Intelligent network crime intelligence perception method and system

Abstract

The invention discloses an intelligent network crime intelligence perception method and system, and belongs to the technical field of artificial intelligence. The method comprises the following steps: S1, constructing a network crime word bank covering dominant crime vocabularies, semantic extension words and secret words, and carrying out vectorization processing on words of the network crime word bank to form a network crime word vector library; s2, preprocessing the social media text to obtain K words, matching each word with words in the network crime word vector library, and calculating the sum A of vector values of the matched words in the network crime word vector library n; and S3, judging: if A is greater than or equal to beta, determining that the social media contain the network crime information, otherwise, determining that the social media do not contain the network crime information, and beta is a threshold value. According to the method, the recognition capability of hidden information is improved by constructing the private network crime lexicon; the problem of low-proportion crime information perception is solved through clustering and a generative artificial intelligence model; and in combination with multi-dimensional features such as a vector model and syntactic rules, the accuracy and efficiency of network crime intelligence perception are improved.

Description

Technical Field

[0001] The present invention relates to an intelligent network crime intelligence perception method and system, belonging to the field of artificial intelligence technology. Background Art

[0002] Current cybercrime intelligence detection technologies rely heavily on general lexicons and traditional topic models (such as LDA), filtering information through single-technique optimization (e.g., improved algorithms). However, cybercrime information is characterized by high concealment, short text, high repetition, and coded language, making it difficult for existing technologies to accurately detect it. Problems include:

[0003] The vocabulary is not targeted enough: There is a lack of a vocabulary specifically for the field of cybercrime, which makes it impossible to effectively identify hidden expressions such as code words and homophones. Summary of the Invention

[0004] To overcome the shortcomings of the existing technology, the present invention provides an intelligent cybercrime intelligence perception method and system, which improves the ability to identify hidden information by building a dedicated cybercrime vocabulary; solves the problem of perceiving low-proportion crime information through clustering and generative artificial intelligence models; and combines vector models to improve the accuracy and efficiency of cybercrime intelligence perception.

[0005] To achieve the above-mentioned object, the present invention provides an intelligent cybercrime intelligence perception method, which comprises the following steps: S1: Construct a cybercrime vocabulary covering explicit crime words, semantically extended words, and codewords, and vectorize the words in the cybercrime vocabulary to form a cybercrime word vector library; S2: Preprocess the social media text to obtain K words, match each word with a word in the cybercrime word vector library, and calculate the vector value of the matched word in the cybercrime word vector library according to the following formula: sum: , S3: Judge, if , then social media contains cybercrime information, otherwise, social media does not contain cybercrime information, is the threshold, is the number of words in K after removing overlapping words.

[0006] To achieve the aforementioned purpose of the invention, the present invention also provides a system comprising a storage medium and one or more processors, wherein the storage medium is used to store code for compiling the aforementioned intelligent cybercrime intelligence perception method into a computer program using a computer language, and the computer program can be called and executed by one or more processors.

[0007] Compared to existing technologies, the intelligent cybercrime intelligence perception method and system provided by this invention enhances the ability to identify hidden information by building a dedicated cybercrime vocabulary. It also incorporates a clustering and generative artificial intelligence model to address the challenge of perceiving low-proportion crime information. Combined with a vector model, it improves the accuracy and efficiency of cybercrime intelligence perception. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 This is a flow chart of the intelligent cybercrime intelligence perception method provided by the present invention. DETAILED DESCRIPTION

[0009] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0010] Figure 1 This is a flow chart of the intelligent cybercrime intelligence perception method provided by the present invention. Figure 1 As shown, the intelligent cybercrime intelligence perception method provided by the present invention includes the following steps: S1: Construct a cybercrime vocabulary covering explicit crime words, semantically extended words, and codewords, and vectorize the words in the cybercrime vocabulary to form a cybercrime word vector library; S2: Preprocess the social media text to obtain K words, match each word with a word in the cybercrime word vector library, and calculate the vector value of the matched word in the cybercrime word vector library according to the following formula: sum: , S3: Judge, if , then social media contains cybercrime information, otherwise, social media does not contain cybercrime information, is the threshold, is the number of words in K after removing overlapping words.

[0011] The intelligent cybercrime intelligence perception method provided by the present invention further includes: identifying fixed sentence patterns in social media texts based on regular expressions. The rule is set such that when a relevant sentence pattern is matched in a social media text, the text is directly determined to contain cybercrime information.

