A method for matching continuous subgraphs in a social network based on dynamic pruning.

Abstract

This invention provides a continuous subgraph matching method for social networks based on dynamic pruning, belonging to the field of social network behavior detection. The invention proposes a dynamic pruning algorithm that establishes local equivalence theory by calculating the backward neighbors of query points and candidate points, defines subtree-level equivalence criteria in dynamic graph environments, and is applicable to highly isomorphic behavior patterns such as zombie account groups and terminal nodes of propagation chains. The dynamic pruning algorithm skips isomorphic subtree structures to achieve the pruning effect. A query graph decomposition and sorting mechanism is proposed to remove the binding constraint of the matching order on the update edges and candidate sets, actively identifying and prioritizing highly redundant candidate set vertices, further reducing the search space. Ultimately, while ensuring result completeness, it achieves a 16.9-fold performance improvement over RapidFlow and a 100% completion rate for complex queries, providing sub-second decision support for abnormal behavior detection in social networks and promoting the application of dynamic graph analysis in resource-constrained environments such as edge computing.

Description

Technical Field

[0001] This invention belongs to the field of social network abnormal behavior detection technology, specifically involving a method for matching continuous subgraphs in social networks based on dynamic pruning. Background Technology

[0002] Graphs are widely used in various fields such as social networks, knowledge graphs, biological networks, and electronic networks to represent complex relationships. Vertices in a graph represent entities, and edges represent connections between entities. Finding pattern subgraphs in large graphs is a fundamental operation in graph mining, a problem defined as subgraph matching (SM). A pattern subgraph is a predefined subgraph template with specific structure and constraints (such as node / edge types, attributes, and connectivity) used to match and identify all instances conforming to the pattern in a large-scale graph. For example, finding "cooperative teams" in a social network.

[0003] However, graphs in most real-world applications are dynamic graphs. A dynamic graph is one whose topology (such as nodes and edges) and / or attributes (such as features of nodes or edges) change over time. These changes are typically achieved through the insertion and deletion of edges or nodes, and the updating of attributes. Continuous subgraph matching (CSM) on dynamic graphs is particularly important in detecting abnormal behavior in social networks—for example, tracing the propagation chain of fake accounts and identifying bot collaborative behavior, requiring real-time capture of sudden abnormal patterns in dynamic graphs. Specifically, CSM studies how to design algorithms to efficiently and in real-time track changes in subgraph matching results as dynamic graphs are continuously updated through edge insertion / deletion flows. Compared to traditional static subgraph matching (SM) on static graphs, CSM emphasizes rapid adaptation to structural changes in dynamic graphs and performs true incremental subgraph matching on these changes. In highly dynamic scenarios like social networks, traditional static subgraph matching algorithms require full graph recomputation, which cannot meet the security requirements of millisecond-level response.

[0004] Existing SM and CSM algorithms both follow a three-stage framework of filtering, sorting, and enumeration. In the filtering stage, existing algorithms compute each query point in the pattern subgraph, minimizing the size of the potential candidate set for these query points to reduce the matching search space. In the sorting stage, the query points in the pattern subgraph are sorted, and the search size is reduced by adjusting the order of matching. The enumeration stage includes two methods: multi-way join and recursive search. Current mainstream CSM algorithms enumerate the final matching results by constructing a recursive search tree.

[0005] The algorithms IncIsoMat (Wenfei Fan, Jianzhong Li, Jizhou Luo, Zijing Tan, Xin Wang, and Yinghui Wu. 2011. Incremental graph pattern matching. (SIGMOD'11). 925–936.) and GraphFlow (Chathura Kankanamge, Siddhartha Sahu, Amine Mhedbhi, Jeremy Chen, and Semih Salihoglu. 2017. Graphflow: An Active Graph Database. (SIGMOD'17). 1695–1698.) do not maintain any intermediate results. They rely on the traditional SM method to perform subgraph matching twice, before and after edge updates. In scenarios where the edge update frequency in social networks is >1000 edges / second, frequent full graph matching leads to excessive consumption of computational resources. Sutanay Choudhury proposed the SJ-Tree algorithm (Sutanay Choudhury, Larry Holder, George Chin, Khushbu Agarwal, and John T. Feo. 2015. A Selectivity-based Approach to Continuous Pattern Detection in Streaming Graphs. (PNNL)), which stores some intermediate results during the matching process, avoiding a lot of redundant computation. Kyoungmin Kim et al. proposed the TurboFlux algorithm (Kyoungmin Kim, In Seo, Wook-Shin Han, Jeong-Hoon Lee, Sungpack Hong, Hassan Chafi, Hyungyu Shin, and Geonhwa Jeong. 2018. TurboFlux: AFast Continuous Subgraph Matching System for Streaming Graph Data (SIGMOD'18). 411–426.), which better adapts to the incremental maintenance and dynamic update nature of CSM by introducing a data-centric graph (DCG) as an intermediate storage structure.Seunghwan Min proposed the Symbi algorithm (Seunghwan Min, Sung Gwan Park, Kunsoo Park, Dora Giammarresi, Giuseppe F. Italiano, and Wook-Shin Han. 2021. Symmetric Continuous Subgraph Matching with Bidirectional Dynamic Programming. Proc. VLDB Endow. 14 (2021), 1298–1310.), which maintains a dynamic candidate space (DCS) data structure to cache intermediate results. It can maximize the reduction of redundant computations and outperforms the TurbFlux and SJ-Tree algorithms in terms of performance. RapidFlow (Shixuan Sun, Xibo Sun, Bingsheng He, and Qiong Luo. 2022. RapidFlow: an efficient approach to continuous subgraph matching. Proc. VLDB Endow. 15, 11 (July 2022), 2415–2427. doi: 10.14778 / 3551793.3551803) designs a two-level index structure to accelerate the process: offline construction of a global index to maintain the query-related candidate set and adjacency relationship, and online dynamic generation of a local index to extract only the relevant candidates for updating the edge neighborhood from I (e.g.) , The algorithm uses a two-level index structure (neighbors) to avoid full graph scanning. It then performs an enumeration search on the local index to obtain the final matching result. RapidFlow significantly reduces the search space and speeds up the search by designing a two-level index structure, making it the best-performing algorithm to date.

