBOOST classifier to obtain a prediction result of the user category to which each user belongs.

[0017] Furthermore, each user event sequence includes: event time interval sequence T g ={g1,g2,...,g m}、Event type sequence T e ={e1,e2,...,e n}, the repository sequence T involved in the event r ={r1,r2,...,r n} and the time window sequence T corresponding to the event w ={w1,w2,...,w n}; wherein, the event time interval sequence is a sequence obtained by traversing user data, calculating the time intervals between adjacent events, and normalizing the calculation results; the event type sequence is a sequence obtained by collecting fields of all event types and converting the event types into one-hot encoding using OneHotEncoder; the repository sequence involved in the event is a sequence obtained by extracting the repository ID of the user operation from the user data and converting the user's repository association into one-hot encoding using OneHotEncoder; the time window sequence corresponding to the event is a sequence obtained by calculating the number of events in the previous and next time windows through the timestamp of each event.

[0018] Furthermore, the method of using the time multi-head attention mechanism for the pre-processed user event sequence includes: g , the event type sequence T e , the repository sequence T involved in the event r And the time window sequence T corresponding to the event w Input them into the fully connected layer respectively to obtain the query matrix Q, key matrix K and value matrix V. Each matrix is divided into h sub-matrices along the last dimension. Each sub-matrix corresponds to an attention head. The output of each attention head is calculated as follows:

[0019]

[0020] Where T represents the transpose operation, d represents the dimension of the vector, and k represents the dimension of the key vector;

[0021] The outputs of the attention heads are concatenated to form a L×(h·d k ) matrix, and maps the matrix back to the original feature dimension d through linear transformation to generate the time dependency A within the event time interval sequence g , the time dependency A within the event type sequence e , the time dependency A within the repository sequence involved in the event r And the time dependency A within the time window sequence corresponding to the event w ;

[0022] The method of using the interactive multi-head attention mechanism for the pre-processed user event sequences includes: g , the event type sequence T e , the repository sequence T involved in the event r And the time window sequence T corresponding to the event w Perform length truncation or padding, map each user event sequence to the same feature dimension, and concatenate them in the last dimension. The expression is: T = [T g ,T e ,T r ,T w ]; calculate the interaction relationship between each feature and obtain the interaction relationship A between each user event sequence f ; Fusing the temporal dependencies within each user event sequence and the interaction relationships between each user event sequence, and inputting them into a feedforward network to obtain a feature representation of the user event;

[0023] The step of inputting the feature representation of the user event into a bidirectional long short-term memory network to extract a comprehensive feature representation of the user event includes: performing hidden layer representation on the feature representation of the user event from both the forward and backward directions, splicing the results from the two directions, and performing a linear transformation on the spliced result to obtain a comprehensive feature representation of the user event.

[0024] Furthermore, the user interaction heterogeneous graph is constructed based on the user data, and the user interaction heterogeneous graph is: Among them, V represents the node set in the user interaction heterogeneous graph, E represents the edge set in the user interaction heterogeneous graph, and X V represents the node feature representation in the user interaction heterogeneous graph, X E represents the edge feature representation in the user interaction heterogeneous graph, represents the node type mapping function, ψ represents the edge type mapping function; the node set in the user interaction heterogeneous graph includes: the target user node set V user , auxiliary user node set V aux_user and the repository node set V repo ; The edge set in the user interaction heterogeneous graph includes: target user-target user edge set E UU , target user-auxiliary user edge set E UA , target user-repository edge set E UR and the auxiliary user-repository edge set E AR .

[0025] Furthermore, the aggregating the nodes in the user interaction heterogeneous graph based on the repository window and the time window includes: dividing the edges in the user interaction heterogeneous graph into multiple time windows, grouping all edges connected to the same repository node in each time window, and performing weighted aggregation on the grouped edges based on the time embedded feature representation of the edges, and updating the feature representation of the repository node. The expression is as follows:

[0026]

[0027] in, represents the updated feature representation of the repository node, h r represents the feature representation of the repository node, W1 represents the linear projection matrix, ε r represents all edges connected to the repository node and belonging to the current time window, t e Temporal embedding feature representation of edges;

[0028] The updated feature representation of the repository node is output to the connected target user node, and the feature representation of the target user node is updated according to the corresponding feature representation of the target user node. The expression is as follows:

[0029]

[0030] in, represents the updated feature representation of the target user node, j u represents the feature representation of the target user node, W2 represents the linear projection matrix, ε r Indicates the edge connecting the target user node, a T Indicates that h r(e) Feature representations of repository nodes representing edge connections, Feature representations of updated repository nodes representing edge connections;

[0031] Aggregate the edges between the target user node and the repository node in the current time window to obtain the interaction feature representation between the target user node and the repository node Identify the concurrent user nodes that interact with the target user node simultaneously in the current time window and calculate the attention score for each concurrent user node. The expression is as follows:

[0032]

[0033] Among them, e uu′ represents the attention score of concurrent user nodes, represents the weight vector, W3 represents the linear projection matrix, Represents the interaction feature representation between the target user node and the repository node, Represents the interaction feature representation between concurrent user nodes and repository nodes, φ uu′ Feature representation of the edge between the target user node and the concurrent user node;

[0034] Aggregate the concurrent users of the target user node within the current time window. The expression is as follows:

[0035]

[0036] in, Represents the feature representation of concurrent user nodes, u ′ Represents the target user node, U u (w) represents the concurrent user nodes that interact with the target user node at the same time, α uu′ represents the attention weight, Representation of the interaction features between concurrent user nodes and repository nodes;

[0037] Aggregate the interaction feature representation of the target user node and the repository node and the feature representation of the concurrent user node. The expression is as follows:

[0038]

[0039] in, represents the updated feature representation of the target user node, W4 represents the linear projection matrix, and b represents the bias vector.

