A network behavior analysis method, apparatus, device and medium

Abstract

The application provides a network behavior analysis method and device, equipment and medium, and relates to the technical field of public opinion analysis. The method comprises the following steps: acquiring all post data in a preset time interval after a starting time; preprocessing the all post data in multiple dimensions to obtain input data based on time steps; processing the input data through a bidirectional long short-term memory network to obtain time sequence high-order feature representation; performing batch normalization on the time sequence high-order feature representation to obtain normalized time sequence high-order feature representation; obtaining an output vector based on the normalized time sequence high-order feature representation through a self-attention mechanism; processing the output vector through a first full connection layer to obtain a behavior analysis result; and processing the output vector through a second full connection layer to obtain a post volume prediction result of a next time step, which is used for analyzing the network behavior of a group of users to obtain a more accurate analysis result.

Description

Technical Field

[0001] This invention relates to the field of public opinion analysis technology, and more specifically, to a method, apparatus, device, and medium for analyzing online behavior. Background Technology

[0002] With the continuous development of the Internet, the number of online communities and the amount of data are gradually increasing. Online communities provide and disseminate data in a convenient, fast, and random manner, making it easy for netizens to express their opinions. However, not all of the massive amount of information is useful; there is a lot of redundant and harmful information.

[0003] In related technologies, users are the target of analysis, and their behavioral patterns are analyzed to identify abnormal accounts. However, users with abnormal behavior usually act collectively, and analyzing the behavior of individual users results in a smaller amount of data, greater difficulty in data collection, and correspondingly greater difficulty in analysis. Summary of the Invention

[0004] The problem addressed by this invention is how to analyze the network behavior of a group of users to obtain more accurate analysis results.

[0005] To address the above problems, the present invention provides a network behavior analysis method, apparatus, device, and medium.

[0006] In a first aspect, the present invention provides a network behavior analysis method, comprising:

[0007] All posting data within a preset time interval after the start time are obtained, and the posting data is preprocessed in multiple dimensions to obtain input data based on time steps. The multiple dimensions include at least one of the following: time dimension, main theme outlier dimension, main theme proportion dimension, posting region dimension, platform dimension, posting volume dimension, and change rate dimension.

[0008] The input data is processed by a bidirectional long short-term memory network to obtain a temporal high-order feature representation;

[0009] The time-series high-order feature representation is batch normalized to obtain a normalized time-series high-order feature representation. An output vector is obtained based on the normalized time-series high-order feature representation through a self-attention mechanism.

[0010] The output vector is processed by the first fully connected layer to obtain the behavior analysis result, and the output vector is processed by the second fully connected layer to obtain the posting volume prediction result for the next time step.

[0011] Optionally, the step of acquiring all published data within a preset time interval after the start time, and preprocessing the published data in multiple dimensions to obtain time-step-based input data includes:

[0012] The preset time interval is divided according to the time step, and the time is aligned backward according to the time step, starting from the first moment of the target event, as the starting moment;

[0013] Using the time step as the unit, the publication time of the published data is normalized and used as time dimension data.

[0014] Optionally, the step of obtaining all published data within a preset time interval after the start time, and preprocessing the published data in multiple dimensions to obtain input data based on time steps further includes:

[0015] An embedding vector is generated for each of the aforementioned posting data using a pre-trained language model;

[0016] Cluster all the embedded vectors within the preset time interval to obtain semantic clusters;

[0017] The average distance between all the published data at the stated time step and the nearest cluster center is determined as the main outlier dimension data.

[0018] Optionally, the step of obtaining all published data within a preset time interval after the start time, and preprocessing the published data in multiple dimensions to obtain input data based on time steps further includes:

[0019] Using a large language model, the main idea analysis is performed on all the published data at the time step, and the proportion of the target main idea in all the published data at the time step is used as the main idea proportion data.

[0020] The publication location of all the published data at the specified time step is used as the publication region dimension data;

[0021] The publishing platform of the published data at the time step is taken as the platform dimension data;

[0022] The data volume of the published data at the time step is normalized and used as the data of the published volume dimension.

[0023] The rate of change of the published data at the specified time step compared to the previous time step is used as the rate of change dimension data.

[0024] Optionally, the step of processing the input data through a bidirectional long short-term memory network to obtain a temporal high-order feature representation includes:

[0025] The input data is processed by a first bidirectional long short-term memory network to obtain a low-order feature representation at the time step;

[0026] The higher-order temporal feature representation is obtained by processing the lower-order feature representation at the time step through a second bidirectional long short-term memory network.