[0006] Existing algorithms such as TurbFlux, Symbi, and RapidFlow all follow a filtering-sorting-enumeration framework. They all attempt to design intermediate index structures to reduce the size of the candidate set, thereby accelerating CSM. However, the construction of intermediate index structures only stops at the filtering stage and does not consider optimizations in the enumeration and sorting stages.

[0007] The primary drawback of existing algorithms lies in their brute-force search approach during the enumeration phase. Even when faced with identical subtree structures (such as isomorphic matches extended from symmetric candidate vertices), a full subtree traversal must still be repeatedly performed. In the constructed recursive search tree, many sibling candidate points often possess similar or identical equivalent subtree structures, and their matching results can be reused extensively. If such equivalence can be identified and subtree results reused, exponentially redundant computations can be avoided.

[0008] The second drawback is the failure to construct a better matching order for CSM. Most existing matching orders consider the size of the candidate set, such as the RI matching order used by RapidFlow, which prioritizes query points with smaller candidate sets. While this method can reduce the search space to some extent, it faces the challenge of frequent updates to the data graph. The candidate set and adjacent vertices of query points change constantly, meaning that a matching order needs to be constructed based on the currently updated edges each time, consuming online query time. Furthermore, the RI matching order always places leaf query points (vertices with a degree of 1 in the query graph) last, but in social networks, leaf nodes (such as newly registered accounts) often carry 80% of the candidate set and are highly redundant. The large candidate sets of leaf query points cannot be pruned in advance, instead causing combinatorial explosion in the later stages of the search, exponentially increasing search efficiency. In fact, the matching order can be constructed offline, relying solely on the query graph and independent of the data graph and candidate set, reducing the complexity of constructing the matching order. Moreover, leaf query points can be matched first because their candidate points often have a large number of equivalence relations, maximizing pruning performance.

[0009] The aforementioned defects collectively lead to a sharp performance degradation of existing algorithms in complex query scenarios: 1) Brute-force enumeration ignores structural equivalence, resulting in repeated traversal of a large number of isomorphic subtrees (experiments show that more than 70% of the results are redundant); 2) The existing matching order consumes online query time and fails to fully consider the pruning potential of leaf query points in the search tree. Summary of the Invention

[0010] To address the efficiency bottleneck of dynamic graph matching in social network anomaly detection, this invention proposes a continuous subgraph matching method for social networks based on dynamic pruning. The aim is to construct a novel algorithm that integrates dynamic pruning and query graph decomposition to construct the matching order. First, this invention proposes a dynamic pruning algorithm. It establishes a local equivalence theory by calculating the backward neighbors of query points and data candidate points, defining a subtree-level equivalence criterion in a dynamic graph environment—particularly applicable to highly isomorphic behavior patterns such as zombie account groups and terminal nodes in propagation chains. Finally, the dynamic pruning algorithm is designed to skip isomorphic subtree structures, achieving the pruning effect. Second, a query graph decomposition and sorting mechanism is proposed, removing the binding constraint of the matching order on the update edges and candidate sets. It actively identifies and prioritizes highly redundant candidate set vertices (such as leaf nodes), further reducing the search space and maximizing the performance of dynamic pruning. Ultimately, while ensuring result completeness, it achieves a 16.9-fold performance improvement over RapidFlow and a 100% completion rate for complex queries (breaking RapidFlow's 60-minute timeout limit), providing sub-second decision support for social network anomaly detection scenarios and promoting the application of dynamic graph analysis in resource-constrained environments such as edge computing.

[0011] The technical solution of the present invention is as follows:

[0012] Social network continuous subgraph matching methods based on dynamic pruning include:

[0013] S1, Input query graph Data chart and update edge ;

[0014] The query graph is a graph structure describing abnormal behavior patterns in social networks, represented as follows: ;in, Represents the set of query points. This indicates the query points, including malicious accounts, forwarding nodes, abnormal content, and victimized users; Represents an edge set; Represents a tag set, derived from the query graph. Each query point The corresponding tags;

[0015] The data graph is a graph structure representing the overall data of the social network. It stores and displays the entities and relationships of the social network data in the form of nodes and edges, represented as follows: ;in, This represents a set of nodes in a data graph, containing the attribute and feature data of entities. Entities include users, content, and devices. User attributes include user ID, registration time, geographical location, reputation score, and login frequency. Content attributes include content ID, publication time, text keywords, sentiment score, and number of reports. Device attributes include device fingerprint, IP address, device type, and binding time. The edges in the data graph represent the relationships between entities, including follow, forward, comment, and device binding relationships; The tags in the data chart include low-reputation accounts, advertising content, and suspicious forwarding;

[0016] The updated edge is represented as ;in, Operations that add or delete edges are represented by "+" or "-". A "+" indicates that data should be added to the graph. Inserting an edge ;if A "-" indicates that data should be retrieved from the chart. Deleting edges ;

[0017] S2. Entering the offline stage, according to the query graph. and data chart Calculate candidate points and construct the index structure. ;