[0040] Furthermore, the method of using the time-aware attention mechanism for the updated user interaction heterogeneous graph includes: for each edge in the user interaction heterogeneous graph, calculating a time decay factor based on the time embedding feature representation of the edge, and the expression is as follows:

[0041]

[0042] Among them, t ijrepresents the temporal embedding feature representation of the edge, t ik Represents the temporal embedding feature representation of other edges related to the source node, t kj represents the timestamps of other edges related to the target node, and τ represents the time decay constant;

[0043] The time decay factors related to the source node and the target node are weighted and combined, and the expression is as follows:

[0044] final_time_weight(t j )=α·timw_weight(t ij ,t ik )+(1-α)·time_weight(t ij ,t kj )

[0045] Among them, final_time_weight(t j ) represents the time weight, and α represents the weight coefficient;

[0046] The attention score is calculated based on the feature representation of the source node, the feature representation of the target node, the feature representation of the edge, and the time decay factor. The expression is as follows:

[0047]

[0048] Among them, attn ij represents the attention score of node i to its neighboring node j, represents the weight vector, h′ i Represents the feature representation of the source node, h′ j Represents the feature representation of the target node, e′ ij The feature representation of the edge connecting node i and its neighboring node j.

[0049] Furthermore, the descriptive features of each user include: the total number of characters in the user name, the proportion of digits in the user name, the number of digits in the user name, the number of symbols and special characters in the user name, the user's nickname, the user's personal profile, the user's email, the user's blog, the user's work situation, the user's company / school, and the user's location; the number of public repositories created by the user, the number of repositories operated by the user, and the total number of operations performed by the user on the repositories; the mean value of the event time interval, the variance of the event time interval, the minimum value of the event time interval, the maximum value of the event time interval, the median of the event time interval, and the proportion of event types;

[0050] The descriptive features of the interaction attributes of each user include: the number of users following the user, the number of users followed by the user, and the ratio of the number of users following the user to the number of users followed by the user, the number of users interacted with by the user, the number of interactions, and the ratio of the number of users interacted with by the user to the number of interactions.

[0051] Furthermore, the training of the comprehensive feature representation of each user based on the XGBOOST classifier includes: inputting the comprehensive feature representation of each user into the XGBOOST classifier for training, adding a new decision tree for each training in the XGBOOST classifier training process, and using the error value of the previous training as the key correction value for the next training; the objective function of the XGBOOST model is defined as follows:

[0052]

[0053] in, represents the objective function of the model, Represents the loss function of the model, Ω(f k ) represents the regularization strategy;

[0054] After multiple rounds of iterative training, the probability of each user belonging to a user category is obtained, and the user category of each user is judged based on the threshold, and the prediction result of the user category of each user is obtained.

[0055] The malicious user detection system for open source software collaboration platforms designed by the present invention to achieve the second objective above is unique in that it includes:

[0056] A data preprocessing module acquires user data, generates corresponding user event sequences according to the user data, and preprocesses the user event sequences to obtain preprocessed user event sequences;

[0057] A sequence attention analysis module applies a temporal multi-head attention mechanism to each of the preprocessed user event sequences to obtain temporal dependencies within each of the user event sequences; applies an interactive multi-head attention mechanism to each of the preprocessed user event sequences to obtain interactive relationships between each of the user event sequences; fuses the temporal dependencies within each of the user event sequences with the interactive relationships between each of the user event sequences, and inputs the results into a feedforward network to obtain a feature representation of the user event; and inputs the feature representation of the user event into a bidirectional long short-term memory network to extract a comprehensive feature representation of the user event.

[0058] A first probability module performs a Softmax operation on the comprehensive feature representation of the user event to obtain the probability of each user belonging to the user category;

[0059] A heterogeneous graph construction module, which constructs a user interaction heterogeneous graph based on user data, wherein the user interaction heterogeneous graph includes a target user node, an auxiliary user node, a repository node, and edges connecting the nodes;

[0060] a graph feature aggregation module that aggregates nodes in the user interaction heterogeneous graph based on a repository window and a time window to obtain a feature representation of a target user node aggregated by the repository window and a feature representation of a target user node aggregated by the time window; fuses the feature representation of the target user node aggregated by the repository window and the feature representation of the target user node aggregated by the time window to obtain a feature representation of the target user node, and updates the user interaction heterogeneous graph using the feature representation of the target user node to obtain an updated user interaction heterogeneous graph;

[0061] A graph attention analysis module, which uses a time-aware attention mechanism method on the updated user interaction heterogeneous graph to obtain a feature representation of each node in the user interaction heterogeneous graph;

[0062] The second probability module performs a Softmax operation on the feature representation of each node in the user interaction heterogeneous graph to obtain the probability of each target user node belonging to the user category;

[0063] The user feature aggregation module extracts the descriptive features of each user from the user data and the descriptive features of the interaction attributes of each user from the user interaction heterogeneous graph; it fuses the probability of each user belonging to a user category, the probability of each target user node belonging to a user category, the descriptive features of each user, and the descriptive features of the interaction attributes of each user to obtain a comprehensive feature representation of each user;

[0064] The user classification module trains the comprehensive feature representation of each user based on the XGBOOST classifier to obtain the prediction result of the user category to which each user belongs.

[0065] In order to achieve the third objective above, the present invention is designed to provide a computer program product, comprising computer instructions, which are used to enable a computer to execute the above-mentioned malicious user detection method for an open source software collaboration platform.

[0066] The present invention has the following beneficial effects:

[0067] (1) The present invention introduces a temporal multi-head attention mechanism and an interactive multi-head attention mechanism to deeply model user event sequences and capture the temporal dependencies and feature interactions between events. It further extracts comprehensive feature representations of user behaviors using a bidirectional long short-term memory network. It can effectively identify users with potentially malicious behaviors, even if their behaviors are superficially similar to those of normal users. It improves the accuracy of malicious user detection by integrating and analyzing multi-dimensional features such as event time intervals, event types, involved repositories, and time windows.

