Aging network propagation source detection method based on graph neural network

Abstract

A method for detecting an aging network propagation source based on a graph neural network relates to the technical field of information propagation traceability, and comprises the following steps: observing and acquiring interaction behavior data of nodes in a target network, judging the final state of the nodes, generating node state information representing the final state of the nodes, and obtaining an aging graph sequence; calculating a multi-scale time-effect interaction context score, a local heterogeneity feature, a node state feature vector and a time information flow potential of each node, splicing obtained results into an initial feature vector corresponding to each node, training a GNN model in combination with the initial feature vector, and using the trained GNN model to predict a propagation source point of a new propagation event; according to the information propagation source point detection method provided by the invention, the traceability accuracy can be remarkably improved, the dynamic importance of the node in different propagation stages can be distinguished by introducing the multi-scale aging interaction context score, and the problem that early key nodes cannot be clearly identified due to the fact that the time dimension is ignored in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of information propagation tracing technology, and in particular to a time-sensitive network propagation source detection method based on graph neural network. Background Art

[0002] In modern social media, news aggregation platforms and various online communication systems, a considerable amount of unverified, false or misleading harmful information often appears. They usually have the characteristics of fast transmission speed, wide range and great influence. They may be for the purpose of gaining attention, profit-driven, misunderstanding or entertainment and jokes, and often disrupt social order, damage the reputation of individuals or institutions, and cause actual economic losses. It can be seen that timely governance of harmful information is one of the key factors in maintaining the normal operation of the social information exchange system.

[0003] On this basis, how to quickly and accurately locate the initial source of harmful information, such as misinformation or cyberattacks, is a key factor in addressing and handling such disseminated content. Existing technologies for detecting such source points generally rely on analyzing the static propagation path or topological structure of information, often overlooking the crucial temporal dimension of information diffusion, simplifying the propagation network into a static graph model. This simplification makes it difficult for existing methods to accurately capture the true dynamic propagation process of information. This is especially true in situations with high transmission speeds, complex paths, or multiple potential interference sources. The accuracy of source point determination is significantly reduced, failing to meet the growing demand for rapid and accurate traceability. Summary of the Invention

[0004] In view of this, the present invention proposes a time-sensitive network propagation source detection method based on graph neural network. To address the core defect of existing technologies, which is insufficient accuracy due to ignoring temporal dynamics, the solution based on time-sensitive network aims to significantly improve the accuracy and reliability of network information source point detection by accurately modeling and analyzing propagation events with timestamps.

[0005] To solve at least one of the above technical problems, the present invention provides a technical solution, which is a method for detecting time-sensitive network propagation sources based on a graph neural network, comprising the following steps: Step S1: Observe and obtain the interaction behavior data of the nodes in the target network, determine the final state of the nodes, generate node state information representing the final state of the nodes, and obtain a time-effect graph sequence; Step S2: Calculate the multi-scale temporal interaction context score of each node, calculate the local heterogeneity characteristics of each node based on the temporal graph sequence, vectorize the node state information to obtain the node state feature vector, and calculate the temporal information flow potential of each node. The multi-scale temporal interaction context score, local heterogeneity characteristics, node state feature vector, and temporal information flow potential of each node are spliced ​​into the initial feature vector corresponding to each node; Step S3: train the GNN model based on the initial feature vector; Step S4: Use the trained GNN model to predict the source of new propagation events.

[0006] The technical effects of the present invention are: 1. The information propagation source detection method proposed in this invention can significantly improve the accuracy of traceability. By introducing the multi-scale temporal interaction context score (MTIC), it can distinguish the dynamic importance of nodes in different propagation stages, overcoming the problem of unclear identification of early key nodes caused by ignoring the time dimension in existing technologies.

[0007] 2. The local heterogeneity features (LHFs) investigated in this paper provide explicit state difference information of node neighborhoods, enhancing the model's understanding of local propagation dynamics. Their combination with MTIC enables the model to more accurately capture the true spatiotemporal characteristics of propagation, thereby significantly improving the accuracy of identifying the true propagation source in complex network environments, which is superior to methods that rely solely on static structures or basic features.