[0018] Data chart Nodes that satisfy the query graph node constraints are selected as candidate nodes, and the labels of these candidate nodes are correlated with the query graph. The labels of the corresponding query points are consistent; any query point All candidate points constitute the candidate set, denoted as ; Query graph The index structure consists of the candidate set of all query points and the edges between each candidate point. ;

[0019] S3. In the offline phase, a query graph decomposition method is used to construct the matching order. ;

[0020] S4. Enter the online phase and determine the update edge. Is it inserting or deleting an edge? If If it is "+", then add data to the graph. Inserting an edge Update data chart and index structure And perform incremental subgraph matching on this edge; otherwise, if If it is "-", then from the data chart Find the edge And delete and update the data chart. and index structure Similarly, incremental subgraph matching should also be performed on this edge;

[0021] S5. Continue matching the next updated edge until the final matching result of the continuous subgraph of the social network is obtained.

[0022] Furthermore, in S3, a query graph decomposition method is used to construct the matching order. Specifically:

[0023] All query points are divided into a priority layer, a pruning layer, and a delay layer; wherein, the priority layer contains leaf query points directly connected to the root node, and the root node is determined based on the following method: with update edges. = , Data points in ) and Matching query points and As the root node, and Match the root of the search tree. and For matching order The first two points in the hierarchy; the pruning layer contains non-leaf query points; the delay layer contains all leaf query points except for the priority layer;

[0024] Final matching order The sequence is: priority layer → pruning layer → delay layer.

[0025] Furthermore, in S4, when judging... To insert an edge, the incremental subgraph matching process for this edge is as follows:

[0026] Side Add data chart and index structure In the middle, and determine the index structure. Are there any candidate points? and If not, then and Fill in the index structure In the middle, the updated data graph is obtained. and index structure ;

[0027] In the updated index structure In the middle, filter out and update edges. Irrelevant candidate points are used to obtain a reduced index structure. ;

[0028] In the index structure The backward neighbors and local equivalence of each candidate point are calculated, and locally equivalent candidate points are marked with the same tag.

[0029] According to the index structure Construct a matching search tree and perform recursive operations; during the search process, whenever a candidate point with the same tag is encountered, the result is directly reused to perform dynamic pruning, thereby achieving the purpose of pruning.

[0030] Furthermore, in S4, when judging... To delete an edge, the incremental subgraph matching process for that edge is as follows:

[0031] In the original index structure In the middle, filter out and update edges. Irrelevant candidate points are used to obtain a reduced index structure. ;

[0032] In the index structure The backward neighbors and local equivalence of each candidate point are calculated, and locally equivalent candidate points are marked with the same tag.

[0033] According to the index structure Construct a matching search tree and perform recursive operations; during the search process, whenever a candidate point with the same tag is encountered, the result is directly reused and dynamic pruning is performed.

[0034] After performing recursive search and dynamic pruning, the updated edges are then deleted to maintain the data graph. and index structure It is always in a state of incremental updates.

[0035] Furthermore, in the index structure The backward neighbor and local equivalence of each candidate point are calculated in the following process:

[0036] 1) Determine if the matching order needs to be traversed All query points are included; if there are unvisited query points, the process continues, providing a prerequisite for subsequent acquisition of neighboring and candidate points;

[0037] 2) According to the matching order Get the current query point The back neighbor At the same time from the index structure Get from All reduced candidate points ;

[0038] 3) Determine if all candidate points have been traversed. ;

[0039] 4) If there are candidate points If a node has not been visited, continue iterating. Each of the backward neighbors ;

[0040] 5) Determine the query point The back neighbor Is it a leaf query point?

[0041] a. If If it is a leaf query point, then calculate the current candidate point. All backward neighbors The product of the number of items;

[0042] Determine local equivalence based on calculation results: if two candidate points and Satisfying equation (1), that is and If the product of the number of backward neighbors is the same, then and It is locally equivalent, meaning that it satisfies the condition that the same search results are obtained within a search subtree;

[0043] (1)

[0044] b. If If it is not a leaf query point, then calculate the current candidate point. All backward neighbors The union of two candidate points and Satisfying equation (2), that is and If the unions of all the back neighbors are identical, then and It is locally equivalent:

[0045] (2)

[0046] 6) Repeat steps 4)-5) until all query points have been traversed. All backward neighbors;

[0047] 7) Repeat steps 3)-5) until all query points have been traversed. All candidate points;

[0048] 8) After traversing the current query point After identifying all candidate points and calculating the backward neighbors of all candidate points, we begin to tag the candidate points using vector hashing, assigning the same tag to locally equivalent candidate points for future pruning.

[0049] 9) Repeat steps 2)-8) until all candidate points for the query points have been processed.

[0050] Further, query points The back neighbor For later in the matching order The matched query point, and with There are edges connecting them; candidate points The back neighbor Determined based on the following methods: It is a query point Candidate points, It is a query point The back neighbors, if yes Candidate points that simultaneously satisfy the edge It is a data chart The edges in, then yes The neighbor behind.

[0051] Furthermore, the dynamic pruning process is as follows:

[0052] (1) Initialize search auxiliary variables

[0053] Before starting the matching search, initialize the global cache to store candidate points. The matching results of the corresponding tag and the corresponding subtree, i.e. It refers to This represents the matching results within the subtree of the root node;

[0054] (2) Traverse the matching search tree

[0055] According to the preset query graph matching order, starting from the root node candidate point associated with the updated edge, the matching search tree is recursively traversed in a depth-first search manner, and the candidate points corresponding to each query point are visited in turn.

