Efficient social network aggregation text steganalysis method based on multi-view feature fusion

Abstract

The invention discloses an efficient social network aggregation text steganography analysis method based on multi-view feature fusion, which can efficiently, stably and accurately detect a steganography text packet in a social network environment with text fragmentation and sparse steganography information. Comprising the following steps: multi-view feature extraction: aggregating multiple text contents of the same user into a text packet, and extracting overall content style features, punctuation mode features and emotion distribution features of the aggregated text from different views to make up for information scarcity of a single fragmented text of a social network; multi-scale heterogeneous feature fusion: carrying out dimension unification on the extracted three types of text packet feature vectors with different scales by adopting an encoder, carrying out deep fusion, and obtaining discriminable text packet representation while keeping the lightweight class of the model; and text packet steganography discrimination: multi-instance learning is adopted to train and optimize a detection model based on a packet-level label classification loss function, noise of a single instance is reduced, and efficient and accurate classification of the text packets is realized. According to the method, a new thought and a new method are provided for social network text steganography analysis oriented to steganography information sparseness and text fragmentation, development and innovation of a text steganography analysis technology oriented to the social network are effectively promoted, and development of text steganography analysis from theoretical research of a laboratory to real social network application is promoted.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of network information security, and particularly relates to a social network-oriented aggregated text steganalysis. BACKGROUND

[0002] With the rapid development of network information technology, social media has become the main channel for global cultural dissemination. While social networks provide convenience for people's lifestyle, there is also a hidden communication means of text steganography, and criminals may use text steganography technology to transmit sensitive information, which poses a potential threat to network security and social stability. However, as a countermeasure of text steganography, the existing text steganalysis technology faces many severe challenges in the social network environment where text data is massive and fragmented, and steganographic samples are extremely sparse: (1) low detection efficiency, the existing single text steganalysis method needs to classify each massive text, which consumes a lot of time and computing resources; (2) difficulty in extracting text features, social network texts are short and incoherent, lack complete semantic structure, and are mixed with non-linguistic elements, making the text semantics more complex, and it is difficult to extract sufficient and effective features from a single text for accurate judgment due to fragmentation and interference of non-linguistic elements; (3) sparse steganographic information limits model performance, steganographic samples in real social networks are extremely sparse, which is quite different from the ideal environment of balanced laboratory samples, and the model trained based on the balanced sample dataset cannot effectively exert its detection performance when applied to real social network environment.

[0003] Therefore, there is an urgent need for a new text steganalysis method that can fully utilize the features of social network texts while ensuring computational efficiency, improve the detection accuracy of steganographic texts, and ensure the security of social network information. SUMMARY

[0004] The present application proposes a high-efficiency social network aggregated text steganalysis method based on multi-view feature fusion to address the above challenges. The so-called "high efficiency" means that the model directly extracts quantifiable multi-view features from the aggregated text as a whole, without the need for complex semantic analysis of each text, thereby reducing time and computing overhead and improving model detection efficiency. At the same time, a multi-scale heterogeneous feature fusion component is designed to introduce the least overhead when the model obtains the aggregated text features with recognition, thereby achieving accurate and efficient steganographic discrimination of aggregated texts.

[0005] The present application provides a high-efficiency social network aggregated text steganalysis method based on multi-view feature fusion, comprising the following steps:

[0006] 1) Multi-view feature extraction: From the user dimension, the text content published by the same user in the social network is aggregated into a text package according to the preset capacity, and the text package features are extracted from multiple perspectives to make up for the lack of single fragmented text information. Including content style features, punctuation pattern features and emotion distribution features. Content style features can reflect the overall writing style, word habit, etc. of the text package; punctuation pattern features can reveal the use rules of punctuation in the text package; emotion distribution features can reflect the emotion continuity and volatility of the text sequence. By extracting these multi-view features, the text package can be described from multiple aspects to provide more comprehensive information for subsequent feature fusion and steganography discrimination;

