A time-effect network propagation source detection method based on a graph neural network

Abstract

A time-effect network propagation source detection method based on a graph neural network relates to the technical field of information propagation traceability, and comprises the following steps: observing and acquiring interaction behavior data of nodes in a target network, judging the final state of the nodes, generating node state information representing the final state of the nodes, deriving a time-effect graph sequence, calculating a multi-scale time-effect interaction context score, a local heterogeneity feature, a node state feature vector and time information flow potential of each node, splicing the obtained results into an initial feature vector corresponding to each node, training a GNN model in combination with the initial feature vector, and using the trained GNN model to predict a propagation source point of a new propagation event; the information propagation source point detection method proposed in the application can significantly improve the accuracy of traceability, and by introducing a multi-scale time-effect interaction context score, the dynamic importance of nodes at different propagation stages can be distinguished, and the problem that the prior art ignores the time dimension, resulting in unclear identification of early key nodes, is overcome.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information propagation traceability, and particularly relates to a time-effective network propagation source detection method based on a graph neural network. BACKGROUND

[0002] In modern social media, news aggregation platforms and various online communication systems, there are often a considerable amount of unverified, false or misleading harmful information, which usually has the characteristics of fast spread, wide range and great influence. They may be driven by attention-seeking, interest, misunderstanding or entertainment, and often disrupt social order, damage personal or institutional reputation, and cause actual economic losses. It can be seen that the timely governance of harmful information is one of the key factors to maintain the normal operation of the social information exchange system.

[0003] On this basis, how to quickly and accurately locate the initial propagation source point of harmful information such as false information or cyber attacks is one of the key points in dealing with such propagation content. The existing technology generally relies on analyzing the static propagation path or topology of information when detecting such source points, often ignoring the crucial time dimension information in the information diffusion process, i.e. simplifying the propagation network into a static graph model. This simplification makes it difficult for existing methods to accurately capture the real dynamic propagation process of information propagation, especially in the case of fast spread, complex path or multiple potential interference sources, the accuracy of source point judgment is significantly reduced, which cannot meet the growing demand for fast and accurate traceability. SUMMARY

[0004] In view of this, the present application proposes a time-effective network propagation source detection method based on a graph neural network. In view of the core defect of the prior art that the accuracy is insufficient due to the neglect of time dynamics, the solution based on time-effective network aims to significantly improve the accuracy and reliability of network information source point detection by accurately modeling and analyzing propagation events with timestamps.

[0005] To solve the above at least one technical problem, the technical scheme provided by the present application is a time-effective network propagation source detection method based on a graph neural network, comprising the following steps:

[0006] Step S1: observing and obtaining the interaction behavior data of the nodes in the target network, judging the final state of the nodes, generating node state information representing the final state of the nodes, and obtaining a time-effective graph sequence;

[0007] Step S2: calculate the multi-scale time-effect interaction context score of each node, combine the time-effect graph sequence to calculate the local heterogeneity feature of each node, vectorize the node state information to obtain the node state feature vector, and calculate the time information flow potential of each node; splice the multi-scale time-effect interaction context score, local heterogeneity feature, node state feature vector and time information flow potential of each node into an initial feature vector corresponding to each node;

[0008] Step S3: train the GNN model in combination with the initial feature vector;

[0009] Step S4: use the trained GNN model to predict the propagation source point of a new propagation event.

[0010] The technical effects of the present application are:

[0011] 1. The information propagation source point detection method proposed in the present application can significantly improve the accuracy of tracing, by introducing the multi-scale time-effect interaction context score (MTIC), the dynamic importance of nodes at different propagation stages can be distinguished, and the problem of unclear identification of early key nodes caused by ignoring the time dimension in the prior art is overcome.

[0012] 2. The local heterogeneity feature (LHF) investigated in the present application provides explicit state difference information of the node neighborhood, enhancing the model's understanding of local propagation dynamics; the combined application of LHF and MTIC enables the model to more accurately capture the real spatiotemporal characteristics of propagation, thereby significantly improving the accuracy of identifying real propagation source points in complex network environments, which is superior to methods that rely only on static structures or basic features.