[0056] (3) Cache lookup and pruning judgment

[0057] For the currently accessed candidate point, query whether its tag exists in the global cache:

[0058] a. If the tag already exists, directly reuse the subtree matching result corresponding to the tag in the cache and assign it to the result of the current candidate point, skipping the recursive traversal of the subtree of the candidate point;

[0059] b. If the tag does not exist, perform the recursive search of its next level subtree normally. After the subtree search is completed, store the result of the current candidate point in the global cache and associate it with its tag.

[0060] (4) Dynamic management of outcome variables

[0061] When backtracking away from the subtree rooted at a certain candidate point, promptly clear the result of all lower-level candidate points in that subtree to release memory space, and only retain the result of the current root candidate point for accumulation of upper-level results to ensure efficient memory utilization;

[0062] (5) Complete the search matching and output the results.

[0063] Continue executing steps (2)-(4) until all candidate points at all levels of the matching search tree have been traversed. Finally, summarize the result of the candidate points at the root node to obtain the matching result of the continuous subgraph after dynamic pruning.

[0064] The beneficial effects of this invention are as follows: This invention achieves groundbreaking technical results in the field of continuous subgraph matching in dynamic graphs of social networks. Through an original dynamic pruning and query optimization mechanism, it significantly improves the real-time performance and accuracy of abnormal behavior detection in social networks. Compared with existing technical solutions, in the validation of the LiveJournal social network dataset with hundreds of millions of edges, the system improves the detection efficiency of abnormal behaviors such as fake account propagation chains and collaborative attacks by tens to hundreds of times. In particular, it maintains millisecond-level response capability even in high-concurrency dynamic update environments, which can effectively support the high-timeliness business needs of social platforms such as real-time fraud warnings and malicious behavior tracking.

[0065] Compared to the existing best method, RapidFlow, this invention improves matching speed on dynamic graphs with hundreds of millions of edges, such as LiveJournal, by 16.9 times (average) to 489 times (maximum), completely breaking through its 60-minute timeout limit. Simultaneously, the dynamic pruning method based on local equivalence theory significantly reduces redundant computation by over 90%, successfully overcoming the computational bottleneck caused by search space explosion in traditional methods, providing a technical foundation for deploying dynamic graph analysis on low-power devices. In long-term stress testing, this invention significantly outperforms mainstream solutions in terms of timeliness with a 100% query completion rate, fully validating its efficiency and engineering potential in detecting abnormal behavior on social networks. Attached Figure Description

[0066] Figure 1 This is the main flowchart of the social network continuous subgraph matching method based on dynamic pruning of the present invention.

[0067] Figure 2 It is a flowchart for calculating backward neighbor and local equivalence.

[0068] Figure 3 This is a schematic diagram of dynamic pruning.

[0069] Figure 4 This is a schematic diagram illustrating the construction of the matching order using the query graph decomposition method. Detailed Implementation

[0070] To make the objectives, technical solutions, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0071] like Figure 1 As shown, this invention proposes a continuous subgraph matching method for social networks based on dynamic pruning, comprising the following steps:

[0072] S1, Input query graph Data chart and update edge .

[0073] The query graph is a graph structure describing abnormal behavior patterns in social networks, represented as follows: ;in,

[0074] Represents the set of query points. The query points include malicious accounts, forwarding nodes, abnormal content, and victimized users, namely, information such as the leader of the online troll army, the account of the dissemination intermediary, spam posts, and real users who have been harassed by @ tags;

[0075] This represents a set of edges, where edges represent relationships between nodes, such as two individuals (nodes). and An interaction between two points can be represented as an edge. , Indicates a malicious account Follow the intermediary account , Indicates intermediary account "Forwarding" spam blog posts ;

[0076] Represents a tag set, derived from the query graph. Each query point The corresponding tags; Represents the query point The tag is ;For example, ( = "bot account" ( = "Advertisement content".

[0077] The data graph is a graph structure representing the overall data of the social network. It stores and displays the entities (such as users, content, devices, etc.) and their relationships in the form of nodes and edges, represented as follows: ;in,

[0078] This represents a set of nodes in a data graph, containing the attributes and characteristics of entities. Entities include users, content, devices, etc. User attributes include user ID, registration time, geographic location, reputation score, and login frequency, etc. For example, a node... Because the registration time is less than 7 days, it represents a low-reputation account; the attributes of the content include content ID, publication time, text keywords, sentiment score, and number of reports; the attributes of the device include device fingerprint, IP address, device type, and binding time.

[0079] Edges in a data graph represent relationships between entities. They typically have labels and attributes to describe the type and characteristics of the relationship, including relationships such as following, forwarding, commenting, and device binding.

[0080] The tags in the data chart include low-reputation accounts, advertising content, suspicious forwarding, etc.; when in the data chart Find the query graph A completely consistent label structure means that the data graph Existence and Query Graph Isomorphic subgraph structures, specifically, subgraph isomorphism refers to the existence of a subgraph that is derived from the query graph. To data chart A mapping of a subgraph such that the following two conditions are satisfied simultaneously:

[0081] 1) Each node in is mapped to One of the nodes, and the node label matches (e.g., The "malicious account" in the mapping ("low-reputation accounts")

[0082] 2) Each edge in is mapped to An edge in the relation, and the edge label matches the relation type (e.g., The "attention relationship" in the map is mapped to (The "focus edge" in the text).