[0027] Optionally, the temporal higher-order feature representation includes a feature dimension; the step of batch normalizing the temporal higher-order feature representation to obtain a normalized temporal higher-order feature representation, and obtaining an output vector based on the normalized temporal higher-order feature representation through a self-attention mechanism, includes:

[0028] Each of the aforementioned feature dimensions is normalized over the entire batch and all the aforementioned time steps to obtain the normalized temporal high-order feature representation;

[0029] The normalized temporal high-order feature representation is extracted using a self-attention mechanism and a preset extraction method to obtain the output vector. The preset extraction method includes at least one of extracting high-order features at a preset time step, global average pooling, and weighted summation.

[0030] Optionally, the step of processing the output vector through a first fully connected layer to obtain the behavioral analysis result, and processing the output vector through a second fully connected layer to obtain the posting volume prediction result for the next time step, includes:

[0031] The output vector is input to the first fully connected layer, and the behavior analysis result is obtained through the behavior analysis binary classification head.

[0032] The output vector is input to the second fully connected layer, and the prediction result of the number of posts at the next time step is obtained through the post data volume regression head.

[0033] In a second aspect, the present invention provides a network behavior analysis device, comprising:

[0034] The preprocessing module is used to acquire all posting data within a preset time interval after the start time, and to preprocess all posting data in multiple dimensions to obtain input data based on time steps. The multiple dimensions include at least one of the following: time dimension, main theme outlier dimension, main theme proportion dimension, posting region dimension, platform dimension, posting volume dimension, and change rate dimension.

[0035] A bidirectional long short-term memory network module is used to process the input data through a bidirectional long short-term memory network to obtain a temporal high-order feature representation.

[0036] The batch normalization module is used to perform batch normalization on the temporal high-order feature representation to obtain a normalized temporal high-order feature representation.

[0037] The self-attention module is used to obtain the output vector based on the normalized temporal high-order feature representation through the self-attention mechanism;

[0038] The output module is used to process the output vector through a first fully connected layer to obtain the behavior analysis result, and to process the output vector through a second fully connected layer to obtain the posting volume prediction result for the next time step.

[0039] Thirdly, the present invention provides an electronic device, including a memory and a processor;

[0040] The memory is used to store computer programs;

[0041] The processor is configured to implement the network behavior analysis method as described in the first aspect when executing the computer program.

[0042] Fourthly, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the network behavior analysis method as described in the first aspect.

[0043] The beneficial effects of the network behavior analysis method of the present invention are:

[0044] This approach acquires group posting data within preset time intervals, ignoring individual user behavior and focusing on overall statistical characteristics within each time step. The analysis unit shifts from individual users to the aggregation of group behavior within a time step, avoiding reliance on highly sensitive information such as user identity and historical trajectories. This reduces the difficulty of data collection and alignment, and improves applicability across multiple platforms and anonymized scenarios. Through multi-dimensional preprocessing, a group behavior profile is constructed from spatiotemporal, content, media, and scale perspectives, enhancing the ability to identify abnormal patterns. A bidirectional long short-term memory (LSTM) network is used to process the input sequence, generating high-order temporal feature representations. This allows the representation at each time step to integrate the full window context, more completely reconstructing the dynamic evolution path of group behavior and improving the modeling ability for complex collaborative behaviors. Batch normalization of the LSM output is performed, and feature representations are processed based on a self-attention mechanism to eliminate the offset of feature distribution between different batches and time steps, making the hidden representation more stable and improving training robustness. By sharing an output vector through two independent fully connected layers, the behavioral analysis results and the post volume prediction results are output respectively. Since online troll activities are usually accompanied by an abnormally high post volume, the two tasks are strongly correlated. Sharing the underlying temporal semantics can enhance each other. Independent task heads avoid target conflicts, retain the discriminative characteristics of each task, and improve the comprehensiveness and reliability of identifying abnormal group behavior. Attached Figure Description

[0045] Figure 1 This is a flowchart illustrating the network behavior analysis method according to an embodiment of the present invention;

[0046] Figure 2 This is a flowchart of the network behavior analysis method according to an embodiment of the present invention;

[0047] Figure 3 This is an example diagram of a network behavior analysis device according to an embodiment of the present invention;

[0048] Figure 4 This is an example diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0049] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Although some embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present invention. It should be understood that the accompanying drawings and embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of protection of the present invention.

[0050] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0051] The term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to"; the term "based on" means "at least partially based on"; the term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments"; and the term "optionally" means "optional embodiments". Definitions of other terms will be given in the following description. It should be noted that the concepts of "first," "second," etc., mentioned in this invention are used only to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies.