[0013] 3. The present application enhances the model's understanding and expression ability of the propagation process, providing more rich and targeted information input for the graph neural network model, enabling the model not only to learn the network topology, but also to deeply understand the time evolution law and local diffusion pattern of propagation, and improving the model's fitting and inference ability of the entire dynamic process. BRIEF DESCRIPTION OF DRAWINGS

[0014] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0015] Figure 1 The present application is a whole flowchart. DETAILED DESCRIPTION

[0016] The application will be described in further detail below with reference to the drawings and embodiments.

[0017] To make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative effort belong to the protection scope of the present application. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application.

[0018] A time-effect network propagation source detection method based on a graph neural network, comprising the following steps:

[0019] Step S1: observing and acquiring interaction behavior data of nodes in a target network, judging the final state of the nodes, generating node state information representing the final state of the nodes, and obtaining a time-effect graph sequence.

[0020] The data acquisition mode mainly relies on common data acquisition technologies in the prior art, for example, continuous monitoring of a specific target website, combining network crawler and data interface technologies, and automatically capturing user interaction behavior data on a platform. Each piece of interaction behavior data at least contains a source user (initiator), a target user (receiver) and a time stamp of occurrence, thereby meeting the minimum three-tuple requirement of constructing edges and dynamic features.

[0021] A time control mechanism is introduced in the data collection process. Time windows are divided based on a set time granularity Δt (such as 1 hour or 5 minutes or any time period), and the user can freely set the time granularity according to the requirements. The system continuously collects all edge events (i.e. interaction behaviors) generated between all nodes in each window within the time period, and at the same time, all recorded edge events are distributed into the corresponding time window according to their time stamps, thereby generating a static snapshot representing the network state at that moment, as shown in the following formula:

[0022] In the formula, G_t is a static snapshot of the network state; V is a set of all nodes in the network; E_t represents all interaction connections between nodes occurring in the current time window.

[0023] Finally, all static snapshots corresponding to the time windows are arranged in time, thereby obtaining a discrete time-effect graph sequence G that can be directly processed by a graph neural network (GNN).

[0024] Meanwhile, based on the obtained interaction behavior data, the node categories in the network are judged, and the final state of each node at the end of observation is determined to provide a supervision signal for the subsequent GNN model. The specific steps are as follows:

[0025] First, according to a specific propagation event to be traced (such as a certain marketing activity), one or more feature sets composed of “pollution information” strongly related to the propagation event are defined in advance. The pollution information can be a keyword set containing words, phrases or sentences related to the content of the propagation event, a specific URL link pointing to known information or content carrying the propagation event, and the MD5 or SHA-256 hash value of the picture or video related to the propagation event.

[0026] Next, the nodes are divided into infected nodes, uninfected nodes and recovered nodes according to the difference in state. The specific method is as follows: for any node, if any element in the above-mentioned “pollution information” feature set appears in the content published or forwarded by the node for the first time in the entire observation period, the node is determined to be an “infected node”.

[0027] On the contrary, if the node has never published any element in the above-mentioned “pollution information” feature set in the entire observation period, the node is determined to be an “uninfected node”.

[0028] If any element in the above-mentioned “pollution information” feature set has been published in the observation period, but the content is deleted until the end of the observation period, or the corresponding clarifying information opposite to the content of the propagation event is published, the node is determined to be a “recovered node”.

[0029] Step S2: Calculate the multi-scale time-effective interaction context score of each node, calculate the local heterogeneity feature of each node combined with the time-effective graph sequence, vectorize the node state information to obtain the node state feature vector, and calculate the time information flow potential of each node. The multi-scale time-effective interaction context score, local heterogeneity feature, node state feature vector and time information flow potential of each node are spliced into the initial feature vector corresponding to each node.

[0030] Next, the multi-scale time-effective interaction context score (MTIC) of each node is calculated to reflect the infection source potential of the node in the dynamic interaction process. The specific steps are as follows:

[0031] First, the static degree centrality of each node u on the static network at each obtained timestamp is calculated, and the specific calculation formula is as follows:

[0032] In the formula, d u ( t) is the static centrality of node u at time t; j is other nodes; summation symbol represents traversing all other nodes j in the network; A uj ( t ) is an element in the adjacency matrix, which is a 0-1 variable, equal to 1 when there is a connection between node u and node j at time t, otherwise equal to 0.