[0012] The intelligent cybercrime intelligence perception method provided by the present invention further includes: using a rule engine to perform multi-threaded scanning on social media texts, and triggering or marking the social media texts as including cybercrime information.

[0013] In the present invention, a cybercrime word library covering explicit criminal vocabulary, semantically extended words, and codewords is constructed, and the words in the cybercrime word library are vectorized to form a cybercrime word vector library, which includes: S1-1: assign 1 to n; S1-2: Segment the nth corpus from N corpora to obtain explicit crime vocabulary, semantically extended words, and codewords, and then construct the nth core vocabulary of cybercrime; S1-3: Quantify the words in the n-th core vocabulary using a vectorization model to obtain the n-th core word vector library, such as Word2Vec, support vector machine, etc.; S1-4: Using the vocabulary expansion model, expand the words in the nth core word vector library to obtain the nth extended word vector library, and then merge the nth core word vector library and the nth extended word vector library to obtain the nth cybercrime word vector library; S1-5: Determine whether n is greater than or equal to N. If so, execute step S1-6. If not, assign n+1 to n, and then return to step S1-2. S1-6: Merge the 1st to nth cybercrime word vector libraries to generate a first cybercrime word vector library.

[0014] In the present invention, constructing a cybercrime vocabulary covering explicit criminal vocabulary, semantically extended words, and codewords, and vectorizing the words in the cybercrime vocabulary to form a cybercrime word vector library also includes: S1-7: Obtain M new corpora, replace N with M, and repeat steps S1-1 to S1-6 to obtain a second cybercrime word vector library; S1-8: Merge the first cybercrime word vector library and the second cybercrime word vector library to obtain a cybercrime word vector library.

[0015] In the present invention, the vectorization model is used to quantize the words in the n-th core vocabulary to obtain the n-th core word vector library, which includes: S1-3-1: Calculate the vector of the jth word in the nth core vocabulary according to the following formula: , Where, is the number of times the jth word appears in the nth corpus, is the total number of words in the nth corpus after preprocessing; is the number of times the jth word appears in N pieces of data and M pieces of data.

[0016] In the present invention, using a vocabulary expansion model to expand words in the nth core word vector library to obtain the nth expanded word vector library includes: S1-4-1: Calculate the vector of the cth word expanded from the word vector of the jth word in the nth corpus according to the following formula: , Where, ; From the input word vector to the hidden vector The transformation matrix of S1-4-2: Calculate the first loss function according to the following formula: , Where, From the implicit vector The transformation matrix transformed to the vector of the c-th word, S1-4-2: Determine whether the value of the first loss function L1 is the minimum. If so, output and , c=1,…,C; if not, adjust the transformation matrix and the transformation matrix The element in the array is then returned to step S1-4-1.

[0017] Optionally, , Where, The vector representing the jth core word of the nth corpus and the vector of the cth expanded word Similarity, c=1,…,C.

[0018] In the present invention, preprocessing social media text includes: S2-1: Use clustering algorithms to cluster social media texts and separate hot event background and cybercrime information; S2-2: Establish a generative artificial intelligence model based on cybercrime information, and generate K words based on the generative artificial intelligence model. The process of building the generative artificial intelligence model includes: S2-2-1: Generate word distribution for the kth topic : , Where, is the hyperparameter of the kth topic distribution, k=1,…,K, where K is a positive integer greater than or equal to 1; represents Dirichlet distribution; S2-2-2 generates topic distribution for the d-th document: , Where, is the hyperparameter of the d-th topic distribution, d=1,…,D, where D is a positive integer greater than or equal to 1; S2-2-3: Topic distribution generated from the dth document Sampling a topic : , Where, Represents a multinomial distribution, e=1,…,N d ; S2-2-4: From the subject Corresponding word distribution Sample a word : ; S2-2-5: Generate joint probability distribution according to the following formula : ; S2-2-6: Infer the topic distribution θ of the document, the word distribution ϕ of the topic, and the topic distribution z of the word based on the following generative AI model: , Where, , Where, is the posterior distribution, For a simple distribution, are the two parameters of a simple distribution; represents the antiphase divergence; represents the expected posterior distribution of word w for , represents the prior about word w; S2-2-7: Generate K words based on the topic distribution θ, the word distribution ϕ of the topic, and the topic distribution z of the word. The words include those related to the target population of the crime, the means of crime, the organizational method, the behavior pattern, and the items involved in the case.