[0008] 3. This invention enhances the model's ability to understand and express the propagation process, providing richer and more targeted information input for the graph neural network model, enabling the model to not only learn network topology, but also to deeply understand the temporal evolution of propagation and local diffusion patterns, thereby improving the model's ability to fit and infer the entire dynamic process. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0010] Figure 1 It is a schematic diagram of the overall process of the present invention. DETAILED DESCRIPTION

[0011] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings.

[0012] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention.

[0013] A method for detecting time-sensitive network propagation sources based on graph neural networks includes the following steps: Step S1: Observe and obtain the interaction behavior data of the nodes in the target network, determine the final state of the nodes, generate node state information representing the final state of the nodes, and obtain a time-effect graph sequence.

[0014] Data acquisition relies primarily on common existing data acquisition techniques, such as continuous monitoring of specific target websites, combined with web crawlers and data interface technologies, to automatically capture user interaction behavior data on the platform. Each interaction behavior data entry contains at least the source user (initiator), the target user (recipient), and the timestamp of the interaction, thus meeting the minimum triple requirement for constructing edges and their dynamic features.

[0015] A time control mechanism is introduced during the data collection process. Time windows are divided based on a set time granularity △t (e.g., 1 hour, 5 minutes, or any other time period). Users can freely set the time granularity as needed. Within each window, the system continuously collects all edge events (i.e., interactions) generated between nodes during that time period. At the same time, all recorded edge events are assigned to the corresponding time window based on their timestamps, thereby generating a static snapshot representing the network state at that moment, as shown in the following formula: Where G_t is a static snapshot of the network state; V is the set of all nodes in the network; E_t represents the interactive connections between all nodes in the current time window.

[0016] Finally, the static snapshots corresponding to all time windows are arranged in time to obtain a discrete time-effect graph sequence G that can be directly processed by the graph neural network (GNN).

[0017] At the same time, based on the acquired interaction behavior data, the node categories in the network are judged, and the final state of each node at the end of the observation is determined to provide supervision signals for the subsequent GNN model. The specific steps are as follows: First, based on the specific communication event to be traced (such as a marketing campaign, etc.), a feature set consisting of one or more "contamination information" that is strongly related to the communication event is pre-defined. The contamination information can be a keyword set containing words, phrases or sentences related to the content of the communication event, a specific URL link pointing to a known source that carries the communication event information or content, and the hash value of the MD5 or SHA-256 algorithm of the picture or video involved in the communication event.

[0018] Next, the nodes are divided into infected nodes, uninfected nodes, and recovered nodes according to their status. The specific method is: for any node, if any element in the above-mentioned "contaminated information" feature set appears for the first time in the content it publishes or forwards during the entire observation period, the node is judged to be an "infected node."

[0019] On the contrary, if the node has never published any element in the above-mentioned “contamination information” feature set during the entire observation period, the node is judged as an “uninfected node”.

[0020] If any element in the above-mentioned "polluted information" feature set has been published during the observation period, but the content is deleted before the end of the observation period, or corresponding clarification information contrary to the content of the propagation event is published, the node will be judged as a "recovery node".

[0021] Step S2: Calculate the multi-scale temporal interaction context score of each node, calculate the local heterogeneity features of each node based on the temporal graph sequence, vectorize the node state information to obtain the node state feature vector, and calculate the temporal information flow potential of each node. The multi-scale temporal interaction context score, local heterogeneity features, node state feature vector, and temporal information flow potential of each node are concatenated to form the initial feature vector corresponding to each node.

[0022] Next, the multi-scale temporal interaction context score (MTIC) of each node is calculated to reflect the infection source potential of the node in the dynamic interaction process. The specific steps are as follows: First, calculate the static degree centrality of each node u on the static network at each obtained timestamp. The specific calculation formula is as follows: Where, d u ( t ) is the static degree centrality of node u at time t; j is other nodes; the summation symbol Indicates traversing all other nodes j in the network; A uj ( t) is an element in the adjacency matrix, which is a 0-1 variable. When it is equal to 1, it means that there is a connection between node u and node j at time t, otherwise it is equal to 0.