[0068] (2) The present invention constructs a user interaction heterogeneous graph containing target users, auxiliary users and repository nodes, and introduces a time-aware attention mechanism to dynamically update the features of the nodes in the graph; by aggregating the node features of the repository window and the time window, it can capture the complex collaborative relationships between users and the potential propagation paths of malicious behaviors; this combination of graph neural networks and time-aware mechanisms enables the effective identification of malicious behaviors hidden behind normal interactions when faced with complex collaborative network structures, thereby improving the overall detection capability and robustness of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 A flow chart illustrating a specific embodiment of a malicious user detection method for an open source software collaboration platform according to the present invention is shown.

[0070] Figure 2 A module diagram illustrating a specific embodiment of a malicious user detection system for an open source software collaboration platform according to the present invention. DETAILED DESCRIPTION

[0071] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0072] like Figure 1 and Figure 2 As shown, the embodiment of the present invention discloses a malicious user detection method and system for an open source software collaboration platform, which can improve the accuracy of malicious user detection and reduce the missed alarm and false alarm rates.

[0073] Example 1

[0074] This embodiment discloses a method for detecting malicious users on an open source software collaboration platform, the method comprising the following steps:

[0075] Acquire user data, generate corresponding user event sequences according to the user data, and preprocess each user event sequence to obtain preprocessed user event sequences;

[0076] A temporal multi-head attention mechanism is used on each preprocessed user event sequence to obtain the temporal dependencies within each user event sequence. An interactive multi-head attention mechanism is used on each preprocessed user event sequence to obtain the interactions between each user event sequence. The temporal dependencies within each user event sequence and the interactions between each user event sequence are fused and input into a feedforward network to obtain a feature representation of the user event. The feature representation of the user event is input into a bidirectional long short-term memory network to extract a comprehensive feature representation of the user event.

[0077] Perform a Softmax operation on the comprehensive feature representation of user events to obtain the probability of each user belonging to the user category;

[0078] It should be noted that the Softmax operation maps the feature vector to the classification probability distribution P1[i], where P1[0] represents the probability that the user is a malicious user, and P1[1] represents the probability that the user is a legitimate user;

[0079] Construct a user interaction heterogeneous graph based on user data. The user interaction heterogeneous graph includes target user nodes, auxiliary user nodes, and repository nodes, as well as edges connecting the nodes.

[0080] Aggregating nodes in the user interaction heterogeneous graph based on the repository window and the time window, obtaining feature representations of target user nodes aggregated by the repository window and feature representations of target user nodes aggregated by the time window; fusing the feature representations of target user nodes aggregated by the repository window and the feature representations of target user nodes aggregated by the time window to obtain feature representations of the target user nodes, and using the feature representations of the target user nodes to update the user interaction heterogeneous graph to obtain an updated user interaction heterogeneous graph;

[0081] The time-aware attention mechanism is used on the updated user interaction heterogeneous graph to obtain the feature representation of each node in the user interaction heterogeneous graph;

[0082] Perform Softmax operation on the feature representation of each node in the user interaction heterogeneous graph to obtain the probability of each target user node belonging to the user category;

[0083] It should be noted that the Softmax operation maps the node features to the classification probability distribution P2[i], where P2[0] represents the probability of predicting that the target user is a malicious user, and P2[1] represents the probability of predicting that the target user is a legitimate user;

[0084] Extract the descriptive features of each user from the user data, and extract the descriptive features of each user's interaction attributes from the user interaction heterogeneous graph; fuse the probability of each user belonging to a user category, the probability of each target user node belonging to a user category, the descriptive features of each user, and the descriptive features of each user's interaction attributes to obtain a comprehensive feature representation of each user;

[0085] The comprehensive feature representation of each user is trained based on the XGBOOST classifier to obtain the prediction result of the user category to which each user belongs.

[0086] In this embodiment, each user event sequence includes: event time interval sequence T g ={g1,g2,...,g m}, event type sequence T e ={e1,e2,...,e n}, the repository sequence T involved in the event r ={r1,r2,...,r n} and the time window sequence T corresponding to the event w ={w1,w2,...,w n}; Among them, the event time interval sequence is a sequence obtained by traversing user data, calculating the time intervals between adjacent events, and normalizing the calculation results; the event type sequence is a sequence obtained by collecting fields of all event types and converting the event types into one-hot encoding using OneHotEncoder; the repository sequence involved in the event is a sequence obtained by extracting the repository ID of the user operation from the user data and converting the user's repository association into a one-hot encoding using OneHotEncoder; the time window sequence corresponding to the event is a sequence obtained by calculating the number of events in the previous and next time windows through the timestamp of each event.

[0087] In this embodiment, the method of using the temporal multi-head attention mechanism for each pre-processed user event sequence includes: g , event type sequence T e , the repository sequence T involved in the event r And the time window sequence T corresponding to the event w Input them into the fully connected layer respectively to obtain the query matrix Q, key matrix K and value matrix V. Each matrix is divided into h sub-matrices along the last dimension. Each sub-matrix corresponds to an attention head. The output of each attention head is calculated as follows:

[0088]

[0089] Where T represents the transpose operation, d represents the dimension of the vector, and k represents the dimension of the key vector;

[0090] The outputs of each attention head are concatenated to form a L×(h·d k ) matrix, and maps the matrix back to the original feature dimension d through linear transformation to generate the time dependency A within the event time interval sequence g , the time dependency A within the event type sequence e , the time dependency A within the repository sequence involved in the event r And the time dependency A within the time window sequence corresponding to the event w ;

[0091] The interactive multi-head attention mechanism method for each pre-processed user event sequence includes: g , event type sequence T e , the repository sequence T involved in the event r And the time window sequence T corresponding to the event w Perform length truncation or padding, map each user event sequence to the same feature dimension, and concatenate them in the last dimension. The expression is: T = [T g ,T e ,T r ,T w ]; calculate the interaction relationship between each feature and obtain the interaction relationship A between each user event sequence f The temporal dependencies within each user event sequence and the interactions between user event sequences are integrated and fed into the feedforward network to obtain the feature representation of user events.

