An interactive analysis system and method for semantic deconstruction and dynamic reasoning in cases.

Abstract

The application relates to the technical field of intelligent processing and reasoning of judicial documents, and discloses an interactive analysis system and method for case-related semantic deconstruction and dynamic reasoning, wherein the interactive analysis method for case-related semantic deconstruction and dynamic reasoning comprises the following steps: obtaining social platform data flow of known case-related personnel, and generating a multidimensional social behavior data set; using a coded language evolution sequence analysis algorithm to analyze the multidimensional social behavior data set, and outputting a coded language-behavior correlation characteristic matrix; processing the coded language-behavior correlation characteristic matrix through a psychometric mapping algorithm, and calculating a latent accomplice probability distribution; and using a multi-hop path search strategy to analyze a hidden contact chain through multiple intermediaries by using an indirect correlation mining algorithm. The application overcomes the monitoring failure problem caused by the continuous evolution of coded language semantics, solves the limitation of direct correlation analysis, and can effectively discover deep hidden criminal network members.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of judicial document intelligent processing and reasoning, more particularly, it relates to an interactive analysis system and method for case-related semantic deconstruction and dynamic reasoning. BACKGROUND

[0002] In the current criminal investigation field, criminal gangs conduct hidden communication through social networks, which has become the norm. Criminals not only use constantly evolving code systems to evade monitoring, but also maintain secret contact through specific psychological behavior patterns, while deliberately creating social blind spots to hide core accomplices. Traditional social network analysis methods face three major technical challenges: first, the continuous evolution of the code system makes the monitoring method based on fixed keywords ineffective; second, accomplices evade direct association analysis through complex psychological tacit understanding and indirect contact, making regular network topology analysis unable to discover deep relationships; third, criminals have anti-detective consciousness and will actively create false social relationships to confuse the situation, making positive network analysis fall into a misunderstanding. SUMMARY

[0003] The present application provides an interactive analysis system and method for case-related semantic deconstruction and dynamic reasoning, which solves the technical problem of continuously tracking the dynamic changing code system through the code evolution sequence analysis algorithm in related technology; and analyzes the propagation path of multiple intermediaries through the indirect association mining algorithm, solving the limitation of direct association analysis.

[0004] The present application provides an interactive analysis method for case-related semantic deconstruction and dynamic reasoning, comprising:

[0005] Obtaining social platform data stream of known case-related personnel, generating a multi-dimensional social behavior data set;

[0006] Analyzing the multi-dimensional social behavior data set using a code evolution sequence analysis algorithm, and outputting a code-behavior association feature matrix;

[0007] The multi-dimensional social behavior data set includes:

[0008] Extracting historical data of known case-related personnel from social platforms, including post content, comment records, like behavior, forwarding records, private message correspondence, and active time period records;

[0009] Performing time series processing on the original data, sorting and labeling time windows according to timestamps;

[0010] Extracting code usage traces in text content, and converting unstructured social data into a multi-dimensional structured data set containing time dimension, content dimension, behavior dimension, and relationship dimension;

[0011] The non-numeric data is encoded and processed, wherein the behavior type, the interaction type and the topic label are converted into a numeric vector by using one-hot encoding, the timestamp data is converted into a relative time value by using standardization processing, and the like number and the forwarding number are processed by using the maximum and minimum value normalization method, so that the data in each dimension is unified to the range of [0, 1];

[0012] The psychological measurement mapping algorithm is used to process the code-behavior association feature matrix, and the reverse inference algorithm is used to analyze the social data anomaly and calculate the potential accomplice probability distribution;

[0013] The psychological measurement mapping algorithm converts the behavior characteristics into a personality dimension vector containing openness, responsibility, extroversion, agreeableness and neuroticism based on the Big Five Personality Model, constructs a behavior-personality mapping function, and calculates the scores of each personality dimension by using a weighted projection method, wherein the weight coefficient is obtained by analyzing the behavior-personality association in the historical case data;

[0014] The indirect association mining algorithm is used to analyze the code propagation path and psychological similarity, and generate a deep accomplice relationship graph;

[0015] The deep accomplice relationship graph and the code evolution prediction result are cross-validated, and a deep accomplice network mining report is output;

[0016] The cross-validation of the deep accomplice relationship graph and the code evolution prediction result includes:

[0017] The code evolution trajectory is used to predict new code forms that may appear in the future period;

[0018] The potential accomplices in the deep accomplice relationship graph are matched and verified with the predicted code usage mode;

[0019] The comprehensive case risk value of each potential member is calculated by the risk assessment algorithm, and the comprehensive case risk value is equal to the weighted sum of the accomplice posterior probability, the network association strength and the code matching degree, wherein the weight coefficient is determined according to the case type characteristics;

[0020] The code evolution sequence analysis algorithm maps the code vocabulary to the semantic vector space, calculates the similarity of the semantic vectors in the adjacent time window to generate a semantic evolution trajectory; the reverse inference algorithm calculates the posterior probability of the potential associated object becoming an accomplice based on the abnormal index through the Bayesian inference framework; the indirect association mining algorithm analyzes the hidden contact chain through multiple levels of intermediaries through a multi-hop path search strategy.

[0021] Further, the code evolution sequence analysis algorithm includes:

[0022] The historical code text is processed by word segmentation, and the code vocabulary sequence is extracted;

[0023] A multilayer perceptron is used to map coded words to a semantic vector space to obtain a semantic vector sequence. The multilayer perceptron includes an input layer, two hidden layers and an output layer. The first hidden layer contains 512 neurons and the second hidden layer contains 256 neurons.

[0024] Calculate the cosine similarity of semantic vectors within adjacent time windows to generate semantic evolution trajectories;

[0025] The clustering algorithm groups semantically similar coded messages into the same evolutionary cluster to identify the evolutionary pattern of the coded messages. The clustering algorithm adopts a hierarchical clustering method and uses a distance metric based on cosine similarity.

[0026] Further reverse inference algorithms include:

[0027] The reverse inference algorithm defines a set of abnormal indicators, including social gaps, gaps in the use of coded language, and sudden changes in interaction frequency. It uses a maximum-minimum normalization method for each abnormal indicator. It calculates the conditional probability based on historical case data and uses Bayes' theorem to calculate the posterior probability, where the posterior probability is equal to the conditional probability of being an accomplice when the abnormal indicator appears, multiplied by the prior probability and then divided by the evidence probability.

[0028] Further indirect association mining algorithms include:

[0029] Construct a code word propagation network and track the propagation path of code words among different users;

[0030] The psychological similarity between users is calculated by taking the negative exponent of the Euclidean distance between personality dimension vectors;

[0031] A multi-hop path search strategy is adopted to analyze the hidden connection chain through multiple levels of intermediaries, where the path weight is determined by the cumulative sum of the frequency of code word propagation and psychological similarity.