[0007] 2) Multi-scale heterogeneous feature fusion: The encoder is used to unify the dimensions of the multi-view text package feature vectors of different scales, and the multi-modal adaptive gate is used to dynamically adjust the feature weight, to deeply fuse the multi-view features and form a more discriminative text package representation. In the feature fusion process, the invention focuses on keeping the model lightweight to avoid introducing too much computational overhead, while ensuring that the fused text package representation is discriminative enough to provide effective feature support for subsequent steganography discrimination while balancing computational overhead and detection performance;

[0008] 3) Text package steganography discrimination: A multi-instance learning based package level label classification loss function is used to train and optimize the model. The package level label classification loss function can guide the model to learn the key features that distinguish normal text packages and steganography text packages, thereby achieving efficient and accurate steganography discrimination of text packages. Through this training and optimization method, the model can quickly and accurately determine whether there is steganography text in the text package when facing actual social network text packages, providing strong support for information security in social networks.

[0009] Further, the multi-view text package feature extraction in step 1) includes:

[0010] a) Content style feature extraction: According to the number of emoji expressions c emoji , the number of URL links c url , the number of high-frequency word categories c high and the number of low-frequency word categories c low , four types of meta-features, the content style feature vector of the text package is constructed;

[0011] b) Punctuation pattern feature extraction: Count the number of each type of punctuation symbol in the text package to form a punctuation pattern feature vector;

[0012] c) Emotion distribution feature extraction: Use sentiment analysis attacks to calculate the sentiment value of each text in the text package, arrange the sentiment values in the order of the publication time of the text,

[0013] Forming an emotional distribution feature vector.

[0014] Further, the multi-scale heterogeneous feature fusion in step 2) comprises:

[0015] a) uniformizing feature dimensions by using an encoder: three encoders composed of fully connected layers are adopted to uniformly convert the content style feature, the punctuation pattern feature and the emotional distribution feature into hidden layer feature vectors with consistent dimensions (i.e., the output feature dimensions are all l);

[0016] b) performing feature depth fusion by using a multi-modal adaptive gate: the multi-modal adaptive gate takes the unified hidden layer features as input, calculates a displacement vector of the punctuation pattern feature and the emotional distribution feature through the core gating attention mechanism thereof, performs weighted summation of the displacement vector and the content style feature, and performs normalization and dropout operation on the result,

[0017] to obtain a final depth fusion feature vector.

[0018] Further, the text package steganography discrimination in step 3) comprises:

[0019] The feature vector after the depth fusion in step 2) is input into a fully connected layer, and scores of the text package belonging to the normal text package category and the steganographic text package category are obtained by performing weighted summation on the features, and then the category scores are mapped into probabilities through Softmax.

[0020] The method of the present application can be used for aggregated text steganography analysis in a social network with fragmented network texts and sparse steganographic information, effectively solving the problems of traditional single-text-oriented steganography analysis models in terms of detection accuracy and efficiency, and has the following advantages compared with the prior art:

[0021] 1. The present application proposes a social network-oriented aggregated text steganography analysis method, which aggregates multiple texts of the same user into a "text package", selects content style, punctuation pattern and emotional distribution features of the text package for quantitative analysis from three different perspectives, which can not only make up for the information deficiency of single fragmented network text, but also avoid the resource waste caused by the one-by-one classification of single text steganography analysis, and through the identification of steganographic text packages, the distribution area of steganographic texts can be quickly locked in a large-scale social network environment, providing an adaptive detection environment for existing single text steganography analysis methods;

[0022] 2. The present application designs a new multi-scale heterogeneous feature fusion method to integrate features of different scales, which can obtain a text package representation with discriminability while keeping the model lightweight, and balances the detection efficiency and detection accuracy, compared with the simple fusion method of feature splicing or feature addition, the model can learn the correlation between multi-modal features, and enhance the ability of the model to capture subtle steganographic signals.

[0023] 3、The weak supervision loss function of multi-instance learning is used to reduce the noise of a single instance, and the robustness of the aggregated text steganalysis model in the sample imbalance scene is improved. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 The flowchart of the method for performing aggregated text steganalysis of the application.