[0092] Inputting the feature representation of the user event into the bidirectional long short-term memory network to extract the comprehensive feature representation of the user event includes: performing hidden layer representation on the feature representation of the user event from both the forward and backward directions, splicing the results from the two directions, and performing linear transformation on the spliced result to obtain the comprehensive feature representation of the user event.

[0093] In this embodiment, a user interaction heterogeneous graph is constructed based on user data. The user interaction heterogeneous graph is: Among them, V represents the node set in the user interaction heterogeneous graph, E represents the edge set in the user interaction heterogeneous graph, and X V represents the node feature representation in the user interaction heterogeneous graph, X E represents the edge feature representation in the user interaction heterogeneous graph, represents the node type mapping function, ψ represents the edge type mapping function; the node set in the user interaction heterogeneous graph includes: the target user node set V user , auxiliary user node set V aux_user and the repository node set Vrepo ; The edge set in the user interaction heterogeneous graph includes: target user-target user edge set E UU , target user-auxiliary user edge set E UA , target user-repository edge set E UR and the auxiliary user-repository edge set E AR .

[0094] In this embodiment, aggregating nodes in the user interaction heterogeneous graph based on the repository window and the time window includes: dividing the edges in the user interaction heterogeneous graph into multiple time windows, grouping all edges connected to the same repository node in each time window, performing weighted aggregation on the grouped edges based on the time-embedded feature representation of the edges, and updating the feature representation of the repository node. The expression is as follows:

[0095]

[0096] in, represents the updated feature representation of the repository node, h r represents the feature representation of the repository node, W1 represents the linear projection matrix, ε r represents all edges connected to the repository node and belonging to the current time window, t e Temporal embedding feature representation of edges;

[0097] Output the updated feature representation of the repository node to the connected target user node. Update the feature representation of the target user node according to the corresponding feature representation of the target user node. The expression is as follows:

[0098]

[0099] in, represents the updated feature representation of the target user node, h u represents the feature representation of the target user node, W2 represents the linear projection matrix, ε r Indicates the edge connecting the target user node, a T Indicates that h r(e) Feature representations of repository nodes representing edge connections, Feature representations of updated repository nodes representing edge connections;

[0100] Aggregate the edges between the target user node and the repository node in the current time window to obtain the interaction feature representation between the target user node and the repository node Identify the concurrent user nodes that interact with the target user node simultaneously in the current time window and calculate the attention score for each concurrent user node. The expression is as follows:

[0101]

[0102] Among them, e uu′ represents the attention score of concurrent user nodes, represents the weight vector, W3 represents the linear projection matrix, Represents the interaction feature representation between the target user node and the repository node, Represents the interaction feature representation between concurrent user nodes and repository nodes, φ uu′ Feature representation of the edge between the target user node and the concurrent user node;

[0103] Aggregate the concurrent users of the target user node within the current time window. The expression is as follows:

[0104]

[0105] in, Represents the feature representation of concurrent user nodes, u ′ Represents the target user node, U u (w) represents the concurrent user nodes that interact with the target user node at the same time, α uu′ represents the attention weight, Representation of the interaction features between concurrent user nodes and repository nodes;

[0106] Aggregate the interaction feature representation of the target user node and the repository node and the feature representation of the concurrent user node. The expression is as follows:

[0107]

[0108] in, represents the updated feature representation of the target user node, W4 represents the linear projection matrix, and b represents the bias vector.

[0109] In this embodiment, the method of using the time-aware attention mechanism on the updated user interaction heterogeneous graph includes: for each edge in the user interaction heterogeneous graph, calculating the time decay factor based on the time embedding feature representation of the edge, and the expression is as follows:

[0110]

[0111] Among them, t ij represents the temporal embedding feature representation of the edge, t ik Represents the temporal embedding feature representation of other edges related to the source node, t kj represents the timestamps of other edges related to the target node, and τ represents the time decay constant;

[0112] The time decay factors related to the source node and the target node are weighted and combined, and the expression is as follows:

[0113] final_time_weight(t j )=α·time_weight(t ij ,t ik )+(1-α)·time_weight(t ij ,t kj )

[0114] Among them, final_time_weight(t j ) represents the time weight, and α represents the weight coefficient;

[0115] The attention score is calculated based on the feature representation of the source node, the feature representation of the target node, the feature representation of the edge, and the time decay factor. The expression is as follows:

[0116]

[0117] Among them, attn ij represents the attention score of node i to its neighboring node j, represents the weight vector, h′ i Represents the feature representation of the source node, h′ j Represents the feature representation of the target node, e′ ij The feature representation of the edge connecting node i and its neighboring node j.

[0118] In this embodiment, the descriptive features of each user include: the total number of characters in the user name, the proportion of digits in the user name, the number of digits in the user name, the number of symbols and special characters in the user name, the user's nickname, the user's personal profile, the user's email, the user's blog, the user's work situation, the user's company / school, and the user's location; the number of public repositories created by the user, the number of repositories operated by the user, and the total number of operations performed by the user on the repositories; the mean value of the event time interval, the variance of the event time interval, the minimum value of the event time interval, the maximum value of the event time interval, the median value of the event time interval, and the proportion of event types;

[0119] The descriptive characteristics of each user's interaction attributes include: the number of users following the user, the number of users the user follows, and the ratio of the number of users following the user to the number of users the user follows, the number of users the user interacts with, the number of interactions, and the ratio of the number of users the user interacts with to the number of interactions.