[0033] The time weight function is redefined as shown in the following formula:

[0034] In the formula, ω ( t ) is the time weight function; γ is a non-negative time decay factor, which is an important parameter for regulating early time weight; t is the current time.

[0035] Combining the above formula, the multi-scale time-effective interaction context score of node u at time t can be calculated, as shown in the following formula:

[0036] In the formula, MTIC(u) is the multi-scale time-effective interaction context score of node u; t is the current time; t max is the end time of the observation time window; t min is the start time of the observation time window; d u ( t ) is the static centrality of node u at time t; γ is a non-negative time decay factor, which can be determined arbitrarily as needed.

[0037] Thus, the multi-scale time-effective interaction context (MTIC) score of node u is defined, which can be regarded as a time-weighted centrality measure. The core term d u ( t ) represents the static centrality of node i at time t, that is, the degree in the instantaneous network snapshot composed of interactions at that timestamp, which measures the activity of the node at that particular time. γ is a non-negative time decay factor, which is a key adjustment parameter for controlling the weight of interaction behavior at different time points. When γWhen > 0, the denominator will increase with the increase of time t, thereby reducing the influence of long-term interaction and giving higher importance to recent interaction. Therefore, the formula effectively integrates the instantaneous influence of the node and the time sequence of its occurrence by time-decay weighting and summing the centrality of the node at each time, providing a dynamic and robust metric for identifying the source point of propagation.

[0038] Then, the local heterogeneity feature (LHF) is calculated to quantify the difference in propagation state in the local neighborhood of the node, and the specific steps are as follows:

[0039] Step S21: First, aggregate the time-effect graph sequence G in discrete form to obtain a set of static, undirected global networks, as shown in the following formula:

[0040] In the formula, G agg is the global network; V is the set of all nodes in the network, including all nodes that appear in the entire observation period; E agg is the global edge set, including all connection relationships that appear at least once in any time window. The aggregated network G agg represents all potential propagation paths in the entire observation period.

[0041] Step S22: Select any node u in the set of all nodes V in the network, and obtain the neighbor node set N(u) consisting of directly adjacent neighbor nodes;

[0042] Step S23: Determine the final state of the node u;

[0043] Step S24: Traverse each neighbor node in the neighbor node set N(u) to obtain the final state of each neighbor node;

[0044] Step S25: Count the number of neighbor nodes whose final state is different from that of the node;

[0045] Step S26: Calculate the proportion of neighbor nodes whose final state is different from that of the node in the neighbor node set, and form a three-dimensional vector of the respective proportions as the local heterogeneity feature of the node. The calculation formula of the proportion of neighbor nodes whose final state is different from that of the node is as follows:

[0046] In the formula, LHF is the local heterogeneity feature of the node; N (u) is the neighbor node set of the node; j is the final state type; is the sum of neighbor nodes with the final state of uninfected; the sum of the neighbor nodes in the final state of infection; the sum of the neighbor nodes in the final state of recovery.

[0047] Based on the above formula, first, the total number of nodes in the neighbor set N(u) of node u in the states of uninfected (S), infected (I) and recovered (R) is counted respectively, S j 、 I j 、 R j respectively, are state indicator variables corresponding to the three final states. Then, the obtained count value is divided by the total number of neighbors , so as to convert the absolute number into a relative proportion.

[0048] At this time, the relative proportions corresponding to the three states are taken as the components of a three-dimensional vector, and the three-dimensional vector is the local heterogeneity feature LHF of the node u.

[0049] Based on LHF, the proportion of nodes in the susceptible, infected and recovered states in the neighbors of node u can be accurately represented, providing a standardized and information-rich feature for quantitatively describing the local epidemic environment of the node.

[0050] Step S27: Repeat the above steps until the LHF of all nodes in the network is obtained.

[0051] In addition, when node u has no neighbor nodes, LHF is defined as 0.

[0052] Next, the time information flow potential (TIFP) of each node needs to be calculated.

[0053] Time-Information Flow Potential (TIFP) is a novel dynamic feature, whose core role is to evaluate the source potential of a node without relying on any specific propagation model, only using the time structure of the network and the observed final infection state.