[0052] It should be noted that the terms "a" and "a plurality of" used in this invention are illustrative rather than restrictive. Those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0053] The names of the messages or information exchanged between the multiple devices in the embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0054] like Figure 1 As shown in the figure, an embodiment of the present invention provides a network behavior analysis method, including:

[0055] Step S100: Obtain all posting data within a preset time interval after the start time, and preprocess all posting data in multiple dimensions to obtain input data based on time steps. The multiple dimensions include at least one of the following: time dimension, main theme outlier dimension, main theme proportion dimension, posting region dimension, platform dimension, posting volume dimension, and change rate dimension.

[0056] A preset time interval represents a fixed duration window extending forward from a specific starting point, such as 2 hours, 4 hours, or 24 hours. This interval is used to limit the data range for analysis, allowing the model to focus on time-sensitive public opinion dynamics. Its function is to define the time boundary of modeling and avoid interference from historical noise; its advantage is that it supports continuous monitoring using a sliding window, adapting to the rhythm of public opinion evolution.

[0057] The data on published content represents the text content and its associated metadata posted by users on various online platforms within a preset time period, including the posting time, posting region, platform type, and user identifier. This data serves as the primary basis for public opinion analysis.

[0058] Preprocessing across multiple dimensions involves structurally transforming the original published data according to different semantic or statistical perspectives to form computable numerical features.

[0059] The time dimension maps the posting time to a normalized time point. For example, using 5-minute time steps, a day is divided into 288 time slots, with 00:00 corresponding to 0 and 00:05 corresponding to 1 / 288. This dimension depicts the temporal distribution patterns of public opinion activities. The theme outlier dimension quantifies the degree of anomaly of semantic content relative to the overall picture. The theme proportion dimension reflects the concentration or dispersion of public opinion focus, identifying public opinion structures dominated by a single issue or with multiple viewpoints. The posting region dimension reveals the geographical diffusion characteristics of public opinion, identifying regional events or cross-regional collaborative behaviors. The platform dimension depicts the dissemination path of information across different media, revealing cross-platform collaborative hype or information cocoons on a single platform. The posting volume dimension measures the heat of public opinion, providing intuitive scale indicators for easy horizontal comparison. The rate of change dimension reflects the speed of public opinion development, enabling early identification of sudden growth trends and improving early warning sensitivity.

[0060] For example, the input data is in the form of a time series matrix, such as [B, T, F], where B represents batch_size, which is used to represent the batch size of the published data, T represents the number of time steps (e.g., 288), and F represents the feature dimension (determined by concatenating the features).

[0061] Step S200: The input data is processed through a bidirectional long short-term memory network to obtain a temporal high-order feature representation.

[0062] Bidirectional Long Short-Term Memory (BiLSTM) networks represent recurrent neural network structures composed of a forward Long Short-Term Memory network and a backward Long Short-Term Memory network running in parallel. The forward network processes the input sequence in chronological order, capturing historical context information; the backward network processes the input sequence in reverse chronological order, capturing future context information. The outputs of both networks are concatenated at each time step to form a hidden state that integrates bidirectional temporal dependencies. The advantage of this structure is that it simultaneously utilizes contextual information before and after the current moment in the time series to jointly model local dynamics and global trends; compared to unidirectional structures, it can more comprehensively characterize the turning points, suddenness, and persistence characteristics of public opinion evolution.

[0063] The input data serves as the input to the bidirectional long short-term memory network, providing structured time-series observation data. Through multi-dimensional fusion, the bidirectional long short-term memory network can understand public opinion status from multiple perspectives.

[0064] Temporal high-order feature representation refers to the hidden state vector corresponding to each time step output by a bidirectional long short-term memory network. Its dimension is determined by the size of the network's hidden layers and its bidirectional structure. This representation is not a simple combination of the original features, but rather an abstract semantic encoding formed after multiple layers of nonlinear transformation and gating mechanisms. Its role is to transform the original statistical features into a semantic embedding with temporal awareness, explicitly encoding the evolution pattern of public opinion in the time dimension. Its advantage is that it can effectively capture complex dependencies across time steps, such as collaborative behavioral patterns of geographical concentration, platform diffusion, and theme shift, providing a highly discriminative and robust feature foundation for subsequent tasks.

[0065] By using all posting data within a time step as the basic data processing unit, ignoring individual user behavior patterns, and analyzing the behavior patterns of all posting data under different dimensions within the time step, the difficulty of data collection is reduced, and abnormal posting situations within the time step can be better summarized and analyzed.

[0066] Step S300: Batch normalize the temporal high-order feature representation to obtain normalized temporal high-order feature representation, and obtain the output vector based on the normalized temporal high-order feature representation through a self-attention mechanism.