[0032] When the path weight exceeds a preset threshold, an indirect connection edge is established in the deep complicity relationship graph.

[0033] Furthermore, the path weight calculation incorporates the time dimension:

[0034] Define the path time span as the total time interval from the start point to the end point of the path;

[0035] A time decay factor is introduced, which is equal to the path time span divided by the negative exponent of the time decay constant;

[0036] The corrected path weight is equal to the product of the original path weight and the time decay factor.

[0037] Furthermore, the algorithm for analyzing coded evolutionary sequences further includes:

[0038] Based on the adversarial example generation algorithm, a set of social cover strategies is generated by simulating anti-reconnaissance strategies.

[0039] The adversarial example generation algorithm generates fake interaction patterns, code word obfuscation strategies, and relationship spoofing schemes through an adversarial learning framework. This includes training a generator to learn how to generate realistic fake social patterns and training a discriminator to learn how to distinguish between real and fake social patterns.

[0040] Furthermore, the code word matching degree is calculated in the following way:

[0041] Calculate the semantic similarity and edit distance between users' code usage patterns and predicted code forms;

[0042] The code word matching degree is equal to the weighted sum of semantic similarity and edit distance normalization value.

[0043] One of the systems provided includes:

[0044] The data acquisition module is used to acquire social media data streams of known individuals involved in the case and generate a multidimensional social behavior dataset.

[0045] The code word analysis module is used to execute the code word evolution sequence analysis algorithm to analyze the multidimensional social behavior dataset and output the code word-behavior association feature matrix;

[0046] The psychological inference module is used to execute psychometric mapping algorithms and inverse inference algorithms to analyze social data anomalies and calculate the probability distribution of potential accomplices;

[0047] The association mining module is used to execute indirect association mining algorithms to analyze the propagation path of coded messages and psychological similarity, and generate a deep complicity relationship graph;

[0048] The risk assessment module is used for cross-validation and outputs a deep network of complicity reports.

[0049] The beneficial effects of this invention are as follows:

[0050] This invention achieves continuous tracking of dynamically changing coded language systems through a code language evolution sequence analysis algorithm, overcoming the monitoring failure problem caused by the continuous evolution of code language semantics. By combining psychometric mapping algorithms and inverse inference algorithms, surface-level social behavioral characteristics are transformed into deep psychological characteristics, and deliberately hidden connections are identified from abnormal social gaps and code language gaps, breaking through the evasion tactics employed by criminals through psychological tacit understanding and indirect communication. The indirect association mining algorithm analyzes the propagation path of multi-level intermediaries, overcoming the limitations of direct association analysis. Therefore, this method can effectively discover deeply hidden members of criminal networks. Attached Figure Description

[0051] Figure 1 This is a flowchart of an interactive analysis method for semantic deconstruction and dynamic reasoning related to a case, according to the present invention;

[0052] Figure 2 This is a line graph illustrating the semantic evolution trajectory analysis of the secret language of this invention;

[0053] Figure 3 This is a heatmap of the code word-behavior association feature matrix of the present invention;

[0054] Figure 4 This is a bar chart showing the anomaly indicators of potential related objects and the probability of complicity in this invention;

[0055] Figure 5 This is a deep complicity network diagram of the present invention;

[0056] Figure 6 This is a Sankey diagram of the code word propagation path of the present invention;

[0057] Figure 7 This is a comparative analysis of the comprehensive risk assessment results of the present invention using a mixed bar chart. Detailed Implementation

[0058] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed only to enable those skilled in the art to better understand and implement the subject matter described herein, and changes may be made to the function and arrangement of the elements discussed without departing from the scope of this specification. Various processes or components may be omitted, substituted, or added as needed in the examples. Furthermore, some features described in the examples may be combined in other examples.

[0059] At least one embodiment of the present invention discloses an interactive analysis method for semantic deconstruction and dynamic reasoning in relation to a case, such as... Figure 1 As shown, it includes the following steps:

[0060] Step 100: Obtain the social media data streams of known individuals involved in the case and generate a multidimensional social behavior dataset.

[0061] Specifically, historical data of known individuals involved in the case is extracted from social media platform APIs or databases, including raw data such as post content, comment records, likes, reposts, private messages, and active time periods. This raw data undergoes time-series processing, sorting by timestamps and labeling time windows. Simultaneously, traces of coded language usage are extracted from the text content, transforming the unstructured social data into a multi-dimensional structured dataset containing time, content, behavior, and relationship dimensions. During the data transformation process, non-numerical data is encoded. Specifically, categorical data such as behavior type, interaction type, and topic tags are converted into numerical vectors using one-hot encoding; timestamp data is standardized to relative time values; and count data such as likes and reposts are processed using a minimum-maximum normalization method, unifying the data across all dimensions. Within the range.

[0062] Step 200: Analyze the multidimensional social behavior dataset using the code word evolution sequence analysis algorithm and output the code word-behavior association feature matrix.

[0063] The multidimensional social behavior dataset generated in step 100 is input into the codeword evolution sequence analysis algorithm. This algorithm first semantically encodes historical codes, then tracks the changes in the expression of the same concept at different times through temporal comparison analysis, generating a semantic evolution trajectory of the codes. Simultaneously, a behavior pattern mining algorithm is used to extract users' topic preference distribution and sentiment characteristics. The codeword evolution features are then correlated with the behavior pattern features to calculate the correlation coefficient between codeword use and specific behavior patterns, ultimately outputting the final result. Dimensional code-behavior association feature matrix ,in This indicates the dimension of the code word features. This represents the dimension of behavioral characteristics.

[0064] The aforementioned behavior pattern mining algorithm employs a frequent itemset mining method. The input consists of user behavior sequence data, including posting time, interaction type, and topic tags. The output is a topic preference distribution vector and a sentiment feature vector. The algorithm uses the Apriori algorithm to extract frequent behavior patterns, sets a minimum support of 0.05, and calculates the temporal stability of the behavior patterns through time window analysis.

[0065] It should be noted that the code word evolution sequence analysis algorithm includes the following sub-steps:

[0066] Step 201: Perform word segmentation on the historical code text and extract the code word sequence. ,in Indicates the length of the time series.

[0067] Step 202: Use a multilayer perceptron (MLP) to map the coded words to a semantic vector space to obtain a semantic vector sequence. ,in , For semantic vector dimensions.

[0068] The aforementioned multilayer perceptron consists of an input layer, two hidden layers, and an output layer. The input layer receives the one-hot encoded vectors of the coded words. ,in This is the size of the vocabulary. The first hidden layer contains 512 neurons, computed through a fully connected layer. ,in , The second hidden layer contains 256 neurons. (The calculation...) ,in , Output layer generates 3D semantic vector ,in , .