[0083] The updated edge It is an update stream An update stream is an edge in a time-sequential sequence of data edge update operations, describing how a data edge changes over time. Each element (update event) in the update stream is also called an update edge, typically containing information such as the type of update (e.g., insertion, deletion). Update edges are usually represented as... ;in, Operations that add or delete edges are represented by "+" or "-". A "+" indicates that data should be added to the graph. Inserting an edge ,like Indicates user New Followers ;if A "-" indicates that data should be retrieved from the chart. Deleting edges ,like Indicates user Delete blog post The continuous subgraph matching problem involves performing incremental subgraph matching on the updated edge that arrives at a certain time.

[0084] S2. Entering the offline stage, according to the query graph. and data chart Calculate candidate points and construct the index structure. .

[0085] Data chart Nodes that satisfy the query graph node constraints are selected as candidate nodes, and the labels of these candidate nodes are correlated with the query graph. If the label of the corresponding query point matches, it may become a candidate object mapped to a query node in the subgraph matching result. Candidate points are "potential matching nodes" selected during the subgraph matching process. By pre-filtering nodes that do not meet the conditions (such as normal user accounts), the amount of subsequent matching calculations is reduced; any query point All candidate points constitute the candidate set, denoted as .

[0086] In detecting anomalous behavior on social networks, such as propagation chain tracing on the LiveJournal platform, candidate points correspond to high-risk entities—such as query points. Candidates for (malicious accounts) must meet the following criteria: registration duration < 7 days, device risk value > 0.8.

[0087] The index structure It is a hierarchical and dynamic data structure that achieves efficient incremental maintenance of subgraph queries in dynamic graph data by recording historical matching results, partial matching intermediate states, and data change relationships. This structure avoids re-matching the entire dataset after each update, and instead quickly updates the results based on the existing matching state, reducing computational overhead.

[0088] Query graph The index structure consists of the candidate set of all query points and the edges between each candidate point. Subsequent continuous subgraph matching is all done on the index structure.

[0089] S3. In the offline phase, a query graph decomposition method is used to construct the matching order. This approach depends only on the query graph, and is independent of the data graph and candidate set, because the query graph is usually small in size, so the process of building the matching order is very fast.

[0090] Matching order It queries the order in which the nodes in the graph are arranged, for example... This means that malicious accounts will be matched first during the subgraph matching process. Intermediary accounts in sequence Abnormal content Victim users , In detecting abnormal behavior on social networks, this order ensures that high-risk source nodes (such as...) are processed first. (Zombie control accounts); the matching order is used to guide the subgraph matching algorithm to find the mapping node in the data graph for each query point in sequence. Its essence is to determine the search priority through the dependency relationship between query points (such as structural constraints and attribute associations), and to prioritize matching query points with "strong constraints" to prevent invalid paths.

[0091] like Figure 4 As shown, the matching order is constructed using the query graph decomposition method. Specifically, based on the pruning potential and role of each query point in the query graph, all query points are divided into three structural layers: a priority layer, a pruning layer, and a delay layer.

[0092] The priority layer includes leaf query points directly connected to the root node. Since the candidate points for these leaf query points are all within the subtree of the update point, all candidate points are equivalent, ensuring that pruning occurs as early as possible. The root node is determined based on the following: its connection to the update edge. = , Data points in ) and Matching query points and As the root node, and It usually matches the root of the search tree. and Usually the matching order The first two points in;

[0093] The pruning layer contains non-leaf query points, and the candidate points of these query points are often only equivalent within a single subtree;

[0094] The delay layer contains all leaf query points except the priority layer. These query points tend to have the weakest pruning potential and can only be pruned within a single subtree.

[0095] Final matching order The matching order is priority layer → pruning layer → delay layer. This matching order ensures that vertices with greater pruning potential are matched as early as possible, making their candidate points as close as possible to the root of the matching search tree. The earlier the pruning, the greater the reduction in the search space.

[0096] S4. Enter the online phase and determine the update edge. Is it inserting or deleting an edge? If If it is "+", then add data to the graph. Inserting an edge Update data chart and index structure Then, incremental subgraph matching is performed on this edge. The specific process is as follows:

[0097] Side Add data chart and index structure In the middle, and determine the index structure. Are there any candidate points? and If not, then and Fill in the index structure In the middle, the updated data graph is obtained. and index structure To ensure they are always up-to-date;

[0098] Build a reduced index structure Because continuous subgraph matching only involves updating edges. Related, therefore the updated index structure There will be a large number of candidate points that are irrelevant to the updated edge. Filtering out irrelevant candidate points will result in an updated index structure. Reduced to This will reduce the final search space;

[0099] In the index structure The backward neighbors and local equivalence of each candidate point are calculated, and locally equivalent candidate points are marked with the same tag.

[0100] According to the index structure Construct a matching search tree and perform recursive operations; during the search process, whenever a candidate point with the same tag is encountered, the result is directly reused to perform dynamic pruning, thereby achieving the purpose of pruning.

[0101] if If it is "-", then judge To delete an edge, the incremental subgraph matching process for that edge is as follows:

[0102] In the original index structure In the middle, filter out and update edges. Irrelevant candidate points are used to obtain a reduced index structure. ;

[0103] In the index structure The backward neighbors and local equivalence of each candidate point are calculated, and locally equivalent candidate points are marked with the same tag.

[0104] According to the index structure Construct a matching search tree and perform recursive operations; during the search process, whenever a candidate point with the same tag is encountered, the result is directly reused and dynamic pruning is performed.

[0105] After performing the recursive search and dynamic pruning, the updated edge is then deleted to maintain the data graph. and index structure It is always in a state of incremental updates.