[0025] Figure 2 The multi-scale heterogeneous feature fusion component framework used in the method of the application.

[0026] Figure 3 The gating attention mechanism diagram in the method of the application.

[0027] Figure 4 The overall model framework diagram of the efficient social network aggregated text steganalysis method based on multi-view feature fusion proposed in the method of the application. DETAILED DESCRIPTION

[0028] In order to make the above features and advantages of the application more obvious and easy to understand, the application will be further described in detail below in combination with specific embodiments and drawings.

[0029] The aggregated text steganalysis method designed by the application can extract multi-view quantifiable features of aggregated text, and use a lightweight feature fusion component to fuse different scale features extracted into text package features with discriminability, which can balance model detection efficiency and accuracy in a large-scale social network environment. The method includes the following three parts: multi-view feature extraction of aggregated text, multi-scale heterogeneous feature fusion, and text package steganographic discrimination. The specific method flow is as shown in Figure 1 The main steps include:

[0030] Step 101, aggregate the text content published by the same user of the social network according to the preset capacity from the user dimension, and extract the content style features, punctuation pattern features and emotion distribution features of the text package, including:

[0031] Select the number of emoji expression usage c emoji , the number of URL links (such as http: / / , https: / / , www., etc.) c url , the number of high-frequency word categories c high , and the number of low-frequency word categories c low These four types of meta-features of aggregated text are used to construct the content style features of the text package, and their calculation methods are as follows:

[0032]

[0033] chigh =|{w|freq(w)>K}|

[0034] c low =|{w|freq(w) <M}|

[0035] Among them, t i represents the i-th text in the text package, n is the total number of tweets in the text package, CountEmoji(t i ) function returns t i The number of emoji expressions in isURL(t i ) function at t i It returns 1 if it contains a valid URL link, otherwise it returns 0. freq(w) is the frequency of word w, and |·| represents the cardinality of the set (i.e., the number of elements). The hyperparameters K and M are the thresholds for high-frequency and low-frequency words, respectively. Combining the above four types of text package meta-features, we can form the content style feature vector f of the text package. c ,Right now:

[0036] f c =(c emoji ,c url ,c high ,c low ).

[0037] By counting the usage of various punctuation marks in the text package, the steganographic signal of the text package from the perspective of punctuation pattern is captured, which is expressed as:

[0038] f p =(p1,p2,…,p m )

[0039] Among them, p i represents the number of the i-th punctuation mark. The punctuation marks counted in the present invention include 32 kinds in total, that is, m=32.

[0040] Use the social network sentiment analysis model to learn the sentiment value of each text in the text package. Then, arrange the sentiment value sequence in the order of the time when the tweets were posted to form the sentiment value feature vector. The calculation formula is as follows:

[0041] s i =SAM(t i )

[0042]

[0043] Among them, s i Indicates the sentiment value of the i-th text content, SAM is the sentiment analysis model (such as VADER), and n is the total number of texts in the text package. Feature vector f sIt reflects the dynamic changes in tweet sentiment and captures the continuity and volatility of users' emotional tendencies.

[0044] Step 102: Use a multi-scale heterogeneous feature fusion component (framework such as Figure 2 As shown in Figure 2, the encoder unifies the dimensions of the multi-view text package feature vectors of different scales and uses a multimodal adaptation gate to perform deep feature fusion, including:

[0045] First, the content style features f c , punctuation pattern features f p , sentiment distribution characteristics f s Construct an encoder E consisting of a fully connected layer network c 、E p and E s , aiming to obtain hidden layer features with consistent feature scale The calculation formula is as follows:

[0046] h c =E c (W c ;f c )

[0047] h p =E p (W p ;f p )

[0048] h s =E s (W s ;f s )

[0049] Where W c 、W p and W s is the learnable weight parameter of the corresponding encoder, and l is the output dimension of the encoder.