[0019] The present invention uses the above technical solution to extract criminal themes from a low proportion of information, and the precision rate is increased to 87.5%.

[0020] The present invention also provides a system comprising a storage medium and one or more processors, wherein the storage medium is used to store code for compiling the above-mentioned intelligent cybercrime intelligence perception method into a computer program using a computer language, and the computer program can be called and executed by one or more processors.

[0021] The preferred embodiments of the present invention disclosed above are only used to help illustrate the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the contents of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can better understand and utilize the present invention. The present invention is only limited by the claims and their full scope and equivalents.

Claims

1. An intelligent cybercrime intelligence perception method, characterized in that: The steps include: S1: Construct a cybercrime vocabulary covering explicit crime words, semantically extended words, and codewords, and vectorize the words in the cybercrime vocabulary to form a cybercrime word vector library; S2: Preprocess the social media text to obtain K words, match each word with a word in the cybercrime word vector library, and calculate the vector value of the matched word in the cybercrime word vector library according to the following formula: The sum A: ， Where, is the number of words in K after removing overlapping words; S3: Judge, if , then social media contains cybercrime information, otherwise, social media does not contain cybercrime information, is the threshold.

2. The intelligent cybercrime intelligence perception method according to claim 1 is characterized in that: Construct a cybercrime vocabulary that covers explicit criminal vocabulary, semantically extended words, and codewords, and vectorize the words in the cybercrime vocabulary to form a cybercrime word vector library, including: S1-1: assign 1 to n; S1-2: Segment the nth corpus from N corpora to obtain explicit crime vocabulary, semantically extended words, and codewords, and then construct the nth core vocabulary of cybercrime; S1-3: Use the vectorization model to quantize the words in the n-th core vocabulary to obtain the n-th core word vector library; S1-4: Using the vocabulary expansion model, expand the words in the nth core word vector library to obtain the nth extended word vector library, and then merge the nth core word vector library and the nth extended word vector library to obtain the nth cybercrime word vector library; S1-5: Determine whether n is greater than or equal to N. If so, execute step S1-6. If not, assign n+1 to n, and then return to step S1-2. S1-6: Merge the 1st to nth cybercrime word vector libraries to generate a first cybercrime word vector library.

3. The intelligent cybercrime intelligence perception method according to claim 2, characterized in that: Constructing a cybercrime vocabulary that covers explicit criminal vocabulary, semantically extended words, and codewords, and vectorizing the words in the cybercrime vocabulary to form a cybercrime word vector library also includes: S1-7: Obtain M new corpora, replace N with M, and repeat steps S1-1 to S1-6 to obtain a second cybercrime word vector library; S1-8: Merge the first cybercrime word vector library and the second cybercrime word vector library to obtain a cybercrime word vector library.

4. The intelligent cybercrime intelligence perception method according to claim 3 is characterized in that: The vectorization model is used to quantize the words in the n-th core vocabulary to obtain the n-th core word vector library, including: S1-3-1: Calculate the vector of the jth word in the nth core vocabulary according to the following formula: ， Where c nj is the number of times the jth word appears in the nth corpus, N n is the total number of words after preprocessing of the nth corpus; N j is the number of times the jth word appears in N pieces of data and M pieces of data.

5. The intelligent cybercrime intelligence perception method according to claim 4 is characterized in that: Using the vocabulary expansion model to expand the words in the n-th core word vector library to obtain the n-th expanded word vector library includes: S1-4-1: Calculate the vector of the cth extended word of the jth word in the nth corpus according to the following formula: , Where, ;W nj From the input word vector to the implicit vector h nj The transformation matrix; S1-4-2: Calculate the first loss function according to the following formula: ， Where W njc From the implicit vector h nj The transformation matrix transformed to the vector of the cth word; S1-4-2: Determine whether the value of the first loss function L1 is the minimum. If so, output W njc and W nj ; If not, adjust the transformation matrix W njc and the transformation matrix W nj , and then returns to step S1-4-1.

6. The intelligent cybercrime intelligence perception method according to claim 4 is characterized in that: , Where, It represents the similarity between the j-th core word and the c-th extended word in the n-th word material, c=1,…,C.

7. A system comprising a storage medium and one or more processors, wherein the storage medium is used to store code that uses a computer language to compile the intelligent cybercrime intelligence perception method described in any one of claims 1 to 6 into a computer program, and the computer program can be called and executed by one or more processors.

Images