[0054] The core logic of this method is to start from the micro perspective of the "receiver" and reverse the source point through a hypothetical information flow simulation: it will traverse each node n in the network and assume it as a source point, then calculate how a unit of influence will decay and propagate to any other node u in the multi-path, multi-time step structure of the time network from this hypothetical source n.

[0055] The specific calculation steps are as follows:

[0056] Step S2-1: Assume any node n as an infected source point;

[0057] Step S2-2: initializing the hypothetical information flow propagated by the node to any other node u;

[0058] Step S2-3: calculating the cumulative flow of the hypothetical information flow propagated by the current node n to any other node u in the overall network structure at any time step;

[0059] Step S2-4: calculating the time information flow potential ratio of any node u receiving the hypothetical information flow in the propagation process;

[0060] Wherein, the time information flow potential ratio of node u is calculated as follows:

[0061] In the formula, TIFP ratio (u) is the time information flow potential ratio of node u; n is the assumed infection source point; U is the set of all uninfected nodes; I is the set of all infected nodes; is a non-zero constant; t is the current time; t max is the end time of the observation time window; t min is the start time of the observation time window; f n (u, t) is the flow of the hypothetical information flow received by node u at time t.

[0062] At the initial time t = 0, the flow of the hypothetical information flow received by node u is initialized as follows:

[0063] In the formula, f n (u, 0) is the flow of the hypothetical information flow received by node u at the initial time t = 0; 1 u=n is an indicator function, indicating that only the source point n itself obtains the flow;

[0064] Subsequently, at the time t ≥ 1 corresponding to each time window, the total information flow received by any node in the network structure is updated according to the following formula:

[0065] In the formula, f n (u, t) is the flow of the hypothetical information flow received by node u at time t; v is the rest of the nodes except node u; N t v is the node v ​The set of neighbor nodes at time t; a is an attenuation factor, which can be set arbitrarily as needed, and is set to 0.6 here; The flow of the hypothetical information stream received by node u at time t-1; The sum of the flows of the hypothetical information streams received by the remaining nodes other than node u at time t-1.

[0066] After calculating the flow of the hypothetical information stream received by any node u in each time window, the TIFP of node u is determined, and the TIFP ratio corresponding to any node is obtained.

[0067] According to the node u time information flow potential ratio calculation method, the total influence received by node u from the final all infected node set I and the total influence received from all uninfected node set U are compared, ∈ To prevent small constants with a denominator of zero. If a node is infected and its TIFP ratio is very low, it means that it obtains weak structural "pull" from other infected companions, which exactly indicates that it is more likely to be an "initiator" of influence rather than a "receiver", and therefore has a higher source point possibility.

[0068] After the above feature calculation is completed, the input of the GNN model can be constructed. For any node u in the entire node set V in the network, the initial feature vector of the node is formed by concatenating all the calculated features. The concatenation operation is performed according to the vector concatenation method in the prior art to ensure that the dimensions and structures of all node feature vectors are consistent. When expressed in mathematical formula, the initial feature vector of node u is as follows:

[0069] In the formula, x_u is the initial feature vector of node u; MTIC(u) is the multi-scale time-effective interaction context score of node u; LHF(u) is the local heterogeneity feature of node u; TIFP ratio (u) is the time information flow potential ratio of node u; OneHotStatus(u) is the final state label of node u;

[0070] Among them, the final state label (One-Hot Status) is obtained after one-hot encoding operation is performed on the final state of the node, and the purpose is to input the final state of the node into the model in the form of a value, and the specific operation is: based on the results of the final state of the node obtained in step S1, that is, "infected node", "uninfected node" and "recovered node", a node state feature vector is generated for each node, wherein the feature vector is a three-dimensional vector. If the final state of a node u is "infected node", the state feature vector of the node can be defined as [1, 0, 0]; if the final state of the node is "uninfected node", the final state feature vector of the node can be defined as [0, 1, 0], and if the final state of the node is "recovered node", the state feature vector of the node is defined as [0, 0, 1]. Through the one-hot encoding operation, the state feature is converted into a numerical form, which provides a direct supervision signal for the model about the final infection distribution of the node.