[0067] Batch normalization, during training, standardizes the temporal high-order feature representations of all samples within a batch along the feature dimension, making their mean approach zero and variance approach 1. Its function is to alleviate the internal covariate shift problem during the training of bidirectional long short-term memory (BSL-RM) networks, stabilize the hidden layer distribution, accelerate the convergence speed of BSL-RM networks, improve training stability, and to some extent, achieve a regularization effect, thereby enhancing generalization ability.

[0068] Normalized temporal high-order feature representation refers to the temporal high-order feature representation after batch normalization. Its shape is consistent with the original representation, still in the form of a time step sequence, but the numerical distribution of each feature dimension is more balanced. The role of this representation is to provide scale-consistent input for subsequent attention mechanisms, avoiding certain dimensions from dominating the calculation due to excessively large values. Its advantage is that it makes the model less sensitive to feature dimensions, improving the rationality and robustness of attention weight allocation.

[0069] Self-attention is a sequence modeling method based on a query-key-value structure. It dynamically weights and aggregates information by calculating the correlation scores between time steps within a sequence, thereby highlighting time segments that are more discriminative for the current task. This mechanism automatically identifies key moments such as public opinion outbursts or turning points, enhancing their influence in the overall representation. It achieves adaptive focusing on important contexts without relying on fixed windows or manual rules, improving the model's adaptability to heterogeneous public opinion patterns.

[0070] The output vector represents the final feature vector generated after the self-attention mechanism processes the normalized temporal high-order feature representation. It is usually taken from the last time step of the sequence or obtained through weighted aggregation and is used for subsequent multi-task prediction.

[0071] Step S400: Process the output vector through the first fully connected layer to obtain the behavior analysis result, and process the output vector through the second fully connected layer to obtain the prediction result of the number of posts in the next time step.

[0072] Following the self-attention mechanism, at least two parallel fully connected layers are included. The first fully connected layer is used for behavior analysis based on the output features, and the second fully connected layer is used for prediction of the number of posts in the next time step based on the output features.

[0073] In this embodiment, group posting data is acquired in units of preset time intervals, ignoring individual user behavior and focusing on overall statistical characteristics within a time step. The analysis unit is transformed from individual users to the aggregation of group behavior within a time step, avoiding reliance on highly sensitive or difficult-to-obtain information such as user identity and historical trajectories. This reduces the difficulty of data collection and alignment, and improves the applicability of the method in multi-platform and anonymized scenarios. The statistical patterns of group behavior within the time window better reflect the true trend of public opinion, rather than interference from individual noisy users. This facilitates the capture of abnormal group behavior patterns at a macro level, improving the representativeness and stability of the analysis results. Multi-dimensional preprocessing includes time, outlier themes, theme proportion, region, platform, posting volume, and rate of change. These multi-dimensional features, from the perspectives of time, content, media, and scale, jointly construct a group behavior profile, enhancing the ability to identify abnormal postings. A Bidirectional Long Short-Term Memory (BiLSTM) network is used to process the input sequence, generating high-order temporal feature representations. The BiLSTM network simultaneously models historical trends and subsequent evolution, integrating the full-window context into the representation at each time step. This more completely reconstructs the dynamic evolution path of group behavior and enhances the modeling ability for complex collaborative behaviors. The output of the BiLSTM network is batch-normalized and processed using a self-attention mechanism to eliminate the bias in feature distribution between different batches and time steps. This makes the hidden representation more stable, prevents certain dimensions from dominating subsequent calculations due to excessively large numerical values, ensures balanced contributions from all dimensions, accelerates model convergence, and improves training robustness, especially in long sequences or multi-task scenarios. It provides high-quality, scale-consistent input for subsequent attention mechanisms, ensuring the effective transmission and utilization of group behavior features. Since online troll activities are usually accompanied by an abnormally high volume of posts, the two tasks are strongly correlated. The two independent fully connected layers share the output vector and output the behavior analysis results and post volume prediction results respectively. The two independent fully connected layers avoid target conflicts, retain the discriminative characteristics of their respective tasks, and output the behavior analysis results and post volume prediction results, thereby improving the comprehensiveness and reliability of identifying abnormal group behavior.

[0074] Optionally, the step of acquiring all published data within a preset time interval after the start time, and preprocessing the published data in multiple dimensions to obtain time-step-based input data includes:

[0075] The preset time interval is divided according to the time step, and the time is aligned backward according to the time step, starting from the first moment of the target event, as the starting moment;

[0076] Using the time step as the unit, the publication time of the published data is normalized and used as time dimension data.