[0069] Furthermore, the weight matrices and bias vectors of each layer of the aforementioned multilayer perceptron are initialized using the Xavier initialization method.

[0070] Specifically, for the weight matrix ,

[0071] Its elements are from a uniform distribution Random sampling in the middle, where Input dimension for this layer, This is the output dimension of this layer. Bias vector. Initialize to a zero vector. The Xavier initialization method ensures that the variance of activation values ​​in each layer remains stable during forward propagation, avoiding gradient vanishing or exploding problems and accelerating model convergence.

[0072] The aforementioned multilayer perceptron employs a self-supervised training model, using a context prediction task for training. Given a center word... Predict the words within its context window The negative sampling loss function is used during training.

[0073]

[0074] in For the target word vector, For context word vectors, The number of negative samples. It is a negative sampling distribution. The function used is the sigmoid function. The optimization strategy employs the Adam optimizer, with a learning rate of 0.001 and a batch size of 128.

[0075] Furthermore, the aforementioned negative sampling distribution It is calculated based on the frequency of word occurrence in the corpus, and the specific formula is as follows: ,in Words Frequency of occurrence in the corpus For vocabulary list. Index This is used to smooth the word frequency distribution, increasing the probability of sampling low-frequency words and decreasing the probability of sampling high-frequency words, thus avoiding excessive focus on high-frequency words during training. (Number of negative samples) Set to 5, randomly draw from the negative sampling distribution in each training iteration. Each word is used as a negative sample, and together with the positive samples (the real context words), they are used to calculate the loss function.

[0076] Step 203: Calculate the cosine similarity of semantic vectors within adjacent time windows:

[0077]

[0078] Generate semantic evolution trajectory.

[0079] Furthermore, the aforementioned range of cosine similarity values ​​is: The cosine similarity is denoted as 1, where 1 indicates that the two vectors have the same direction, -1 indicates that the directions are completely opposite, and 0 indicates that they are orthogonal. Since the semantic vectors are directly generated by the output layer of the multilayer perceptron in step 202 without undergoing non-negative constraint processing, the vector elements can be positive or negative, so the cosine similarity may take a negative value.

[0080] Step 204: Group semantically similar coded messages into the same evolutionary cluster using a clustering algorithm to identify the evolutionary pattern of the coded messages.

[0081] The aforementioned clustering algorithm employs a hierarchical clustering method, with the input being the semantic vector sequence generated in step 203. The output is An evolutionary cluster A distance metric based on cosine similarity is used, and hierarchical merging is performed using the average link criterion. Merging stops when the inter-cluster distance is greater than a threshold of 0.7.

[0082] Furthermore, the aforementioned distance metric is defined as follows: This converts cosine similarity into a distance value. Since the range of cosine similarity values ​​is... The corresponding distance value range is The threshold of 0.7 is at... Within this range, merging stops when the average semantic distance between two clusters exceeds 0.7 (corresponding to a cosine similarity below 0.3). This threshold setting ensures that the semantic similarity of coded messages within the same evolutionary cluster is not lower than 0.3, thereby guaranteeing that coded messages within the cluster have sufficient semantic relevance.

[0083] The aforementioned coded language evolution sequence analysis algorithm tracks the dynamic evolution of coded language by combining temporal semantic analysis and behavioral association mining. The algorithm input is a multi-dimensional social behavior dataset, including fields such as user ID, timestamp, text content, and behavior type. The output is... Dimensional code-behavior association feature matrix, where each element Indicates the first The first coded feature and the second The association strength of each behavioral feature, with a value range of [value range missing]. The algorithm captures the temporal variation patterns of code word meanings through trajectory analysis in the semantic vector space and establishes a mapping relationship between code word usage and user behavior patterns.

[0084] Step 300: Process the code word-behavior association feature matrix using a psychometric mapping algorithm, combine it with a reverse inference algorithm to analyze social data anomalies, and calculate the probability distribution of potential accomplices.

[0085] The code word-behavior association feature matrix output from step 200 is input into a psychometric mapping algorithm. The psychometric mapping algorithm, based on the Big Five personality model, converts behavioral features into personality dimension vectors. ,in to These represent scores on five dimensions: openness, conscientiousness, extraversion, agreeableness, and neuroticism. Simultaneously, a backward inference algorithm analyzes anomalous patterns in social networks, including social gaps, gaps in coded language use, and abrupt changes in interaction frequency. Using a Bayesian inference framework, combining personality traits and anomalous indicators, the posterior probability of each potential associate becoming an accomplice is calculated. This generates a probability distribution of potential accomplices.

[0086] The aforementioned psychometric mapping algorithm takes as input a code word-behavior association feature matrix. The output is a personality dimension vector. Since the elements in the code word-behavior association feature matrix have been normalized to... The scope ensures the uniformity of different behavioral characteristics across dimensions. The algorithm constructs a behavior-personality mapping function. The scores for each personality dimension were calculated using a weighted projection method: ,in For the first The mean of each behavioral characteristic, For the first The behavioral characteristic for the first Weighting coefficients for individual personality dimensions. These weighting coefficients are obtained through behavioral-personality correlation analysis of historical case data. The calculated personality dimension scores are mapped to... using a sigmoid function. Within the range.

[0087] Furthermore, the aforementioned weighting coefficients It is calculated from historical case data through the following steps:

[0088] The first step is to extract a set of user samples with labeled personality dimension scores from the historical case library:

[0089]

[0090] in For the sample size, For the first The coded message-behavior association feature matrix of each sample. The corresponding personality dimension score is obtained through psychological scale assessment.

[0091] The second step is to analyze each personality dimension. ,

[0092] Constructing a linear regression model ,in For the first The sample at the th The mean of each behavioral characteristic This is the error term;

[0093] The third step is to use the least squares method to solve for the regression coefficients and minimize the objective function:

[0094]

[0095] Obtain the weight coefficient vector The regression analysis described above was performed on each of the five personality dimensions, resulting in a complete weight coefficient matrix. .

[0096] Furthermore, the constraints of the aforementioned least squares optimization problem are as follows:

[0097] Weight coefficient vector Unconstrained, i.e. The weights can take any real value because the influence of behavioral characteristics on personality dimensions can be positive (positive weight) or negative (negative weight). The optimization problem involves adjusting the objective function with respect to... Taking the partial derivative and setting it to zero yields the normal equation: ,in To design the matrix, the first Line number Column elements are , For the response vector, the th The elements are .

[0098] when When invertible, the analytical solution for the weighting coefficients is: .like If it is irreversible (the number of samples is less than the number of features), then ridge regression with a regularization term is used. ( To prevent overfitting, we set the value to 0.01. The solution then becomes... ,in It is an identity matrix.