[0106] like Figure 2 As shown, in the index structure The specific process for calculating the backward neighbors and local equivalence of each candidate point is as follows:

[0107] 1) Determine if the matching order needs to be traversed All query points are included; if there are unvisited query points, the process continues, providing a prerequisite for subsequent acquisition of neighboring and candidate points;

[0108] 2) According to the matching order Get the current query point The back neighbor At the same time from the index structure Get from All reduced candidate points ,in,

[0109] The query point The back neighbor For later in the matching order The matched query point, and with There are edge connections (i.e., structurally adjacent); for example ,if If we are querying an edge in graph Q, then yes A backward neighbor;

[0110] Reduced candidate points This refers to updating the edge pairs of the original candidate set. The reduced candidate set is typically smaller, and the final search tree is determined based on this reduced candidate set. It can be directly derived from... Retrieved from [the source]. For example, candidate set , ,at this time It will be reduced to ,because and None of them are associated with the update edge, so they cannot perform incremental matching. Meanwhile, those that are only associated with... or Candidate points for other connected query points will also be filtered out;

[0111] 3) Determine if all candidate points have been traversed. ;

[0112] 4) If there are candidate points If a node has not been visited, continue iterating. Each of the backward neighbors ;

[0113] 5) Determine the query point The back neighbor Is it a leaf query point?

[0114] a. If If it is a leaf query point, then calculate the current candidate point. All backward neighbors The product of the number of hashes is the direct basis for determining local equivalence and generating hash tags in the subsequent step 8).

[0115] Local equivalence is determined based on the calculation results. Specifically, if two candidate points... and If equation (1) is satisfied, then and It is locally equivalent, meaning that it satisfies the condition that the same search results are obtained within a search subtree;

[0116] (1)

[0117] for For leaf query points, and The products of the number of their back neighbors are the same, meaning they have similar subtree structures, for example, It can be expanded to two nodes, and each node can be expanded to two more nodes. Only one node can be expanded, and this one node can be expanded to four nodes. , and If they both have four subtrees, then they are considered to have similar subtree structures, i.e. and It is locally equivalent;

[0118] b. If If it is not a leaf query point, then calculate the current candidate point. All backward neighbors The union of two candidate points and If equation (2) is satisfied, then and It is locally equivalent:

[0119] (2)

[0120] for Is it a leaf query point? and If the unions of all the back neighbors are identical, then it is considered that... and Having completely identical subtrees, i.e. and It is also locally equivalent; in this case, equivalence cannot be determined by accumulating identical values, because... As a non-leaf query point, it may have other backward neighbors, i.e. The various candidate points may constrain each other, affecting the equivalence of the subtree structure;

[0121] Candidate points The back neighbor Determined based on the following methods: It is a query point Candidate points, It is a query point The back neighbors, if yes Candidate points that simultaneously satisfy the edge It is a data chart The edges in, then yes The rear neighbor;

[0122] 6) Repeat steps 4)-5) until all query points have been traversed. All backward neighbors;

[0123] 7) Repeat steps 3)-5) until all query points have been traversed. All candidate points;

[0124] 8) After traversing the current query point After identifying all candidate points and calculating the backward neighbors of all candidate points, we begin to tag the candidate points using vector hashing, assigning the same tag to locally equivalent candidate points for future pruning.

[0125] 9) Repeat steps 2)-8) until all candidate points for the query points have been processed, and the program ends.

[0126] The dynamic pruning process is as follows:

[0127] (1) Initialize search auxiliary variables

[0128] Before starting the matching search, initialize the global cache to store candidate points. The matching results of the corresponding tag and the corresponding subtree, i.e. It refers to This represents the matching results within the subtree of the root node;

[0129] (2) Traverse the matching search tree

[0130] According to the preset query graph matching order, starting from the root node candidate point associated with the updated edge, the matching search tree is recursively traversed in a depth-first search manner, and the candidate points corresponding to each query point are visited in turn.

[0131] (3) Cache lookup and pruning judgment

[0132] For the currently accessed candidate point, query whether its tag exists in the global cache:

[0133] a. If the tag already exists (i.e. the subtree of the candidate point of the equivalence class has been searched), directly reuse the subtree matching result corresponding to the tag in the cache, assign it to the result of the current candidate point, and skip the recursive traversal of the subtree of the candidate point;

[0134] b. If the tag does not exist (i.e., the candidate point of the equivalence class is visited for the first time), the recursive search of its next level subtree is performed normally. After the subtree search is completed, the result (cumulative value of subtree matching results) of the current candidate point is stored in the global cache and associated with its tag.

[0135] (4) Dynamic management of result variables

[0136] When backtracking away from the subtree rooted at a certain candidate point, promptly clear the result of all lower-level candidate points in that subtree to release memory space, and only retain the result of the current root candidate point for accumulation of upper-level results to ensure efficient memory utilization;

[0137] (5) Complete the search matching and output the results.

[0138] Continue executing steps (2)-(4) until all candidate points at all levels of the matching search tree have been traversed. Finally, summarize the result of the candidate points at the root node to obtain the matching result of the continuous subgraph after dynamic pruning.

[0139] Figure 3 This is a diagram of dynamic pruning, assuming a matching order. Update the edges as , and They were matched respectively and ; candidate points ,pass Figure 2 The equivalence of the process shown is calculated. , , The three candidate points are locally equivalent, meaning they are all assigned the symbol 1. According to the theory of local equivalence, , and exist{ , The subtree rooted at} is equivalent, and They are not equivalent, tag 2; and They are equivalent, with tag 3, and they are in or Equivalent within the subtree; and They are equivalent, with a tag of 4, and they are in and Equivalent within the subtree.