[0077] In one embodiment, the main theme of public opinion content is summarized, and time slices are divided according to a preset step size, starting from the publication time of the first article on the target public opinion event. For example, if the preset time step is 5 minutes and the publication time of the first article is 2025-08-28 14:01:23, then the starting time of t0 is 2025-08-28 14:00:00. The preset time interval is set according to the event; if the event lasts for a longer period, the preset time interval is set relatively longer, and if the event lasts for a shorter period, the preset time interval is set relatively shorter.

[0078] The posting time of the data is normalized using time steps as the unit. For example, according to the time point defined by 24-hour time, a value is set every 5 minutes and then normalized. The value input into the model at 00:00:00 is 0, and the value at 00:05:00 is 1 / 288, which is used as the time dimension data of the posting data.

[0079] Optionally, the step of obtaining all published data within a preset time interval after the start time, and preprocessing the published data in multiple dimensions to obtain input data based on time steps further includes:

[0080] An embedding vector is generated for each of the aforementioned posting data using a pre-trained language model;

[0081] Cluster all the embedded vectors within the preset time interval to obtain semantic clusters;

[0082] The average distance between all the published data at the stated time step and the nearest cluster center is determined as the main outlier dimension data.

[0083] In one embodiment, the degree of anomalousness of the main idea of ​​the textual information within a time step relative to the entire preset time interval is quantified. A pre-trained language model (Sentence-BERT) generates a uniform-dimensional embedding vector for each posting data, such as a 768-dimensional vector. All embedding vectors within the preset time interval are clustered (K-Means), with K ranging from 5 to 10, to identify the main semantic clusters. After identifying the main semantic clusters, the average distance between the corresponding embedding vector of all posting data at each time step and the nearest cluster center is determined, and this average distance is used as the outlier degree.

[0084] Optionally, the step of obtaining all published data within a preset time interval after the start time, and preprocessing the published data in multiple dimensions to obtain input data based on time steps further includes:

[0085] Using a large language model, the main idea analysis is performed on all the published data at the time step, and the proportion of the target main idea in all the published data at the time step is used as the main idea proportion data.

[0086] The publication location of all the published data at the specified time step is used as the publication region dimension data;

[0087] The publishing platform of the published data at the time step is taken as the platform dimension data;

[0088] The data volume of the published data at the time step is normalized and used as the data of the published volume dimension.

[0089] The rate of change of the published data at the specified time step compared to the previous time step is used as the rate of change dimension data.

[0090] In one embodiment, the theme proportion data represents the proportion of posts published within a time step that reflect the theme's concentration.

[0091] The data on the geographical distribution of the articles is compiled by calculating the proportion of the time steps and the location of the article, forming multi-dimensional data. The data dimensions are consistent with the number of administrative divisions.

[0092] Platform-level data is divided according to the online posting platforms, and the proportion of the public opinion field of the posting within the calculation time step is used to form multi-dimensional data. The data dimensions are consistent with the number of online platforms.

[0093] The post volume data is obtained by calculating the total number of posts within a time step and normalizing it according to the maximum range, for example, the maximum range is 1 million.

[0094] The posting change rate dimension data represents the rate of change in the number of posts at the current time step compared to the previous time step.

[0095] Input data example: [

[0097] 0.069444444444444, # Time dimension data: corresponding time 01:40:00;

[0098] 0.523, # Outlier dimension data;

[0099] 0.817, # Main theme percentage data;

[0100] 0.0, 0.01, 0.09, 0.11, 0.12, 0.13, 0.0, 0.0, 0.0, 0.54, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, # Geographical distribution data of published articles, 35 dimensions;

[0101] 0.12, 0.05, 0.23, 0.15, 0.09, 0.36, # Platform-level data, 6 dimensions;

[0102] 0.0012, # Data for the number of posts, 1200;

[0103] 0.1 # Data on posting change rate, increased by 10%; ]

[0105] When the batch size is 1200, the number of time steps is 288, and the feature dimension is 46, the input data is represented as a tensor of [1200, 288, 46].

[0106] Optionally, such as Figure 2 As shown, the process of processing the input data through a bidirectional long short-term memory network to obtain a temporal high-order feature representation includes:

[0107] The input data is processed by a first bidirectional long short-term memory network to obtain a low-order feature representation at the time step;

[0108] The higher-order temporal feature representation is obtained by processing the lower-order feature representation at the time step through a second bidirectional long short-term memory network.

[0109] In one embodiment, a first bidirectional long short-term memory network receives input data and processes it in parallel along the forward and backward time dimensions to generate a low-order feature representation for each time step. This low-order feature representation incorporates bidirectional contextual information of the original input sequence within a local time range, and initially abstracts the basic temporal pattern.

[0110] The second bidirectional long short-term memory network takes low-order feature representations as input and performs bidirectional temporal modeling again, outputting high-order temporal feature representations for each time step. This representation further captures complex dependencies and global evolutionary trends across time steps based on the low-order features, forming a deeper semantic encoding of the dynamics of group behavior.