[0099] It should be noted that the specific calculation process of the reverse inference algorithm is as follows:

[0100] Step 301: Define the set of abnormal indicators ,in Indicates the first The quantitative values ​​of various abnormal indicators are determined. Since abnormal indicators include metrics with different dimensions such as social gaps (time units), gaps in code word usage (number of times), and sudden changes in interaction frequency (frequency values), a maximum-minimum normalization method is used to normalize each abnormal indicator value to a minimum value. Within the range, the influence of dimensional differences on subsequent probability calculations is eliminated.

[0101] Furthermore, the specific calculation formula for the aforementioned maximum and minimum value normalization method is as follows:

[0102] ,in For the first The original values ​​of the abnormal indicators, This represents the set of values ​​for this metric across all users. and These are the minimum and maximum values ​​of the indicator, respectively. This is the normalized value. When When all users have the same value for this metric, the setting is as follows: Normalized index value This ensures the numerical comparability of abnormal indicators with different dimensions.

[0103] Step 302: Calculate conditional probability based on historical case data. and .

[0104] Furthermore, the aforementioned method for calculating conditional probability is as follows:

[0105] Extract confirmed accomplice sample sets from the historical case database. Non-accomplice sample set ,in and These represent the number of samples in each of the two classes. For the multidimensional anomaly index vector... Assuming that each abnormal indicator is conditionally independent, the conditional probability can be decomposed into: .

[0106] For each abnormal indicator The probability density function is estimated from the sample set of the corresponding category using the kernel density estimation method: ,in The number of samples in this category. For the first Each sample in the indicator The value on, Gaussian kernel function , The bandwidth parameter is calculated using the Silverman criterion: ,in This is the sample standard deviation. It was calculated using the methods described above. and .

[0107] Step 303: Calculate the posterior probability using Bayes' theorem:

[0108]

[0109] in For prior probability, This represents the probability of evidence.

[0110] Furthermore, the aforementioned prior probabilities Calculated based on the proportion of accomplices in the historical case database: ,in The sample size of CCP offenders in historical cases. Number of non-accomplice samples. Probability of evidence. Calculated using the law of total probability:

[0111] ,in Substituting the above probability values ​​into Bayes' theorem yields the posterior probability. .

[0112] The aforementioned reverse inference algorithm analyzes anomalous patterns in social networks.

[0113] Input is social network data ,in For a set of nodes (users). Given a set of edges (social relationships), the output is an anomaly indicator vector. ,in This represents the number of abnormal indicator types. The algorithm first calculates the baseline behavioral pattern for each user, including average interaction frequency. Average density of code word usage Average online time Then, abnormal behaviors deviating from the baseline pattern are detected, including: abnormal social gaps: interaction frequency lower than normal within a continuous period of time. During that period, The standard deviation of interaction frequency for code usage anomalies: code usage density suddenly drops to The following periods; abnormal changes in interaction frequency: the interaction frequency changes by more than [a certain amount] within a short period of time. The changes.

[0114] The aforementioned reverse inference algorithm identifies potential accomplices by analyzing abnormal patterns in social behavior.

[0115] The algorithm takes into account time-series data of users' social behavior and a historical case database, and outputs the posterior probability of complicity for each user. The core of the algorithm lies in inferring hidden relationships from anomalies such as social gaps and behavioral discontinuities, rather than relying on explicit direct connections. By using Bayesian inference to synthesize multidimensional anomaly indicators into a unified probability assessment, it achieves reverse identification of deliberately concealed behaviors.

[0116] Step 400: Analyze the propagation path and psychological similarity of coded messages using an indirect association mining algorithm to generate a deep complicity relationship graph.

[0117] Based on the potential accomplice probability distribution and personality dimension vector calculated in step 300, the indirect association mining algorithm first constructs a code word propagation network to track the propagation path of code words among different users. This is achieved by calculating the psychological similarity between users. The algorithm identifies user groups with similar psychological characteristics. It employs a multi-hop path search strategy to analyze hidden connection chains through multiple levels of intermediaries, where path weights are determined by both the frequency of coded language propagation and psychological similarity. The final output is a deep complicity relationship graph containing nodes (potential accomplices) and edges (association strength). ,in For a set of nodes, Let it be the set of edges.

[0118] Furthermore, the aforementioned psychological similarity The value range analysis is as follows: Due to the personality dimension vector In step 300, the sigmoid function is used to map to... Range, the Euclidean distance (L2 norm) between two personality vectors. The range of values ​​is Where 0 indicates that two users have exactly the same personality traits. This represents the extreme case where one user has all personality dimensions of 0 and another user has all personality dimensions of 1.

[0119] Therefore, psychological similarity The range of values ​​is That is, approximately The value of 1 indicates that the personality traits are completely identical, while a value close to 0.082 indicates that the personality traits are most different.

[0120] The aforementioned indirect association mining algorithm takes as input the potential accomplice probability distribution. Personality dimension vector set The transmission of coded messages is recorded, and the output is a deep complicity graph. .

[0121] The algorithm constructs multi-hop propagation paths Calculate path weights ,in This represents the frequency of coded messages propagated between adjacent nodes. This is used to eliminate similarity. The difference in dimensions between the propagation frequency (number of times) and the propagation frequency is addressed by using a maximum-minimum normalization method to normalize the propagation frequency values ​​between all node pairs. The range is determined to ensure that the similarity and normalized propagation frequency are consistent in terms of units, making the path weight calculation comparable. When the path weight exceeds the threshold of 0.3, indirect association edges are established in the graph.

[0122] Furthermore, the specific method for incorporating the time dimension into the aforementioned path weight calculation formula is as follows: the coded message propagation record contains timestamp information, denoted as... ,in Indicates the code from the user Distributed to users Timestamp. For multi-hop paths. Define the path time span This represents the total time interval from the start point to the end point of the path. A time decay factor is introduced. ,in The time decay constant is set to 30 days (in days). The time decay factor reflects the characteristic that the larger the time span, the weaker the path correlation.

[0123] Incorporating the time decay factor into the path weight calculation, the corrected path weight formula is as follows:

[0124]

[0125] The revised path weight formula ensures that propagation paths with shorter time spans receive higher weights, which aligns with the behavioral patterns of criminal gangs interacting frequently within concentrated time periods.

[0126] Furthermore, the aforementioned path weight threshold of 0.3 is set based on the following: Since the path weight is obtained by multiplying multiple similarity values ​​and propagation frequency values, the weight decreases exponentially as the number of hops in the path increases. According to statistical analysis of historical case data, when the path contains 3 hops and the product of the average similarity and propagation frequency of each hop is 0.67, the path weight is approximately... The threshold of 0.3 corresponds to identifying indirect relationship paths with no more than 3 hops and an average association strength of no less than 0.67 per hop. This threshold balances the breadth of the association range with the reliability of the association strength: a path weight below 0.3 indicates that the association is too weak or the path is too long to support the inference of complicity; a path weight above 0.3 indicates that there is strong evidence of indirect association and should be included in the graph for further analysis.