[0071] In summary, the initial feature vector x_u of each node u can simultaneously fuse the multi-scale time-effective interaction context score (MTIC) reflecting the topological importance, the local environment reflecting the propagation difference (LHF), the time information flow potential (TIFP) reflecting the source point probability, and the final state label (One-Hot Status) reflecting the final state of the node, thereby providing a rich information, multi-dimensional input for the GNN model.

[0072] Step S3: training the GNN model in combination with the initial feature vector, and setting the training parameters according to actual needs;

[0073] Finally, all the constructed dynamic graph sequences G and the collected corresponding node final state information and the initial feature vectors of the nodes are input into the subsequent graph neural network modeling stage as inputs, for training a high-performance source node detection model.

[0074] In order to realize the learning of the model on a large amount of data and finally identify the source node, the GNN model in the application adopts an edge perception graph convolution kernel. The convolution kernel has the ability of adaptive learning of convolution weight based on edge label, and can get rid of the dependence of traditional methods on hop distance or heuristic neighborhood linearization. In addition, it also retains the weight sharing and locality properties of the standard convolution, so that it can still operate efficiently and stably when processing graph structure data. The target loss function adopts a cross-entropy loss function, which is specifically as follows:

[0075] In the formula, is a cross-entropy loss function, which is a standard method for measuring the difference between model prediction and true label in multi-classification task; to sum over all N classes or samples; y i is a binary variable indicating the true label of the ith class, where y i = 1, i is the correct class, and where y i = 0, i is the incorrect class; log is the output of the Softmax function; h i is the raw, unnormalized score (also called the logit) output by the model for class i; is the normalized score for all classes j by summing the exponentiated scores, ensuring that the entire formula computes the probability that the model predicts class i as the correct class.

[0076] Finally, by converting the log probability (which is typically negative) into a positive loss value, the model’s goal is to minimize this loss function through training.

[0077] Through the aggregation mechanism and feature update operation of the multi-layer graph neural network, the model can gradually capture the structural patterns and dynamic context of the nodes in the propagation process, and learn their potential infection ability and propagation influence. In the top structure of the model, a binary classification output layer is introduced to generate the probability estimation of each node as a source point, thereby realizing the source point probability inference at the whole graph level.

[0078] During the training process, the historical propagation instances with known labels are used as supervision signals, and the cross-entropy loss function is used to measure the difference between the predicted distribution and the true label y i , and the network parameters are iteratively updated through mainstream optimization algorithms such as the Adam optimizer. This supervised learning process effectively realizes the end-to-end mapping between the propagation features and the node source point probability. This end-to-end supervised learning process effectively establishes an accurate mapping relationship between the input propagation features (including network dynamics, node heterogeneity, and state) and the output node source point probability. This enables the model to learn the inherent patterns and complex rules of information propagation from data, thereby possessing the ability to accurately trace the source of unknown propagation events.

[0079] Step S4: Use the trained GNN model to predict the propagation source of a new propagation event.

[0080] After the model training is completed, it can be applied to the source point prediction of unknown propagation instances. For each new propagation data, by encoding its infection state and calculating its MTIC, LHF feature and TIFP ratio, a feature matrix X' is generated, which is input into the trained model together with the graph G' to output the source probability of each node. Finally, the node with the highest probability is selected as the prediction result.

[0081] Embodiments

[0082] In order to comprehensively evaluate the performance, adaptability and robustness of the algorithm of the present application, the standard-based SIR (Susceptible-Infected-Recovered) model in the present application generates simulated propagation data for testing on five real networks (Math, Message, Escorts, Bitcoin-Alpha, Bitcoin-OTC), as shown in Table 1.

[0083]

[0084] Two groups of core average infection rate and recovery rate parameter combinations are set for testing and combined with different data sampling strategies (such as selecting a specific time period or fixed interval sampling), twelve different experimental data sets are finally constructed, and different models LPSI (LabelPropagation based Source Identification), IVGD (Invertible Validity-aware GraphDiffusion), BN (Backtracking Network) and the model NHTD (Node Heterogeneity and Temporal Dynamics) in the present application are compared in performance. In order to simulate the uncertainty in real propagation and consider the differences between theoretical models and actual situations, each specific simulation process does not use fixed parameters, but the actual infection rate α and recovery rate β are independently randomly sampled from the uniform distribution centered on the average value At the same time, the starting time t_0 of each simulation is randomly selected within the preset interval, and the initial infection source (zero patient) is also randomly selected from the active nodes at this time. This experimental design with multiple random factors aims to produce diverse and more realistic propagation scenarios, so as to strictly test and verify the effectiveness and robustness of the algorithm of the present application under different parameter conditions and propagation dynamics.