[0111] The two-tiered structure enables hierarchical temporal feature learning. The first layer extracts local, basic behavioral patterns, while the second layer combines these patterns to identify complex, higher-order collaborative behavioral features. The key design choice of stacking bidirectional long short-term memory (BSSM) networks instead of a single layer is crucial to this model architecture. By stacking multiple BSSM networks, the model can learn temporal patterns at different levels of abstraction. The first BSSM network captures the most microscopic and localized behavioral changes, such as daily fluctuations in comment volume; the second BSSM network, based on these lower-level representations, learns more macroscopic and abstract patterns, such as periodic surges in activity over weekends or behavioral shifts after specific public opinion events. This hierarchical feature learning capability allows the model to more comprehensively understand the inherent patterns in post volume, thereby improving its detection accuracy in complex scenarios.

[0112] The outputs of the first and second bidirectional long short-term memory networks have the same shape, represented as [B, T, H*2], where B represents the batch size, T represents the number of time steps, and H represents the hidden size. Since it is a bidirectional long short-term memory network, the dimension of H needs to be multiplied by 2.

[0113] Optionally, the temporal higher-order feature representation includes a feature dimension; the step of batch normalizing the temporal higher-order feature representation to obtain a normalized temporal higher-order feature representation, and obtaining an output vector based on the normalized temporal higher-order feature representation through a self-attention mechanism, includes:

[0114] Each of the aforementioned feature dimensions is normalized over the entire batch and all the aforementioned time steps to obtain the normalized temporal high-order feature representation;

[0115] The normalized temporal high-order feature representation is extracted using a self-attention mechanism and a preset extraction method to obtain the output vector. The preset extraction method includes at least one of extracting high-order features at a preset time step, global average pooling, and weighted summation.

[0116] In one embodiment, batch normalization (Batch Norm) can significantly accelerate the model training process, improve convergence speed, reduce sensitivity to parameter initialization, and effectively handle internal covariate offset issues, thereby improving training stability.

[0117] The self-attention mechanism is used to model the internal correlation of normalized temporal high-order feature representations. By calculating the attention weights between each time step, it dynamically measures the contribution of different time segments to the overall semantics. A single output vector is generated from the attention output sequence. Preset extraction methods include at least one of the following: extracting high-order features at preset time steps, global average pooling, and weighted summation. Extracting high-order features at preset time steps is suitable for scenarios where future trends are predicted based on the latest state; global average pooling is suitable for situations where overall behavioral patterns are considered; and weighted summation fuses the time steps according to the attention weights, highlighting key segments.

[0118] Batch normalization operates on the feature dimension H*2, normalizing each feature across the entire batch B and all time steps T. This requires transposing [B, T, H*2] to [B, H*2, T] before batch normalization, and then transposing the output back to the form [B, T, H*2]. However, in the output matrix, each time step has a normalized context-aware feature vector of dimension H*2, which integrates bidirectional temporal information from the entire time step.

[0119] The self-attention mechanism performs internal weighting on the [B, T, H*2] sequence and processes it using a preset extraction method. The output is also in the form of [B, T, H*2], which is used to automatically determine the more important time steps and construct the output of the self-attention mechanism, i.e., the output vector [B, H*2].

[0120] Optionally, such as Figure 2 As shown, the process of processing the output vector through a first fully connected layer to obtain the behavioral analysis result, and then processing the output vector through a second fully connected layer to obtain the posting volume prediction result for the next time step, includes:

[0121] The output vector is input to the first fully connected layer, and the behavior analysis result is obtained through the behavior analysis binary classification head.

[0122] The output vector is input to the second fully connected layer, and the prediction result of the number of posts at the next time step is obtained through the post data volume regression head.

[0123] The output vector is fed into two independent fully connected layers to generate behavioral analysis results and post volume prediction results for the next time step. The output vector is a high-dimensional feature vector obtained after processing by a self-attention mechanism, which is used to characterize the overall state of the user group's network behavior in the current time step.

[0124] In one embodiment, the first fully connected layer includes a behavior analysis binary classification head, the structure of which consists of one or more linear transformation layers and nonlinear activation functions, used to map the output vector to a single numerical value, and convert it into a binary classification value between 0 and 1 through the activation function as the behavior analysis result. When the classification value is 0, it indicates that the group behavior is not abnormal, and when the classification value is 1, it indicates that the group behavior is abnormal, and the posting data may be posted by online trolls.