[0127] In this embodiment of the application, in order to improve the anti-reconnaissance capability, the method further includes the following after step 200:

[0128] Step 250: Simulate anti-reconnaissance strategies based on adversarial example generation algorithms to generate a set of social cover strategies.

[0129] The coded message-behavior association feature matrix is ​​input into the adversarial example generation algorithm, which generates possible fake interaction patterns, coded message obfuscation strategies, and relationship spoofing schemes through an adversarial learning framework. Specifically, the algorithm trains a generator based on a multilayer perceptron. A discriminator based on a multilayer perceptron The generator learns to generate realistic fake social patterns, while the discriminator learns to distinguish between real and fake social patterns.

[0130] The aforementioned generator A multilayer perceptron is employed, comprising an input layer, three hidden layers, and an output layer. The input layer receives a random noise vector with a dimension of 100. The first hidden layer contains 256 neurons. (The calculation...) ,in The second hidden layer contains 512 neurons. (The calculation is incomplete and requires further context.) The third hidden layer contains 1024 neurons. (Calculation...) The output layer produces a feature matrix with the same dimensions as the coded message-behavior association matrix. Fake social models .

[0131] Furthermore, since the output range of the tanh activation function is... The value range of the code word-behavior association feature matrix in step 200 is... This requires adjusting the range of the generator output. Specifically, this is done through a linear transformation. Transform the output value from Mapped to This ensures that the generated fake social patterns and the real feature matrix have the same value range, thus ensuring that the discriminator can distinguish between true and false at the same numerical scale.

[0132] The aforementioned discriminator A multilayer perceptron is employed, comprising an input layer, three hidden layers, and an output layer. The input layer receives data in the following dimensions: The feature matrix (real or generated). The first hidden layer contains 1024 neurons, calculated... ,in This represents the matrix vectorization operation. The second hidden layer contains 512 neurons, and the computation... The third hidden layer contains 256 neurons. (The calculation...) The output layer generates scalar discrimination probabilities. ,in This is the sigmoid function.

[0133] Furthermore, the aforementioned generator and discriminator network parameters are initialized using the He initialization method, which is specifically optimized for the LeakyReLU activation function. Specifically, for the weight matrix... Its elements are distributed normally. Random sampling in the middle, of which This is the input dimension for this layer. Bias vector. Initialize to a zero vector. The He initialization method takes into account the nonlinear characteristics of the LeakyReLU activation function, ensuring that the variance of the activation values ​​in each layer remains within an appropriate range during forward propagation, which is beneficial to the stability of adversarial training.

[0134] The aforementioned generator and discriminator employ an adversarial training model. The training process alternates: first, the generator parameters are fixed, and the discriminator is optimized to distinguish between real and generated social patterns; then, the discriminator parameters are fixed, and the generator is optimized to generate patterns that can deceive the discriminator. The loss function is:

[0135]

[0136] in Represents a real social model. Indicates random noise. Represents the true data distribution. The noise distribution is represented. The optimization strategy employs the Adam optimizer, with a generator learning rate of 0.0002 and a discriminator learning rate of 0.0001. Label smoothing is used to improve training stability. The generated masking strategy set is used to enhance the robustness of subsequent analysis.

[0137] Furthermore, the specific iterative process of the aforementioned adversarial training is as follows:

[0138] In each training iteration, the discriminator training step is performed first: random sampling is performed from the real dataset. A real sample Simultaneously generate random noise vectors And obtain the generated sample through the generator. ,in ;

[0139] Fixed generator parameters By maximizing the discriminator's objective function:

[0140] Update discriminator parameters Perform a gradient ascent step using the Adam optimizer. Then perform the generator training step: generate new... A random noise vector is used to generate samples through a generator, and the discriminator parameters are fixed. By minimizing the generator objective function Update generator parameters Perform a gradient descent step using the Adam optimizer. Repeat the above alternating training process. When the discriminator's accuracy in distinguishing between real and generated samples on the validation set stabilizes at around 50% (indicating that the samples generated by the generator are difficult to distinguish from real samples), the training is considered to have converged and the iteration stops.

[0141] Furthermore, the constraints of the aforementioned discriminator and generator optimization problem are as follows:

[0142] Discriminator optimization ,parameter There are no explicit constraints, but the parameter update magnitude is implicitly constrained through the gradient pruning mechanism of the Adam optimizer. Specifically, the gradient pruning threshold is set to 1.0. That is, when the L2 norm of the gradient exceeds 1.0, the gradient is scaled proportionally to the norm of 1.0 to prevent training instability caused by gradient explosion.

[0143] For generator optimization ,parameter Similarly, gradient clipping constraints are applied. Furthermore, the generator output, after passing through the tanh activation function, has a range of... Mapped to through linear transformation This ensures that the feature matrix values ​​of the generated samples and the real samples are within the same range, which constitutes an implicit constraint on the generator's output. The optimization terminates when the number of training epochs reaches the maximum of 10,000 iterations, or when the discriminator's accuracy remains within a certain range for 100 consecutive validation epochs. Within the range and with fluctuations less than 0.02.

[0144] Furthermore, the aforementioned label smoothing technology is specifically implemented as follows:

[0145] During the discriminator training process, the labels of the real samples are smoothed from hard label 1 to soft label 2. The labels of the generated samples are smoothed from hard label 0 to soft label. Specifically, the discriminator's loss function is modified as follows: Label smoothing prevents the discriminator from overconfidently outputting extreme probability values ​​close to 0 or 1, reduces the risk of overfitting the model to a single sample, and improves the stability of adversarial training and the diversity of generated samples.

[0146] The aforementioned adversarial example generation algorithm takes as input a coded message-behavior association feature matrix. The output is a sample set of fake social patterns. The algorithm uses adversarial learning to generate samples that are statistically similar to real social patterns but contain deliberately disguised features, simulating counter-surveillance strategies that criminals might employ. The generated fake sample set is used to enhance the subsequent analysis algorithm's ability to identify counter-surveillance behaviors.

[0147] In this embodiment of the application, to improve the accuracy of the analysis, the method further includes the following after step 400:

[0148] Step 500: Cross-validate the deep complicity relationship graph with the code word evolution prediction results, and output a deep complicity network mining report.

[0149] Using the coded language evolution trajectory obtained in step 200, new coded language forms that may appear in the future are predicted.