[0085] Meanwhile, three complementary evaluation metrics, Top-1 accuracy, Top-5 accuracy, and Hop-1 accuracy, are also selected in the test. Top-1 accuracy measures whether the model can accurately point the highest probability prediction to the real initial spreader; Top-5 accuracy relaxes the standard and investigates whether the real source is contained in the top five candidate nodes with the highest prediction probability, evaluating the positioning ability of the model in a small range; and Hop-1 accuracy focuses on the proximity of the prediction result in the network topology, measuring whether the distance between the predicted source and the real source is less than or equal to 1 hop (i.e., the predicted node is the real source itself or its direct neighbor). By combining these three indicators, the accuracy, reliability, and practical application value of the model can be comprehensively and meticulously evaluated from multiple dimensions such as precise identification (Top-1), candidate set hit (Top-5), and topological proximity (Hop-1). On the basis of ensuring a certain Top-1 accuracy, the model has as high Top-5 and Hop-1 accuracy as possible. The performance comparison specific experimental results are shown in Tables 2 and 3, respectively:

[0086]

[0087]

[0088] The above empirical evaluation on the data sets on five real-world time-effective networks shows that explicit modeling of time effectiveness is a key factor in achieving accurate source positioning. This is particularly evident in comparison with static graph methods, which have inherent limitations and cannot capture the evolution process of network interactions. For example, on the high propagation rate Bitcoin Alpha data set, the Top-1 accuracy of the IVGD method based on graph neural networks is only 0.23, while the accuracy of the time-aware method NHTD of the present application is significantly higher at 0.53.

[0089] As another time-aware method, the performance of the BN model consistently outperforms all static methods, thereby verifying the importance of time modeling. Even so, the NHTD model still performs best among all evaluation models. A significant feature of NHTD is further demonstrated on the Math data set: its Hop-1 accuracy reaches 0.82, exceeding its Top-5 accuracy of 0.62. This phenomenon indicates that NHTD has a unique advantage in topological positioning, which is an ability that other baseline methods do not possess. This superior performance can be attributed to the integration of the MTIC, HLF, and TIFP modules in the present application, which can effectively capture the multi-scale and heterogeneous time-effective patterns present in the data.

[0090] The above merely describes preferred specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any changes or replacements within the technical range disclosed by the embodiments of the present application, which can be easily thought of by those skilled in the art, should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for detecting time-sensitive network propagation sources based on graph neural networks, characterized in that, Includes the following steps: Step S1: Observe and acquire the interaction behavior data of nodes in the target network, determine the final state of the nodes, generate node state information representing the final state of the nodes, and obtain the time-effect graph sequence; The final state of a node includes infected, uninfected, and recovered. Step S2: Calculate the multi-scale time-sensitive interaction context score for each node, combine the time-sensitive graph sequence to calculate the local heterogeneity features of each node, vectorize the node state information to obtain the node state feature vector, and calculate the time information flow potential of each node. Concatenate the multi-scale time-sensitive interaction context score, local heterogeneity features, node state feature vector, and time information flow potential of each node to form the initial feature vector corresponding to each node. The method for calculating the local heterogeneity characteristics of each node is as follows: Step S21: Aggregate the time-lapse graph sequence to obtain a set of static, undirected global networks, as shown in equation (2): （2） In equation (2), G agg V represents the global network; V is the set of all nodes in the network, including all nodes that have appeared during the entire observation period. E agg The global edge set contains all connections that have appeared at least once in any time window; Step S22: Select any node from the set of all nodes in the network, and obtain the neighboring nodes that are directly adjacent to it to form a set of neighboring nodes; Step S23: Determine the final state of the node; Step S24: Traverse each neighbor node in the neighbor node set and obtain the final state of all neighbor nodes respectively; Step S25: Count the number of neighboring nodes whose final state is different from that of the current node in the set of neighboring nodes; Step S26: Calculate the proportion of neighboring nodes whose final state differs from the current node in the set of neighboring nodes, and form a three-dimensional vector from the proportions of each node as the local heterogeneity feature of the current node. The formula for calculating the proportion of neighboring nodes whose final state differs from the current node in the set of neighboring nodes is shown in Equation (3): （3） In equation (3), LHF represents the local heterogeneity characteristic of the node; N (u) represents the set of neighboring nodes of this node; j represents the final state type; The final state is the sum of the uninfected neighboring nodes; The final state is the sum of the infected neighboring nodes; The final state is the sum of the neighboring nodes that have recovered; Step S27: Repeat the above steps until the local heterogeneity characteristics of all nodes in the network are obtained; Step S3: Train the GNN model using the initial feature vectors; Step S4: Use the trained GNN model to predict the propagation source of new propagation events.