[0023] Then define the time weight function as shown below: Where, oh ( t ) is the time weight function; c is a non-negative time decay factor, which is an important parameter for regulating the early time weight; t is the current time.

[0024] Combining the above formula, the multi-scale time-sensitive interaction context score of node u at time t can be calculated as shown in the following formula: Where MTIC(u) is the multi-scale temporal interaction context score of node u; t For the current moment; t max is the end time of the observation time window; t min is the starting time of the observation time window; d u ( t ) is the static degree centrality of node u at time t; c is a non-negative time attenuation factor that can be determined arbitrarily as needed.

[0025] This defines the multi-scale temporal interaction context (MTIC) score of node u, which can be regarded as a time-weighted centrality measure. d u ( t ) represents the static degree centrality of node i at time t, that is, the degree on the instantaneous network snapshot composed of interactions at that timestamp, which is used to measure the activity of the node at that specific moment. c is a non-negative time decay factor, which is used as a key adjustment parameter to control the weight of interaction behaviors at different time points. c When t > 0, the denominator increases with time t, thereby reducing the influence of long-term interactions and giving greater importance to recent interactions. Therefore, by weighting the centrality of the node at each moment with time decay and summing it, this formula effectively integrates the instantaneous influence of the node with the temporal order of its occurrence, providing a dynamic and robust metric for identifying the source of transmission.

[0026] Afterwards, the local heterogeneity feature (LHF) is calculated to quantify the difference in propagation states in the local neighborhood of the node. The specific steps are as follows: Step S21: First, aggregate the discrete time-effect graph sequence G to obtain a set of static, undirected global networks, as shown in the following formula: Where, G agg is the global network; V is the set of all nodes in the network, including all nodes that have appeared in the entire observation period; E agg is a global edge set, which contains all the connection relationships that appear at least once in any time window. G agg Represents all potential propagation paths during the entire observation period.

[0027] Step S22: Select any node u from the set of all nodes V in the network, and obtain its directly adjacent neighbor nodes to form a neighbor node set N(u); Step S23: Determine the final state of the node u; Step S24: traverse each neighbor node in the neighbor node set N(u) and obtain the final state of all neighbor nodes respectively; Step S25: Count the number of neighbor nodes in the neighbor node set whose final states are different from the final state of the node; Step S26: Calculate the proportion of neighbor nodes whose final states are different from the node in the neighbor node set, and form a three-dimensional vector with each proportion as the local heterogeneity feature of the node. The calculation formula for the proportion of neighbor nodes different from the node in the neighbor node set is as follows: Where LHF is the local heterogeneity feature of the node; N (u) is the set of neighbor nodes of the node; j is the final state type; The final state is the sum of uninfected neighbor nodes; The final state is the sum of infected neighbor nodes; The final state is the sum of recovered neighbor nodes.

[0028] Based on the above formula, we can first calculate the total number of nodes in the uninfected (S), infected (I) and recovered (R) states in the neighbor set N(u) of node u by summing them up. S j 、 I j 、 R j are the state indicator variables corresponding to the three final states. Then, the obtained count value is divided by the total number of neighbors , thereby converting absolute quantities into relative proportions.

[0029] At this time, the relative proportions corresponding to the three states are taken as the components of a three-dimensional vector, and the three-dimensional vector is the local heterogeneity feature LHF of the node u.

[0030] Based on LHF, the proportion of nodes in the susceptible, infected, and recovered states among the neighbors of node u can be accurately represented, providing a standardized and information-rich feature for quantitatively describing the local epidemic environment of the node.

[0031] Step S27: Repeat the above steps until the LHFs of all nodes in the network are obtained.

[0032] In addition, when node u has no neighbor nodes, LHF is defined as 0.

[0033] Next, we need to calculate the temporal information flow potential (TIFP) of each node.

[0034] Time-Information Flow Potential (TIFP) is a novel dynamic feature. Its core function is to evaluate the source potential of a node by using only the temporal structure of the network and the final observed infection status without relying on any specific propagation model.