[0125] The second fully connected layer contains a regression head for the amount of posts published. Its structure also consists of linear transformations and nonlinear activations, used to map the output vector to real values, serving as the prediction result for the amount of posts published in the next time step. This result reflects the expected scale of posts published in future time steps, enabling a quantitative prediction of public opinion trends.

[0126] Two fully connected layers share the same output vector but learn their parameters independently, allowing the behavior discrimination and quantity prediction tasks to be optimized separately based on shared semantics. This approach leverages the inherent correlation between online troll activities and abnormal posting volume to achieve multi-task collaboration while avoiding interference between task objectives, thus improving the comprehensiveness and reliability of identifying abnormal group behavior.

[0127] like Figure 3 As shown, an embodiment of the present invention provides a network behavior analysis device, comprising:

[0128] The preprocessing module is used to acquire all posting data within a preset time interval after the start time, and to preprocess all posting data in multiple dimensions to obtain input data based on time steps. The multiple dimensions include at least one of the following: time dimension, main theme outlier dimension, main theme proportion dimension, posting region dimension, platform dimension, posting volume dimension, and change rate dimension.

[0129] A bidirectional long short-term memory network module is used to process the input data through a bidirectional long short-term memory network to obtain a temporal high-order feature representation.

[0130] The batch normalization module is used to perform batch normalization on the temporal high-order feature representation to obtain a normalized temporal high-order feature representation.

[0131] The self-attention module is used to obtain the output vector based on the normalized temporal high-order feature representation through the self-attention mechanism;

[0132] The output module is used to process the output vector through a first fully connected layer to obtain the behavior analysis result, and to process the output vector through a second fully connected layer to obtain the posting volume prediction result for the next time step.

[0133] like Figure 4As shown, an electronic device 400 provided in this embodiment of the invention includes a memory 410 and a processor 420; the memory 410 is used to store a computer program; the processor 420 is used to implement the network behavior analysis method as described above when the computer program is executed.

[0134] Alternatively, an electronic device 400 includes a memory 410 and a processor 420 coupled to the memory 410; the memory 410 is configured to store a computer program; and the processor 420 is configured to perform the following operations when the computer program is executed:

[0135] All posting data within a preset time interval after the start time are obtained, and the posting data is preprocessed in multiple dimensions to obtain input data based on time steps. The multiple dimensions include at least one of the following: time dimension, main theme outlier dimension, main theme proportion dimension, posting region dimension, platform dimension, posting volume dimension, and change rate dimension.

[0136] The input data is processed by a bidirectional long short-term memory network to obtain a temporal high-order feature representation;

[0137] The time-series high-order feature representation is batch normalized to obtain a normalized time-series high-order feature representation. An output vector is obtained based on the normalized time-series high-order feature representation through a self-attention mechanism.

[0138] The output vector is processed by the first fully connected layer to obtain the behavior analysis result, and the output vector is processed by the second fully connected layer to obtain the posting volume prediction result for the next time step.

[0139] This invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the network behavior analysis method described above.

[0140] Alternatively, a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, causes the processor to perform the following operations:

[0141] All posting data within a preset time interval after the start time are obtained, and the posting data is preprocessed in multiple dimensions to obtain input data based on time steps. The multiple dimensions include at least one of the following: time dimension, main theme outlier dimension, main theme proportion dimension, posting region dimension, platform dimension, posting volume dimension, and change rate dimension.

[0142] The input data is processed by a bidirectional long short-term memory network to obtain a temporal high-order feature representation;

[0143] The time-series high-order feature representation is batch normalized to obtain a normalized time-series high-order feature representation. An output vector is obtained based on the normalized time-series high-order feature representation through a self-attention mechanism.

[0144] The output vector is processed by the first fully connected layer to obtain the behavior analysis result, and the output vector is processed by the second fully connected layer to obtain the prediction result of the number of posts in the next time step.

[0145] The present invention will now be described an electronic device 400 that can serve as a server or client of the present invention, which is an example of a hardware device that can be applied to various aspects of the present invention. Electronic device 400 is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic device 400 can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0146] Electronic device 400 includes a computing unit that can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) or a computer program loaded from a storage unit into random access memory (RAM). The RAM may also store various programs and data required for device operation. The computing unit, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0147] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc. In this application, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments of the present invention according to actual needs. Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated units can be implemented in hardware or as software functional units.

[0148] While the present invention has been disclosed above, its scope of protection is not limited thereto. Those skilled in the art can make various changes and modifications without departing from the spirit and scope of the present invention, and all such changes and modifications will fall within the scope of protection of the present invention.