[0150] Furthermore, the aforementioned coded language evolution prediction employs a temporal prediction method based on semantic vector extrapolation, with the following specific steps: First, extract the time series from the semantic evolution trajectory obtained in step 203.

[0151] ,in For timestamps, This is the semantic vector at that point in time;

[0152] The second step is to calculate the semantic vector changes between adjacent time points. The semantic drift velocity sequence is obtained. ;

[0153] The third step is to smooth the semantic drift rate by calculating the exponentially weighted moving average method. ,in For smoothing coefficients;

[0154] Fourth step, based on the most recent a time window ( Take 5) as the average semantic drift rate ,

[0155] Predicting future moments The semantic vector is ,in To predict the time step;

[0156] The fifth step is to search for related terms in the semantic vector space of the vocabulary. Most similar front vocabulary ( Taking 10), using cosine similarity as a similarity measure, these words are the predicted new coded language forms that may appear in the future.

[0157] Furthermore, the aforementioned prediction time step The definitions and value constraints are as follows: Indicates the time since the last observation. The number of time intervals for starting the forecast forward, in units of time windows. The length of each time window is set in step 100, typically 7 days. Forecast time step. The range of values ​​is constrained as follows: This means predicting only the possible forms of the code within the next 1 to 3 time windows (7 to 21 days). This range of values ​​is constrained for the following reasons:

[0158] First, the evolution of the code word has nonlinear and random characteristics, which significantly reduces the reliability of long-term predictions (more than 3 windows);

[0159] Second, historical case data shows that the average update cycle of criminal gangs' code words is about 2 weeks, and it is predicted that 3 windows can cover a complete update cycle.

[0160] Third, an excessively long prediction time step will lead to a decrease in the prediction vector. Deviating from the effective region of the current semantic space renders the most similar words found meaningless. In practical applications, the default setting... By predicting the code words for the next time window, investigators can adjust their strategies based on the urgency of the case and the quality of the data. Values ​​can be taken within the allowed range.

[0161] The potential accomplices in the deep complicity relationship map generated in step 400 are matched and verified against the predicted code word usage patterns. A risk assessment algorithm is then used to calculate the comprehensive risk value for each potential member.

[0162]

[0163] in Indicates the first Risk value of each potential member

[0164] , , The weighting coefficients are and satisfy the following conditions: ,

[0165] The range of values ​​for the posterior probability of this member being an accomplice is: , Indicates with members The associated set of nodes, The range of values ​​for the weights of edges in the graph, representing the correlation strength, is as follows: , The range of values ​​for the code word matching degree is: Since all three indicators have been normalized to The range ensures the consistency of dimensions in the weighted summation calculation, thus reducing the risk value. The range of values ​​is also... .

[0166] Furthermore, the aforementioned network correlation strength summation term Normalization is required to ensure that its value range is [value range missing]. Specifically, when members The set of associated nodes Non-empty time (i.e.) ), calculate the normalized network correlation strength as ,in The maximum number of associated nodes among all potential members, i.e. .

[0167] Due to the weight of each edge And after summing, divide by the maximum number of associated nodes to ensure When members When there are no associated nodes (i.e.) ),set up .

[0168] The formula for calculating the risk value has been revised accordingly. This normalization correction ensures that the three indicators are linearly added under the same dimensions. Rights, making risk value The calculation results are comparable and interpretable.

[0169] Furthermore, the aforementioned weighting coefficients , , The specific value is determined based on the characteristics of the case type:

[0170] For case types with obvious individual crime characteristics, set , , It focuses more on identifying individual abnormal behavior; for cases involving strong gang involvement, it sets... , , It focuses more on the analysis of network correlation strength;

[0171] For case types where the use of code words follows a strong pattern, set up... , , It places greater emphasis on the accuracy of code word matching. In practical applications, investigators can determine the case type based on the known behavioral characteristics of those involved and select an appropriate weighting scheme, or obtain the optimal weighting combination through training with historical data from similar cases.

[0172] The aforementioned risk assessment algorithm inputs include the probability distribution of potential accomplices and a deep accomplice relationship graph. The results of the code word evolution prediction are output as the risk value of each potential member. The range of values ​​is The algorithm integrates three risk factors through linear weighting: individual anomaly probability, network association strength, and code word usage matching degree. Among these, the code word matching degree... By calculating users The similarity between the code usage pattern and the predicted code form is obtained by using a combination of edit distance and semantic similarity.

[0173] The aforementioned code word matching degree The specific calculation formula is as follows:

[0174]

[0175] in Indicates user The use of coded language A coded form indicating a prediction. The balance coefficient is set to 0.6. The semantic similarity between two code word sequences is calculated by averaging the semantic vectors of each word in the code word sequence (obtained by the multilayer perceptron in step 202) and then calculating the cosine similarity. The edit distance between two code word sequences represents the minimum number of operations required to transform one sequence into another using insertion, deletion, and replacement operations. and These represent the lengths of the two sequences, respectively. The normalized edit distance term has a range of values ​​of [value missing]. The inverse of the value indicates the similarity at the character level.

[0176] The aforementioned deep network of complicity report includes the following specific details:

[0177] The first step is to create a list of potential accomplices, categorized by risk level. Sort from highest to lowest, including each member's user ID, risk value, and risk level (risk value is in...). The interval is marked as high risk. The interval is marked as medium risk. (The interval is marked as low risk).

[0178] The second step is to visualize the deep complicity relationship graph, which displays the relationships between nodes in the form of a graph structure. The size of the nodes reflects the level of risk, and the thickness of the edges reflects the strength of the relationship.

[0179] The third step involves detailed analysis of each potential member, including the posterior probability of complicity, the number of associated nodes, the code word matching degree, the main code word usage characteristics, and a summary of abnormal behavior patterns.

[0180] The fourth step is a codeword evolution trend analysis, listing currently used codeword forms and predicted future codeword variations. The report is presented in a combination of structured data and visual charts, facilitating investigators to quickly identify key targets and crucial connection paths.

[0181] In investigating a cross-provincial telecommunications fraud case, the municipal public security bureau had identified two core suspects, Zhang (user ID: U001) and Li (user ID: U002). The investigation revealed that the gang used coded language on social media platforms, such as "shipping" to refer to transferring illicit funds, "listing" to refer to committing fraud, and "customer" to refer to the victim, demonstrating a clear awareness of counter-surveillance. Investigators needed to utilize the method of this invention to uncover other hidden accomplices within the social networks of the two known suspects.

[0182] Step 100: Obtain social media data of known individuals involved in the case;

[0183] Social behavior data of Zhang and Li over the past 6 months were extracted from social media platforms. After preprocessing, a multidimensional social behavior dataset was generated. Some of the original data is shown in Table 1.