[0140] according to Figure 3 Explain the process of dynamic pruning:

[0141] (1) From the updated edge = , ) formed and The root node enters the recursive search tree;

[0142] (2) Enter Layer, access Node, Get Pruning marks And record it;

[0143] (3) Enter Layer, access Node, Get Pruning marks And record it;

[0144] (4) Enter Layer, access Node, Get Pruning marks And record it;

[0145] (5) Enter Layer, or bottom layer, is the layer that is accessed. Three results mean three matches;

[0146] (6) Retrospection Layers, record them. Then access Node, Get Pruning marks At this point, it is discovered that tag=3 has already been recorded, so the branch is pruned and no longer accessed. The child nodes, and reuse As a result, ;

[0147] (7) Retrospection Layer, record = + =6; Since I have already left The root is a subtree, so clear it. and The value; then access the value. Node, find its tag value and If they are the same, they can be reused directly. As a result, = =6, no more visits child nodes;

[0148] (8) Retrospection Layer, record = + =12, simultaneously clear and Continue visiting and Discover their tags and If they are the same, prune them directly and record the results. = = =12, access pruning marks were found. If the first visit is made, the process (1)-(8) is repeated until the root is reached.

[0149] As can be seen from the above process, the result variable is constantly being dynamically assigned and dynamically cleared, hence this pruning strategy is called dynamic pruning.

[0150] S5. Continue matching the next updated edge until the final matching result of the continuous subgraph of the social network is obtained. .

[0151] The method of this invention was tested on four datasets: Human, Email, Amazon, and Livejournal. The speedup ratio (the ratio of the matching speed of the dynamic pruning algorithm in this invention to the baseline algorithm) was used as the performance indicator. The final results are shown below.

[0152] Table 1 shows the average speedup ratio when inserting edges into the data graph. Among them, Represents a query graph Query fixed-point numbers in the middle. The table shows the speedup ratios of various methods, where HF represents the present invention, TF refers to the TurboFlux algorithm, SY refers to the Symbi algorithm, and RF refers to the RapidFlow algorithm. Table 1 shows that the present invention demonstrates significant improvements, exhibiting the highest speedup ratio observed on tree query sets, particularly on the Amazon and LiveJournal datasets. For example, compared to existing RF algorithms, the present invention's HF achieves an average speedup of 5.32 times and 16.94 times on tree graphs in the Amazon and LiveJournal datasets, respectively.

[0153] Table 1 Average speedup when updating the flow includes edge insertion

[0154]

[0155] The invention also performs well in removing edges from the data graph, as shown in Table 2. Particularly on the LiveJournal tree dataset, the average speedup reaches 429.76 times, further demonstrating the effectiveness of the invention. Furthermore, HF completed all query graph matching tasks, while RF left 6 and 20 unresolved graphs in the Amazon and LiveJournal datasets, respectively.

[0156] Table 2 Average speedup when update flow includes edge deletion

[0157]

[0158] Furthermore, the performance of this invention improves as the complexity of the query graph increases. When the query graph contains 6 vertices, the speedup performance of this invention is not significant. However, when the number of vertices increases to 8, the algorithm's performance improves significantly. In other words, the performance of this invention improves as the search complexity increases.

[0159] Finally, it should be noted that the above embodiments are intended to illustrate the technical solutions of the present invention and do not constitute any limitation on the present invention. Those skilled in the art should fully understand that modifications to the technical solutions described in the foregoing embodiments or equivalent substitutions for any part or all of the technical features are entirely feasible. Such modifications or substitutions, as long as they do not depart from the scope of protection defined by the claims of the present invention, should be considered reasonable extensions of the present invention.

Claims

1. A continuous subgraph matching method for social networks based on dynamic pruning, characterized in that, Includes the following steps: S1, Input query graph Data chart and update edge ; The query graph is a graph structure describing abnormal behavior patterns in social networks, represented as follows: ;in, Represents the set of query points. This indicates the query points, including malicious accounts, forwarding nodes, abnormal content, and victimized users; Represents an edge set; Represents a tag set, derived from the query graph. Each query point The corresponding tags; The data graph is a graph structure representing the overall data of the social network. It stores and displays the entities and relationships of the social network data in the form of nodes and edges, represented as follows: ;in, This represents a set of nodes in a data graph, containing the attribute and feature data of entities. Entities include users, content, and devices. User attributes include user ID, registration time, geographical location, reputation score, and login frequency. Content attributes include content ID, publication time, text keywords, sentiment score, and number of reports. Device attributes include device fingerprint, IP address, device type, and binding time. The edges in the data graph represent the relationships between entities, including follow, forward, comment, and device binding relationships; The tags in the data chart include low-reputation accounts, advertising content, and suspicious forwarding; The updated edge is represented as ;in, Operations that add or delete edges are represented by "+" or "-". A "+" indicates that data should be added to the graph. Inserting an edge ;if If it is "-", it means to start from the data chart. Deleting edges ; S2. Entering the offline stage, according to the query graph. and data charts Calculate candidate points and construct the index structure. ; Data chart Nodes that satisfy the query graph node constraints are selected as candidate nodes, and the labels of these candidate nodes are correlated with the query graph. The labels of the corresponding query points are consistent; any query point All candidate points constitute the candidate set, denoted as ; Query graph The index structure consists of the candidate set of all query points and the edges between each candidate point. ; S3. In the offline phase, a query graph decomposition method is used to construct the matching order. Specifically: All query points are divided into a priority layer, a pruning layer, and a delay layer; wherein, the priority layer contains leaf query points directly connected to the root node, and the root node is determined based on the following method: with update edges. = , Data points in ) and Matching query points and As the root node, and Match the root of the search tree. and For matching order The first two points in the hierarchy; the pruning layer contains non-leaf query points; the delay layer contains all leaf query points except for the priority layer; Final matching order Priority layer → Pruning layer → Delayed layer; S4. Entering the online phase, determine the update edge. Is it inserting or deleting an edge? If If it is "+", then add data to the graph. Inserting an edge Update data chart and index structure And perform incremental subgraph matching on this edge; otherwise, if If it is "-", then from the data chart Find the edge And delete and update the data chart. and index structure Similarly, incremental subgraph matching should also be performed on this edge; where, when judging To insert an edge, the incremental subgraph matching process for this edge is as follows: Side Add data chart and index structure In the middle, and determine the index structure. Are there any candidate points? and If not, then and Fill in the index structure In the middle, the updated data graph is obtained. and index structure ; In the updated index structure In the middle, filter out and update edges. Irrelevant candidate points are used to obtain a reduced index structure. ; In the index structure The backward neighbors and local equivalence of each candidate point are calculated, and locally equivalent candidate points are marked with the same tag. According to the index structure Construct a matching search tree and perform recursive operations; during the search process, whenever a candidate point with the same tag is encountered, the result is directly reused and dynamic pruning is performed to achieve the purpose of pruning. S5. Continue matching the next updated edge until the final matching result of the continuous subgraph of the social network is obtained.