[0035] The core logic of this method is to start from the microscopic perspective of the "receiver" and reversely infer the source point through a hypothetical information flow simulation: it traverses every node n in the network and assumes it as the source point, and then calculates how the influence of a unit starting from this hypothetical source n decays and propagates to other arbitrary nodes u in the multi-path, multi-time-step structure of the time-sensitive network.

[0036] The specific calculation steps are as follows: Step S2-1: Assume that any node n is the infection source; Step S2-2: Initialize a hypothetical information flow propagated from the node to any other node u; Step S2-3: Calculate the cumulative flow of hypothetical information flow transmitted from the current node n to any other node u in the overall network structure at any time step; Step S2-4: Calculate the temporal information flow potential ratio of any node u receiving the hypothetical information flow during the propagation process; The calculation method of the time information flow potential ratio of node u is as follows: Where, TIFP ratio (u) is the temporal information flow potential ratio of node u; n is the assumed infection source; U is the set of all uninfected nodes; I is the set of all infected nodes; is a non-zero constant; tFor the current moment; t max is the end time of the observation time window; t min is the starting time of the observation time window; f n (u,t) is the flow rate of the hypothetical information flow received by node u at time t.

[0037] At the initial time t = 0, the traffic of the hypothetical information flow received by node u is initialized as shown in the following formula: Where, f n (u,0) is the flow rate of the hypothetical information flow received by node u at the initial time t = 0; 1 u=n is the indicator function, indicating that only the source point n itself obtains the flow; Afterwards, at the moment t ≥ 1 corresponding to each subsequent time window, the total information flow received by any node in the network structure is updated according to the following formula: Where, f n (u,t) is the flow rate of the hypothetical information flow received by node u at time t; v are the remaining nodes except node u; N t ( v ) is a node v The set of neighbor nodes at time t; α is the attenuation factor, which can be set arbitrarily according to needs, and is set to 0.6 here; is the flow rate of the hypothetical information flow received by node u at time t-1; It is the sum of the traffic of hypothetical information flows received by the nodes other than node u at time t-1.

[0038] After calculating the flow rate of the hypothetical information flow received by any node u in each time window, the TIFP of node u is judged to obtain the TIFP ratio corresponding to any node.

[0039] The total influence received by node u from the final set of all infected nodes I and the total influence received from the set of all uninfected nodes U are compared according to the calculation method of the time information flow potential ratio of node u. ∈ To prevent the denominator from being zero, a small constant is used. If an infected node has a low TIFP ratio, it means that the structural “pull” it receives from other infected peers is weak, which precisely indicates that it is more likely to be an “initiator” of influence rather than a “receiver”, and therefore has a higher probability of being a source point.

[0040] After the above features are calculated, the input to the GNN model can be constructed. For any node u in the set of all nodes V in the network, its comprehensive initial feature vector is formed by concatenating all the calculated features. This concatenation operation is performed according to the vector concatenation method in the prior art to ensure that the dimensions and structure of the feature vectors of all nodes are consistent. Expressed mathematically, the initial feature vector of node u is as follows: Where x_u is the initial feature vector of node u; MTIC(u) is the multi-scale temporal interaction context score of node u; LHF(u) is the local heterogeneity feature of node u; TIFP ratio (u) is the temporal information flow potential ratio of node u; OneHotStatus(u) is the final status label of node u; The final state label (one-hot status) is obtained by one-hot encoding the final state of the node. Its purpose is to input the node's final state into the model in numerical form. Specifically, based on the final node states obtained in step S1 (i.e., "infected node," "uninfected node," and "recovered node"), a node state feature vector is generated for each node. This feature vector is a three-dimensional vector. If the final state of a node u is "infected node," its state feature vector can be defined as [1, 0, 0]; if its final state is "uninfected node," its final state feature vector can be defined as [0, 1, 0]; and if its final state is "recovered node," its state feature vector can be defined as [0, 0, 1]. The one-hot encoding operation converts the state features into numerical form, providing the model with a direct supervisory signal regarding the final infection distribution of the node.