[0050] Then, through the gated attention mechanism (such as Figure 3 As shown), calculate the punctuation pattern attention gate vector g p and the sentiment distribution attention gate vector g s , the calculation formula is as follows:

[0051] g p =ReLU(W gp [h d ;h p ]+b p )

[0052] g s =ReLU(W gs [h d ;hs ]+b s )

[0053] where W gs and W gp are the weight matrices of sentiment distribution and punctuation pattern respectively, b s and b p are the corresponding bias vectors, and ReLU is a nonlinear activation function.

[0054] Then, the sentiment distribution feature and the symbol pattern feature are multiplied by the respective gating vectors and fused to obtain a displacement vector H:

[0055] H = g s ·(W s h s )+g p ·(W p h p )+B

[0056] where W s and W p are the corresponding weight matrices, and B is the bias vector.

[0057] Finally, the obtained displacement vector H is weighted summed with the content style feature h c , and the result is subjected to layer normalization and dropout operation to obtain the final deep fused feature vector

[0058]

[0059] where ||·||2 denotes the L2 norm. In order to keep the influence of H within an ideal range, we use a scaling factor a to modulate it, and the calculation formula is as follows:

[0060]

[0061] where b denotes a hyperparameter selected through a cross-validation process.

[0062] After the fused features are input into the fully connected layer, the Softmax classifier is used to efficiently and accurately steganalysis the text package, and the probability calculation formula is as follows:

[0063]

[0064] where W and b are the weight matrix and bias vector respectively. Softmax(·) is an activation function used to determine whether the aggregated text is a stego text package.

[0065] The overall model framework diagram of the present application is shown in Figure 4 The present application is compared with five advanced baseline methods on the Twitter dataset, and the detailed description of each baseline method is shown in Table 1.

[0066] Table 1 Detailed description of baseline methods

[0067]

[0068] In order to evaluate the performance of the method of the present application in detecting different types of steganographic text packets, steganographic text packets with different steganographic text types (AC, VLC, ADG and MixALG respectively) and different steganographic text proportions (10%, 30% and 50% respectively) are selected. In order to evaluate the detection performance of the method of the present application when the steganographic information is sparse, different proportions of steganographic packets (i.e. RoS is 1%, 10%, 30% and 50% respectively) are set to simulate different steganographic sparsity detection scenarios. Since F1 takes into account the accuracy and recall of the classification model, F1 is used as the evaluation index. All experimental codes are written based on PyTorch and executed on a GeForce RTX 3080 GPU with 10 Gb graphics memory, and other parameters related to the experiment are shown in Table 2.

[0069] Table 2 Experimental parameter settings

[0070]

[0071] Table 3 Detection F1 value results of each method in different scenarios

[0072]

[0073] The F1 values of each method in different scenarios are tested, and the experimental results are shown in Table 3. It can be seen that the baseline method can only achieve an ideal F1 value when RoS approaches 50%. This is because the baseline method needs to be based on the premise that the positive and negative samples in the detection environment are balanced. When RoS approaches 50%, the premise is met, and the detection performance is stable. However, as RoS decreases, the detection performance of the baseline method decreases sharply. Specifically, in the extreme imbalance scenario of RoS = 1%, the F1 value of some baseline methods is even less than 2%, indicating that they perform poorly in the real social network environment with highly imbalanced sample distribution. In addition, the real fragmented network text in the data set makes the baseline method have a high misjudgment rate for a single text, which further affects the accurate discrimination of the text package. In contrast, the method proposed in the present application can maintain an F1 value of more than 90% in almost all simulated scenarios. Even in the detection scenario where RoS is only 1% and SR contains only 10% of the steganographic information, it still shows significantly better detection performance than the baseline method. This is due to the effective extraction and fusion of the text package features in the present application, which can learn more recognizable steganographic features, thereby making more accurate classification decisions.