[0120] In this embodiment, training the comprehensive feature representation of each user based on the XGBOOST classifier includes: inputting the comprehensive feature representation of each user into the XGBOOST classifier for training, adding a new decision tree for each training session of the XGBOOST classifier, and using the error value of the previous training as the key correction value for the next training session; the objective function of the XGBOOST model is defined as follows:

[0121]

[0122] in, represents the objective function of the model, Represents the loss function of the model, Ω(f k ) represents the regularization strategy;

[0123] After multiple rounds of iterative training, the probability of each user belonging to a user category is obtained, and the user category of each user is judged based on the threshold, and the prediction result of the user category of each user is obtained.

[0124] It should be noted that the verification experiment in this example is based on a GitHub user dataset, which integrates existing public datasets and new data collected in this article. The existing public GitHub user dataset contains a total of 10,000 users, including 2,150 malicious users and 7,850 legitimate users, whose activity was concentrated between 2015 and 2018. However, over time, malicious users have continuously adjusted their behavior patterns to evade detection mechanisms, and their number has continued to increase. To obtain more timely and representative data, this example collected a new batch of malicious user data through the GitHub API and GH Archive based on real malicious incidents that have occurred on GitHub in recent years and have been officially reported. At the same time, by randomly generating user IDs and determining whether the IDs actually exist based on the API, data on legitimate users who have remained active in recent years was collected. Ultimately, the constructed GitHub user dataset contains a total of 15,529 users, including 3,338 malicious users and 12,191 legitimate users. This dataset can more comprehensively reflect the behavioral changes and characteristics of malicious users, providing more timely and representative data support for malicious user detection and behavior analysis.

[0125] In the verification experiment, this embodiment selected GitSec as the main baseline model and conducted a comparative experiment with the proposed method. GitSec is a malicious user detection method for open source software collaboration platforms based on deep learning. It uses neural network and graph neural network technology to distinguish malicious and legitimate users by analyzing user activity sequences, social interactions and account characteristics. At the same time, Bi-LSTM, Transformer, Informer and the PLSTM+Attention model in GitSec were selected as comparison methods for Trans-BL, and HAN, HeteGCN, SeHGNN and GraphSAGE in GitSec were selected as comparison methods for THGAT. In the experiment, malicious users were defined as positive and legitimate users as negative. The number of positive samples correctly identified was TP, and the number of negative samples incorrectly identified as positive was FP; the number of negative samples correctly identified was TN, and the number of positive samples incorrectly identified as negative was FN.

[0126] This example uses the following four indicators to evaluate the performance of the method:

[0127] Precision: precision = TP / (TP+FP), the proportion of samples predicted to be malicious users that are actually malicious users.

[0128] Recall: recall = TP / (TP + FN), the proportion of real malicious users that are predicted to be malicious users.

[0129] F1 score (F1-score): F1-score = (2*precision*recall) / (precision+recall), the harmonic mean of precision and recall.

[0130] AUC: The probability that the classifier will rank a randomly selected malicious user higher than a randomly selected legitimate user.

[0131] To verify the effectiveness of the Trans-BL model proposed in this example, we compared it with the Bi-LSTM, Transformer, Informer, and PLSTM+Attention models in GitSec. The experimental results are shown in Table 1.

[0132] Table 1 Comparison of Trans-BL with other models

[0133] Model Precision Recall F1-score AUC Bi-LSTM 0.8260 0.7922 0.8087 0.9382 Transformer 0.8478 0.7792 0.8121 0.9334 Informer 0.8496 0.7842 0.8156 0.9397 PLSTM+Attention 0.7463 0.7485 0.7474 0.9197 Trans-BL 0.8573 0.8042 0.8299 0.9514

[0134] Compared to the PLSTM+Attention model used in the current state-of-the-art GitSec method, Trans-BL achieved improvements of 14.87%, 7.44%, 11.04%, and 3.45% in Precision, Recall, F1-score, and AUC, respectively. This demonstrates that Trans-BL possesses greater adaptability and robustness than other comparable models, enabling a more comprehensive analysis of user activity sequences and more comprehensive detection of malicious users, reducing false positives and false negatives, and improving the accuracy of malicious user detection.

[0135] To verify the effectiveness of the THGAT model proposed in this example, it is compared with the GraphSAGE models in HAN, HeteGCN, SeHGNN, and GitSec, respectively. The experimental results are shown in Table 2.

[0136] Table 2 Comparison of THGAT with other models

[0137] Model Precision Recall F1-score AUC GraphSAGE 0.8750 0.7972 0.8342 0.9529 HAN 0.8295 0.7532 0.7895 0.9426 HeteGCN 0.8496 0.7213 0.7802 0.9383 SeHGNN 0.8695 0.8122 0.8399 0.9479 THGAT 0.9278 0.8981 0.9127 0.9776

[0138] Compared to the GraphSAGE model, a leading GitSec method, THGAT achieves improvements of 6.03%, 12.66%, 9.41%, and 2.59% in Precision, Recall, F1-score, and AUC, respectively. This demonstrates that THGAT, compared to other graph neural networks, can more deeply explore dynamic user interaction patterns and accurately model complex temporal dependencies, thereby effectively reducing false positives and missing positives, enabling more accurate detection of malicious users in open source software collaboration platforms.

[0139] In order to verify the effectiveness of the malicious user detection method based on multi-dimensional feature fusion proposed in this embodiment, a comparison was made with the current advanced GitSec method. The experimental results are shown in Table 3.