[0184] Table 1. Raw data on the known social behaviors of the individuals involved in the case (partial):

[0185]

[0186] After time-series processing and encoding transformation, the original data is converted into a normalized multidimensional dataset, where timestamps are converted to relative time values, behavior types are encoded using one-hot encoding, and numerical data is normalized to... scope.

[0187] Step 200: Analysis of the coded language evolution sequence;

[0188] A multidimensional social behavior dataset was input into a code word evolution sequence analysis algorithm to extract code word terms such as "shipping," "listing," and "customer," which were then mapped to a semantic vector space using a multilayer perceptron. The evolution trajectory of the code words was tracked from March to August, revealing that "shipping" gradually evolved into "order placed," and "customer" evolved into variants such as "fans." Simultaneously, user topic preferences and sentiment characteristics were extracted to generate a code word-behavior association feature matrix; some results are shown in Table 2.

[0189] Table 2. Code Word-Behavior Association Feature Matrix (Partial, selected from...) A coded feature, (Individual behavioral characteristics):

[0190]

[0191] The values ​​of each element in the matrix represent the correlation strength between the corresponding code word feature and the behavioral feature. For example, the correlation strength between the semantic cluster "listing" and "emotional concealment" is 0.81, indicating that the emotional expression of users using this code word is relatively concealed.

[0192] Figure 2 The core output of the codeword evolution sequence analysis algorithm is shown.

[0193] Figure 3 This study reveals the mapping relationship between different code word usage patterns and user behavior patterns, providing basic data for subsequent psychological characteristic analysis.

[0194] Step 300 Implementation: Psychometric Mapping and Backward Inference;

[0195] The code word-behavior association feature matrix was input into a psychometric mapping algorithm to calculate the Big Five personality traits scores for each user. Simultaneously, a reverse inference algorithm identified eight potential associated individuals, extracted their anomalous indicators (social isolation periods, gaps in code word usage, and abrupt changes in interaction frequency), and calculated the posterior probability of complicity after normalization. The results are shown in Table 3.

[0196] Table 3. Anomalies and Probability of Accomplices Among Potential Associates:

[0197]

[0198] Table 3 shows that the posterior probability of accomplices for users U007, U003, and U005 all exceeded 0.8, and they showed significant anomalies in the social gap period and code word gap indicators, suggesting that they have a high probability of being involved in the case.

[0199] Figure 4 The analysis results of the reverse inference algorithm are presented.

[0200] Step 400 Implementation: Indirect Association Mining;

[0201] Based on the probability of potential accomplices and personality dimension vectors, an indirect association mining algorithm was used to construct a code word propagation network. Analysis revealed multiple hidden propagation paths through intermediary nodes, such as:

[0202] Path 1: The path weight is 0.68.

[0203] Path 2: The path weight is 0.52.

[0204] Path 3: The path weight is 0.71.

[0205] Calculate the psychological similarity between users, for example:

[0206] By combining path weights and psychological similarity, a deep complicity relationship graph containing 8 nodes and 12 associated edges is generated.

[0207] Figure 5 Visualize the deep complicity relationship graph generated by the indirect association mining algorithm.

[0208] Figure 6 The diagram illustrates the propagation path of coded messages identified in the diagram. The diagram clearly shows the multi-level intermediary path of coded message propagation, such as the propagation chain of U001→U003→U007, revealing the covert mode by which criminal gangs transmit information indirectly.

[0209] Step 500 Implementation: Cross-validation and Risk Assessment;

[0210] Using a code word evolution prediction method, new code words that may emerge in the next 7-day time window are predicted, such as "commission," "volume," and "followers." The code word usage patterns of potential members are matched with the prediction results to calculate the code word matching degree. A weighted allocation is then performed based on a combination of complicity probability, network association strength, and code word matching degree. , , (For cases involving strong gang involvement), calculate the comprehensive risk value, and the final output results are shown in Table 4.

[0211] Table 4: Comprehensive Risk Assessment Results of Potential Accomplices

[0212]

[0213] The system output a deep network mining report on accomplices, marking U003 and U007 as high-risk potential accomplices and recommending that investigators prioritize peripheral investigations. The report shows that U003 has an indirect connection with the known suspect Zhang (U001) through the intermediary node U018, and there was a significant social gap between late March and early April, highly coinciding with the known timeline of the case. U007 and Li (U002) frequently used code words such as "uploading" in their private messages, and their code word usage pattern highly matched the predicted evolutionary form "volume generation" (match degree 0.78).

[0214] Figure 7 This chart comprehensively presents the final results of cross-validation and risk assessment. It is the final output of the entire analysis process, providing investigators with a basis for prioritizing investigation targets.

[0215] Based on the analysis report output by the system, investigators conducted peripheral investigations and technical reconnaissance on U003 and U007, ultimately confirming that the two were respectively the "cash withdrawal agent" and "telephone operator" of the fraud gang. This led to their successful arrest and helped solve a series of fraud cases involving over 8 million yuan. This application validated the effectiveness of this method in identifying deeply hidden accomplices in actual investigative work.

[0216] The embodiments of the present invention have been described above. However, the embodiments are not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make more equivalent embodiments under the guidance of the present embodiments, and all of them are within the protection scope of the present embodiments.

Claims

1. An interactive analysis method of implicated semantic deconstruction and dynamic inference, characterized in that, The method comprises the following steps: Obtain the social platform data stream of the known suspects, and generate a multi-dimensional social behavior data set; Analyze the multi-dimensional social behavior data set using a code evolution sequence analysis algorithm to output a code-behavior correlation feature matrix; The multi-dimensional social behavior data set comprises: Extract the historical data of the known suspects from the social platform, including post content, comment records, like behavior, forwarding records, private message exchanges, and active time period records; Perform time series processing on the original data, sort them according to the time stamp, and label the time window; Extract the code usage traces in the text content, and convert the unstructured social data into a multi-dimensional structured data set containing time, content, behavior, and relationship dimensions; Encode the non-numeric data, where the behavior type, interaction type, and topic label are converted into numeric vectors using one-hot encoding, the time stamp data is converted into relative time values using standardization processing, and the like number and forwarding number are processed using the maximum and minimum value normalization method to unify the data in the [0, 1] range; Process the code-behavior correlation feature matrix using a psychometric mapping algorithm, analyze social data anomalies using a reverse inference algorithm, and calculate the potential accomplice probability distribution; The psychometric mapping algorithm converts behavior features into personality dimension vectors containing openness, conscientiousness, extraversion, agreeableness, and neuroticism based on the Big Five Personality Model, constructs a behavior-personality mapping function, and calculates the scores of each personality dimension using a weighted projection method, where the weight coefficients are obtained through behavior-personality correlation analysis in historical case data; Analyze the code propagation path and psychological similarity using an indirect correlation mining algorithm to generate a deep accomplice relationship graph; Cross-validate the deep accomplice relationship graph with the code evolution prediction results to output a deep accomplice network mining report; Cross-validating the deep accomplice relationship graph with the code evolution prediction results comprises: Using the code evolution trajectory, predict new code forms that may appear in future time periods; Match and verify the potential accomplices in the deep accomplice relationship graph with the predicted code usage patterns; Calculate the comprehensive involvement risk value of each potential member using a risk assessment algorithm, which is equal to the weighted sum of the accomplice posterior probability, network correlation strength, and code matching degree, where the weight coefficients are determined according to the case type characteristics; The code evolution sequence analysis algorithm maps code vocabulary to semantic vector space, calculates the similarity of semantic vectors in adjacent time windows to generate semantic evolution trajectories; the reverse inference algorithm calculates the posterior probability of potential associated objects becoming accomplices based on abnormal indicators through a Bayesian reasoning framework; the indirect correlation mining algorithm analyzes hidden contact chains through multiple levels of intermediaries through a multi-hop path search strategy.