2. The method for detecting time-sensitive network propagation sources based on graph neural networks according to claim 1, characterized in that: The interaction behavior data mentioned in step S1 includes the source user, the target user, and the timestamp of the interaction.

3. The method for detecting time-sensitive network propagation sources based on graph neural networks according to claim 1, characterized in that: The specific method for obtaining the time-effect diagram sequence in step S1 is as follows: Step S11: Determine the observation period and divide the observation period into time windows, wherein the observation period is the time from the initial state to when the infection rate reaches the set threshold; Step S12: Determine the interaction behavior of all nodes within each time window and their corresponding timestamps, and generate a static network snapshot representing the network state within that time window; Step S13: Arrange all network snapshot time window sequences to form a time-lapse sequence.

4. The method for detecting time-sensitive network propagation sources based on graph neural networks according to claim 3, characterized in that, Includes the following steps: The method for determining the final state of a node is as follows: traverse the interaction behavior data of all nodes in the network, and define the nodes whose interaction behavior data still contain contamination information throughout the entire observation period as infected nodes. Nodes whose interaction behavior data did not contain contamination information throughout the entire observation period were defined as uninfected nodes. Nodes whose interactive behavior data contained contaminated information throughout the entire observation period, but remained uncontaminated until the end of the observation period, are defined as recovery nodes.

5. The method for detecting time-sensitive network propagation sources based on graph neural networks according to claim 4, characterized in that: The pollution information includes: a set of keywords, specific URL links, and specific media file identifiers; The keyword set consists of words, phrases, or sentences related to the content of the dissemination event. A specific URL link is a link to a known webpage that carries information or content related to the dissemination of an event; Specific media files are identified by the MD5 or SHA-256 hash values ​​of images or videos related to the dissemination of the event.

6. The method for detecting time-sensitive network propagation sources based on graph neural networks according to claim 1, characterized in that: The calculation method for the multi-scale timeliness interaction context score in step S2 is shown in equation (1): （1） In equation (1), MTIC(u) is the multi-scale time-sensitive interaction context score of node u; t The current moment; t max This is the end time of the observation time window; t min This is the start time of the observation time window; d u ( t Let ) represent the static degree centrality of node u at time t; γ It is a non-negative time decay factor.

7. The method for detecting time-sensitive network propagation sources based on graph neural networks according to claim 1, characterized in that: The convolution kernel of the GNN model is an edge-aware graph convolution kernel.

8. The method for detecting time-sensitive network propagation sources based on graph neural networks according to claim 1, characterized in that: The method for calculating the time information flow potential of each node is as follows: Step S2-1: Assume any node n is the source of infection; Step S2-2: Initialize the hypothetical information flow propagated from this node to any other node; Step S2-3: Calculate the cumulative flow of hypothetical information flow propagated by the current node n to any other node u in the overall network structure within any time window; Step S2-4: Calculate the temporal information flow potential ratio of any node u receiving the hypothetical information flow during the propagation process; The calculation method for the time information flow potential ratio of node u is shown in equation (4): （4） In equation (4), TIFP ratio (u) represents the temporal information flow potential ratio of node u; n is the assumed source of infection; U is the set of all uninfected nodes; I is the set of all infected nodes; It is a non-zero constant; t The current moment; t max This is the end time of the observation time window; t min This is the start time of the observation time window; f n (u,t) represents the flow rate of the hypothetical information flow.

Images