[0140] Table 3 Comparison of the method of this embodiment with other methods

[0141] method Precision Recall F1-score AUC GitSec 0.9308 0.8462 0.8864 0.9642 The method of this embodiment 0.9624 0.9201 0.9408 0.9899

[0142] It can be observed that this embodiment has improved the four evaluation indicators of Precision, Recall, F1-score and AUC by 3.39%, 8.73%, 6.14% and 2.67% respectively, all of which are higher than GitSec. In addition, the Recall indicator is significantly better than GitSec compared to the other three indicators. This shows that the method of this embodiment can more comprehensively identify potential malicious users when detecting malicious users and can effectively avoid missed detections. Since malicious users in open source software collaboration platforms may pose a huge threat to network security, this method can better cope with the malicious user detection task in open source software collaboration platforms in practical applications.

[0143] Example 2

[0144] This embodiment discloses a malicious user detection system for an open source software collaboration platform, the system comprising:

[0145] The data preprocessing module obtains user data, generates corresponding user event sequences according to the user data, and preprocesses each user event sequence to obtain the preprocessed user event sequence;

[0146] The sequence attention analysis module applies a temporal multi-head attention mechanism to each pre-processed user event sequence to obtain the temporal dependencies within each user event sequence; applies an interactive multi-head attention mechanism to each pre-processed user event sequence to obtain the interactions between each user event sequence; fuses the temporal dependencies within each user event sequence with the interactions between each user event sequence, and inputs the result into a feedforward network to obtain a feature representation of the user event; and inputs the feature representation of the user event into a bidirectional long short-term memory network to extract a comprehensive feature representation of the user event.

[0147] The first probability module performs a Softmax operation on the comprehensive feature representation of user events to obtain the probability of each user belonging to the user category;

[0148] Heterogeneous graph construction module, which constructs a user interaction heterogeneous graph based on user data. The user interaction heterogeneous graph includes target user nodes, auxiliary user nodes, and repository nodes, as well as edges connecting the nodes;

[0149] A graph feature aggregation module aggregates nodes in the user interaction heterogeneous graph based on the repository window and the time window to obtain a feature representation of the target user node aggregated by the repository window and a feature representation of the target user node aggregated by the time window; the feature representation of the target user node aggregated by the repository window and the feature representation of the target user node aggregated by the time window are fused to obtain a feature representation of the target user node, and the feature representation of the target user node is used to update the user interaction heterogeneous graph to obtain an updated user interaction heterogeneous graph;

[0150] The graph attention analysis module uses the time-aware attention mechanism method on the updated user interaction heterogeneous graph to obtain the feature representation of each node in the user interaction heterogeneous graph;

[0151] The second probability module performs a Softmax operation on the feature representation of each node in the user interaction heterogeneous graph to obtain the probability of each target user node belonging to the user category;

[0152] The user feature aggregation module extracts the descriptive features of each user from the user data and the descriptive features of each user's interaction attributes from the user interaction heterogeneous graph. It fuses the probability of each user belonging to a user category, the probability of each target user node belonging to a user category, the descriptive features of each user, and the descriptive features of each user's interaction attributes to obtain a comprehensive feature representation of each user.

[0153] The user classification module trains the comprehensive feature representation of each user based on the XGBOOST classifier to obtain the prediction result of the user category to which each user belongs.

[0154] Example 3

[0155] The present embodiment discloses a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of computer program instructions in computer-readable media includes but is not limited to source files, executable files, installation package files, etc., and accordingly, the way in which computer program instructions are executed by a computer includes but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to the computer. Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the program and module described above can refer to the corresponding process description in the aforementioned method embodiment, and will not be repeated here.

[0156] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general-purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing this type of system. In addition, the present invention is not directed to any specific programming language. It should be understood that various programming languages can be utilized to realize the content of the present invention described herein, and the above description of specific languages is for the purpose of disclosing the best mode of the present invention.

[0157] In the description provided herein, numerous specific details are described. However, it is understood that embodiments of the present invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0158] Similarly, it should be understood that in order to streamline the present disclosure and aid understanding of one or more of the various inventive aspects, in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the claims, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Accordingly, the claims that follow the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of the invention.

Claims

1. A malicious user detection method for an open source software collaboration platform, characterized in that: The steps include: Acquire user data, generate corresponding user event sequences according to the user data, and preprocess the user event sequences to obtain preprocessed user event sequences; Applying a temporal multi-head attention mechanism to each of the preprocessed user event sequences to obtain a temporal dependency relationship within each of the user event sequences; Applying an interactive multi-head attention mechanism to the preprocessed user event sequences to obtain interactive relationships between the user event sequences; The temporal dependencies within each user event sequence and the interaction relationships between each user event sequence are integrated and input into a feedforward network to obtain a feature representation of the user event; the feature representation of the user event is input into a bidirectional long short-term memory network to extract a comprehensive feature representation of the user event; Performing a Softmax operation on the comprehensive feature representation of the user event to obtain the probability of each user belonging to the user category; Constructing a user interaction heterogeneous graph based on the user data, wherein the user interaction heterogeneous graph includes a target user node, an auxiliary user node, a repository node, and edges connecting the nodes; Aggregating each node in the user interaction heterogeneous graph based on a repository window and a time window to obtain a feature representation of a target user node aggregated by the repository window and a feature representation of a target user node aggregated by the time window; fusing the feature representation of the target user node aggregated by the repository window and the feature representation of the target user node aggregated by the time window to obtain a feature representation of the target user node, and updating the user interaction heterogeneous graph using the feature representation of the target user node to obtain an updated user interaction heterogeneous graph; Applying a time-aware attention mechanism to the updated user interaction heterogeneous graph to obtain a feature representation of each node in the user interaction heterogeneous graph; Performing a Softmax operation on the feature representation of each node in the user interaction heterogeneous graph to obtain the probability of each target user node belonging to the user category; Extract the descriptive features of each user from the user data, and extract the descriptive features of each user's interaction attributes from the user interaction heterogeneous graph; fusing the probability of each user belonging to a user category, the probability of each target user node belonging to a user category, the descriptive features of each user, and the descriptive features of the interaction attributes of each user to obtain a comprehensive feature representation of each user; The comprehensive feature representation of each user is trained based on the XGBOOST classifier to obtain a prediction result of the user category to which each user belongs.