[0041] Combining the above splicing operations, the initial feature vector x_u of each node u can simultaneously integrate the multi-scale temporal interaction context score (MTIC) reflecting its topological importance, the propagation difference (LHF) reflecting the local environment, the temporal information flow potential (TIFP) reflecting the source point probability, and the final state label (One-HotStatus) reflecting its own final state, thereby providing an information-rich, multi-dimensional input for the GNN model.

[0042] Step S3: Train the GNN model based on the initial feature vector and set the training parameters according to actual needs; Finally, all constructed dynamic graph sequences G, together with the collected corresponding node final state information and the node's initial feature vector, are used as input to the subsequent graph neural network modeling stage to train a high-performance source point detection model.

[0043] In order to enable the model to learn a large amount of data and ultimately identify the source node, the GNN model in this invention uses an edge-aware graph convolution kernel. This convolution kernel has the ability to adaptively learn convolution weights based on edge labels, which can get rid of the traditional method's reliance on hop distance or heuristic neighborhood linearization. In addition, it also retains the weight sharing and locality properties of standard convolution, enabling it to still operate efficiently and stably when processing graph-structured data. The target loss function uses the cross-entropy loss function, which is shown in the following formula: Where, is the cross entropy loss function, which is a standard method for measuring the difference between model predictions and true labels in multi-classification tasks; To sum all N categories or samples; y i is a binary variable, representing the true label of the i-th category. y i = 1, i is the correct category, when y i = 0, i is an incorrect category; log is the output of the Softmax function; h i is the raw, unnormalized score (also called logit) output by the model for class i; Normalization is performed by summing the exponential scores for all categories j, ensuring that the entire formula calculates the probability that the model predicts category i to be the correct category.

[0044] Finally, by converting the log probability (usually negative) into a positive loss value, the goal of the model is to minimize this loss function through training. .

[0045] Through the aggregation mechanism and feature update operations of a multi-layer graph neural network, the model can gradually capture the structural patterns and dynamic context of nodes during the propagation process, learning their potential infectiousness and dissemination influence. At the top level of the model, a binary classification output layer is introduced to generate a probability estimate for each node as a source, thereby achieving full-graph source probability inference.

[0046] During the training process, historical propagation instances with known labels are used as supervisory signals, and the cross entropy loss function is used to measure the predicted distribution and the true label yi The model then iterates and updates network parameters using mainstream optimization algorithms such as the Adam optimizer. This supervised learning process effectively achieves an end-to-end mapping from propagation features to node source probabilities. This end-to-end supervised learning process effectively establishes a precise mapping between input propagation features (including network dynamics, node heterogeneity, and state) and output node source probabilities. This enables the model to learn the inherent patterns and complex laws of information propagation from data, thus enabling high-precision tracing of unknown propagation events.

[0047] Step S4: Use the trained GNN model to predict the source of new propagation events.

[0048] After model training is complete, it can be applied to predict the source of unknown transmission instances. For each new transmission data point, the feature matrix X' is generated by encoding its infection status and calculating its MTIC, LHF features, and TIFP ratio. This matrix, along with the graph G', is input into the trained model, outputting the source probability of each node. The node with the highest probability is ultimately selected as the prediction result.

[0049] Example

[0050] To comprehensively evaluate the performance, adaptability, and robustness of the algorithm of the present invention, we generated simulated propagation data based on the standard SIR (Susceptible-Infectious-Recovered) model on five real networks (Math, Message, Escorts, Bitcoin-Alpha, and Bitcoin-OTC) for testing, as shown in Table 1.

[0051]

[0052] The test set the average infection rate and recovery rate parameter combination of two core groups , and combined with different data sampling strategies (such as selecting specific time periods or fixed interval sampling), we finally constructed twelve different experimental data sets and used different models LPSI (Label Propagation based Source Identification), IVGD (Invertible Validity-aware Graph Diffusion), BN (Backtracking Network), and the model NHTD (Node Heterogeneity and Temporal Dynamics) in this invention to compare their performance. In order to simulate the uncertainty in real-world transmission and consider the differences between theoretical models and actual conditions, each specific simulation process does not use fixed parameters. Instead, the actual infection rate α and recovery rate β are respectively extracted from a uniform distribution centered on the mean value. . Furthermore, the starting time t_0 of each simulation is randomly selected within a preset interval, and the initial infection source (patient zero) is also randomly selected from the active nodes at that time. This experimental design, which introduces multiple randomizations, aims to generate diverse and more realistic transmission scenarios, thereby enabling rigorous testing and verification of the effectiveness and robustness of the proposed algorithm under different parameter conditions and transmission dynamics.