Claims

1. A network behavior analysis method, characterized by, The method comprises the following steps: obtaining all the post data in a preset time interval after a starting time, preprocessing all the post data in multiple dimensions to obtain input data based on time steps, including: generating an embedding vector for each piece of post data through a pre-trained language model; clustering all the embedding vectors in the preset time interval to obtain semantic clusters; determining the average distance between all the post data at the time step and the nearest cluster center as the main theme outlier dimension data; performing main theme analysis on all the post data at the time step through a large language model, and taking the proportion of the target main theme in all the post data at the time step as the main theme proportion data; taking the location of the post data at the time step as the post regional dimension data; taking the post platform of the post data at the time step as the platform dimension data; normalizing the data volume of the post data at the time step as the post volume dimension data; taking the change rate of the post data at the time step compared with the previous time step as the change rate dimension data, wherein the multiple dimensions include at least one of the time dimension, the main theme outlier dimension, the main theme proportion dimension, the post regional dimension, the platform dimension, the post volume dimension and the change rate dimension; processing the input data through a bidirectional long short-term memory network to obtain a time sequence high-order feature representation; batch normalizing the time sequence high-order feature representation to obtain a normalized time sequence high-order feature representation, and obtaining an output vector based on the normalized time sequence high-order feature representation through a self-attention mechanism; processing the output vector through a first full connection layer to obtain an behavior analysis result, and processing the output vector through a second full connection layer to obtain a post volume prediction result of the next time step.

2. The network behavior analysis method of claim 1, wherein, The method comprises the following steps: dividing the preset time interval according to the time step, starting from the first post time of the target event, and aligning the time according to the time step as the starting time; normalizing the post time of the post data in units of the time step as the time dimension data.

3. The network behavior analysis method of claim 1, wherein, The method comprises the following steps: processing the input data through a first bidirectional long short-term memory network to obtain a low-order feature representation at the time step; processing the low-order feature representation at the time step through a second bidirectional long short-term memory network to obtain the time sequence high-order feature representation.

4. The network behavior analysis method of claim 1, wherein, The time sequence high-order feature representation comprises a feature dimension; the method comprises the following steps: normalizing each feature dimension in the entire batch and all the time steps to obtain the normalized time sequence high-order feature representation; The self-attention mechanism is used to perform feature extraction on the normalized time sequence high-order feature representation through a preset extraction manner, and the output vector is obtained, wherein the preset extraction manner includes at least one of extracting high-order features of a preset time step, global average pooling, and weighted summation.

5. The network behavior analysis method of claim 1, wherein, The output vector is input into the first full connection layer, and the behavior analysis result is obtained through a behavior analysis binary classification head. The output vector is input into the second full connection layer, and the article publishing amount prediction result of the next time step is obtained through an article publishing data amount regression head. The output vector is input into the first full connection layer, and the behavior analysis result is obtained through a behavior analysis binary classification head.

6. A network behavior analysis apparatus, characterized by comprising: The preprocessing module is configured to obtain all article publishing data in a preset time interval after a starting time, and perform preprocessing on the all article publishing data in multiple dimensions to obtain input data based on a time step, including: generating an embedding vector for each article publishing data by using a pre-trained language model; clustering all embedding vectors in the preset time interval to obtain semantic clusters; determining an average distance between all article publishing data at the time step and the nearest cluster center as a main theme outlier dimension data; performing main theme analysis on all article publishing data at the time step by using a large language model, and taking a proportion of target main theme in all article publishing data at the time step as a main theme proportion data; taking a publishing location of all article publishing data at the time step as an article publishing region dimension data; taking a publishing platform of the article publishing data at the time step as a platform dimension data; normalizing a data amount of the article publishing data at the time step as an article publishing amount dimension data; and taking a change rate of the article publishing data at the time step compared to a previous time step as a change rate dimension data, wherein the multiple dimensions include at least one of a time dimension, a main theme outlier dimension, a main theme proportion dimension, an article publishing region dimension, a platform dimension, an article publishing amount dimension, and a change rate dimension. The bidirectional long short-term memory network module is configured to process the input data by using a bidirectional long short-term memory network to obtain a time sequence high-order feature representation. The batch normalization module is configured to perform batch normalization on the time sequence high-order feature representation to obtain a normalized time sequence high-order feature representation. The self-attention module is configured to obtain an output vector based on the normalized time sequence high-order feature representation by using a self-attention mechanism. The output module is configured to process the output vector by using a first full connection layer to obtain a behavior analysis result, and process the output vector by using a second full connection layer to obtain an article publishing amount prediction result of a next time step. The memory and the processor are included.

7. An electronic device, comprising: The memory is configured to store a computer program. The processor is configured to implement the network behavior analysis method of any one of claims 1-5 when executing the computer program. The storage medium has a computer program stored thereon, and the computer program, when executed by a processor, implements the network behavior analysis method of any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, ​

Images