2. The malicious user detection method for an open source software collaboration platform according to claim 1, characterized in that: The user event sequences include: event time interval sequence T g ={g1,g2,...,g m }、Event type sequence T e ={e1,e2,...,e n }, the repository sequence T involved in the event r ={r1,r2,...,r n } and the time window sequence T corresponding to the event w ={w1,w2,...,w n }; wherein, the event time interval sequence is a sequence obtained by traversing user data, calculating the time intervals between adjacent events, and normalizing the calculation results; the event type sequence is a sequence obtained by collecting fields of all event types and converting the event types into one-hot encoding using OneHotEncoder; the repository sequence involved in the event is a sequence obtained by extracting the repository ID of the user operation from the user data and converting the user's repository association into one-hot encoding using OneHotEncoder; the time window sequence corresponding to the event is a sequence obtained by calculating the number of events in the previous and next time windows through the timestamp of each event.

3. The malicious user detection method for an open source software collaboration platform according to claim 1, characterized in that: The method of using the temporal multi-head attention mechanism for the pre-processed user event sequences includes: g , the event type sequence T e , the repository sequence T involved in the event r And the time window sequence T corresponding to the event w Input them into the fully connected layer respectively to obtain the query matrix Q, key matrix K and value matrix V. Each matrix is divided into h sub-matrices along the last dimension. Each sub-matrix corresponds to an attention head. The output of each attention head is calculated as follows: Where T represents the transpose operation, d represents the dimension of the vector, and k represents the dimension of the key vector; The outputs of the attention heads are concatenated to form a L×(h·d k ) matrix, and maps the matrix back to the original feature dimension d through linear transformation to generate the time dependency A within the event time interval sequence g , the time dependency A within the event type sequence e , the time dependency A within the repository sequence involved in the event r And the time dependency A within the time window sequence corresponding to the event w ; The method of using the interactive multi-head attention mechanism for the pre-processed user event sequences includes: g , the event type sequence T e , the repository sequence T involved in the event r And the time window sequence T corresponding to the event w Perform length truncation or padding, map each user event sequence to the same feature dimension, and concatenate them in the last dimension. The expression is: T = [T g ,T e ,T r ,T w ]; calculate the interaction relationship between each feature and obtain the interaction relationship A between each user event sequence f ; Fusing the temporal dependencies within each user event sequence and the interaction relationships between each user event sequence, and inputting them into a feedforward network to obtain a feature representation of the user event; The step of inputting the feature representation of the user event into a bidirectional long short-term memory network to extract a comprehensive feature representation of the user event includes: performing hidden layer representation on the feature representation of the user event from both the forward and backward directions, splicing the results from the two directions, and performing a linear transformation on the spliced result to obtain a comprehensive feature representation of the user event.

4. The malicious user detection method for an open source software collaboration platform according to claim 1, characterized in that: The user interaction heterogeneous graph is constructed based on user data, and the user interaction heterogeneous graph is: Among them, V represents the node set in the user interaction heterogeneous graph, E represents the edge set in the user interaction heterogeneous graph, and X V represents the node feature representation in the user interaction heterogeneous graph, X E represents the edge feature representation in the user interaction heterogeneous graph, represents the node type mapping function, ψ represents the edge type mapping function; the node set in the user interaction heterogeneous graph includes: the target user node set V user , auxiliary user node set V aux_user and the repository node set V repo ; The edge set in the user interaction heterogeneous graph includes: target user-target user edge set E UU , target user-auxiliary user edge set E UA , target user-repository edge set E UR and the auxiliary user-repository edge set E AR .

5. The malicious user detection method for an open source software collaboration platform according to claim 1, characterized in that: Aggregating the nodes in the user interaction heterogeneous graph based on the repository window and the time window includes: dividing the edges in the user interaction heterogeneous graph into multiple time windows, grouping all edges connected to the same repository node in each time window, and performing weighted aggregation on the grouped edges based on the time embedded feature representation of the edges, and updating the feature representation of the repository node. The expression is as follows: in, represents the updated feature representation of the repository node, h r represents the feature representation of the repository node, W1 represents the linear projection matrix, ε r represents all edges connected to the repository node and belonging to the current time window, t e Temporal embedding feature representation of edges; The updated feature representation of the repository node is output to the connected target user node, and the feature representation of the target user node is updated according to the corresponding feature representation of the target user node. The expression is as follows: in, represents the updated feature representation of the target user node, h u represents the feature representation of the target user node, W2 represents the linear projection matrix, ε r Indicates the edge connecting the target user node, a T Indicates that h r(e) Feature representations of repository nodes representing edge connections, Feature representations of updated repository nodes representing edge connections; Aggregate the edges between the target user node and the repository node in the current time window to obtain the interaction feature representation between the target user node and the repository node Identify the concurrent user nodes that interact with the target user node simultaneously in the current time window and calculate the attention score for each concurrent user node. The expression is as follows: Among them, e uu′ represents the attention score of concurrent user nodes, represents the weight vector, W3 represents the linear projection matrix, Represents the interaction feature representation between the target user node and the repository node, Represents the interaction feature representation between concurrent user nodes and repository nodes, φ uu′ Feature representation of the edge between the target user node and the concurrent user node; Aggregate the concurrent users of the target user node within the current time window. The expression is as follows: in, represents the feature representation of concurrent user nodes, u′ represents the target user node, and U u (w) represents the concurrent user nodes that interact with the target user node at the same time, α uu′ represents the attention weight, Representation of the interaction features between concurrent user nodes and repository nodes; Aggregate the interaction feature representation of the target user node and the repository node and the feature representation of the concurrent user node. The expression is as follows: in, represents the updated feature representation of the target user node, W4 represents the linear projection matrix, and b represents the bias vector.