[0053] The test also used three complementary evaluation metrics: Top-1 accuracy, Top-5 accuracy, and Hop-1 accuracy. Top-1 accuracy measures whether the model can accurately point the highest-probability prediction to the true initial propagator. Top-5 accuracy relaxes the criteria, examining whether the true source is included in the five candidate nodes with the highest model prediction probability, evaluating the model's localization ability within a small range. Hop-1 accuracy focuses on the topological proximity of the prediction results, measuring whether the distance between the predicted source and the true source is less than or equal to one hop (i.e., the predicted node is the true source itself or a direct neighbor of it). By combining these three metrics, a comprehensive and detailed assessment of the model's accuracy, reliability, and practical application value can be conducted from multiple dimensions, including precise identification (Top-1), candidate set hits (Top-5), and topological proximity (Hop-1). While maintaining a certain Top-1 accuracy, the model achieves the highest possible Top-5 and Hop-1 accuracy. Specific experimental results for performance comparison are shown in Tables 2 and 3, respectively.

[0054]

[0055] The empirical evaluation on five real-world time-sensitive network datasets demonstrates that explicit modeling of time-sensitive dynamics is a key factor in achieving accurate source localization. This is particularly evident when compared to static graph methods, which have inherent limitations and fail to capture the evolving nature of network interactions. For example, on the high-propagation Bitcoin Alpha dataset, the graph neural network-based IVGD method achieved a Top-1 accuracy of only 0.23, while our time-sensitive NHTD method achieved a significantly higher accuracy of 0.53.

[0056] As another time-aware method, the BN model consistently outperforms all static methods, thus verifying the importance of time-aware modeling. Even so, the NHTD model still performed best among all evaluated models. A notable feature of NHTD was further demonstrated on the Math dataset: its Hop-1 accuracy reached 0.82, exceeding its Top-5 accuracy of 0.62. This phenomenon shows that NHTD has unique advantages in topological positioning, which is a capability that other baseline methods do not have. This superior performance can be attributed to the integration of MTIC, HLF, and TIFP modules in the present invention, which can effectively capture the multi-scale, heterogeneous time-aware patterns present in the data.

[0057] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the embodiments of the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A method for detecting time-sensitive network propagation sources based on graph neural networks, characterized in that: The following steps are involved: Step S1: Observe and obtain the interaction behavior data of the nodes in the target network, determine the final state of the nodes, generate node state information representing the final state of the nodes, and obtain a time-effect graph sequence; Step S2: Calculate the multi-scale temporal interaction context score of each node, calculate the local heterogeneity characteristics of each node based on the temporal graph sequence, vectorize the node state information to obtain the node state feature vector, and calculate the temporal information flow potential of each node. The multi-scale temporal interaction context score, local heterogeneity characteristics, node state feature vector, and temporal information flow potential of each node are spliced ​​into the initial feature vector corresponding to each node; Step S3: train the GNN model based on the initial feature vector; Step S4: Use the trained GNN model to predict the source of new propagation events.

2. The method for detecting time-sensitive network propagation sources based on graph neural networks according to claim 1, characterized in that: The interaction behavior data in step S1 includes the source user, the target user, and the timestamp of the interaction.

3. The method for detecting time-sensitive network propagation sources based on graph neural networks according to claim 1, characterized in that: The specific method for obtaining the time-effect diagram sequence in step S1 is: Step S11: Determine an observation period and divide the observation period into time windows, where the observation period is the time from the initial state to the time when the infection rate reaches the set threshold; Step S12: Determine the interaction behaviors generated by all nodes in each time window and their corresponding timestamps, and generate a static network snapshot representing the network state in the time window; Step S13: Arrange all network snapshot time window sequences to form a time-efficiency graph sequence.