2. The interactive analysis method of claim 1, wherein, The code evolution sequence analysis algorithm comprises: Perform word segmentation on historical code text to extract code vocabulary sequences; The semantic vector sequence is obtained by mapping the code word vocabulary to a semantic vector space using a multi-layer perceptron, the multi-layer perceptron comprising an input layer, two hidden layers and an output layer, the first hidden layer comprising 512 neurons, and the second hidden layer comprising 256 neurons; A semantic evolution trajectory is generated by calculating the cosine similarity of semantic vectors in adjacent time windows; Code words with similar semantics are classified into the same evolution cluster by a clustering algorithm, and the evolution mode of the code words is identified, the clustering algorithm using a hierarchical clustering method and a distance measurement based on the cosine similarity.

3. The interactive analysis method of claim 1, wherein, The reverse inference algorithm comprises: The reverse inference algorithm defines a set of abnormal indicators, including a social blank period, a code word use fault, and an interaction frequency mutation, and adopts a maximum and minimum value normalization method for each abnormal indicator; conditional probabilities are calculated based on historical case data, and posterior probabilities are calculated using Bayes' formula, wherein the posterior probability is equal to the conditional probability of being a co-offender when the abnormal indicator appears, multiplied by the prior probability, and then divided by the evidence probability.

4. The interactive analysis method of claim 1, wherein, The indirect association mining algorithm comprises: A code word propagation network is constructed to track the propagation path of the code words among different users; A psychological similarity between users is calculated, the psychological similarity being obtained by taking the negative exponential of the Euclidean distance between personality dimension vectors; A multi-hop path search strategy is adopted to analyze the hidden contact chain through multiple intermediaries, wherein the path weight is determined by the product of the code word propagation frequency and the psychological similarity; When the path weight exceeds a preset threshold, an indirect association edge is established in the deep co-offender relationship graph.

5. The interactive analysis method of claim 4, wherein, The path weight calculation incorporates a time dimension: The path time span is defined as the total time interval from the starting point to the ending point of the path; A time decay factor is introduced, the time decay factor being equal to the negative exponential of the path time span divided by a time decay constant; The corrected path weight is equal to the product of the original path weight and the time decay factor.

6. The interactive analysis method of claim 1 to 4, wherein, After the code word evolution sequence analysis algorithm, the following is further included: An adversarial sample generation algorithm is used to simulate anti-detective strategies to generate a set of social cover strategies; The adversarial sample generation algorithm generates false interaction patterns, code word confusion strategies and relationship camouflage schemes through an adversarial learning framework, including training a generator to learn to generate realistic false social patterns, and training a discriminator to learn to distinguish between real and false social patterns.

7. The interactive analysis method of claim 1, wherein, The code word matching degree is calculated by: Calculating the semantic similarity and edit distance of the code word usage pattern of the user and the predicted code word form; The code word matching degree is equal to the weighted sum of the semantic similarity and the edit distance normalization value.

8. A system for performing the interactive analysis method of claim 1-7, wherein, It comprises: A data acquisition module is used to acquire social platform data streams of known suspects, and generate a multi-dimensional social behavior data set; The multi-dimensional social behavior data set comprises: The historical data of the known suspects is extracted from the social platform, including post content, comment records, like behavior, forwarding records, private message exchanges, and active time period records; The original data is time-sequenced, sorted according to the timestamp and labeled with a time window; The code word usage traces in the text content are extracted, and the unstructured social data is converted into a multi-dimensional structured data set containing time, content, behavior and relationship dimensions; The non-numeric data is encoded, wherein the behavior type, the interaction type, and the topic label are converted into a numeric vector by using a one-hot encoding, the timestamp data is converted into a relative time value by using a standardization processing, and the number of likes and the number of forwards are processed by using a maximum and minimum value normalization method, so that the data in each dimension is unified to the range of [0, 1]; a code analysis module configured to analyze the multi-dimensional social behavior data set by using a code evolution sequence analysis algorithm, and output a code-behavior association feature matrix; a psychological inference module configured to process the code-behavior association feature matrix by using a psychometric mapping algorithm, analyze social data anomalies by using a reverse inference algorithm, and calculate a potential accomplice probability distribution; the psychometric mapping algorithm converts behavior features into a personality dimension vector including openness, conscientiousness, extraversion, agreeableness, and neuroticism five dimensions based on a big five personality model, constructs a behavior-personality mapping function, and calculates scores of each personality dimension by using a weighted projection method, wherein a weight coefficient is obtained by analyzing a behavior-personality association in historical case data; an association mining module configured to analyze a code propagation path and a psychological similarity by using an indirect association mining algorithm, and generate a deep accomplice relationship graph; a risk assessment module configured to cross-validate the deep accomplice relationship graph and a code evolution prediction result, and output a deep accomplice network mining report; the cross-validation of the deep accomplice relationship graph and the code evolution prediction result includes: predicting a new code form that may appear in a future period by using a code evolution trajectory; matching and verifying a potential accomplice in the deep accomplice relationship graph with a predicted code usage mode; calculating a comprehensive involvement risk value of each potential member by using a risk assessment algorithm, wherein the comprehensive involvement risk value is equal to a weighted sum of a posterior probability of an accomplice, a network association strength, and a code matching degree, and a weight coefficient is determined according to a case type characteristic; wherein the code evolution sequence analysis algorithm generates a semantic evolution trajectory by mapping code words to a semantic vector space and calculating a similarity of semantic vectors in adjacent time windows; the reverse inference algorithm calculates a posterior probability that a potential associated object becomes an accomplice based on an abnormality index by using a Bayesian inference framework; and the indirect association mining algorithm analyzes a hidden contact chain through multiple levels of intermediaries by using a multi-hop path search strategy.

Images