6. The malicious user detection method for an open source software collaboration platform according to claim 1, characterized in that: The method of using the time-aware attention mechanism on the updated user interaction heterogeneous graph includes: for each edge in the user interaction heterogeneous graph, calculating a time decay factor based on the time embedding feature representation of the edge, and the expression is as follows: Among them, t ij represents the temporal embedding feature representation of the edge, t ik Represents the temporal embedding feature representation of other edges related to the source node, t kj represents the timestamps of other edges related to the target node, and τ represents the time decay constant; The time decay factors related to the source node and the target node are weighted and combined, and the expression is as follows: final_time_weight(t j )=α·time_weight(t ij ,t ik )+(1-α)·time_weight(t ij ,t kj ) Among them, final_time_weight(t j ) represents the time weight, and α represents the weight coefficient; The attention score is calculated based on the feature representation of the source node, the feature representation of the target node, the feature representation of the edge, and the time decay factor. The expression is as follows: Among them, attn ij represents the attention score of node i to its neighboring node j, represents the weight vector, h′ i Represents the feature representation of the source node, h′ j Represents the feature representation of the target node, e′ ij The feature representation of the edge connecting node i and its neighboring node j.

7. The malicious user detection method for an open source software collaboration platform according to claim 1, characterized in that: The descriptive features of each user include: the total number of characters in the user name, the proportion of digits in the user name, the number of digits in the user name, the number of symbols and special characters in the user name, the user's nickname, the user's personal profile, the user's email, the user's blog, the user's work situation, the user's company / school, and the user's location; the number of public repositories created by the user, the number of repositories operated by the user, and the total number of operations performed by the user on the repositories; the mean value of the event time interval, the variance of the event time interval, the minimum value of the event time interval, the maximum value of the event time interval, the median value of the event time interval, and the proportion of event types; The descriptive features of the interaction attributes of each user include: the number of users following the user, the number of users followed by the user, and the ratio of the number of users following the user to the number of users followed by the user, the number of users interacted with by the user, the number of interactions, and the ratio of the number of users interacted with by the user to the number of interactions.

8. The malicious user detection method for an open source software collaboration platform according to claim 1, characterized in that: The training of the comprehensive feature representation of each user based on the XGBOOST classifier includes: inputting the comprehensive feature representation of each user into the XGBOOST classifier for training, adding a new decision tree for each training in the XGBOOST classifier training process, and using the error value of the previous training as the key correction value for the next training; the objective function of the XGBOOST model is defined as follows: in, represents the objective function of the model, Represents the loss function of the model, Ω(f k ) represents the regularization strategy; After multiple rounds of iterative training, the probability of each user belonging to a user category is obtained, and the user category of each user is judged based on the threshold, and the prediction result of the user category of each user is obtained.

9. A malicious user detection system for an open source software collaboration platform, characterized in that: include: A data preprocessing module acquires user data, generates corresponding user event sequences according to the user data, and preprocesses the user event sequences to obtain preprocessed user event sequences; A sequence attention analysis module uses a temporal multi-head attention mechanism method on each preprocessed user event sequence to obtain the temporal dependency relationship within each user event sequence; Applying an interactive multi-head attention mechanism to the preprocessed user event sequences to obtain interactive relationships between the user event sequences; The temporal dependencies within each user event sequence and the interaction relationships between each user event sequence are integrated and input into a feedforward network to obtain a feature representation of the user event; the feature representation of the user event is input into a bidirectional long short-term memory network to extract a comprehensive feature representation of the user event; A first probability module performs a Softmax operation on the comprehensive feature representation of the user event to obtain the probability of each user belonging to the user category; A heterogeneous graph construction module, which constructs a user interaction heterogeneous graph based on user data, wherein the user interaction heterogeneous graph includes a target user node, an auxiliary user node, a repository node, and edges connecting the nodes; a graph feature aggregation module that aggregates nodes in the user interaction heterogeneous graph based on a repository window and a time window to obtain a feature representation of a target user node aggregated by the repository window and a feature representation of a target user node aggregated by the time window; fuses the feature representation of the target user node aggregated by the repository window and the feature representation of the target user node aggregated by the time window to obtain a feature representation of the target user node, and updates the user interaction heterogeneous graph using the feature representation of the target user node to obtain an updated user interaction heterogeneous graph; A graph attention analysis module, which uses a time-aware attention mechanism method on the updated user interaction heterogeneous graph to obtain a feature representation of each node in the user interaction heterogeneous graph; The second probability module performs a Softmax operation on the feature representation of each node in the user interaction heterogeneous graph to obtain the probability of each target user node belonging to the user category; The user feature aggregation module extracts the descriptive features of each user from the user data and the descriptive features of the interaction attributes of each user from the user interaction heterogeneous graph; fusing the probability of each user belonging to a user category, the probability of each target user node belonging to a user category, the descriptive features of each user, and the descriptive features of the interaction attributes of each user to obtain a comprehensive feature representation of each user; The user classification module trains the comprehensive feature representation of each user based on the XGBOOST classifier to obtain a prediction result of the user category to which each user belongs.

10. A computer program product, characterized in that The method comprises computer instructions for causing a computer to execute the malicious user detection method for an open source software collaboration platform as described in claims 1-8.

Images