2. The social network continuous subgraph matching method based on dynamic pruning according to claim 1, characterized in that, In S4, when judging To delete an edge, the incremental subgraph matching process for that edge is as follows: In the original index structure In the middle, filter out and update edges. Irrelevant candidate points are used to obtain a reduced index structure. ; In the index structure The backward neighbors and local equivalence of each candidate point are calculated, and locally equivalent candidate points are marked with the same tag. According to the index structure Construct a matching search tree and perform recursive operations; during the search process, whenever a candidate point with the same tag is encountered, the result is directly reused and dynamic pruning is performed. After performing recursive search and dynamic pruning, the updated edges are then deleted to maintain the data graph. and index structure It is always in a state of incremental updates.

3. The social network continuous subgraph matching method based on dynamic pruning according to claim 1 or 2, characterized in that, In the index structure The backward neighbor and local equivalence of each candidate point are calculated in the following process: 1) Determine if the matching order needs to be traversed All query points are included; if there are unvisited query points, the process continues, providing a prerequisite for subsequent acquisition of neighboring and candidate points; 2) According to the matching order Get the current query point The back neighbor At the same time from the index structure Get from All reduced candidate points ; 3) Determine whether all candidate points have been traversed. ; 4) If there are candidate points If a node has not been visited, continue iterating. Each of the backward neighbors ; 5) Determine the query point The back neighbor Is it a leaf query point? a. If If it is a leaf query point, then calculate the current candidate point. All backward neighbors The product of the number of items; Determine local equivalence based on calculation results: if two candidate points and Satisfying equation (1), that is and If the product of the number of backward neighbors is the same, then and It is locally equivalent, meaning that it satisfies the condition that the same search results are obtained within a search subtree; (1) b. If If it is not a leaf query point, then calculate the current candidate point. All backward neighbors The union of two candidate points and Satisfying equation (2), that is and If the unions of all the back neighbors are identical, then and It is locally equivalent: (2) 6) Repeat steps 4)-5) until all query points have been traversed. All backward neighbors; 7) Repeat steps 3)-5) until all query points have been traversed. All candidate points; 8) After traversing the current query point After identifying all candidate points and calculating the backward neighbors of all candidate points, we begin to tag the candidate points using vector hashing, assigning the same tag to locally equivalent candidate points for future pruning. 9) Repeat steps 2)-8) until all candidate points for the query points have been processed.

4. The social network continuous subgraph matching method based on dynamic pruning according to claim 3, characterized in that, query point The back neighbor For later in the matching order The matched query point, and with There are edges connecting them; candidate points The back neighbor Determined based on the following methods: It is a query point Candidate points, It is a query point The back neighbors, if yes Candidate points that simultaneously satisfy the edge It is a data chart The edges in, then yes The neighbor behind.

5. The social network continuous subgraph matching method based on dynamic pruning according to claim 1 or 2, characterized in that, The process of dynamic pruning is as follows: (1) Initialize search auxiliary variables Before starting the matching search, initialize the global cache to store candidate points. The matching results of the corresponding tag and the corresponding subtree, i.e. It refers to This represents the matching results within the subtree of the root node; (2) Traverse the matching search tree According to the preset query graph matching order, starting from the root node candidate point associated with the updated edge, the matching search tree is recursively traversed in a depth-first search manner, and the candidate points corresponding to each query point are visited in turn. (3) Cache lookup and pruning judgment For the currently accessed candidate point, query whether its tag exists in the global cache: a. If the tag already exists, directly reuse the subtree matching result corresponding to the tag in the cache and assign it to the result of the current candidate point, skipping the recursive traversal of the subtree of the candidate point; b. If the tag does not exist, perform the recursive search of its next level subtree normally. After the subtree search is completed, store the result of the current candidate point in the global cache and associate it with its tag. (4) Dynamic management of outcome variables When backtracking away from the subtree rooted at a certain candidate point, promptly clear the result of all lower-level candidate points in that subtree to release memory space, and only retain the result of the current root candidate point for accumulation of upper-level results to ensure efficient memory utilization; (5) Complete the search matching and output the results. Continue executing steps (2)-(4) until all candidate points at all levels of the matching search tree have been traversed. Finally, summarize the result of the candidate points at the root node to obtain the matching result of the continuous subgraph after dynamic pruning.

Images