[0074] Table 4 Time efficiency and detection F1 value experimental results of each method

[0075]

[0076] The average time consumption and F1 value of each method in the training and testing process under all detection scenarios are compared, and the experimental results are shown in Table 4. It can be seen that the current mainstream single text detection baseline method has significant limitations in the trade-off between detection accuracy and timeliness. Specifically, ATT spends too much time on feature extraction and in-depth analysis in order to improve detection accuracy, thereby reducing detection efficiency. FCN and CSW use simple network structures for feature processing, and their running speed is significantly faster than that of ATT, but their detection accuracy is significantly limited. RNN is unsatisfactory in both detection efficiency and accuracy. Compared with ATT, which has the highest detection accuracy among the baseline methods, the proposed ATS-MPFF model achieves an 8.9% improvement in detection accuracy, while the detection time is reduced by 99.7%. Compared with FCN, which has the fastest processing speed among the baseline methods, the detection time of the proposed model is only 10.1% of that of FCN, and the F1 value is increased by 45.9%. The experimental results show that the proposed method can exhibit excellent performance in both detection accuracy and timeliness, the two key evaluation indicators. The main reason is that the proposed method does not need to deeply analyze the semantic features of single text, but focuses on accurately extracting and aggregating the meta-features with obvious hidden traces under multi-perspective text, and through an efficient feature fusion strategy, it constructs discriminative text bag features, thereby greatly reducing the time and computational resource consumption while ensuring detection accuracy.

[0077] The above merely describes preferred embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An efficient social network aggregate text steganalysis method based on multi-view feature fusion, characterized by: include: A. Multi-perspective feature extraction of aggregated text: Aggregate a preset amount of text into text packages and extract package-level features from different perspectives to make up for the scarcity of individual fragmented text information on social networks. This includes content style features, punctuation pattern features, and sentiment distribution features. B. Multi-scale heterogeneous feature fusion: An encoder is used to unify the dimensions of multi-view text bag feature vectors at different scales, and a multimodal adaptation gate is used to perform deep feature fusion. This method obtains discriminative text bag representations while maintaining a lightweight model, achieving a trade-off between computational overhead and detection performance. C. Text package steganography identification: After the fused features are input into the fully connected layer, the Softmax classifier is used to perform efficient and accurate steganography identification on the text package.

2. The efficient social network aggregate text steganalysis method based on multi-view feature fusion according to claim 1 is characterized in that: Step A further comprises the following steps: A1. Extract the content style features of text packages to describe the vocabulary and non-words (such as hyperlinks, emoji expressions, etc.) used by social network users when creating text content. Defined as: f c =(c emoji ,c url ,c high ,c low ) Among them, c emoji 、c url 、c high and c low Respectively represent the number of emoji expressions used, the number of URL links, the number of high-frequency word types, and the number of low-frequency word types in the aggregated text; A2. Extract punctuation pattern features from text packages to describe the personalized usage patterns of punctuation marks (e.g., .; !@#￥&, etc.) by social network users when creating text content. This is defined as: f p =(p1,p2,…,p m ) Among them, p i represents the number of punctuation marks of type i; A3. Extract the sentiment distribution features of text packages to describe the continuity and volatility of sentiment changes in text content posted by social network users. Defined as: Where n is the number of texts in the text package, s i Indicates the sentiment value of the i-th text.

3. The efficient social network aggregate text steganalysis method based on multi-view feature fusion according to claim 1 is characterized in that: Step B further comprises the following steps: B1. Using an encoder composed of a fully connected layer network, the three types of heterogeneous feature vectors extracted (content style features, punctuation pattern features, and sentiment distribution features) are dimensionalized to obtain corresponding hidden layer features with consistent feature scales. B2. Use the Multimodal Adaptation Gate (MAG) technology to deeply fuse the hidden layer features obtained in step B1 to obtain the final text package features.

4. The efficient social network aggregate text steganalysis method based on multi-view feature fusion according to claim 1 is characterized in that: Step C further comprises the following steps: C1, using a fully connected layer to map the fused text bag feature representation to the output category; C2. Convert the output of step C1 into the probability distribution of text package categories through the Softmax activation function to complete the binary classification task of the text package (normal text package or steganographic text package).

Images