4. The method for detecting time-sensitive network propagation sources based on graph neural network according to claim 3 is characterized in that: The following steps are involved: The final status of the node includes infected, uninfected, and recovered; The method for determining the final state of the node is as follows: traversing the interaction behavior data of all nodes in the network, and defining the node whose interaction behavior data has contaminated information during the entire observation period as an infected node; The nodes without contamination information in the interaction behavior data during the entire observation period are defined as uninfected nodes; The nodes whose interactive behavior data have contaminated information during the entire observation period but are no longer contaminated by the end of the observation are defined as recovery nodes.

5. The method for detecting time-sensitive network propagation sources based on graph neural networks according to claim 4 is characterized in that: The pollution information includes: keyword set, URL link, media file identifier; The keyword set includes words, phrases or sentences related to the content of the communication event; The URL link is a link to a known web page that carries information or content about the dissemination event; The media file identifier is the hash value of the MD5 or SHA-256 algorithm of the image or video involved in the dissemination event.

6. The method for detecting time-sensitive network propagation sources based on graph neural networks according to claim 1, characterized in that: The calculation method of the multi-scale temporal interaction context score in step S2 is as follows: Where MTIC(u) is the multi-scale temporal interaction context score of node u; t For the current moment; t max is the end time of the observation time window; t min is the starting time of the observation time window; d u ( t ) is the static degree centrality of node u at time t; γ is a non-negative time decay factor.

7. The method for detecting time-sensitive network propagation sources based on graph neural networks according to claim 4, characterized in that: The calculation method of the local heterogeneity feature of each node in step S2 is: Step S21: Aggregate the time-efficiency graph sequence to obtain a set of static, undirected global networks, as shown in the following formula: Where, G agg is the global network; V is the set of all nodes in the network, including all nodes that have appeared in the entire observation period; E agg is the global edge set, which contains all connection relationships that appear at least once in any time window; Step S22: Select any node from the set of all nodes in the network, and obtain the neighboring nodes directly adjacent to the node to form a neighboring node set; Step S23: Determine the final state of the node; Step S24: traverse each neighbor node in the neighbor node set and obtain the final status of all neighbor nodes respectively; Step S25: Count the number of neighbor nodes in the neighbor node set whose final states are different from the final state of the node; Step S26: Calculate the proportion of neighbor nodes whose final states are different from the node in the neighbor node set, and form a three-dimensional vector with each proportion as the local heterogeneity feature of the node. The calculation formula for the proportion of neighbor nodes different from the node in the neighbor node set is as follows: Where LHF is the local heterogeneity feature of the node; N (u) is the set of neighbor nodes of the node; j is the final state type; The final state is the sum of uninfected neighbor nodes; The final state is the sum of infected neighbor nodes; The final state is the sum of recovered neighbor nodes; Step S27: Repeat the above steps until the local heterogeneity characteristics of all nodes in the network are obtained.

8. The method for detecting time-sensitive network propagation sources based on graph neural networks according to claim 1, characterized in that: The convolution kernel of the GNN model is an edge-aware graph convolution kernel.

9. The method for detecting time-sensitive network propagation sources based on graph neural networks according to claim 1, characterized in that: The method for calculating the temporal information flow potential of each node is: Step S2-1: Assume that any node n is the infection source; Step S2-2: Initialize a hypothetical information flow propagated from the node to any other node; Step S2-3: Calculate the cumulative flow of hypothetical information flow transmitted by the current node n to any other node u in the overall network structure in any time window; Step S2-4: Calculate the temporal information flow potential ratio of any node u receiving the hypothetical information flow during the propagation process; The calculation method of the time information flow potential ratio of node u is as follows: Where, TIFP ratio (u) is the temporal information flow potential ratio of node u; n is the assumed infection source; U is the set of all uninfected nodes; I is the set of all infected nodes; is a non-zero constant; t For the current moment; t max is the end time of the observation time window; t min is the starting time of the observation time window; f n (u,t) is the flow rate of the hypothetical information flow.

Images